Introduction to Cyber/InfoSec


Brimstone offer specialist IT recruitment and niche IT services to include IT Security and Information Security.  We cover all the skill domains and an easy way to reference our areas is that we cover all ten domains of CISSP (Certified Information Systems Security Professional) if you have any doubts please call us and we will give an opinion on our ability to help with your particular requirements.
With Cyber Security gaining press for APT’s (Advanced Persistent Threats), Cyber War and also the glamorous image of hackers from Hollywood the public are now more aware of the risks and businesses that fall victim of attacks suffer reputational damage.  This has led to more staffing requirements and numerous qualifications are available from various providers.  Below is a list of the most popular providers and qualifications.  To give you an overview we have added the most detail to a holistic qualification already mentioned – CISSP from ISC2.

 
International Information Systems Security Certification Consortium (ISC2)  
ISC2 offer a number of Cyber qualifications and concentrations/electives of CISSP some include: 
   
If you know Information/Cyber Security you will be aware of CISSP.  CISSP is a qualification best suited to people who have worked their way up and are now looking to take a leadership role of all the businesses Security issues so aspiring to be CISO and need to gain a holistic view of all the security domains.  Taking CISSP as an entry level qualification is not ideal as it gives a good but not complete view in each area so a more focussed and technical route to enter this sector would be advisable.  As well as CISSP ISC2 also provide more specialised electives e.g.

-ISSAP - Certified Information Systems Architecture Professional
-ISSEP - Certified Information Systems Engineering Professional
-ISSMP - Certified Information Systems Management Professional

Some other qualifications from ISC2
Systems Security Certified Practitioner (SSCP) 

The SSCP certification offers information security technicians, with implementation experience, the opportunity to demonstrate their level of competence. The SSCP credential is ideal for those working toward or who have already attained positions as Senior Network Security Engineers, Senior Security Systems Analysts or Senior Security Administrators. 

Certification and Accreditation Professional (CAP) 

The CAP credential is specifically designed for security professionals involved in the Certification and Accreditation process. The credential is suited to those responsible for formalising processes used to assess risk and establish security requirements, as well as ensuring information systems possess security commensurate with the level of exposure to potential risk.  This in a more junior qualification to CISSP and SSCP.

What are the Ten Domains of CISSP?

The CISSP domains are drawn from various information security topics within the (ISC)² CBK. The CISSP CBK consists of the following ten domains:

Brimstone recruit staff into all these domains and staff who have CISSP etc. and are at the more senior end of the spectrum e.g. CISO (Chief Information Security Officer’s) who have knowledge of them all.

1) Access Control – a collection of mechanisms that work together to create security architecture to protect the assets of the information system.
?    Concepts/methodologies/techniques
?    Effectiveness
?    Attack 


2)    Telecommunications and Network Security – discusses network structures, transmission methods, transport formats and security measures used to provide availability, integrity and confidentiality.

?    Network architecture and design
?    Communication channels
?    Network components
?    Network attacks


3)    Information Security Governance and Risk Management – the identification of an organization’s information assets and the development, documentation and implementation of policies, standards, procedures and guidelines.


?    Security governance and policy
?    Information classification/ownership
?    Contractual agreements and procurement processes
?    Risk management concepts
?    Personnel security
?    Security education, training and awareness
?    Certification and accreditation

4)    Software Development Security – refers to the controls that are included within systems and applications software and the steps used in their development.


?    Systems development life cycle (SDLC)
?    Application environment and security controls
?    Effectiveness of application security

5)    Cryptography – the principles, means and methods of disguising information to ensure its integrity, confidentiality and authenticity.


?    Encryption concepts
?    Digital signatures
?    Cryptanalytic attacks
?    Public Key Infrastructure (PKI)
?    Information hiding alternatives


6)    Security Architecture and Design – contains the concepts, principles, structures and standards used to design implement, monitor, and secure, operating systems, equipment, networks, applications, and those controls used to enforce various levels of confidentiality, integrity and availability.

 

?    Fundamental concepts of security models
?    Capabilities of information systems (e.g. memory protection, virtualization)
?    Countermeasure principles
?    Vulnerabilities and threats (e.g. cloud computing, aggregation, data flow control).


7)     Operations Security – used to identify the controls over hardware, media and the operators with access privileges to any of these resources.

 

?    Resource protection
?    Incident response
?    Attack prevention and response
?    Patch and vulnerability management


8)     Business Continuity and Disaster Recovery Planning – addresses the preservation of the business in the face of major disruptions to normal business operations.
 

?    Business impact analysis
?    Recovery strategy
?    Disaster recovery process
?    Provide training


9)    Legal, Regulations, Investigations and Compliance – addresses computer crime laws and regulations; the investigative measures and techniques which can be used to determine if a crime has been committed and methods to gather evidence.


?    Legal issues
?    Investigations
?    Forensic Procedures (also see our Digital Forensics and e-Discovery sector)
?    Compliance requirements/procedures


10)    Physical (Environmental) Security – addresses the threats, vulnerabilities and countermeasures that can be utilized to physically protect an enterprise’s resources and sensitive information.


?    Site/facility design considerations
?    Perimeter security
?    Internal security
?    Facilities security


More information about the qualifications offered by (ISC)² can be found atwww.isc2.org