Page 124 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

access to objects and prevention of denial-of-service attacks. It also
implies that the supporting infrastructure is functional and allows

authorized users to gain authorized access.

Other security-related concepts and principles that should be
considered and addressed when designing a security policy and
deploying a security solution are privacy, identification,
authentication, authorization, accountability, nonrepudiation, and
auditing.

Other aspects of security solution concepts and principles are the
elements of protection mechanisms: layering, abstraction, data hiding,

and encryption. These are common characteristics of security controls,
and although not all security controls must have them, many controls
use these mechanisms to protect confidentiality, integrity, and
availability.

Security roles determine who is responsible for the security of an
organization’s assets. Those assigned the senior management role are

ultimately responsible and liable for any asset loss, and they are the
ones who define security policy. Security professionals are responsible
for implementing security policy, and users are responsible for
complying with the security policy. The person assigned the data
owner role is responsible for classifying information, and a data
custodian is responsible for maintaining the secure environment and

backing up data. An auditor is responsible for making sure a secure
environment is properly protecting assets.

A formalized security policy structure consists of policies, standards,
baselines, guidelines, and procedures. These individual documents are
essential elements to the design and implementation of security in any
environment.

The control or management of change is an important aspect of
security management practices. When a secure environment is

changed, loopholes, overlaps, missing objects, and oversights can lead
to new vulnerabilities. You can, however, maintain security by
systematically managing change. This typically involves extensive
logging, auditing, and monitoring of activities related to security
controls and security mechanisms. The resulting data is then used to