Appendix: Key Formulas & Acronyms
Key Formulas & Acronyms
Risk Formulas (Domain 1)
| Formula | Meaning |
|---|---|
|
Single Loss Expectancy = Asset Value × Exposure Factor |
|
Annualized Loss Expectancy = SLE × Annualized Rate of Occurrence |
|
Qualitative risk |
|
Risk remaining after controls |
|
Is the control worth it? |
DR/BCP Metrics (Domain 7)
| Metric | Meaning |
|---|---|
RTO |
Recovery Time Objective — max acceptable downtime |
RPO |
Recovery Point Objective — max acceptable data loss (time) |
MTD |
Maximum Tolerable Downtime — beyond this, business fails |
MTBF |
Mean Time Between Failures — reliability |
MTTR |
Mean Time To Repair — recoverability |
Security Models (Domain 3)
| Model | Focus | Rule |
|---|---|---|
Bell-LaPadula |
Confidentiality |
No read up, no write down |
Biba |
Integrity |
No read down, no write up |
Clark-Wilson |
Integrity |
Well-formed transactions, separation of duties |
Access Control Models (Domain 5)
| Model | Who Decides |
|---|---|
DAC |
Owner (discretionary) |
MAC |
System/policy (mandatory labels) |
RBAC |
Roles (job function) |
ABAC |
Attributes (rules engine) |
ISC2 Code of Ethics (Domain 1)
-
Protect society, the common good, necessary public trust, and the infrastructure
-
Act honorably, honestly, justly, responsibly, and legally
-
Provide diligent and competent service to principals
-
Advance and protect the profession
IR Phases (Domain 7)
-
Preparation
-
Detection and Analysis
-
Containment
-
Eradication
-
Recovery
-
Post-Incident Activity (Lessons Learned)
OWASP Top 10 (Domain 8)
-
Broken Access Control
-
Cryptographic Failures
-
Injection
-
Insecure Design
-
Security Misconfiguration
-
Vulnerable Components
-
Auth Failures
-
Software/Data Integrity Failures
-
Logging/Monitoring Failures
-
SSRF