7.4 Security Operations Foundations

Key Takeaways

CISSP 7.4 focuses on foundational Security Operations concepts.

The current CISSP outline explicitly includes need-to-know and least privilege, Separation of Duties and responsibilities, privileged account management, job rotation and Service-Level Agreements.

The overall purpose is to control operational authority and reduce the risk created when excessive access, incompatible responsibilities or critical knowledge become concentrated in one place.

Responsibility describes the duty assigned to a person or function.

Authority describes the permission required to perform that duty.

Accountability allows actions and decisions to be associated with the responsible person or function.

Responsibility = duty. Authority = permission. Accountability = answerability.

Need-to-know and least privilege are related but different.

Need-to-know restricts access to information necessary for authorised work.

Least privilege restricts the capabilities and authorisations granted to an identity.

Need-to-know = minimum information. Least privilege = minimum capability.

Least privilege applies to people, administrators, service accounts, applications, workloads, processes and devices.

Excessive privilege increases the potential impact of credential theft, misuse and software compromise.

Privilege determines blast radius.

Default-deny approaches start from no access and grant permissions when a legitimate authorised requirement exists.

Privilege creep occurs when users accumulate permissions while changing roles without old permissions being removed.

Access should therefore be reviewed when responsibilities change.

Just-in-Time privilege can reduce standing administrative access by granting elevated rights only when required and removing them afterwards.

Least privilege can therefore restrict:

what an identity can do, where it can do it and how long the privilege exists.

Separation of Duties divides incompatible activities among different people or functions.

A person who creates a sensitive transaction may therefore be prevented from approving that same transaction.

Static SoD prevents incompatible roles from being assigned to the same identity.

Dynamic SoD can allow several roles while preventing conflicting actions within the same transaction or context.

Static = cannot hold both roles. Dynamic = cannot perform both conflicting actions here.

Dual control and Separation of Duties are related but distinct.

Separation of Duties divides responsibilities.

Dual control requires multiple authorised people to participate in a sensitive operation.

Split knowledge divides knowledge of sensitive information so one person does not possess the entire secret.

SoD = divide duties. Dual control = divide action. Split knowledge = divide information.

Separation of Duties does not eliminate all risk because two authorised individuals can collude.

Logging, monitoring, reconciliation, rotation and independent review can provide additional layers of control.

Shared privileged accounts can weaken accountability because the system may identify which account performed an action without identifying which person used the account.

Unique attributable identities strengthen auditing and accountability.

Privileged accounts can perform security-relevant operations ordinary accounts cannot perform.

Privileged identities may include system administrators, database administrators, cloud administrators, network administrators, service accounts and emergency accounts.

Privileged account = greater authority + greater consequence.

Privileged Account Management should address the lifecycle of privileged access rather than only the storage of passwords.

Controls may include account discovery, approvals, MFA, credential vaulting, rotation, Just-in-Time privilege, session monitoring, access reviews and revocation.

Ordinary and administrative identities should be separated where practical so high privilege is not unnecessarily exposed during routine work such as email and web browsing.

Privileged access should be strongly authenticated and appropriately monitored.

Emergency or break-glass accounts can provide critical access when normal administrative methods fail.

Such accounts should receive strong protection because they can bypass or operate independently of normal access mechanisms.

Emergency access should be available when needed and conspicuous when used.

Service accounts and workload identities can also be privileged.

Non-human identities therefore require ownership, appropriate privilege, credential protection and monitoring.

Job rotation moves appropriately trained personnel through different responsibilities.

It can support cross-training, resilience, knowledge sharing and independent examination of operational practices.

Job rotation can also make irregular behaviour harder to conceal when another person begins performing the process.

Job rotation should be accompanied by access changes.

Rotate the responsibility and reassess the privilege.

Mandatory vacation is a related concept in which an individual in a sensitive function must step away while another authorised person performs the work.

Job rotation and cross-training also reduce key-person dependency.

A critical process that only one employee understands creates both security and resilience risk.

Documentation, cross-training and controlled credential management help distribute operational knowledge.

A Service-Level Agreement defines measurable service expectations and responsibilities between a provider and customer.

SLA terms can include availability, performance, support, response times, restoration expectations, escalation, reporting and security-related service commitments.

SLA = what service, at what level, by whom and measured how.

Service commitments should be measurable.

"Respond quickly" is harder to verify than "acknowledge Priority 1 incidents within 15 minutes."

Availability percentages should be interpreted together with the measurement period and applicable exclusions.

99.99% availability does not mean zero downtime.

Security services can also have measurable service levels, including incident notification and security response commitments.

Outsourced service does not eliminate the customer's need to understand security responsibilities.

Provider and customer obligations should therefore be clearly defined, particularly in cloud and managed-service environments.

Read the responsibility model, not only the uptime percentage.

Response time and resolution time are different.

Response time measures how quickly the provider acknowledges or begins handling an issue.

Resolution or restoration time concerns how quickly the issue or service is restored or resolved.

An SLA is also different from an RTO or RPO.

RTO defines the recovery-time target.

RPO defines the acceptable recovery point for data.

SLA = service commitment. RTO = recovery time. RPO = recovery point.

SLA performance should be monitored rather than merely assumed.

A useful operational process is:

Define → Measure → Compare → Act.

Failure to meet an agreed service target may constitute an SLA breach.

An SLA breach does not automatically mean that a security incident occurred.

The five concepts in 7.4 reinforce each other.

Least privilege limits individual authority.

Separation of Duties distributes sensitive responsibilities.

Privileged Account Management protects elevated authority.

Job rotation distributes knowledge and operational capability.

SLAs define accountable service expectations.

The central CISSP principle is: give people only the access they need, avoid concentrating sensitive authority in one person, closely govern powerful accounts, ensure critical knowledge is not dependent on one individual and make service responsibilities measurable and accountable.