Domain 5: Protection of Information Assets

CISA · about 26% of the exam

Security governance, access control, cryptography, network and physical security, threats and incident response.

Governance and privacy

Security Governance and Roles Who's in charge of information security and who does what, from the board to the people at keyboards, plus the success factor and CISO reporting line the exam keeps returning to.
Data Classification and Ownership Sorting information by how much harm it could do, so protection matches the risk: who decides the level, typical schemes, and how the level drives every handling rule.
Security Policies The information security policy and the policies under it: what they say, who approves them, how they're made to work in real life, and how the auditor tests that they do.
Privacy Principles and GDPR Handling personal information fairly, not just securely: the seven privacy principles, the GDPR essentials (controllers, processors, rights, DPIAs, the 72-hour rule) and what the auditor checks.

Identity Management Knowing who's who and what they may do: identification, authentication, authorisation and accountability, the joiner-mover-leaver cycle, SSO and federation, and how the auditor tests user access.
Authentication Factors The three ways to prove who you are, what genuinely counts as multifactor, how to make passwords less bad, and which kinds of MFA stand up to phishing.
Biometrics Using your body to prove who you are: how biometric matching works, the two kinds of error and why one is worse, the crossover rate, the types of biometric, and the risks of data you can't change.
Access Models: DAC, MAC, RBAC The different ways systems decide who gets access (by the owner, by labels, by job role, by rules or by attributes), the principles that apply to all of them, and how to spot each one in a scenario.
Logical and Privileged Access Controlling every route into systems and data, and keeping the most powerful accounts on a very short leash: access paths, session controls, privileged access management, emergency access and remote access.

Cryptography Basics What cryptography can and can't do, the handful of terms you need, how the three main tools fit together, and why the keys matter more than the maths.
Symmetric Encryption One key to lock and unlock: how symmetric encryption works, why it's fast, why sharing the key is the hard part, the algorithms to use and avoid, and where you'll find it.
Asymmetric Encryption Public and private keys explained with a padlock, why they solve the 'how do we share the key?' problem, and the 'whose key?' rule the exam keeps testing.
Hashing and Integrity A fingerprint for data: what a hash is, why it can't be reversed, how keyed hashes and signatures stop deliberate tampering, how passwords should be stored, and where hashes turn up in audit work.
Digital Signatures The electronic version of a signature that can't be forged: how it's made and checked, which key does what, what it proves, what it doesn't, and why it depends on a certificate.
PKI and Certificates How we know a public key really belongs to who it claims: certificate authorities and their helpers, what's in a certificate, the chain of trust, revocation, and the controls an auditor checks.

Firewalls The gatekeepers between networks: firewall types from simple packet filters to web application firewalls, the DMZ design, how rule sets go wrong, and what firewalls can't stop.
IDS/IPS Alarms and guards for networks: intrusion detection versus prevention, network versus host based, signature versus anomaly detection, the two kinds of error, and honeypots.
VPN, SSL/TLS, IPsec Private tunnels through a public internet: what a VPN does, IPsec's parts and modes, how TLS secures a web connection, and the remote-access weaknesses auditors find.
Wireless Security Securing a network that leaks through the walls: Wi-Fi protocols from WEP to WPA3, personal versus enterprise mode, rogue and fake access points, and which controls are strong or just for show.
Endpoint and Mobile (BYOD) Protecting the laptops and phones where people actually work: the core endpoint controls, why encryption matters for lost devices, mobile device management, BYOD policies and data loss prevention.
Cloud and Virtualization Security Many computers on one machine, and computers you rent from someone else: hypervisor risks, VM sprawl and snapshots, containers, and the misconfiguration and identity mistakes behind most cloud breaches.

Physical Access Controls Keeping the wrong people away from the hardware: layers of physical security, locks from keys to biometrics, mantraps against tailgating, guards, CCTV and visitors, and where to put a data centre.
Environmental Controls: Fire, Power, HVAC Protecting computer rooms from the elements: power problems and their fixes, fire detection, water and gas suppression (and which one suits a computer room), cooling, water leaks and testing.

Social Engineering Hacking people instead of computers: the psychological levers attackers pull, the phishing family and its relatives, business email compromise, and the controls that actually work.
Malware The zoo of malicious software, from viruses and worms to ransomware, the old-fashioned crime terms the exam still uses, and the layers of defence that stop, spot, contain and recover from it.
Network Attacks: DoS, Spoofing, Sniffing Attacks on the network itself, grouped by what they damage (availability, identity, confidentiality), and the one control that best matches each, which is what the exam asks for.
Application Attacks: SQLi, XSS Attacks that trick an application into doing something it shouldn't, especially SQL injection, cross-site scripting and buffer overflows, and why secure code beats a firewall in front of bad code.
Vulnerability Management and Pen Testing Finding the holes before attackers do: the vulnerability management cycle, how a scan differs from a penetration test, the kinds of pen test, and why written permission comes first.

Incident Response What to do when a security incident happens: the response life cycle, why preparation matters most, containing damage without destroying evidence, who must be told, and learning from it.
Digital Forensics and Chain of Custody Handling digital evidence so it stands up in court: the forensic process, collecting the most fragile evidence first, imaging and hashing, the chain of custody, and the auditor's limited role.
Security Awareness Training Turning staff into a line of defence: what a good awareness programme includes, extra training for high-risk roles, phishing simulations, and measuring behaviour rather than attendance.
Logging, SIEM, and Auditing Security Keeping a trustworthy record of what happened and actually reading it: what to log, protecting logs from the people they record, what a SIEM adds, and how an auditor approaches a security audit.