Certified Information Systems Security Professional (CISSP) Study Guide

Chapter 2. Risk Management

A Note for Early Release Readers

With Early Release ebooks, you get books in their earliest form—the author’s raw and unedited content as they write—so you can take advantage of these technologies long before the official release of these titles.

This will be the third chapter of the final book.

If you’d like to be actively involved in reviewing and commenting on this draft, please reach out to the editor at [e-mail].

Risk management is an important part of security management. It could easily be said that risk management sits at the core of many different business decisions, and the operations of many departments is based on risk – business continuity, incident management, security, and audit all use risk as the foundation for their activities.

In this chapter you will learn the knowledge and skills necessary to be a security expert with an excellent foundation in risk management. You will see the value of risk management and the techniques used to make risk management an effective part of security management.

There are two sections in the CISSP that are truly practical and logical. This makes these sections relatively easy to understand and follow. Those two are Cryptography and Risk Management. Many people are afraid of these two topics but there is no need for that – by the end of this chapter you will understand risk management, and by the end of the cryptography chapter you will undoubtedly be fascinated with crypto.

This chapter steps ...