Certified Ethical Hacker Domain 5: Information Security Procedures and Assessment Methodologies

Introduction

This is the fifth domain of the CEH exam. The domain carries a weight of 8.77%, with a total of 11 questions from two of the main sections: Security Procedures and Information Security Assessment Methodologies.

This article will discuss the sections in some detail and point out the things that candidates will be required to know before taking the exam, such as the key differences between security procedures and security policies. We shall also discuss the security assessment methodologies that are widely accepted across the information security industry.

Policies and Procedures

One of the main reasons that this is being discussed here (and will be evaluated by the exam) is because a good number of people do not quite understand the difference between security policies and security procedures. I have, during my many security audits, asked for policies and ended up receiving procedures and vice versa. We will seek to address that in this section. It should also be noted that this section will contain five items in the exam.

Information Security Procedures

A security procedure answers the question “How do I do it?” It should and will describe step-by-step methods that identify, prevent and enforce measures that protect against unwanted behavior. Security procedures can include, for example, documents indicating how system values should be configured and the steps that should be followed for instance while performing production system upgrades.

Security procedures are mainly meant for internal departments and should adhere to strict change control processes. Good security procedures have the following characteristics:

Sponsorships Available

Sponsorships Available

Sponsorships Available

• They are detailed just enough to be understood by parties authorized to have access to them. In fact, they must not be too in-depth, so that only a small number of people can understand them
• They are normally the recipe that should be consulted (Read more...)