Certified Information Systems Auditor (CISA) | Domain 5 Cybersecurity and Response 02

Separating by trust level or business function and controlling traffic at the boundaries limits how far a compromise spreads.

Revisit permissions left over after business changes and keep traffic to the minimum.

An IDS mainly detects and alerts, while an in-line IPS can also take defensive action.

Enterprise authentication provides individual credentials and strong encryption, and improves traceability.

Mistaken public settings and excessive permissions are a leading cause of cloud data leaks.

Combining identity, input handling, abuse prevention and monitoring reduces API risk.

Scanning mainly identifies candidates, while penetration testing evaluates the real impact under controlled conditions.

Prioritise on asset value, exposure, exploitation activity and compensating controls, not on severity alone.

Isolation limits spread and outbound traffic while evidence is preserved and analysis proceeds.

Measure continuously the increase in the desired reporting behaviour and the decrease in risky behaviour.

Recording how the evidence was handled supports its integrity and its credibility for legal and investigative purposes.

A SIEM normalises and correlates a wide range of logs and supports visibility of and response to suspicious activity.

Turning the lessons of the post-incident review into improvements reduces the recurrence and the impact of similar incidents.