Security Operations · Topic 4 of 9
Operations Concepts and Resource Protection
Need to know, least privilege, separation of duties, privileged accounts, job rotation, SLAs, and protecting media, hardware and data in operations.
- 3 min
- Need to know and least privilege limit access; separation of duties limits power.
- Job rotation and mandatory vacations detect fraud.
- Privileged accounts: separate, vaulted, MFA, monitored, time-limited.
What it is
Foundational operations concepts are the everyday principles that limit what any one person or account can do. Resource protection applies them to media, hardware and data during operations, including when assets leave the organization.
How it works
Foundational concepts
| Concept | Meaning |
|---|---|
| Need to know | Access only to information required for a specific task |
| Least privilege | Only the rights required, for only as long as required |
| Separation of duties | Critical tasks split so no one person can complete and hide misuse |
| Two-person integrity / dual control | Two people must act together for very sensitive tasks |
| Privileged account management | Vaulting, monitoring and just-in-time use of admin accounts |
| Job rotation | Moving people between roles to detect fraud and spread knowledge |
| Mandatory vacation | Enforced absence lets others notice irregularities |
| Service level agreements (SLAs) | Agreed service levels with providers, measured and reported |
Least privilege includes time. Rights granted for a one-week project should expire at the end of the week.
Privileged account controls
Separate admin accounts from daily accounts, require MFA, check out credentials from a vault, record sessions and review use. Emergency (break-glass) accounts need dual-person checkout, alerts and reset after use.
Media management
| Practice | Purpose |
|---|---|
| Labeling by classification | Correct handling |
| Secure storage and transport | Prevent loss or theft |
| Inventory and tracking (serial numbers) | Know where every item is |
| Retention and sanitization | Remove data before reuse or disposal |
| Chain of custody for destruction | Prove each item was destroyed |
For drives collected by a destruction vendor, track each drive by serial number through to a destruction certificate; a contract clause or weight-based invoice gives no item-level assurance.
Media protection techniques
Encrypt portable media and backups, restrict use of removable media, and protect backup media from the same threats as production (for example keep an immutable or offline copy).
Data protection in operations
- Snapshots and copies: memory and disk snapshots can contain secrets; encrypt them, restrict access and enforce expiry.
- Mobile devices: use mobile device management; on personally owned devices, wipe only the managed work container when the agreement forbids erasing personal data.
- Cloud storage: default-deny public access and require owner tags at creation.
- Leased equipment: for the most sensitive unencrypted data, keep and destroy the drives rather than relying on the lessor's wipe.
Hardware and asset management
Maintain inventory, track assets through their lifecycle, plan for end of support, and secure hardware physically.
How the exam asks about this
- "Contractor needs finance rights for one week." Only the needed rights with an expiry.
- "Lost personal phone enrolled in MDM; policy forbids erasing personal data." Wipe the work container and revoke access.
- "Database snapshots with memory contents are readable by every engineer." Encrypt, restrict and expire them.
What to remember for the exam
- Need to know and least privilege limit access; separation of duties limits power.
- Job rotation and mandatory vacations detect fraud.
- Privileged accounts: separate, vaulted, MFA, monitored, time-limited.
- Track media by item through destruction.
- Protect copies, snapshots and backups like production data.
Backups reachable with the same domain administrator credentials as production can be destroyed by ransomware operators. Keep an immutable copy managed with separate credentials.
Common mistakes
Granting broad admin group membership for temporary tasks.
Trusting weight-based destruction reports.
Forgetting that snapshots and test copies hold real data.
Check yourself
What is the difference between need to know and least privilege?
Need to know limits which information you access; least privilege limits the rights you hold.
Why use job rotation?
It helps detect fraud and reduces dependence on one person.
What gives the best assurance that every retired drive was destroyed?
Serial-number tracking through to a destruction certificate.
Topic 4 of 9 in Security Operations
Test yourself on Security Operations
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.