Google Cybersecurity Certificate, Course 2: Play It Safe: Manage Security Risks (Study Notes)

• Domains tell you where a risk lives (policy, data, network, access, testing, operations, software).
• Risk management is a loop: identify, assess, treat, monitor.
• Risk is roughly likelihood multiplied by impact. A rare but catastrophic event can outrank a frequent minor one.
• Treating risk: reduce it (add controls), avoid it (stop the activity), transfer it (insurance, vendor contract) or accept it (low impact, documented decision).
• Think in terms of threat (danger), vulnerability (gap) and asset value.

A framework is a ready-made structure so you do not invent a security programme from scratch.

Older CSF versions have five functions without Govern; check which version your course uses. NIST CSF is voluntary guidance.

NIST RMF is a step-by-step lifecycle for managing risk in a specific system: Prepare, Categorize, Select controls, Implement, Assess, Authorize, Monitor. See NIST RMF.

Other names to recognise: CIS Controls, ISO/IEC 27001, and regulations such as GDPR, HIPAA and PCI DSS.

Controls are also grouped as administrative (policies, training), technical (software, encryption) and physical (locks, badges).

OWASP security principles (from the OWASP community) are habits for safer design:

• Least privilege: minimum access needed.
• Separation of duties: no one person controls a whole sensitive process.
• Defense in depth: several layers, so one failure is not fatal.
• Minimise the attack surface: switch off what you do not use.
• Fail securely: when something breaks, deny access rather than allow it.
• Secure defaults and keep it simple: complicated systems hide mistakes.
• Do not rely on secrecy alone: hiding a design is not protection.

An audit is a structured review of whether security practices meet a standard or policy.

• Internal audits are run by the organisation’s own staff; external audits by independent parties.
• Typical flow: set scope and goals, assess risk, check controls against the standard, record gaps, report findings, recommend fixes.
• Scope says what is in and out; goals say what you want to learn.
• Findings should be clear to non-technical managers: what is wrong, why it matters, what to do first.

Threat modeling means thinking like an attacker before you build or deploy, so you fix weak spots early.

PASTA is a seven-stage, risk-centred process: define objectives, define technical scope, break the application down, analyse threats, find vulnerabilities, model attacks, then analyse risk and impact and plan countermeasures. It starts from business goals rather than a checklist.

SIEM dashboards turn raw logs into visual summaries such as failed logins over time, top source IPs, or alerts by severity. Analysts use them to spot spikes, then drill into the underlying events. A dashboard shows where to look; it does not prove an attack.

Reduce, avoid, transfer, accept. Each is a valid choice depending on cost and impact.

Transfer. The financial impact moves to the insurer, though the risk itself still exists.

Recover. It focuses on restoring services and learning from the event.

CSF gives broad outcome areas for an organisation; RMF is a step-by-step lifecycle for authorising and monitoring a particular system.

Administrative. It is a policy and people-based control.

Fail securely. Failure should not grant access.

Separation of duties: one person acting alone (or with a stolen account) cannot complete fraud.

Tampering. It attacks integrity.

STRIDE is a quick category checklist of threat types; PASTA is a longer, business-focused process that models attacks and weighs risk.

Drill into the underlying log events, check the account and source, then follow the playbook (for example, block the IP or reset credentials) and escalate if it looks malicious.