CISSP Course Introduction
Domain 1: Security and Risk Management
- Introduction
- Introduction to Security and Risk Management
- Understand, adhere to, and Promote Professional Ethics
- Understand and Apply Security Concepts
- Evaluate and Apply Security Governance Principle
- Goals, Mission, and Objectives
- Control Frameworks, Due Care, and Due Diligence
- Determine Compliance and Other Requirements
- Understand Legal and Regulatory Issues that Pertain to Information Security in a Holistic Context
- Types of Intellectual Properties (IP) Law
- OECD Principles, GDPR, and Data Protection principles
- Data Protection Principles
- Understand Requirements for Investigation Types
- Develop, Document, and Implement Security Policy, Standards,Procedures, and Guidelines
- Need for Business Continuity Planning (BCP)
- Business Continuity Planning Phases
- Business Impact Analysis
- Identify Preventive Controls
- Contribute and Enforce Personnel Security Policies and Procedures
- Introduction to Risk Management Concepts
- Risk Analysis
- Risk Analysis and Assessment
- Countermeasure Selection
- Risk Handling and Security Control Assessment
- Security Control Assessment (SCA)
- Risk Monitoring and Continuous Improvement
- Understand and Apply Threat Modeling Concepts and Methodologies
- Threat Modeling Steps
- DREAD Rating
- Apply Supply Chain Risk Management (SCRM) Concepts
- Third-Party Management and Risks
- Third-Party Risk Management Life Cycle
Domain 2: Asset Security
- Introduction
- Introduction to Asset Security
- Identify and Classify Information and Assets
- Information Classification Objectives
- Establish Information and Asset Handling Requirements
- Provision Resources Securely
- Manage Data Life Cycle
- Data Life Cycle: Create, Store, and Use
- Data Life Cycle: Share, Archive, and Destroy
- Data Remanence and Data Destruction
- Ensure Appropriate Asset Retention
- Data and Data Security Controls
- How to Select Controls
- Digital Rights Management (DRM)
- Data Loss Prevention (DLP)
- Quick Recap
Domain 3: Security Architecture and Engineering
- Introduction
- Introduction to Security Engineering
- Research, Implement, and Manage Engineering Processes Using
- Trust but Verify and Zero Trust
- Privacy by Design
- Understand the Fundamental Concepts of Security Models
- _State Machine Model, Multilevel Lattice Model, Non-Interference Model, and Information Flow Model
- Types of Security Models
- Composition Theories, Covert Channels, and Open and Closed Systems
- Select Controls Based on System Security Requirements
- Security Capabilities of Information Systems
- Assess and Mitigate the Vulnerabilities of Security Architectures
- SCADA
- Security Concerns of ICS
- Cloud Computing
- Categorization of Cloud
- Internet of Things
- Fog and Edge Computing
- Select and Determine Cryptographic Solutions
- Cryptosystem Elements
- Encryption Methods
- Data Encryption Standards
- Output Feedback, Counter, and Triple DES
- Advanced Encryption Standards
- Asymmetric Cryptography
- Public Key Infrastructure
- PKI Certificate and Processes
- PKI Process: Steps
- Hashing, MAC, and Digital Signatures
- Key Management Principles
- Methods of Cryptanalytic Attacks
- Apply Security Principles to Site and Facility Design
- Design Site and Facility Security Controls
- Personnel Access Controls
- Environmental Security Controls
- Classes of Fires
- Other Security Controls
- HVAC, Power Supply, and Training
Domain 4: Communication and Network Security
- Introduction
- Introduction to Communications and Network Security
- Assess and Implement Secure Design Principles
- Physical Layer and Data Link Layer
- Network Layer
- Transport Layer
- Session Layer and Presentation Layer
- Application Layer and Protocols
- IP Addressing
- IPv6 and Its Address Structures
- Internet Security Protocol (IPsec)
- IPsec Security Protocols
- Secure Access Protocols
- Implementation of Multilayer Protocol, Fiber Channels, and Micro-Segmentation
- SDN and Wireless Technologies
- Cellular Network and CDN
- Secure Network Components
- Understand Network Access Control (NAC) and Endpoint Security
- Implement Secure Communication Channels
- Application-Level Gateway, Circuit-Level Gateway, and Network Security Terms
- Remote Access Technologies
- VPN Protocols
- VPN Protocols: Comparison
- Multimedia Collaboration, Network Function Virtualization, and Network Attacks
- Quick Recap
Domain 5: Identity and Access Management
- Introduction
- Introduction to Identity and Access Management (IAM)
- Control Physical and Logical Access to Assets
- Manage Identification and Authentication of People Devices and Services
- Biometrics and Accuracy Measurement
- Passwords and Its Types
- Tokens, Token Devices, and Authorization
- Federated Identity Management (FIM) and Credential Management System
- Single Sign-On (SSO) and Just-In-Time (JIT)
- Federated Identity with a Third-Party Service
- Implement and Manage Authorization Mechanisms
- Attribute-Based Access Control (ABAC) and Risk-Based Access Control
- Manage the Identity and Access Provisioning Life Cycle
- Privilege Escalation
- Implement Authentication Systems
- _Kerberos and Its Steps, RADIUS, TACACS, and TACACS Plus
Domain 6: Security Assessment and Testing
- Introduction
- Introduction to Security Assessment and Testing
- Design and Validate Assessment, Test, and Audit Strategies
- SOC Reports and Security Assessments
- Internal Audit and Assessment
- External Audit and Assessment
- Third-Party Audit and Assessment
- Vulnerability Assessment
- Network Discovery Scan
- Network Vulnerability Scan and Web Vulnerability Scan
- Penetration Testing
- Penetration Testing Process and Testing Types
- Log Management and Review
- Security Testing in SDLC
- Code Review and Testing
- Testing Methods
- Interface Testing
- Collect Security Process Data
- KPI Process
- Analyze Test Output and Generate Report
Domain 7: Security Operations
- Introduction
- Introduction to Security Operations
- Understand and Comply with Investigations
- Digital Forensics
- Understand the Digital Evidence
- Conduct Logging and Monitoring Activities
- Continuous Monitoring
- Digital Forensics Tools, Tactics, Procedures, Artifacts, and UEBA
- Perform Configuration Management
- Apply Foundational Security Operation Concepts
- Identity and Access Management with Various Types of Accounts
- Apply Resource Protection
- Controls for Protecting Assets
- Conduct Incident Management
- Understand Incident Response Life Cycle
- Operate and Maintain Detective and Preventive Measures
- Understand Anti-Malware Systems, AI, Machine Learning, and Deep Learning
- Implement and Support Patch and Vulnerability Management
- Understand and Participate in Change Management Processes
- Implement Recovery Strategies
- Types of Recoveries
- Operational Recovery
- Recovery Partner Strategies
- Redundancy and Fault Tolerance
- Implement Disaster Recovery (DR) Processes
- Test Disaster Recovery Plans (DRP)
- Participate in Business Continuity (BC) Planning and Exercises
- Implement and Manage Physical Security
- Importance of Lighting in Security Management
- Access Control
- Address Personnel Safety and Security Concerns
Domain 8: Software Development Security
- Introduction
- Introduction to Software Development Security
- Integrate Security in the Software Development Life Cycle
- Software Development Models
- Extreme Programming Model
- DevOps and DevSecOps
- CMM and SAMM
- Change Management and Integrated Product Team (IPT)
- Security Controls in Software Development Ecosystems
- Other Security Controls in Software Development Ecosystems
- Software Configuration Management (SCM)
- Database and Data Warehousing Environments
- Assess the Effectiveness of Software Security
- Software Security and Assurance: Granularity of Controls and Separation of Environments
- Software Security and Assurance: TOC or TOU, Prevention of Social Engineering, Backup, Software Forensics, Cryptography
- Software Security and Assurance: Password Protection, Mobile Mode Controls, and Sandbox
- Software Security and Assurance: Strong Language Support, XML, and SAML
- Assessing the Effectiveness of Software Security
- Assess Security Impact of Acquired Software
- Free and Open-Source Software
- _ Define and Apply Secure Coding Guidelines and Standards
- Web Application Environment