(ISC)2 - CISSP - CBK Review Seminar

Curriculum

You will learn the following on the CISSP training course:

Domain 1 – Security and Risk Management (Security, risk, compliance, law, regulations, business continuity)

• Understand and apply concepts of confidentiality, integrity and availability
• Apply security governance principles
• Compliance
• Understand legal and regulatory issues that pertain to information security In a global context
• Understand professional ethics
• Develop and implement document security policy, standards, procedures and guidelines
• Understand business continuity requirements
• Contribute to personnel security policies
• Understand and apply risk management concepts
• Understand and apply threat modelling
• Integrate security risk considerations into acquisitions strategy and practice
• Establish and manage information security education, training and awareness

Domain 2 - Asset Security (Protecting security of assets)

• Classify information and support assets
• Determine and maintain ownerships (data owners, system owners, business/mission owners)
• Protect privacy
• Ensure appropriate retention (media, hardware, personnel)
• Determine data security controls (data at rest, data in transit)
• Establish requirements ( makings, labels, storage, destruction of sensitive information)

Domain 3- Security Engineering (Engineering and management of security)

• Implement and Manage engineering processes using secure design principles
• Understand the fundamental concepts of security models (Confidentiality, Integrity, and Multi-level Models)
• Select controls and countermeasures based upon systems security evaluation modules
• Understand security capabilities of information systems (memory protection, virtualisation, trusted platform module, interfaces, fault tolerance)
• Assess and mitigate vulnerabilities in web-based systems (XML, OWASP)
• Apply cryptography
• Apply secure principles to site and facility design
• Design and implement physical security

Domain 4 – Communication and Network Security (Designing and protecting network security)

• Apply secure design principles to network architecture (IP & non-IP protocols, segmentation)
• Secure network components
• Design and establish secure communication channels
• Prevent or mitigate network attacks

Domain 5 – Identity and Access Management (Controlling access and managing identity)

• Control physical and logical access to assets
• Manage identification and authentication of people and devices
• Integrate identity as a service (cloud identity)
• Integrate third-party identity services (on-premise)
• Implement and manage authorisation mechanisms
• Prevent or mitigate access control attacks
• Manage the identity and access provisioning lifecycle (provisioning, review)

Domain 6 – Security Assessment and Testing (Designing, performing, and analysing security testing)

• Design and validate assessment and test strategies
• Conduct security control testing
• Collect security process date (management and operational controls)
• Analyse and report test outputs (automated, manual)
• Conduct or facilitate internal and third party audits

Domain 7 – Security Operations (Foundational concepts, investigations, incident management, disaster recovery)

• Understand and support investigations
• Understand requirements for investigation types
• Conduct logging and monitoring activities
• Secure the provisioning of resources
• Understand and apply foundational security operations concepts
• Employ resource protection techniques
• Conduct incident management
• Operate and maintain preventative measures
• Implement and support patch and vulnerability management
• Participate in and understand change management processes (versioning, baselining, security impact analysis)
• Implement recovery strategies
• Implement disaster recovery processes
• Test disaster recovery plans
• Participate in addressing personnel safety concerns (duress, travel, monitoring)

Domain 8 – Software Development Security (Understanding, applying, and enforcing software security)

How to maintain business in the face of major disruptions:

• Understand and apply security in the software development lifecycle
• Enforce security controls in development environments
• Assess the effectiveness of software security
• Assess security impact of acquired software