CISSP: The Complete Exam Guide

Agenda

1 - Understanding Information Security Concepts in Domain 1 - Security and Risk Management

• Defining Security
• Security Governance
• Effective Security Program
• Compliance
• Global Legal and Regulatory Issues
• Understand Professional Ethics
• Develop and Implement Security Policy
• Business Continuity (BC) & Disaster Recovery (DR) Requirements
• Manage Personnel Security
• Risk Management Concepts
• Threat Modeling
• Acquisitions Strategy and Practice
• Security Education, Training, and Awareness

2 - Understanding Information Security Concepts in Domain 2 - Asset Security Managing Data: Determining and Maintaining Data Ownership

• Data Standards
• Protecting Data
• Classifying Information and Supporting Assets
• Protecting Privacy
• Ensuring Appropriate Retention
• Determining Data Security Controls
• Selecting Standards

3 - Understanding Information Security Concepts in Domain 3 - Security Engineering:

• Using Security Design Principles in The Engineering Lifecycle
• Understanding Fundamental Concepts of Security Models
• Exploring Information Systems Security Evaluation Models
• Ensuring Security Capabilities of Information Systems
• Discovering Vulnerabilities of Security Architectures
• Securing Databases
• Analyzing Vulnerabilities and Threats
• Applying and Using Cryptography
• Site Planning
• Implementing and Operating Facilities Security

4 - Understanding Information Security Concepts in Domain 4- Communication and Network Security

• Secure Network Architecture and Design
• Implications of Multi-Layer Protocols
• Converged Protocols
• Securing Network Components
• Secure Communication Channels
• Network Attacks

5 - Understanding Information Security Concepts in Domain 5 - Identity and Access Management

• Physical and Logical Access to Assets
• Identification and Authentication of People and Devices
• Identity Management Implementation
• Identity as a Service (IDaaS)
• Integrate Third-Party Identity Services
• Implement and Manage Authorization Mechanisms
• Prevent or Mitigate Access Control Attacks
• Identity and Access Provisioning Lifecycle

6 - Understanding Information Security Concepts in Domain 6 - Security Assessment and Testing

• Assessment and Test Strategies
• Collect Security Process Data
• Internal and Third-Party Audits

7 - Understanding Information Security Concepts in Domain 7 Security Operations

• Investigations
• Provisioning of Resources through Configuration Management
• Foundational Security Operations Concepts
• Resource Protection
• Incident Response
• Preventative Measures against Attacks
• Patch and Vulnerability Management
• Change and Configuration Management
• The Disaster Recovery Process
• Test Plan Review
• Business Continuity and Other Risk Areas
• Access Control
• Internal Security
• Building and Inside Security
• Personnel Safety

8 - Understanding Information Security Concepts in Domain 8 - Security in the Software Development Life Cycle

• Software Development Security Outline
• Environment and Security Controls
• Security of the Software Environment
• Software Protection Mechanisms
• Assess the Effectiveness of Software Security
• Assess Software Acquisition Security