CISSP®: become an information systems security expert

Module 1: master security and risk management

• Understanding, adhering to and promoting professional ethics.
• Understanding and applying security concepts.
• Evaluating and implementing security governance principles.
• Defining compliance requirements.
• Legal and regulatory aspects of information security from a holistic perspective.
• Requirements for different types of investigations: administrative, criminal, civil and others.
• Developing, documenting and implementing security policies, standards, procedures and guidelines.
• Identifying, analysing and prioritising business continuity requirements.
• Personnel security policies and procedures.
• Risk management and threat modelling concepts.
• Supply chain risk management principles.
• Creating and maintaining a security awareness, education and training programme.

Module 2: secure assets

• Identifying and classifying information and assets.
• Information and asset management requirements.
• Secure provisioning of resources.
• Managing the data lifecycle.
• Asset retention measures: end of life and end of support.
• Data security controls and compliance requirements.

Module 3: design security architecture and engineering

• Researching, implementing and managing engineering processes using secure design principles.
• Core security model concepts: Biba, Star Model, Bell-LaPadula and others.
• Selecting controls according to system security requirements.
• Information systems security capabilities: memory protection, Trusted Platform Module, encryption and decryption.
• Assessing and mitigating vulnerabilities in security architectures and solutions.
• Selecting and developing cryptographic solutions.
• Cryptanalytic attack methods.
• Security principles in site and facility design.

Module 4: secure communications and networks

• Assessing and implementing secure design principles for network architectures.
• Securing network components.
• Implementing secure communication channels in accordance with the design.

Module 5: manage identity and access

• Controlling physical and logical access to assets.
• Managing identification and authentication of people, devices and services.
• Federated identity with third-party services.
• Implementing and managing authorisation systems.
• Managing the identity and access provisioning lifecycle.
• Implementing authentication systems.

Module 6: assess and test security

• Designing and validating assessment, testing and audit strategies.
• Testing security controls.
• Collecting data from security processes.
• Analysing test results and preparing reports.
• Conducting and facilitating security audits.

Module 7: lead security operations

• Understanding and conducting investigations.
• Logging and monitoring activities.
• Configuration management: provisioning, baselining and automation.
• Core security operations concepts.
• Resource protection measures.
• Incident management.
• Detection and prevention measures.
• Patch and vulnerability management.
• Change management processes.
• Recovery strategies and disaster recovery processes.
• Business continuity planning and exercises.
• Physical and personnel security.

Module 8: secure software development

• Integrating security into the software development lifecycle.
• Security controls in software development ecosystems.
• Assessing software security effectiveness.
• Assessing the security impact of purchased software.
• Secure coding guidelines and standards.

Module 9: prepare for the CISSP exam

• Advice and tips for exam success.
• Assessment quizzes.