CISSP-ISSAP®: information systems security architecture specialist

Domain 1: governance, compliance and risk management for information systems architectures

• Applicable information security standards and regulations.
• Third-party and contractual obligations (supply chain, outsourcing, subcontracting, etc.).
• Applicable data protection standards and guidelines (GDPR).
• Designing information systems for auditability (regulatory, legislative, forensic, segregation and high-assurance system requirements, etc.).
• Coordination with external parties (law enforcement, public relations, independent experts, etc.).
• Risk identification and classification.
• Developing risk treatment recommendations (mitigation, transfer, acceptance, avoidance, etc.).
• Risk monitoring and reporting.

Domain 2: security architecture modelling

• Types and scope: enterprise, network, service-oriented architecture (SOA), cloud, IoT, industrial control systems (ICS) and Supervisory Control and Data Acquisition (SCADA).
• Frameworks: Sherwood Applied Business Security Architecture (SABSA) and Service-Oriented Modeling Framework (SOMF).
• Reference architectures and blueprints.
• Security configuration (baselines, benchmarks, profiles, etc.).
• Network configuration (physical, logical, high availability, segmentation and zones).
• Validating threat modelling outcomes (threat vectors, consequences and likelihood).
• Identifying gaps and alternative solutions.
• Independent verification and validation (tabletop exercises, modelling and simulation, manual functional reviews).

Domain 3: infrastructure security architecture

• Requirements for on-premises, cloud and hybrid systems.
• The Internet of Things (IoT) and Zero Trust.
• Network management.
• Industrial control system (ICS) security.
• Network security.
• Operating system (OS) security.
• Database security.
• Container security.
• Cloud workload security.
• Firmware security.
• User security awareness considerations.
• Securing shared services (Wi-Fi, email, voice over IP, unified communications, DNS and NTP).
• Designing boundary protection (firewalls, VPNs, air gaps, software-defined perimeters, wireless and cloud-native environments).
• Secure device management (Bring Your Own Device (BYOD), mobile devices, servers, endpoints, cloud instances and storage).
• Network visibility (sensor placement, time reconciliation, scope of control and record compatibility).
• Active and passive collection solutions (SPAN ports, port mirroring, taps, inline devices and flow logs).
• Security analytics (log collection, machine learning, User Behavior Analytics (UBA), Security Information and Event Management (SIEM)).
• Cryptographic design considerations and constraints.
• Cryptographic implementation.
• Key management lifecycle planning (generation, storage, distribution, etc.).
• Designing secure network and communications infrastructure (VPN, IPsec and TLS).
• Aligning physical security requirements with business needs (perimeter protection, internal zoning, fire suppression, etc.).
• Validating physical and environmental security controls.

Domain 4: identity and access management architecture

• Identity identification and verification.
• Assigning identifiers to users, services, processes and devices.
• Identity provisioning and deprovisioning.
• Federated and standalone trust relationships.
• Authentication methods (multifactor authentication (MFA), risk-based, location-based, knowledge-based, possession-based and characteristic-based).
• Authentication protocols and technologies (SAML, RADIUS, Kerberos, etc.).
• Access control concepts and principles.
• Access control configuration types (physical, logical and administrative).
• Authorisation processes and workflows (governance, issuance, periodic review and revocation).
• Roles, rights and responsibilities for access to systems, applications and data.
• Privileged account and permission management.
• Access control protocols and technologies (XACML and LDAP).
• Authorisation management technologies (passwords, certificates and smart cards).
• Centralised and decentralised identity and access management architectures.
• Implementing privileged access management (PAM).
• Accounting for logging, tracking and auditing.

Domain 5: application security for architecture

• Assessing code review methods (dynamic, manual, static, etc.).
• Assessing application protection needs (web application firewalls, anti-malware, secure APIs and secure SAML).
• Encryption requirements at rest, in transit and in use.
• Assessing security requirements for communications between applications and databases or other endpoints.
• Using a secure code repository.
• Application security analysis.
• Selecting cryptographic solutions for applications (cryptographic application programming interfaces, pseudorandom number generators and key management).
• Assessing whether security controls can be applied to system components.
• Identifying common proactive application controls with the Open Web Application Security Project (OWASP).

Domain 6: security operations architecture

• Security operations requirements (legal, compliance, organisational and business).
• Detection and analysis.
• Proactive, automated security monitoring and remediation (vulnerability management, compliance auditing and penetration testing).
• Integrating business impact analysis (BIA).
• Selecting recovery and viability strategies.
• Continuity and availability solutions (cold, hot and cloud backup).
• Processing agreement requirements (vendor, reciprocal, mutual, cloud and virtualisation).
• Recovery time objectives (RTOs) and recovery point objectives (RPOs).
• Establishing secure emergency communications for operations.
• Validating business continuity and disaster recovery plan architecture.
• Preparation (communications plan, incident response plan and staff training).
• Identification.
• Containment.
• Eradication.
• Recovery.
• Lessons learned analysis.