Certified Information Systems Security Professional (CISSP)

Prerequisites:

Target Audience:

Course Objectives:

• Understand and apply concepts of confidentiality, integrity and availability
• Evaluate and apply security governance principles
• Determine compliance requirements
• Understand legal and regulatory issues that pertain to information security in a global
• context
• Understand, adhere to, and promote professional ethics
• Develop, document, and implement security policy, standards, procedures, and guidelines
• Identify, analyze, and prioritize Business Continuity (BC) requirements 
• Contribute to and enforce personnel security policies and procedures
• Understand and apply risk management concepts
• Understand and apply threat modeling concepts and methodologies
• Apply risk-based management concepts to the supply chain 
• Establish and maintain a security awareness, education, and training program
• Identify and classify information and assets
• Determine and maintain information and asset ownership
• Protect privacy
• Ensure appropriate asset retention
• Determine data security controls
• Establish information and asset handling requirements
• Implement and manage engineering processes using secure design principles
• Understand the fundamental concepts of security models
• Select controls based upon systems security requirements
• Understand security capabilities of information systems (e.g., memory protection, Trusted
• Platform Module (TPM), encryption/decryption)
• Assess and mitigate the vulnerabilities of security architectures, designs, and solution
• elements
• Assess and mitigate vulnerabilities in web-based systems
• Assess and mitigate vulnerabilities in mobile systems
• Assess and mitigate vulnerabilities in embedded devices
• Apply cryptography
• Apply security principles to site and facility design
• Implement site and facility security controls
• Implement secure design principles in network architectures
• Secure network components
• Implement secure communication channels according to design
• Control physical and logical access to assets
• Manage identification and authentication of people, devices, and services
• Integrate identity as a third-party service
• Implement and manage authorization mechanisms
• Manage the identity and access provisioning lifecycle
• Design and validate assessment, test, and audit strategies
• Conduct security control testing
• Collect security process data (e.g., technical and administrative)
• Analyze test output and generate report
• Conduct or facilitate security audits
• Understand and support investigations
• Understand requirements for investigation types
• Conduct logging and monitoring activities
• Securely provisioning resources 
• Understand and apply foundational security operations concepts
• Apply resource protection techniques
• Conduct incident management
• Operate and maintain detective and preventative measures
• Implement and support patch and vulnerability management
• Understand and participate in change management processes
• Implement recovery strategies
• Implement Disaster Recovery (DR) processes 
• Test Disaster Recovery Plans (DRP)
• Participate in Business Continuity (BC) planning and exercises
• Implement and manage physical security 
• Address personnel safety and security concerns 
• Understand and integrate security in the Software Development Life Cycle (SDLC) 
• Identify and apply security controls in development environments
• Assess the effectiveness of software security
• Assess security impact of acquired software
• Define and apply secure coding guidelines and standards

Course Outline:

• Data Access Principles
• System Access and Authentication
• Penetration Tests

• Security Models
• Security Modes
• System Assurance

• Data Network Design
• Remote Data Access
• Data Network Security
• Data Network Management

• Organizational Security
• The Application of Security Concepts

• Information Classification
• Security Program Development

• Risk Management
• Ethics

• Software Configuration Management
• Software Controls
• Database System Security

• Ciphers and Cryptography
• Symmetric-Key Cryptography
• Asymmetric-Key Cryptography
• Hashing and Message Digests
• Email, Internet, and Wireless Security
• Cryptographic Weaknesses

• Physical Access Control
• Physical Access Monitoring
• Physical Security Methods
• Facilities Security

• Operations Security Control
• Operations Security Auditing and Monitoring
• Operational Threats and Violations

• Business Continuity Plan Fundamentals
• Business Continuity Plan Implementation
• Disaster Recovery Plan Fundamentals
• Disaster Recovery Plan Implementation

• Computer Crime Laws and Regulations
• Computer Crime Incident Response