Cissp Course Content
Cissp Course Content
Cissp Course Content
2024
Certif ied Inf or mat ion
S ys tem Se c ur it y P r of e s s i o n a l
Online Training
www.infosectrain.com I sales@infosectrain.com 1
CISSP Program Overview
The CISSP® certification is one of the most renowned achievements within the realm of information security.
Our training course is meticulously crafted to endow participants with the technical skills and managerial
prowess necessary to effectively design, build, and oversee an organization’s security framework, aligning
with globally recognized information security norms.
(ISC)² is a globally recognized nonprofit organization dedicated to advancing the information security field.
The CISSP® was the first credential in information security to meet the stringent requirements of ISO/IEC
Standard 17024. It is looked upon as an objective measure of excellence and a highly reputed standard of
achievement.
www.infosectrain.com I sales@infosectrain.com 2
Why CISSP® Training Course with InfosecTrain?
InfosecTrain is a leading IT security training and consulting organization offering best-in-class yet cost-
effective, customized training programs to enterprises and individuals across the globe. We offer role-specific
certification training programs and prepare professionals for the future. Our CISSP® certification training
course provides participants with the technical and managerial skills that are in demand for designing,
architecting, and managing an organization’s security posture by using globally recognized information
security standards.
Here’s what you get when you choose InfosecTrain as your learning partner:
• Flexible Schedule: Training sessions to match your schedule and accommodate your needs.
• Extended Post Training Support: Ongoing assistance and support until the learners achieve their
certification goals.
• Customized Training: A training program that caters to your specific learning needs.
• Knowledge Sharing Community: Collaborative group discussions to facilitate knowledge sharing and learning.
• Expert Career Guidance: Free career guidance and support from industry experts.
Target Audience
• Chief Information Security Officer
• Chief Information Officer
• Director of Security
• IT Director/Manager
• Security Systems Engineer
• Security Analyst
• Security Manager
• Security Auditor
• Security Architect
• Security Consultant
• Network Architect
www.infosectrain.com I sales@infosectrain.com 3
Pre-Requisites
To apply for the CISSP® certification, you need to:
• Have a minimum 5 years of cumulative paid full-time work experience in two or more of the 8 domains of
the (ISC)² CISSP® Common Body of Knowledge (CBK).
• A one-year experience waiver can be earned with a 4-year college degree, regional equivalent, or
additional credential from the (ISC)² approved list.
3 hours
Exam Duration 4 hours
Passing Score 700 out of 1000 points 700 out of 1000 points
Note: CISSP® is a registered mark of The International Information Systems Security Certification
Consortium ((ISC)2).We are not an authorized training partner of (ISC)2.
www.infosectrain.com I sales@infosectrain.com 4
Course Objectives
You will be able to:
• Master core concepts of risk management, security governance, and compliance.
• Understand the ethical and legal requirements impacting information security.
• Learn to classify information and assets, ensuring appropriate protection.
• Understand data security controls and asset retention.
• Gain insights into secure design principles, engineering processes, and security models.
• Apply cryptography and secure architecture solutions effectively.
• Develop skills in designing and protecting network security.
• Manage secure network architecture and components.
• Implement comprehensive IAM solutions, including access control, identity management, and
authentication mechanisms.
• Integrate third-party identity services and manage identities across different platforms.
• Conduct assessments and testing of security systems to identify vulnerabilities.
• Analyze and interpret test data to enhance security measures.
• Understand operational security controls, incident management, and disaster recovery.
• Support forensic investigations and understand the foundations of operational security.
• Enforce security controls in software development environments.
• Integrate security throughout the Software Development Life Cycle (SDLC).
www.infosectrain.com I sales@infosectrain.com 5
CISSP Course Highlights
Accredited CISSP
Instructors Exam Engine
www.infosectrain.com I sales@infosectrain.com 6
Who Should Attend
www.infosectrain.com I sales@infosectrain.com 7
Our Expert Instructors
Prashant M Sujay
11+ Years Of Experience 15+ Years Of Experience
Security Architect CISSP, CCSP, C|EH & CPISI CSOA | CCSP | CISSP | ISO 27001 Lead Auditor | ITIL v3
www.infosectrain.com I sales@infosectrain.com 8
Happy Learners Across the World
www.infosectrain.com I sales@infosectrain.com 9
CISSP Domains
www.infosectrain.com I sales@infosectrain.com
www.infosectrain.com I sales@infosectrain.com 10
Domain 1
Security and Risk Management (16%)
1.1 Understand, adhere to, and promote professional ethics (2-4 items)
» ISC2 Code of Professional Ethics
» Organizational code of ethics
1.4 Understand legal, regulatory, and compliance issues that pertain to information
security in a holistic context
» Cybercrimes and data breaches
» Licensing and Intellectual Property requirements
» Import/export controls
» Transborder data flow
» Issues related to privacy (e.g., General Data Protection Regulation (GDPR), California Consumer
Privacy Act, Personal Information Protection Law, Protection of Personal Information Act)
» Contractual, legal, industry standards, and regulatory requirements
www.infosectrain.com I sales@infosectrain.com 11
1.5: Understand requirements for investigation types (i.e., administrative, criminal, civil,
regulatory, and industry standards)
1.7: Identify, analyze, assess, prioritize, and implement Business Continuity (BC)
requirements
» Business impact analysis (BIA)
» External dependencies
www.infosectrain.com I sales@infosectrain.com 12
1.11: Apply supply chain risk management (SCRM) concepts
» Risks associated with the acquisition of products and services from suppliers and providers (e.g.,
» Risk mitigations (e.g., third-party assessment and monitoring, minimum security requirements, service
level requirements, silicon root of trust, physically unclonable function, software bill of materials)
1.12: Establish and maintain a security awareness, education, and training program
» Methods and techniques to increase awareness and training (e.g., social engineering, phishing,
» Periodic content reviews to include emerging technologies and trends (e.g., cryptocurrency, artificial
www.infosectrain.com I sales@infosectrain.com 13
Domain 2
Asset Security
» Data retention
» Data remanence
» Data destruction
2.5 Ensure appropriate asset retention (e.g., End-of-Life (EOL), End-of-Support (EOS))
www.infosectrain.com I sales@infosectrain.com 14
Domain 3
Security Architecture and Engineering (13%)
www.infosectrain.com I sales@infosectrain.com 15
3.5 Assess and mitigate the vulnerabilities of security architectures,
designs, and solution elements
» Client-based systems
» Server-based systems
» Database systems
» Cryptographic systems
» Industrial Control Systems (ICS)
» Cloud-based systems (e.g., Software as a Service (SaaS), Infrastructure
as a Service (IaaS), Platform as a Service (PaaS))
» Distributed systems
» Containerization
» Serverless
» Embedded systems
» Virtualized systems
www.infosectrain.com I sales@infosectrain.com 16
» Implementation attacks
» Side-channel
» Fault injection
» Timing
» Man-in-the-Middle (MITM)
» Pass the hash
» Kerberos exploitation
» Ransomware
» Evidence storage
» Requirements analysis
» Architectural design
» Development /implementation
» Integration
» Transition/deployment
» Retirement/disposal
www.infosectrain.com I sales@infosectrain.com 17
Domain 4
Communication and Network Security (13%)
(TCP/IP) models
» Internet Protocol (IP) version 4 and 6 (IPv6) (e.g., unicast, broadcast, multicast, anycast)
» Secure protocols (e.g., Internet Protocol Security (IPSec), Secure Shell (SSH), Secure Sockets
» Converged protocols (e.g., Internet Small Computer Systems Interface (iSCSI), Voice over
» Internet Protocol (VoIP), InfiniBand over Ethernet, Compute Express Link) 4.1.6: Transport architecture
» Logical segmentation (e.g., virtual local area networks (VLANs), virtual private networks
intrusion detection system (IDS)/intrusion prevention system (IPS), zero trust) 4.1.12: Edge networks
www.infosectrain.com I sales@infosectrain.com 18
4.2: Secure network components
» Operation of infrastructure (e.g., redundant power, warranty, support)
» Network Access Control (NAC) systems (e.g., physical and virtual solutions) 4.2.4: Endpoint
www.infosectrain.com I sales@infosectrain.com 19
Domain 5
Identity and Access Management (IAM)
(13%)
5.1 Control physical and logical access to assets
» Information
» Systems
» Devices
» Facilities
» Applications
5.2 Design identification and authentication strategy (e.g., people, devices, and services)
» Groups and Roles
password-less authentication)
» 5.2.8: Just-In-Time
» Cloud
» Hybrid
www.infosectrain.com I sales@infosectrain.com 20
5.4 Implement and manage authorization mechanisms
» Role Based Access Control (RBAC)
» Access policy enforcement (e.g., policy decision point, policy enforcement point)
» Privilege escalation (e.g., managed service accounts, use of sudo, minimizing its use)
» Kerberos
www.infosectrain.com I sales@infosectrain.com 21
Domain 6
Security Assessment and Testing (12%)
» Log reviews
» Coverage analysis
» Interface testing (e.g., user interface, network interface, application programming interface (API))
» Compliance checks
www.infosectrain.com I sales@infosectrain.com 22
6.4 Analyze test output and generate a report
» Remediation
» Exception handling
» Ethical disclosure
www.infosectrain.com I sales@infosectrain.com 23
Domain 7
Security Operations (13%)
» Investigative techniques
» Egress monitoring
» Log management
» Job rotation
www.infosectrain.com I sales@infosectrain.com 24
7.6 Conduct incident management
» Detection
» Response
» Mitigation
» Reporting
» Recovery
» Remediation
» Lessons learned
» Whitelisting/blacklisting
» Sandboxing
» Honeypots/honeynets
» Anti-malware
» Recovery site strategies (e.g., cold vs. hot, resource capacity agreements)
» System resilience, High Availability (HA), Quality of Service (QoS), and fault tolerance
www.infosectrain.com I sales@infosectrain.com 25
7.11 Implement Disaster Recovery (DR) processes
» Response
» Personnel
» Assessment
» Restoration
» Lessons learned
» Walkthrough
» Simulation
» Parallel
» Full interruption
» Communications (e.g., stakeholders, test status, regulators)
» Travel
» Security training and awareness (e.g., insider threat, social media impacts, two-factor
» Emergency management
» Duress
www.infosectrain.com I sales@infosectrain.com 26
Domain 8
Software Development Security (10%)
8.1 Understand and integrate security in the Software Development Life Cycle (SDLC)
» Development methodologies (e.g., Agile, Waterfall, DevOps, DevSecOps Scaled Agile Framework)
» Change management
» Libraries
» Tool sets
» Runtime
» Code repositories
» Application security testing (e.g., static application security testing (SAST), dynamic application
security testing (DAST), software composition analysis, Interactive Application Security Test (IAST))
www.infosectrain.com I sales@infosectrain.com 27
8.4 Assess security impact of acquired software
» Commercial-off-the-shelf (COTS)
» Open source
» Third-party
» Cloud services (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as
a Service (PaaS))
www.infosectrain.com I sales@infosectrain.com 28
CISSP® Course Benefits
www.infosectrain.com I sales@infosectrain.com 29
www.infosectrain.com I sales@infosectrain.com
www.infosectrain.com I sales@infosectrain.com 30