This 5-day concentrated course provides information security professionals with a fully-immersed, minimum-distraction CISSP training and certification experience.

The course covers the 8 domains of the CISSP Common Body of Knowledge as reorganised in early 2015 and fully includes the updates that came into effect from 1 April 2018. The course will broaden and deepen your understanding of the domains and give you full preparation for the (ISC)2 CISSP accreditation examination.

The Gold Standard

CISSP is long regarded as the gold standard of security qualifications. It draws from a comprehensive, up-to-date, global common body of knowledge that ensures security leaders have a deep knowledge and understanding of new threats, technologies, regulations, standards, and practices. It is based on the CBK (Common Body of Knowledge) which comprises eight subject domains that the (ISC) 2 compiles and maintains through ongoing peer review by subject matter experts.

To attain the CISSP certification candidates must have a minimum of 5 years of direct, full-time security professional work experience in 2 or more of the domains of the CISSP CBK. One year of work experience may be waived by (ISC)2 if the candidate holds a four-year or higher college or university degree or approved credential. Candidates who do not meet these criteria may be given Associate status until conditions are met.

Unsure if you have adequate experience?

If you are unsure whether you meet the requisite experience criteria, please refer to the (ISC)2 web site Professional Experience Requirement.

Please note that (ISC)2 also offers the option to become an Associate of (ISC)2.

Learning outcomes

The CISSP exam tests one's competence in the 8 domains of the CISSP CBK.

This 5-day training program is designed to fully prepare you for the CISSP exam. It focuses on the 10 Common Body of Knowledge areas designated by (ISC)2:

Security and Risk Management
Security Engineering
Security Assessment and Testing
Asset Security
Communications and Network Security
Identity and Access Management
Security in the Software Development Life Cycle
Security Operations

Who should attend

The CISSP is designed for experienced security professionals who want to expand their knowledge and gain an internationally recognised accreditation. It is is ideal for those working in positions such as, but not limited to:

Security Consultant
Security Manager
IT Director/Manager
Security Auditor
Security Architect
Security Analyst
Security Systems Engineer
Chief Information Security Officer
Director of Security
Network Architect

Whilst anyone can attend the course, please note that the CISSP accreditation is only available to those who meet the (ISC)2 entry requirements. Refer to the EXAMS tab above for more information.

Course contents

This course covers the 8 domains of the CISSP Common Body of Knowledge as reorganised and updated in early 2015. The order of some topics has been altered to provide a better structure and a more consistent conceptual model. All topics of the new CBK are fully covered and the course provides full prep for the CISSP exam.

1. Introduction

Welcome and Administrivia
Course Overview
Review and Revision Techniques
References
Specialised References and Additional Reading
Other Resources
The “CISSP World-View”
The Exam
On the Day of the Exam
Exam Technique
After the Exam
CISSP Concentrations
Blended Learning Follow-up

2. Security and Risk Management

Security Properties of Information and Systems - The CIA Triad
Security Governance
- Organizational Structure and Processes
- Security Roles and Responsibilities
- Reporting Relationships
- Governance of Third Parties
Compliance, Legal and Regulatory Requirements
- Privacy Requirements
  - Transborder Data Flows
  - Data Breaches
- Intellectual Property
- Computer Ethics and Professional Ethics
Risk Management Concepts
- Definitions of Risk
- Risk Management Processes (SP800-30, ISO27005)
- Information Risk Analysis, Audit Frameworks and Methodologies
- Countermeasures and Controls
  - Control Assessment, Testing and Monitoring
- Threat Modeling
- Business Continuity Requirements
  - Development of Business Continuity and Disaster Recovery Plans
- Security Policies, Standards, Procedures, Guidelines
  - Personnel Security
- Acquisitions Policy and Strategies
- Security Education, Awareness and Training

3. Security Engineering

Security Engineering Lifecycle
Systems Architecture
Enterprise Security Architecture
Security Models
- Mandatory Access Control Models
- Discretionary Access Control
Evaluation, Certification and Accreditation
- Evaluation Schemes
Security Implementation Guidelines, Frameworks and Standards
Database Security
Vulnerabilities
- Architectural Vulnerabilities
- Distributed Computing
- Remote and Mobile Computing
- Process Control and SCADA
- Embedded Systems and the Internet of Things
Cryptology
- Types of Cryptoprimitives
- Classical Cryptography
- Symmetric Cryptoprimitives
- Unkeyed and Keyed Hashes
- Public Key Cryptosystems
  - Authentication & Digital Signatures
  - Public Key Infrastructure
- Key Management
- Advanced Concepts - Quantum computing, etc.
- Cryptanalysis and Attacks
Site Planning and Design
- Security Survey
- Crime Prevention Through Environmental Design
Facility Security
- Physical Security Principles
- Data Centers, Server Rooms and Wiring Closets
- Secure Work Areas

4. Security Assessment and Testing

Security Audit, Assessment and Testing Concepts
- First-Person and Third-Party Audits
Software Security Assessment
- Unit Testing
- Integration Testing
- Regression Testing
- Advanced Techniques and Tools - Fuzzers, Model Checkers, Automated Theorem Provers
Systems Security Assessment
Network Security Assessment
Networking Principles
- Protocol Layers
- ISO/OSI vs TCP/IP
Physical Layer
- Local Area Network Protocols
- Wide Area Network Protocols
- Physical Layer Attacks
Network Layer
- IP Addressing and Routing
- IP Protocol Operation
- ICMP Protocol
- Dynamic Routing Protocols
- Software Defined Networking
- Network Layer Attacks
Transport Layer
- Transport Layer Concepts
- UDP
- TCP
- Other Transport Layer Protocols
- Transport Layer Attacks
Application Layer
- Application Layer Protocols
  - Directory Services - BIND, LDAP, etc.
  - Remote Access and File Transfer
  - Email
  - Web - HTTP
  - VoiP, Instant Messaging and Collaboration
- Application Layer Vulnerabilities and Attacks
Network Security Testing and Assurance
Continuous Security Monitoring

5. Asset Security

Information Assets - Identification, Ownership
Data Standards and Policy
Information Classification
Handling Requirements
Data Retention Policy, Destruction and Disposal

6. Communications and Network Security

Networking Principles
- Protocol Layers
- ISO/OSI vs TCP/IP
Physical Layer
- Local Area Network Protocols
- Wide Area Network Protocols
- Physical Layer Attacks
Network Layer
- IP Addressing and Routing
- IP Protocol Operation
- ICMP Protocol
- Dynamic Routing Protocols
- Software Defined Networking
- Network Layer Attacks
Transport Layer
- Transport Layer Concepts
- UDP
- TCP
- Other Transport Layer Protocols
- Transport Layer Attacks
Application Layer
- Application Layer Protocols
  - Directory Services - BIND, LDAP, etc.
  - Remote Access and File Transfer
  - Email
  - Web - HTTP
  - VoiP, Instant Messaging and Collaboration
- Application Layer Vulnerabilities and Attacks
Network Security Testing and Assurance

7. Identity and Access Management

Basic Concepts: Trust, Identity, Authentication and Access Control
Authentication Techniques
- Password Management
- Tokens, Badges, Smartcards and Other Devices
- Biometric Techniques
Authorization and Access Control
- Mandatory Access Control
  - Multi-Level Systems
  - Role-Based Access Control
  - Rule-Based Access Control
- Discretionary Access Control
- Capability-Based Systems
Federated Identity Management Systems
Identity Management Lifecycle

8. Security in the Software Development Life Cycle

Application Development Concepts
- Programming Languages
- Development Tools
- Object-Oriented Concepts and Security
- Third-Party Libraries and Frameworks
Vulnerabilities Introduced During Development
- Buffer Overflows
- Format String Vulnerabilities
- Input /Output Sanitization
- Citizen Programmers
- Covert Channels
- Time-of-Check/Time-of-Use Vulnerabilities
- Object Reuse
- Trapdoors and Backdoors
- Executable Content and Mobile Code
Software Development Methodologies
- Software Development Life Cycle
  - Security Activities in the SDLC
- Prototyping, Iterative and Agile Techniques
- Cleanroom and Formal Methods
- Continuous Delivery and DevOps
- Maturity Models
Databases and Data Warehouses
- Database Concepts
- Database Vulnerabilities and Controls
- Unstructured Data and Knowledge Management
Web Application Security
- Web Application Architectures and Languages
- Common Vulnerabilities
  - SQL and Command Injection
  - Cross-Site Scripting (XSS)
  - Cross-Site Request Forgery
  - Insecure Direct Object Access
  - Incorrect Session Management
  - Insecure Configuration
  - Inadequate Use of TLS
- Software Acquisition

9. Security Operations

Security Operations and Operations Security
- Segregation of Roles, Job Rotation
- Dealing with Privileged Accounts and Users
- Information Lifecycle
Threats and Vulnerabilities
- Malware
  - Viruses, Worms, Trojans, etc.
  - Rootkits
  - Remote-Access Trojans
  - Spyware and Adware
- Logic Bombs
- Social Engineering
- Phishing, Spear-Phishing, Pharming and Botnets
- Hoaxes and Pranks
Configuration and Change Management
Patch Management and Vulnerabilities
Security Metrics, Monitoring and Reporting
- Network Monitoring and Logging
- Systems Monitoring and Logging
Incident Response
- First Response
  - Containment
  - Investigation
  - Recovery
- Crime Investigation
  - Evidence Collection and Handling
  - Evidence Processing and Forensics
  - Presentation in Court
- Business Continuity and Disaster Recovery
  - Plan Development
    - Recovery Strategies
  - Plan Documentation
  - Training
  - Testing
- Physical Security
- Personnel Safety

10. Summary and Wrap-up

Course fees

Certified Information Systems Security Professional

Course + Exam

USD 2,374

When you attend this course you receive:

5 full days of course instruction with Tier-1 trainer
Comprehensive course workbook quality-printed in colour
Official (ISC)2 CISSP Study Guide
Official (ISC)2 CISSP Practice Tests
Proper sit-down lunch and morning and afternoon tea each day
CISSP exam

NOTE:
The CISSP exams are administered by Pearson Vue on behalf of (ISC)2. Once you register for the course we will send you details for the exam process.

CISSP Exam

The CISSP exam is conducted using the Computer Adaptive Testing (CAT) method
Exam duration is 3 hours
There are 100 - 150 questions using multiple choice and advanced innovative questions.
The pass mark is set at 70% (700 out of 1000 points)
The CISSP exams are administered by Pearson Vue on behalf of (ISC)2. You must register for the exam online. For Information on dates or how to enrol for an exam please contact Pearson Vue.
The exam cost is USD $699.00 (2018)

Prerequisites

The course assumes you have an at least reasonable level of varied IT experience Please note that to attain the CISSP certification you must have a minimum of 5 years of direct, full-time security professional work experience in 2 or more of the domains of the CISSP CBK. One year of work experience may be waived by (ISC)2 if you hold a four-year or higher college or university degree or approved credential. Candidates who do not meet these criteria may be given Associate status until conditions are met.

For full information please refer to the (ISC)2 web site pages dealing with Professional Experience Requirement and becoming an Associate of (ISC)2

CISSP® Course + Exam