COURSE NAME: Certified Information Systems Security Professional (CISSP) (4025)

Course length: 5 days

Overview:

The Certified Information Systems Security Professional (CISSP) certification, from the International Information Systems Security Certification Consortium ISC2 is considered by some to be the single most important step for many security professionals. The CISSP credential is earned by passing a CISSP examination composed of 250 multiple-choice questions. The exam questions are based on what ISC2 refers to as the common body of knowledge (CBK). With this metric, an accomplished and experienced security professional should have a foundation in all 10 areas of the CBK.

Prerequesite Courses:

• No Prerequisites listed for this course

Performance-based Objectives:

• No Objectives listed for this Course

Course content:

Chapter 1: Becoming a CISSP

• Why Become a  CISSP
• The CISSP Exam
• CISSP:  A brief history
• How do you become a CISSP
• Recertification Requirements
• What this book covers
• Tips for taking CISSP Exam

Chapter 2:  Security Trends

• How Security Became an issue
• Areas of Security
• Benign to Scary
• Hacking and Attacking
• Management
• Internet and Web Activities
• A Layered Approach
• An Architectural View
• Politics and Laws
• Education
• Summary

Chapter 3:  Information Security & Risk Management

• Security Management
• Security Administration & Supporting Controls
• Organizational Security Model
• Information Risk Management
• Risk Analysis
• Policies, Standards, Baselines, Guidelines & Procedures
• Information Classfication
• Layers of Responsibility
• Security-Awareness Training

Chapter 4:  Access Control

• Access Controls Overview
• Security Principles
• Identification, Authentication, Authorization and Accountability
• Access Control Models
• Access Control Techniques and Technologies
• Access Control Administration
• Access Control  Methods
• Access Control Types
• Accountability
• Access Control Practices
• Access Control Monitoring
• A Few Threats to Access Control

Chapter 5:  Security Architecture and Design

• Computer Architecture
• System Architecture
• Security Models
• Security Modes of Operation
• Systems Evaluation Methods
• The Orange Book and the Rainbow Series
• Information Technology Security Evaluation Criteria
• Common Criteria
• Certification vs Accreditation
• Open vs Closed Systems
• Enterprise Architecture
• A  Few Threats to Review

Chapter 6:  Physical and Environmental Security

• Introduction to Physical Security
• The Planning Process
• Protecting Assets
• Internal Support Systems
• Perimeter Security

Chapter 7:  Telecommunications and Network Security

• Open Systems Interconnection Reference Model
• TCP/IP
• Types of Transmission
• LAN Networking
• Routing Protocols
• Networking Devices
• Networking Services and Protocols
• Internet and Extranets
• Metropolitan Area Networks
• Wide Area Networks
• Remote Access
• Wireless Technologies
• Rootkits

Chapter 8:  Cryptography

• The History of Cryptography
• Cryptography Definitions and Concepts
• Government Involvement in Cryptography
• Types of Ciphers
• Methods of Encryption
• Types of Symmetric Systems
• Types of Asymmetric Systems
• Message Integrity
• Public Key Infrastructure
• Key Management
• Link Encryption vs End-to-End Ecryption
• E-mail Standards
• Internet Security
• Attacks

Chapter 9:  Business Continuity and Disaster Recovery

• Business Continuity and Disaster  Recovery
• Business Continuity Planning Requirements

Chapter 10:  Legal, Regulations, Compliance and Investigations

• The Many Facets of Cyberlaw
• The Crux of Computer Crime Laws
• Complexities in Cybercrime
• Intellectual Property  Laws
• Privacy
• Liability and Its Ramifications
• Investigations
• Computer Forensics and Proper Collection of Evidence
• Ethics

Chapter 11:  Application Security

• Software’s Importance
• Where Do we Place the Security?
• Different Environments Demand Different Security
• Environment vs Application
• Complexity of Functionality
• Data Types, Format, and Length
• Implementation and Default Issues
• Failure States
• Database Management
• System Development
• Application Development Methodology
• Distributed Computing
• Expert Systems and Knowledge-based Systems
• Artificial Neural Networks
• Web Security
• Mobile Code
• Patch management

Chapter 12:  Operations Security

• The Role of the Operations Department
• Administrative Management
• Assurance Levels
• Operational Responsibilities
• Configuration Management
• Media Controls
• Data Leakage
• Network and Resource Availability
• Mainframes
• E-mail Security
• Vulnerability Testing