Category: Infosec

The Certified Information Systems Security Professional designation is the "gold standard" in professional security certifications. It confirms that the holder has several years' experience in one or more security-related domains and has passed a rigorous six-hour examination.

Who Should Attend?
This course is specifically designed to assist candidates for the CISSP exam to review their knowledge. The candidate should already have several years' experience in one or more of the domains listed below, and should have commenced study in the other domains.. Each domain of the Common Body of Knowledge is reviewed and candidates are able to test their understanding against a set of questions similar to those in the CISSP examination.

What You Will Learn
In addition to the core course content, attendees will learn useful exam technique and study review techniques. In addition, you will have the opportunity to discuss issues with other security professionals.
Your learning continues after the course - the course is backed by an e-learning server which provides discussion forums, wikis, access to updated course notes and other resources.

Course Outline

Reference Books
Specialised References
Review Techniques
Exam Technique
Online Resources

Unit 1 - Information Security and Risk Management Domain
Security management entails the identification of an organisation's information assets and the development, documentation, and implementation of policies, standards, procedures, and guidelines. Management tools such as data classification and riskĀ  assessment/analysis are used to identify threats, classify assets, and to rate system vulnerabilities so that effective controls can be implemented. This session covers:
Basic Concepts - The CIA Triad
Administrative, Technical and Physical Controls
Roles & Responsibilities
Change Control & Change Management
Information Asset Management
Security Architecture
Risk Management Principles, Tools, Methodologies and Standards
Policies, Standards, Guidelines & Procedures
Data Classification
Employment Policies and Practices
Security Awareness Training
Security Management Planning
Information Security Management Systems

Unit 2 - Security Architecture and Design Domain
The Security Architecture and Design domain contains the concepts, principles, structures, and standards used to design, monitor, and
secure operating systems, equipment, networks, applications and those controls used to enforce various levels of availability, integrity, and confidentiality. The session covers:
Platform Architectures
Computer & Network Architectures
Layered Models
Operating System Principles
Threats to Shared Environments
Trusted Systems
Reference Monitors & Kernels, TCB
Operating Modes
Security Models
State Machine Models
Biba Model
Bell-LaPadula Model
Clark-Wilson Model
Other Protection Technologies
Comparison of Security Models
Certification & Accreditation
TCSEC, ITSEC, Common Criteria

Unit 3 - Application Security Domain
This domain addresses the important security concepts that apply to application software development. It outlines the environment where software is designed and developed and explains the critical role software plays in providing information. This session covers:
Introduction; Changes in the Environment
Threat Agents: Hackers, crackers, phreaks and virus authors
Mobile Code: Agents, applets, ActiveX, Java
Buffer Overflows, Stack Smashing, etc.
Malicious Code & Logic: Viruses, Trojans, Worms & Logic Bombs
Attacks: Code alteration, flooding, salami, SQL injection, trapdoors, DoS, etc.
Databases, Data Warehousing & Knowledge-based Systems
System Development Life Cycle
SDLC Phases
Iterative Development Models
Programming Languages and Translators
Object Oriented Design and Programming
Mobile Code
Security Features of Languages
Safeguards, Mitigation and Controls

Unit 4 - Operations Security Domain
Operations Security is used to identify the controls over hardware, media, and the operators and administrators with access privileges to any of these resources. Audit and monitoring are the mechanisms, tools, and facilities that permit the identification of security events and subsequent actions to identify the key elements and report the pertinent information to the appropriate individual, group, or process. This session covers:
Goals of Operations Security
Resources: Hardware, Software, Network, Media
Administrative Management
Principles of Privilege. Least Privilege, Rotation of Duties & Separation of Duties
Due Care & Due Diligence
Privacy and Protection
Sensitive Information and Media
Operations Controls
Operational Controls for Trusted Systems
Network & Telecomms Controls
Media Controls
Personnel Controls
Infrastructure Controls
Configuration Management and Contingency Management
Concepts and Considerations
Audit Trails & Reporting
Violation Analysis
Tools & Techniques
Intrusion Detection
Use of IDS
Types of IDS
Intrusion Prevention Systems
Penetration Testing
Inappropriate Activities
Threats & Countermeasures
Violations, Breaches and Reporting

Unit 5 - Physical and Environment Security Domain
The physical security domain provides protection techniques for the entire facility, from the outside perimeter to the inside office space, including all of the information system resources.
Terminology & Definitions
Changes in the Environment
Characterization of Systems
Physical Threats
Site Selection, Facility Design and Configuration
Water & Plumbing
Power and HVAC
Boundary Protection & Lighting, Fences and Gates
Building Materials
Locks, Keys and Key Control Systems
Fire Prevention, Protection & Detection
Fire Suppression
Computing Facility Requirements
Securing Storage Areas
Portable Device Security
Media Protection & Disposal
Personnel Access Controls
Cards & Badges
Physical Security in Distributed Processing
Office Area Physical Security Controls

Unit 6 - Cryptography Domain
The cryptography domain addresses the principles, means, and methods of disguising information to ensure its integrity, confidentiality and authenticity:
Basic Concepts and Definitions
Goals of Cryptography
Stream vs Block Ciphers
Hash Functions
Message Digests & Message Authentication Codes
Symmetric Ciphers
Public-Key Ciphers
Digital Signatures
Hybrid Cryptosystems
Applications of Cryptography
Digital Certificates and PKI
Email Security
Methods of Attack
Import/Export Regulations

Unit 7 - Access Control Domain
Access controls are mechanisms that work together to create a security architecture to protect the assets of the information system.
Information Protection Requirements, Basic Concepts and Threats
Security Technologies and Tools, Types of Controls
Identification and Authentication Techniques
Passwords, One-Time Passwords, Tokens, SmartCards, Biometrics
Access Control Techniques
Centralised vs Remote Authentication Access Controls, RADIUS, TACACS, etc.
802.1x Port-based Authentication
Decentralised Access Control, Single Signon, Kerberos, SESAME
Discretionary vs Mandatory Access Controls
Rule-Based Access Control, Role-Based Access Control, Lattice-Based Access Control, Access Control Lists, Capabilities
Data Ownership and Custodianship
Types of Attacks
Intrusion Detection and Auditing
Management Activities

Unit 8 - Business Continuity & Disaster Recovery Planning Domain
The Business Continuity & Disaster Recovery Planning (BCP/DRP) domain addresses the preservation and recovery of business operations in the event of outages.
Key Terms & References
Definitionsof BCP & DRP
Other Incident Response Plans
BCP Responsibilities
BCP Process
Critical Function Identification
Supporting Resources
Business Impact Analysis
Plan Development
Plan Content
Off-site Storage
Alternative Sites
Backup Processing
Other Elements
Recovery Organisation & Team Structure
Other Items
Testing and Plan Maintenance
Considerations for Testing
Types of Testing
Stages in an Incident
Disaster Recovery Time Line
Software Escrow

Unit 9 - Regulations & Compliance Domain
This domain addresses:
The Legal and Ethical Environment
Types & Categories of Computer Crime Laws
Corporate Governance and Audit Requirements
Privacy Requirements
Intellectual Property: Trade Secrets, Patents, Copyright, Trademarks
Records Retention
Industrial Relations
Legal Liability
Privacy & Other Personal Rights
Computer Crime
Legal Aspects of Cryptography
Computer Crime Investigation
Incident Response
Investigation Process
Computer Forensics
Rules of Evidence & Legal Proceedings
Computer Ethics
The Ten Commandments
Ethics & The Internet
(ISC)2 Code of Ethics

Unit 10 - Telecommunications and Network Security Domain
The telecommunications, network, and Internet security domain discusses the: Network Structures, Transmission methods, Transport formats, Security measures used to provide availability, integrity, and confidentiality, and finally Authentication for transmissions over private and public communications networks.
Key Terminology
ISO/OSI Layers & Characteristics
TCP/IP Layers & Characteristics
Physical Media Characteristics and Devices
Physical Layer Attacks and Controls
Network Layer Principles
Addresses and Routing
Attacks and Controls
Transport Layer Principles
Attacks and Controls: Port Scanning, IDS
Application Layer Protocols
Types of Protection
Firewalls & IPS
Virtual Private Networks
Honeypots and Honeynets
Network Security Assessment
Penetration Testing