Course Introduction
The CISSP (Course Information Systems Security Professional) certification, governed by (ISC)², is recognized globally as a benchmark in information security. This intensive course prepares participants to master the eight domains of the CISSP Common Body of Knowledge (CBK), covering both theoretical concepts and practical applications in cybersecurity.
By the end of the course, participants will have the knowledge and confidence to manage, design,
General Learning Objectives
By the end of the course, participants will be able to:
- Understand the structure, requirements, and scope of the CISSP certification.
- Apply security principles and governance best practices.
- Design secure architectures and manage information assets effectively.
- Implement robust network, identity, and access control measures.
- Conduct security assessments and manage operational security.
- Integrate security into the software development lifecycle.
- Prepare effectively for the CISSP certification exam.
Course Outline :
Day 1 – Security and Risk Management
- Security concepts: CIA triad, authenticity, non-repudiation
- Governance, compliance, and legal issues (privacy laws, regulations)
- Professional ethics: (ISC)² Code of Ethics, IAB ethics
- Risk management frameworks (ISO 31000, NIST)
- Business continuity and disaster recovery fundamentals
- Activities:
- Case study: Developing a corporate security policy
- Risk assessment workshop
Day 2 – Asset Security & Security Architecture and Engineering
- Asset Security: Information classification, data handling, media sanitization, privacy protection
- Security Architecture: Secure design principles (least privilege, defense-in-depth)
- Security models: Bell-LaPadula, Biba, Clark-Wilson
- Cryptography basics: symmetric/asymmetric, PKI, key management
- Physical security and environmental controls
- Activities:
- Data classification exercise
- Cryptography application lab
Day 3 – Communication & Network Security; Identity and Access Management (IAM)
- Network architecture: OSI/TCP models, segmentation, defense layers
- Network components: firewalls, IDS/IPS, VPNs, secure protocols
- Secure communications: wireless, VoIP, remote access security
- IAM: Identity lifecycle, authentication factors, SSO, federation
- Access control models: discretionary, mandatory, role-based
- Activities:
- Designing a secure enterprise network
- Configuring an IAM policy scenario
Day 4 – Security Assessment & Testing; Security Operations
-
- Assessment & Testing: Penetration testing, vulnerability scanning, audits
- Security metrics and reporting
- Security Operations: Monitoring, incident response, evidence handling
- Disaster recovery and business continuity planning
- Managing investigations and digital forensics
- Activities:
- Vulnerability scanning workshop
- Incident response tabletop exercise
Day 5 – Software Development Security & Exam Preparation
- Secure software development lifecycle (SDLC)
- Common vulnerabilities (OWASP Top 10)
- Application security testing methods
- Change management and version control security
- Review of all CISSP domains
- Exam strategy and question analysis techniques
- Activities:
- Secure coding workshop
- Full-length CISSP practice test and debrief