CISSP Training - United States

CISSP-ISSAP Training & Certification Course Outline

Domain 1: Architect for Governance, Compliance and Risk Management

• Determine Legal, Regulatory, Organisational and Industry Requirements
• Manage Risk

Domain 2: Security Architecture Modelling

• Identify Security Architecture Approach
• Verify and Validate Design

Domain 3: Infrastructure Security Architecture

• Develop Infrastructure Security Requirements
• Design Defence-in-depth Architecture
• Secure Shared Services
• Integrate Technical Security Controls
• Design and Integrate Infrastructure Monitoring
• Design infrastructure Cryptographic Solutions
• Design Secure Network and Communication Infrastructure
• Evaluate Physical and Environmental Security Requirements

Domain 4: Identity and Access Management (IAM) Architecture

• Design Identity Management and Lifecycle
• Design Access Control Management and Lifecycle
• Design Identity and Access Solutions

Domain 5: Architect for Application Security

• Integrate Software Development Life Cycle (SDLC) with Application Security Architecture
• Determine Application Security Capability Requirements and Strategy
• Identify Common Proactive Controls for Applications

Domain 6: Security Operations Architecture

• Gather Security Operations Requirements
• Design Information Security Monitoring
• Design Business Continuity (BC) and Resiliency Solutions
• Validate Business Continuity Plan (BCP)/Disaster Recovery Plan (DRP) Architecture
• Design Incident Response (IR) management

This teaching will be supported by discussion sessions and exercises to help you understand and master the material. There will also be final exam preparation and the chance to try practice questions.

Chief Information Security Officer Training Course Outline

Domain 1: Governance and Risk Management 

Module 1: Governance

• Introduction to Governance
• Information Security Governance

Module 2: Information Security Management Structure

• Introduction
• Sizing
• Management Structure

Module 3: Principles of Information Security

• Principles of Information Security
• CIA Traid
• Security Vulnerabilities, Threats, Risks, and Exposures
• Cyberattack Elements
• Defence-in-depth

Module 4: Risk Management

• Risk Management Programme
• Approach
• Process
• Method
• Best Practice Frameworks for Risk Management

Module 5: Management and Technical Information Security Elements

• Management and Technical Information Security Elements
• Security Programme Plan
• Security Policies, Standards, and Guidelines
• Asset Security
• Identity and Access Management
• Security Engineering
• Security Operations
• Software Development Security
• Security Assessments and Testing
• Security Training and Awareness
• Business Continuity and Disaster Recovery

Module 6: Compliance

• Compliance
• Compliance Team
• Compliance Management

Module 7: Privacy

• Privacy
• Privacy Impact Assessment
• Privacy and Security

Module 8: Laws and Regulatory Drivers

• Laws and Regulatory Drivers

• Federal Information Security Modernisation Act
• Defence Federal Acquisition Regulation Supplement 252.204-7012
• Who Does DFARS 252.204-7012 Apply to?
• How Does Compliance Impact an Organisation?
• Clinger-Cohen Act
• Payment Card Industry Data Security Standard
• Who Does PCI DSS Apply to?
• Privacy Act of 1974
• GRAMM-LEACH-BLILEY ACT
• Health Insurance Portability and Accountability Act
• Family Educational Rights and Privacy Act
• SARBANES-OXLEY ACT
• General Data Protection Regulation

Module 9: Standards and Frameworks

• ISO/IEC 27000 Series
• ISO/IEC 27001
• NIST Cybersecurity Framework
• Federal Information Processing Standards
• Privacy Shield
• COBIT

Module 10: Information Security Trends and Best Practices

• Information Security Trends and Best Practices

• Open Web Application Security Project
• Cloud Security Alliance
• Centre for Internet Security

Module 11: Information Security Training and Certifications

• International Information System Security Certification Consortium
• ISACA
• International Council of E-Commerce Consultants
• Sans Institute
• Computing Technology Industry Association
• International Association of Privacy Professionals
• Offensive Security

Module 12: Ethics

• Introduction to Ethics

Domain 2: Information Security Controls, Compliance, and Audit Management

Module 13: Information Security Controls

• Control Fundamentals
• Control Frameworks

Module 14: Information Security Control Life Cycle

• Information Security Control Life Cycle
• Risk Assessment
• Design
• Implementation
• Assessment
• Monitoring

Module 15: Information Security Control Life Cycle Frameworks

• NIST SP
• NIST Risk Management Framework
• NIST Cybersecurity Framework
• ISO/IEC 27000

Module 16: Information Security Control Frameworks

• Components of Exploring Information Security Control Frameworks
• NIST SP 800-53
• NIST Cybersecurity Framework
• ISO/IEC 27002
• CIS Critical Security Controls
• CSA Cloud Controls Matrix

Module 17: Auditing for the CISO

• Auditing for the CISO
• Audit Management
• Audit Process
• Control Self-assessments
• Continuous Auditing
• Specific Types of Audits and Assessments

Domain 3: Security Programme Management and Operations

Module 18: Security Programme Management

• Security Areas of Focus
• Security Streams of Work
• Security Projects

Module 19: Security Programme Budgets, Finance, and Cost Control

• Establishing the Budget
• Managing and Monitoring Spending
• Security Programme Resource Management: Building the Security Team

Module 20: Project Management

• Project Management Fundamentals
• Phases of Project Management
• Initiating
• Planning
• Executing
• Monitoring and Controlling
• Closing

Domain 4: Information Security Core Competencies

Module 21: Malicious Software and Attacks

• Malware
• Scripting and Vulnerability-Specific Attacks

Module 22: Social Engineering

• Types of Social Engineering Attacks
• Why Employees are Susceptible to Social Engineering?
• Social Engineering Defences

Module 23: Asset Security

• Asset Inventory and Configuration
• Secure Configuration Baselines
• Vulnerability Management
• Asset Security Techniques

Module 24: Data Security

• Data at Rest
• Data in Transit
• Data in Use
• Data Life Cycle

Module 25: Identity and Access Management

• Identity and Access Management Fundamentals
• Identity Management Technologies
• Authentication Factors and Mechanisms
• Access Control Principles
• Access Control Models
• Access Control Administration
• Identity and Access Management Life Cycle

Module 26: Communication and Network Security

• WANs and LANs
• IP Addressing
• Network Address Translation
• Network Protocols and Communications
• Wireless
• Network Technologies and Defences

Module 27: Cryptography

• Cryptography
• Cryptographic Definitions
• Cryptographic Services
• Symmetric, Asymmetric, And Hybrid Cryptosystems
• Hash Algorithms
• Message Authentication Codes
• Digital Signatures
• Public Key Infrastructure

Module 28: Cloud Security

• Cloud Security
• Cloud Computing Characteristics
• Cloud Deployment Models
• Cloud Service Models
• Cloud Security Risks and Assurance Levels
• Cloud Security Resources

Module 29: Physical Security

• Making Security Decisions
• Physical Security Threats
• Physical Security Programme Planning
• Physical Security Resources
• Physical Security Controls
• Physical Security Auditing and Measurement

Module 30: Personnel Security

• Personnel Security
• Software Development Security
• Integrating Security into the SDLC
• Security SDLC Roles and Responsibilities
• Software Vulnerabilities
• Secure Coding Practices
• Software Vulnerability Analysis and Assessments

Module 31: Forensics, Incident Handling, and Investigations

• Relevant Law
• Logging and Monitoring
• Incident Response and Investigations
• Forensics and Digital Evidence

Module 32: Security Assessment and Testings

• Introduction to Security Assessment and Testings
• Vulnerability Assessments
• Penetration Testing
• Security Programme Assessments

Module 33: Business Continuity and Disaster Recovery

• Introduction to Business Continuity and Disaster Recovery
• Continuity Planning Initiation
• Business Impact Analysis
• Identify Preventive Controls
• Develop Recovery Strategies and Solutions
• Develop the Plan
• Test the Plan
• Maintain the Plan

Domain 5: Strategic Planning, Finance, Procurement, and Vendor Management

Module 34: Strategic Planning 

• Introduction to Strategic Planning
• Organisational Strategic Planning
• Organisational Strategic Planning Teams
• Strategic Planning Process
• Security Strategic Plan

Module 35: Making Security Decisions

• Introduction to Making Security Decisions
• Enterprise Architecture

Module 36: Financial Management

• Financial Management
• Accounting and Finance Basics
• Information Security Annual Budget

Module 37: Procurement and Vendor Management

• Overview of Procurement and Vendor Management
• Procurement Core Principles and Processes
• Types of Contracts
• Scope Agreements
• Third-party Vendor Risk Management

Information Systems Security Management Training Course Outline

Module 1: Information Systems

• Introduction to Information Systems
• Components
• Types
• Acquiring Information Systems and Services
• Managing Information Systems
• Information Systems Security and Control
• Impacts of Information Security Systems

Module 2: Information Security

• What is Information Security?
• Need
• Information Security Triad
• Threats
• Active and Passive Attacks
• Password Security
• Virtual Private Networks
• Personal Information Security

Module 3: Information Security Types

• Application Security
• Infrastructure Security
• Cloud Security
• Cryptography
• Incident Response
• Vulnerability Management
• Disaster Recovery

Module 4: Major Challenges to Information Systems Security

• Networked Systems
• Asymmetry Between Defence and Offense
• Ease-Of-Use Compromises
• Perimeter Defence
• Use of Cots Components
• Threats Posed by Insiders
• Passive Defence

Module 5: Common Information Security Risks

• Social Engineering Attacks
• Advanced Persistent Threats (APT)
• Insider Threats
• Cryptojacking
• Distributed Denial of Service (DDoS)
• Ransomware
• Man-in-the-Middle (MitM) Attacks

Module 6: Information Security Technologies

• Firewalls
• Security Incident and Event Management (SIEM)
• Data Loss Prevention (DLP)
• Intrusion Detection System (IPS)
• User Behavioural Analytics (UBA)
• Blockchain Cybersecurity
• Endpoint Detection and Response (EDR)
• Cloud Security Posture Management (CSPM)