Course Outline
Security and Risk Management
- Core principles of confidentiality, integrity, and availability (CIA)
- Governance frameworks, security policies, and standards (ISO 27001, NIST CSF)
- Conducting risk analysis, evaluation, and mitigation strategies
- Business impact assessments, security awareness programs, and staff training
- Navigating legal frameworks, regulations, compliance, and privacy concerns (GDPR, HIPAA, local legislation)
Asset Security
- Classifying, owning, and safeguarding information assets
- Managing data lifecycle stages (retention, purging, backup, and transmission)
- Ensuring privacy protection and effective data lifecycle governance
- Securing asset usage and implementing media control measures
Security Engineering
- Principles of secure system and architectural design
- Cryptographic applications: symmetric/asymmetric encryption, hashing, PKI, and key management
- Integrating physical security considerations and Hardware Security Modules (HSMs)
- Implementing secure virtualization, cloud-native security patterns, and secure API utilization
Communications and Network Security
- Network models, protocols, and secure communication standards (TLS, VPN, IPSec)
- Establishing perimeter defenses, segmentation, firewalls, and IDS/IPS systems
- Securing wireless environments, remote access, and zero-trust network architectures
- Designing secure network topologies for cloud and hybrid environments
Identity and Access Management (IAM)
- Regulating access through identification, authentication, authorization, and accountability
- Implementing identity providers, federation, SSO, and cloud access federation
- Managing privileged access (PAM) and role-based access control (RBAC)
- Overseeing the identity lifecycle: provisioning, deprovisioning, and entitlement reviews
Security Assessment and Testing
- Evaluating security controls via SAST, DAST, penetration testing, and vulnerability scanning
- Developing audit strategies and leveraging review frameworks
- Managing logs, continuous monitoring, and ongoing assessments
- Applying red teaming, blue teaming, and adversary simulation methodologies
Security Operations
- Planning, executing, and conducting forensics for incident response
- Designing SOC operations, monitoring capabilities, and threat intelligence integration
- Managing patching, vulnerability remediation, and configuration consistency
- Establishing business continuity, disaster recovery, and resilience strategies
Software Development Security
- Embedding security into the Software Development Lifecycle (SDLC) and DevSecOps practices
- Addressing common vulnerabilities (extending beyond OWASP Top 10) and implementing mitigation patterns
- Performing code reviews, static/dynamic analysis, and adopting secure frameworks
- Mitigating supply chain risks, managing dependencies, and ensuring runtime protection
Exam Strategy, Practice, and Conclusion
- Understanding CISSP exam structure, question tactics, and time management techniques
- Engaging with practice exams and domain-specific assessments
- Conducting gap analyses and creating personalized study plans
- Exploring recommended resources, professional communities, and continuous learning trajectories
Summary and Future Directions
Requirements
- A minimum of five years of cumulative, paid professional experience in two or more (ISC)² CISSP domains, or equivalent practical expertise
- Core understanding of information security principles, network infrastructure, and software systems
- Working knowledge of risk management, cryptographic concepts, and IT operational procedures
Intended Audience
- Information security specialists undergoing CISSP exam preparation
- Security architects, managers, and consulting professionals
- IT leadership, auditors, and governance specialists
Testimonials (7)
Being approachable and pushing us into interaction
Daniel - EY GLOBAL SERVICES (POLAND) SP Z O O
Course - CISSP - Certified Information Systems Security Professional
the topic was interesting itself and we had opportunity to discuss it with different perspectives.
Marcin - EY GLOBAL SERVICES (POLAND) SP Z O O
Course - CISSP - Certified Information Systems Security Professional
trainer competence
Evghenii - Arctic Stream
Course - CISSP - Certified Information Systems Security Professional
Good material organization and understandable instructor's English.
Ion Temciuc - Arctic Stream
Course - CISSP - Certified Information Systems Security Professional
Good material organization and understandable instructor's English.
Hanny - Arctic Stream
Course - CISSP - Certified Information Systems Security Professional
His knowledge, the way he explains and his kindness
Marcelo Martinez - EY GLOBAL SERVICES (POLAND) SP Z O O
Course - CISSP - Certified Information Systems Security Professional
I liked mix of theory and practical case example. Very good overview of each topic then going through slides.
