CISSP — Certified Information Systems Security Professional

CISSP — Certified Information Systems Security Professional — is (ISC)²'s flagship credential and the most-requested senior cybersecurity certification in the world. It is ANSI/ISO/IEC 17024 accredited, recognized under DoD 8570/8140 at IAT Level III, IAM Level II, and IASAE I & II, and typically commands the highest salary premium of any single security cert. To become certified you must (1) pass the exam, (2) have 5 years of paid, full-time work experience in 2 or more of the 8 CBK domains (a 4-year degree or approved credential waives 1 year, so 4 years total), (3) get endorsed by an existing (ISC)² member within 9 months of passing, and (4) subscribe to the (ISC)² Code of Ethics. Candidates who pass the exam but lack the experience become an 'Associate of (ISC)²' with up to 6 years to earn it.

The current exam blueprint (effective April 15, 2024) is a Computerized Adaptive Test (CAT) in English: 100–150 items, 3 hours, and the algorithm ends the exam as soon as it is 95% confident of pass or fail. Non-English versions are linear: 250 items, 6 hours. Item formats include multiple-choice and advanced innovative items (drag-and-drop, hotspot). Passing is a scaled 700/1000 — but because it is adaptive you never see a percentage. Domain weights: (1) Security & Risk Management — 16%, (2) Asset Security — 10%, (3) Security Architecture & Engineering — 13%, (4) Communication & Network Security — 13%, (5) Identity & Access Management — 13%, (6) Security Assessment & Testing — 12%, (7) Security Operations — 13%, (8) Software Development Security — 10%.

Register at pearsonvue.com/isc2 after creating an (ISC)² account. The current exam fee is US $749. Bring two forms of valid, unexpired photo ID. Certification is valid for 3 years and is maintained by (a) earning 120 Continuing Professional Education (CPE) credits over the 3-year cycle (with a minimum of 40 in year 1), (b) paying the US $135 Annual Maintenance Fee (AMF), and (c) adhering to the Code of Ethics. Think Like a Manager: CISSP is a management-level exam. When two answers seem technically correct, choose the one that reflects the risk-based, policy-first, business-aligned decision — not the most technical hands-on fix. This mindset is the single biggest driver of pass/fail.

Domain 1 is the largest single domain (16%) and sets the tone for the whole exam. Master the CIA triad (Confidentiality, Integrity, Availability), AAA (Authentication, Authorization, Accounting), and the extended DAD triad of failures (Disclosure, Alteration, Destruction). Security governance flows top-down: policy (mandatory, board-approved), standards (specific technologies/versions), baselines (minimum configuration), guidelines (recommended), procedures (step-by-step). Roles: Senior Manager (accountable — signs the policy), Security Professional (advises and implements), Data Owner (classifies), Data Custodian (protects and maintains), User (follows AUP), Auditor (independent review). Due care is doing what a reasonable person would do; due diligence is the investigation that supports it. Together they form the 'prudent person rule.'

Legal and regulatory: know GDPR (EU — lawful basis, DPO, 72-hour breach notification, up to 4% global revenue in fines), HIPAA (US healthcare PHI), PCI DSS (payment cards — industry, not law), SOX (financial reporting, Sec. 302/404), GLBA (financial), FERPA (education), CFAA (US anti-hacking law), ECPA/Stored Communications Act, and the Computer Security Act. IP protection: patents (20 yr, novel/useful/non-obvious), copyrights (life + 70 for individuals; 95/120 for works-for-hire — automatic on creation), trademarks (branding, ™/®), trade secrets (protected as long as kept secret — Coca-Cola formula). The (ISC)² Code of Ethics — Protect society, Act honorably, Provide diligent service, Advance the profession — is testable in the exact preamble order.

Risk management is the heart of CISSP thinking. Quantitative: Asset Value (AV) × Exposure Factor (EF) = SLE; SLE × Annualized Rate of Occurrence (ARO) = ALE. Qualitative uses high/medium/low. Risk responses: Avoid (stop the activity), Transfer (insurance, contract), Mitigate (add controls), Accept (document and monitor); some frameworks add Reject (unwise — do not choose this on the exam). Total risk = threats × vulnerabilities × asset value; residual risk = total risk − controls gap. Threat modeling frameworks: STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege), PASTA (7-stage process), DREAD (scoring), and Attack Trees. Business Continuity Plan (BCP) starts with a Business Impact Analysis (BIA) that establishes MTD (Maximum Tolerable Downtime), RTO, RPO, and RSL (Recovery Service Level). Personnel security includes background checks, NDA at hire, separation-of-duties, mandatory vacation, job rotation, least privilege, and off-boarding procedures — often the correct answer to 'what should be done FIRST when hiring/firing.'

Every asset has a data owner (business, accountable for classification), a data custodian (IT, technical stewardship — backups, encryption, patching), a data steward (quality, definitions), a data processor (acts on behalf of the controller), and a data subject (the individual). Classification schemes: US government uses Top Secret / Secret / Confidential / Unclassified; commercial uses Confidential / Private / Sensitive / Public. Classification drives control selection — higher sensitivity = stronger controls. Labeling (physical/electronic marks) enforces the classification through the lifecycle. Handling requirements per class cover storage, transmission, printing, backup, and destruction.

The data lifecycle: Create → Store → Use → Share → Archive → Destroy. Data states: at rest (encrypt with AES-256, TDE), in transit (TLS 1.3 / IPsec), and in use (confidential computing enclaves such as Intel SGX). Data Loss Prevention (DLP) monitors these states — network DLP inspects egress, endpoint DLP watches USB/print/upload, storage DLP scans repositories. Retention: keep data only as long as required by law, contract, or business need; over-retention increases breach and eDiscovery costs. NIST SP 800-88 defines media sanitization: Clear (overwrite for reuse in same environment), Purge (cryptographic erase, degauss for magnetic, ATA Secure Erase for SSD), Destroy (shred, incinerate, pulverize). Degaussing does NOT work on SSDs — that's a favorite exam trap.

Privacy is data protection with a focus on the individual. Know GDPR concepts: data controller vs processor, lawful basis (consent, contract, legal obligation, vital interests, public task, legitimate interests), Data Protection Impact Assessment (DPIA), Data Protection Officer (DPO), Privacy by Design and by Default. In the US: HIPAA (PHI), GLBA (financial), CCPA/CPRA (California), COPPA (children under 13). Cross-border transfer mechanisms: Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), and the EU-US Data Privacy Framework. Anonymization is irreversible; pseudonymization replaces identifiers with tokens that CAN be re-linked with a separate key — pseudonymized data is STILL personal data under GDPR.

Security models are highly testable. Bell-LaPadula (confidentiality — no read up, no write down); Biba (integrity — no read down, no write up); Clark-Wilson (integrity via well-formed transactions and separation of duties); Brewer-Nash / Chinese Wall (conflict-of-interest, dynamic access based on prior actions); Take-Grant (rights transfer graph); Graham-Denning (create/delete subjects/objects, transfer rights); Harrison-Ruzzo-Ullman (extends Graham-Denning with commands). Reference monitor + security kernel + TCB implement mandatory access control at the OS level. Common Criteria evaluates products against Protection Profiles at EAL1–EAL7 (higher = more rigorous evaluation, NOT necessarily more secure).

Cryptography deep dive: symmetric — AES (128/192/256, blocks of 128 bits; modes: ECB=weak, CBC needs IV, CTR/GCM for authenticated encryption), 3DES (deprecated), ChaCha20; asymmetric — RSA (factoring), ECC (discrete log — smaller keys, same strength), Diffie-Hellman (key exchange, use ECDHE for forward secrecy), ElGamal, DSA/ECDSA. Hashing — SHA-256/SHA-3 (secure), MD5/SHA-1 (broken, do not use). HMAC provides integrity + authenticity. PKI: X.509 v3 certificates, CRL vs OCSP vs OCSP stapling. Cryptographic attacks: brute force, birthday, meet-in-the-middle (why 2DES is not stronger than DES), known-plaintext/chosen-plaintext/chosen-ciphertext, side-channel (timing, power, cache), replay, rainbow tables (defeat with salting). TPM stores keys in hardware and enables measured/secure boot; HSM is a network/PCIe device for high-volume key operations.

Site & physical: CPTED (Crime Prevention Through Environmental Design) — natural surveillance, natural access control, territorial reinforcement. Fire suppression: Class A (wood/paper — water), B (flammable liquids — CO2/foam), C (electrical — CO2/clean agent), D (metals — dry powder), K (kitchen). Modern data centers use clean-agent systems like FM-200/NOVEC 1230 rather than Halon (banned since 1994). Data-center HVAC: hot-aisle/cold-aisle, positive pressure, humidity 40–60%. Cloud: shared responsibility model (customer's share is largest in IaaS, smallest in SaaS). IoT and ICS/SCADA/OT prioritize availability over confidentiality — the security model INVERTS. Levels: Purdue Model 0–5; segmentation with data diodes for critical zones.

OSI 7 layers — Please Do Not Throw Sausage Pizza Away (Physical, Data Link, Network, Transport, Session, Presentation, Application). TCP/IP has 4 (Link, Internet, Transport, Application). Map devices to layers: hub/repeater=L1, switch/bridge=L2, router/L3 switch=L3, firewall (stateful) L3-L4, WAF/proxy L7. Protocols: IPv4 (32-bit) vs IPv6 (128-bit, mandatory IPsec support), TCP (connection, reliable, 3-way handshake SYN → SYN-ACK → ACK), UDP (connectionless), ICMP (control, do not filter ALL of it — path MTU discovery breaks). Common ports: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 88 Kerberos, 110 POP3, 143 IMAP, 389 LDAP, 443 HTTPS, 445 SMB, 636 LDAPS, 3389 RDP.

Secure protocols: TLS 1.3 replaces SSL and TLS 1.0–1.2 (both deprecated). IPsec — AH (integrity only), ESP (integrity + confidentiality); modes: transport (endpoint-to-endpoint) and tunnel (gateway-to-gateway, adds new IP header). IKEv2 negotiates SAs. VPN types: site-to-site (IPsec), remote-access (SSL VPN or IPsec), always-on. Wireless: WEP (broken), WPA/WPA2 (WPA2-PSK vulnerable to KRACK, weak passphrase), WPA3 uses SAE (Simultaneous Authentication of Equals) — protects against offline dictionary attacks; enterprise WPA2/3 uses 802.1X with EAP-TLS (certificate-based, strongest), PEAP, EAP-TTLS. Rogue APs, evil twin, deauth attacks, and war-driving are classic wireless threats.

Firewalls: packet filter (stateless), stateful, application-proxy, next-generation (adds IPS + user identity + DPI), WAF (L7 for web apps), UTM (all-in-one). Network segmentation: VLANs, DMZ (screened subnet), microsegmentation via SDN/service mesh. Software Defined Networking separates control plane (SDN controller) from data plane (switches). SD-WAN aggregates transports and applies policy. Common attacks & defenses: ARP spoofing (dynamic ARP inspection), DHCP starvation (DHCP snooping), MAC flooding (port security), STP attacks (BPDU guard, root guard), DNS cache poisoning (DNSSEC), SYN flood (SYN cookies), amplification DDoS (rate-limit at ISP, use scrubbing). VoIP threats: SIP registration hijack, eavesdropping (mitigate with SRTP + ZRTP or TLS-SIP), toll fraud.

Authentication factors: Type 1 something you know (password, PIN), Type 2 something you have (token, smart card, phone), Type 3 something you are (biometric — fingerprint, iris, retina), plus context factors 'somewhere you are' (geolocation) and 'something you do' (behavior/gait). MFA requires factors from DIFFERENT categories — two passwords is NOT MFA. Biometric evaluation metrics: FAR (False Accept Rate — security risk), FRR (False Reject Rate — usability risk), CER/EER (Crossover / Equal Error Rate) where FAR = FRR — LOWER CER is better. Passwordless authentication (FIDO2 / WebAuthn) uses public-key cryptography stored on the device and is phishing-resistant.

Federation and SSO: Kerberos (KDC issues TGT then service tickets; symmetric; time-sensitive — clocks within 5 min) is the classic on-prem SSO. SAML 2.0 (XML assertions signed by IdP) is browser-based enterprise SSO. OAuth 2.0 is authorization delegation (access tokens); OIDC (OpenID Connect) sits on top of OAuth 2.0 to provide authentication (ID tokens). SPML/SCIM handle account provisioning across systems. Federation trust models: cross-certification (direct), bridge CA (hub-and-spoke), federated identity broker. On the exam, SAML for enterprise SSO, OAuth for delegated API access, OIDC when you need user identity from an OAuth flow.

Access control models: DAC (owner decides; NTFS, Unix), MAC (system-enforced labels; SELinux; military), RBAC (role-based — most common commercial), ABAC (attribute-based, XACML — highly flexible), Rule-BAC (firewall rules), Risk-based (adaptive). Least privilege, need-to-know, and separation of duties are foundational principles. IAM lifecycle: Provisioning (JML — Joiner/Mover/Leaver), Access Review (periodic recertification), De-provisioning (immediate at termination — often the correct 'FIRST' answer). Privileged Access Management (PAM) vaults break-glass credentials, records sessions, and rotates after each use. Account types to control tightly: default, service, shared, guest, and admin. Kerberos vulnerabilities include Kerberoasting, Golden Ticket (compromise of krbtgt), Silver Ticket (service account), and Pass-the-Hash — mitigated by long krbtgt rotation, tiered admin, protected users, and no re-use of privileged creds on workstations.

Assessments range from lightweight to intrusive. Vulnerability scanning: authenticated (credentialed, deeper) vs unauthenticated (attacker's view); Nessus, OpenVAS, Qualys, Rapid7. Penetration testing has phases: Planning & Rules of Engagement → Reconnaissance (passive OSINT then active scanning) → Vulnerability Analysis → Exploitation → Post-Exploitation → Reporting. Test types: black box (no info), gray box (partial), white/crystal box (full knowledge). Red team = offensive, Blue team = defensive, Purple team = collaboration, White team = referees. Bug-bounty programs and responsible disclosure complement internal testing. Get WRITTEN authorization signed by the appropriate senior manager before every engagement — an unauthorized pen test is a crime under CFAA.

Software testing: SAST (Static Application Security Testing — analyzes source code without running it, catches SQL injection patterns), DAST (Dynamic — tests the running app from outside), IAST (Interactive — instruments the running app), and SCA (Software Composition Analysis — third-party components and CVEs). Fuzzing throws malformed inputs to find crashes. Test approaches: unit → integration → system → user acceptance (UAT) → regression. Misuse case modeling explicitly designs for abuse. Code review can be peer review, formal (Fagan inspection), or automated. Synthetic monitoring (fake user transactions) and Real User Monitoring (RUM) verify availability and performance.

Log management and analysis: centralize via SIEM (Splunk, Sentinel, Elastic); protect log integrity with append-only storage and hashing; use NTP for accurate timestamps; retain per legal/regulatory requirements. Key metrics: MTTD (Mean Time to Detect), MTTR (Mean Time to Respond/Resolve), MTBF, and control effectiveness ratios. Third-party assurance reports: SOC 1 (financial), SOC 2 (Trust Services Criteria — Security, Availability, Confidentiality, Processing Integrity, Privacy), SOC 3 (public summary of SOC 2). Type I = point-in-time design; Type II = operating effectiveness over 6–12 months. ISO/IEC 27001 certification and PCI DSS ROC (Report on Compliance) are also common third-party assurance instruments. Continuous monitoring under NIST SP 800-137 shifts from annual audits to real-time posture management.

Investigations: administrative (internal HR — preponderance of evidence), civil (majority of evidence), criminal (beyond a reasonable doubt), and regulatory (compliance-specific). Evidence must be Accurate, Complete, Authentic, Convincing, and Admissible (the '5 rules'). Types: real, documentary, testimonial, demonstrative, direct, circumstantial. Best-evidence rule prefers originals; hearsay is generally inadmissible except business-records exception (logs kept in normal course). Order of volatility (RFC 3227): CPU registers/cache → RAM → temporary swap → routing tables/ARP/process list → disk → remote logs → physical media/archives. Chain of custody documents WHO handled WHAT WHEN WHERE and WHY, unbroken from collection to court.

Incident response follows NIST SP 800-61 Rev. 2: Preparation → Detection & Analysis → Containment/Eradication/Recovery → Post-Incident Activity. SANS uses a 6-step split (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) — same content. Containment strategies vary by severity: short-term (isolate), system backup (image), long-term (temporary patch). Eradication removes the root cause; recovery restores clean systems and monitors for re-infection. Reporting duties: notify law enforcement, regulators (GDPR = 72 hours), affected customers, and internal stakeholders per policy. Preserve evidence throughout — never wipe compromised systems before imaging.

Disaster Recovery: types of sites — hot (fully equipped + near-real-time data, lowest RTO, highest cost), warm (equipped, no live data), cold (empty facility, lowest cost, highest RTO), mobile, cloud/reciprocal agreement. Backup schemes: full, incremental (only changes since last incremental — fastest backup, slowest restore), differential (changes since last full — slower backup, faster restore than incremental). 3-2-1 rule: 3 copies on 2 media with 1 offsite; add IMMUTABLE for ransomware defense. DR tests in order of realism: checklist → tabletop/structured walk-through → simulation → parallel → full interruption (only when the plan is proven). Physical security controls: fences (3ft deters, 6ft difficult, 8ft+topping deters determined), CCTV, mantraps/access-control vestibules, bollards, biometric readers, guards + dogs (unpredictable defense in depth). Fire: detection (smoke/heat/flame) and suppression (Class A/B/C/D/K); clean agents (FM-200, NOVEC 1230) preferred in data centers — Halon banned since 1994.

SDLC models: Waterfall (sequential, heavy documentation, poor at change), Spiral (risk-driven, prototype loops), Agile/Scrum (sprints, backlog, retrospective), DevOps (Dev + Ops), and DevSecOps (security shifted LEFT into every stage — pipelines, IaC scanning, secrets management, container scanning). Maturity models: CMMI (5 levels — Initial → Managed → Defined → Quantitatively Managed → Optimizing), SAMM, and BSIMM. Security in the SDLC: gather security requirements early, threat model during design (STRIDE), SAST during coding, DAST/IAST in testing, dependency scanning (SCA) for CVEs in open-source libraries, and secure deployment via CI/CD with signed artifacts and SBOMs (Software Bill of Materials).

Databases: relational (ACID — Atomicity, Consistency, Isolation, Durability) vs NoSQL (BASE — Basically Available, Soft state, Eventual consistency). SQL security: parameterized queries beat string concatenation; use views + least privilege; encrypt PII at column level (TDE for whole DB). Aggregation and inference attacks combine authorized queries to derive unauthorized information — mitigate with polyinstantiation, cell suppression, and generalization. Data warehousing risks: ETL pipelines exposing raw data; use masking in non-prod. Backups need the same classification and controls as production data.

OWASP Top 10 (2021): A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection (including SQLi, LDAPi, OS command), A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable & Outdated Components, A07 Identification & Authentication Failures, A08 Software & Data Integrity Failures, A09 Security Logging & Monitoring Failures, A10 SSRF. API security adds broken authorization at object level (BOLA/BFLA) and mass assignment. Mobile security concerns: insecure data storage, weak jailbreak/root detection, insecure IPC, tapjacking. AI/ML risks: prompt injection, training-data poisoning, model inversion (extracting PII from a model), evasion (adversarial examples), and model theft — mitigate with input filtering, adversarial training, differential privacy, and rate-limited APIs. Change management workflow: RFC → CAB approval → maintenance window → implementation with rollback plan → post-implementation review — bypasses cause most self-inflicted outages.