Certified Information Systems Security Professional (CISSP)

Explore the five pillars of information security—the CIA triad (confidentiality, integrity, availability)—plus authenticity and non-repudiation—through practical controls like encryption, hashing, certificates, and digital signatures.

Explore defense in depth and layered defense, with authentication, authorization, accountability, least privilege, need to know, and diverse access controls protecting data across physical, technical, and administrative layers.

Explore governance, risk, and compliance principles that align information security with business objectives and cover due diligence, due care, and organizational processes like acquisitions and governance committees.

Explore security control frameworks as structured guidelines to implement, manage, and sustain comprehensive controls, including access control, data protection, incidence response, and risk management.

ISO 27001 presents a risk-based information security management framework emphasizing leadership, compliance, continuous improvement, and documented policies. NIST SP 800-53 provides a customizable control catalog aligned with RMF and monitoring.

Explore major security control frameworks beyond basics, including COBIT, HITRUST CSF, CIS, SABSA, PCI DSS, and FedRAMP, and how they organize controls and governance with risk management.

Explore major legal systems, including civil code law, common law, criminal and civil tort law, regulatory, customary, religious law, and mixed systems, and their impact on information security obligations.

Identify the major United States laws and regulations relevant to information security, including SOX, HIPAA, GLBA, CFAA, and FISA. Understand how these laws affect different sectors and data protection duties.

Explore key international data protection laws, including GDPR's EU/EEA scope and citizens' rights. Compare India's IT rules, PDPA, PIPL, PIPEDA, Basal II, and the UK Investigatory Powers Act.

Explore cybercrime, data breaches, and licensing and intellectual property. Understand import and export controls, transborder data flow, data sovereignty, data localization, and incident response.

Identify and distinguish administrative, criminal, civil, regulatory, and standards investigations, and learn how to collect, preserve, and present evidence with law enforcement, legal, and HR collaboration.

Navigate contractual, legal, regulatory, industry standards, and privacy compliance to align security controls with obligations, manage risk, and enforce data protection and breach notification.

Learn how security documentation shapes your program through policies, processes, procedures, standards, guidelines, and baselines, aligned with compliance, risk management, and incident response.

Explore onboarding, transfer, and offboarding policies, including background and credit checks, employment agreements, acceptable use, and the ethical framework that guides security professionals.

Equip employees with essential security awareness, education, and training to protect organizational assets; use phishing simulations and security champions to foster a secure culture.

Differentiate disruption from disaster and leverage BIA, DRP, and BCP to ensure availability, reliability, and recoverability for continuous operations.

Learn how to perform a business impact analysis by identifying critical processes and resources, assessing outage impacts, and prioritizing recovery with metrics like MTD, MTTR, MTBF, RTO, WRT, and RPO.

Develop, implement, and maintain a robust business continuity plan that identifies critical functions and external dependencies. Lead through business impact analysis, preventive controls, and tested recovery strategies.

Identify and value assets, tangible and intangible, then assess vulnerabilities, threats, risks, and exposure, and implement countermeasures while monitoring and improving risk management through a continuous cycle.

Identify vulnerabilities and threats by categorizing threat agents—human, natural, technical, physical, environmental, and operational—and differentiate internal versus external threats, then apply tailored controls.

Explore risk analysis by defining scope across organizational, facility, department, and asset levels, and compare quantitative, qualitative, and hybrid methods with asset value, EF, SLE, ARO, and ALE.

Identify four risk response types: risk avoidance, risk transfer, risk mitigation, and risk acceptance, and explain how to apply them to manage identified risks with real-world examples.

Identify and classify control types—administrative, logical, and physical—and control categories like compensative, corrective, and detective, then learn security and privacy control assessments.

Learn how to craft internal and external risk reports that communicate risk, controls, and compliance to stakeholders, and implement continuous monitoring, baselines, and the pdca cycle to improve risk management.

Explore six major risk frameworks, iso/iec 27005, nist rmf, cobit, sabsa, pci dss, and ferma, and their common risk management steps from context establishment to monitoring.

Master threat modeling by analyzing attack vectors, entry points, vulnerabilities, and layered defenses with adversarial thinking, including threat modeling perspectives on attacker-centric, application-centric, and asset-centric views.

Identify and mitigate supply chain risks across hardware, software, and service providers through SCRM. Apply mitigations like SBOM, silicon root of trust, PUF, and software escrow to protect CIA.

Identify what counts as an asset, including data and people, and classify and categorize assets using FIPS 199 and NIST SP 860, volume 1 guidance, applying labels by CIA impact.

Identify data classification as an asset, appoint a classification authority, and apply government and corporate schemes, including PII, PHI, and proprietary information; reference NIST 800-122.

Inventory data assets, scan storage locations, classify and label information, and report findings to manage data backups, media, retention, and secure destruction.

Use NIST guidelines and the cybersecurity framework to provision data and assets, designate data and asset owners, set classifications, and establish security controls.

Identify data roles like data owner, custodian, controller, and data steward. Understand governance, metadata, and separation of duties that strengthen data security.

Learn the data lifecycle phases—from creation and collection to storage, use, retention, and destruction—plus data location, maintenance, and automation with AWS Macie.

This lecture expands data retention to all assets and guides you to create an asset retention policy with purpose, scope, exclusions, oversight, retention schedules, and end-of-life and end-of-support considerations.

Learn the three data states—at rest, in transit, and in use—and the key protections, including encryption, authentication, authorization, segmentation, and emerging sandbox technologies that reduce breach risk.

Explore how scoping selects the right security baseline and tailoring customizes it for roles and departments, with documentation and audit trails for future implementation.

Explore how to select standards for information security and governance, from ISO and NIST to IETF and PCI DSS, and learn when to adopt, tailor, or design your own.

Apply threat modeling and defense in depth with MITRE ATT&CK concepts. Explore subject and object, least privilege, separation of duties, secure defaults, privacy by design, and zero trust.

Explore security model basics, emphasize the CIA triad, confidentiality, integrity, availability, and illustrate process protections, user versus kernel mode, and practical demos of vulnerabilities.

Examine four security modes—dedicated, system high, compartmented, and multi-level—and how clearance, formal access approval, NDAs, and need-to-know govern access across levels.

Examine fundamental security model types, including state machines, multi-level lattice, matrix-based models, non-interference, information flow, and take-grant delegation, with practical examples of rights and permissions.

Explore the Bell-LePadula security model, its mandatory access controls and confidentiality focus, including simple and star properties, security levels, no read up, no write down, and its limitations.

Learn how Biba, a state transition security model focused on data integrity, prevents unauthorized modification with no write up and no read down across low, medium, and high integrity levels.

Clark-Wilson presents an integrity-focused security model that enforces separation of duties, well-formed transactions, and certification and enforcement to prevent unauthorized or improper transformations and modifications.

Explore lesser-known security models, like Lipner, which blends Bella-Pagile and Bible concepts to strengthen integrity. Examine Brewer-Nash, Graham Denning, and Harrison Ruzo Ullman matrix for access control and data isolation.

Explore how to choose and tailor security controls across technical, physical, and administrative categories. Learn how frameworks like NIST SP 800-53 Rev 5 guide compliance while risk assessment shapes needs.

Protect memory by implementing ASLR, DEP, memory encryption, and memory integrity protections to defend against buffer overflows and exposure of sensitive data, and use stack canaries to detect corruptions.

Discover how a trusted platform module stores encryption keys and certificates to protect sensitive data on modern devices, and learn binding, sealing, and key terms like EK, SRK, AIK, PCR.

Explore encryption and decryption concepts, including drive and file encryption with BitLocker and GPG, and protect data at rest and in motion via SSH, HTTPS, and Let's Encrypt.

Explore client-based vulnerabilities, including weak authentication, improper permissions, browser and clipboard data exposure, shadow IT, and encryption practices like BitLocker and network encryption.

Explore common server vulnerabilities in server-based systems, including OS flaws, injection attacks, broken authentication, XSS, IDOR, misconfigurations, and defenses like firewalls and wafs.

Explore database vulnerabilities, including aggregation of non-sensitive data to reveal secrets, injection bypasses, and concurrency issues like race conditions and deadlocks, all while stressing data integrity and patch management.

Explore cloud models (SaaS, PaaS, IaaS) and deployment types, plus vulnerabilities like misconfigurations and poor access control. Learn defenses such as CASB, CSPM, security as a service, and CWPP.

Explore industrial control systems and operational technology, including ICS, SCADA, and DCS, and learn key vulnerabilities, from weak encryption and insecure networks to insider threats, input validation, and access control.

Explore vulnerabilities in internet of things and edge computing, focusing on embedded systems, firmware, weak credentials, and insecure apps; learn how patches, encryption, and physical security mitigate risk.

Explain virtualization and containers, highlight vulnerabilities like vm sprawl, resource exhaustion, and container escape, and present best practices in asset management, monitoring, and secure deployment.

Examine distributed systems, microservices, and serverless architectures, and identify vulnerabilities in network communications, APIs, authentication, authorization, and data exposure.

Explore high performance computing vulnerabilities and threat analysis across access, management, HPC, and data storage zones, guided by SP800223.

Explore cryptography basics, including encryption and decryption, hashing, the cryptographic life cycle, and the differences between symmetric and asymmetric key management.

Navigate public key infrastructure, including certificate issuance, revocation, and key rotation, with roles like ca, ra, and va, and concepts like cms, tls certificates, and self-signed versus trusted authorities.

Explore how digital signatures protect integrity and authenticate senders by hashing data, signing the hash with a private key, and verifying with the recipient's public key.

Examine classic cryptanalytic attacks, including brute-force, dictionary, and rainbow-table methods. Explore cipher-text-only, known-plaintext, and chosen-ciphertext techniques, illustrated with Enigma cipher and veneer cipher demonstrations.

Explore side channel attacks that exploit physical device characteristics—from timing and power analysis to fault injection and transient execution methods like Spectre and Meltdown—covering acoustic and electromagnetic side channels.

Explore other cryptanalytic attacks, including man-in-the-middle and meat-in-the-middle techniques, pass-the-hash, Kerberos golden and silver tickets, and ransomware, with practical definitions and defenses.

Learn secure site and facility design to protect people and assets through deterrence, denial, detection, and delay, with layered physical and technical controls, CPTED concepts, and BCDR.

Learn how natural access controls shape secure facilities by prioritizing entrances, security zones, supplier entry, and environmental design through CPTED, natural surveillance, and territorial control.

Create a formal physical security plan guided by the 4Ds, with incident response contacts and defined timeframes. Focus on site visibility, lighting, blind spots, and server room placement.

Explore common facilities and sites in IT, including wiring closets (IDF) and main distribution frames (MDF), server rooms, data centers, media storage facilities, and restricted areas for evidence and backups.

Explore facilities security controls, focusing on physical access, tailgating and impersonation, plus emanation security, climate control, fire suppression, cable management, UPS protection, and related administrative policies.

Explore the information system life cycle (ISLC) from prerequisites to decommissioning and disposal, covering requirements analysis, design, development, testing, deployment, and operations and maintenance.

Explore video, voice, and collaboration technologies used in remote work, and secure them with end-to-end encryption, access controls, password protection, unique IDs, and patch management.

Explore the OSI model and TCP/IP model, their layers, and how encapsulation enables interoperable networking. The lecture covers layer-specific security examples like TLS, IPsec, 802.1X, and L2TP.

Identify and secure physical wired and wireless transmission media, using shielding, port security, air gapping, and strong encryption to protect data integrity, confidentiality, and availability.

Explore transport architecture for secure data transmission, focusing on encryption, strong authentication, end-to-end protection, and the data, control, and management planes across physical and logical topologies.

Explore multilayer protocols that span OSI and TCP/IP, with examples like TCP and ARP, and converged protocols such as VoIP, iSCSI, and fiber channel over Ethernet in SCADA contexts.

Explore north-south and east-west traffic flows and learn how bandwidth, throughput, latency, packet loss, jitter, and signal-to-noise ratio influence the CIA triad and network performance.

Learn about backhaul, middle mile, and last mile in third-party communications, and apply end-to-end encryption, access controls, and continuous monitoring to protect data.

Learn how endpoint security uses endpoint detection and response (EDR) to monitor and remediate endpoints with automation, plus host-based defenses, encryption, patch management, and AppLocker via Intune.

Explore management and monitoring for secure network design, ensuring visibility, performance, security, and accountability via secure management protocols, logged administrative access, and regularly reviewed access controls.

Explore ipv4 addressing concepts, including dotted decimal notation, four octets, and subnet masks, and distinguish networks versus hosts, classful ranges, and nat usage.

Learn to create, scope, and tailor security baselines for devices and departments, and document changes to ensure consistent, auditable asset security.

Explore virtual private clouds as isolated networks with private RFC 1918 addresses and customizable subnets, and secure traffic with security groups, ACLs, NAT gateways, and internet gateways.

Compare personal and enterprise wireless security with WPA modes, 802.1x, and radius server authentication, and review per-protocol attributes like WEP, TKIP, CCMP, AES, and discuss EAP methods.

Explore cellular and satellite communications, from CDMA and GSM evolution to 5G and LTE, compare SIM and ESN identities, and examine uplink, downlink, ground stations, space and CPE architectures.

Practice microsegmentation to isolate workloads and secure east-west traffic in data centers and cloud environments. Leverage containerization, network overlays, and distributed firewalls with zero-trust principles.

Explore edge networks and CDNs, including DMZ, edge computing, and geographic distribution to improve end-user performance. Learn ingress and egress filtering, peering security, data exfiltration prevention, and CDN security considerations.

Study wireless network architecture and WLAN standards, including 2.4/5 GHz bands, MIMO and MU-MIMO, channel bonding, DFS, and OFDM/OFDMA. Compare infrastructure and ad hoc modes, ESS/BSS/SSID, and roaming.

Explore how to maintain reliable network infrastructure through redundancy and fault tolerance, covering power and path redundancy, geo and site strategies, and storage options like RAID, mirroring, and hot spares.

Explore software defined networking (SDN) and its decoupled control, data, and management planes. Programmatic, vendor- and hardware-independent networks use southbound and northbound interfaces for cloud and WAN scalability.

Explore secure protocol implementations, understanding how encryption protects confidentiality and integrity, and how port ranges and common protocols like http, https, ssh, snmpv3, ldap, and ftp influence secure communications.

Explore physical and logical network segmentation, including air-gapped and in-band vs out-of-band management, DMZ, VLANs, VPNs, and virtual routing and forwarding for secure, segmented networks.

Learn IPv6 addressing basics, including 128-bit addresses, network prefix and interface identifiers, and key types such as global unicast, link local, unique local, and multicast, with security by design.

Explore physical and virtual network access control through policy-driven zero-trust. Learn health attestation, ACLs, ABAC, certificate-based device authentication, and cloud-based protections like CASB and next-gen firewall strategies.

Explore physical and logical access controls within identity and access management to protect data, devices, facilities, applications, and services, including BYOD and microservices.

Categorize access controls into administrative, technical, and physical, and illustrate how preventative, deterrent, corrective, recovery, detective, directive, and compensating controls interrelate to secure systems.

Explore users, groups, roles, and policies in AWS identity and access management, focusing on least privilege, scalable permissions, and service roles for EC2 to S3.

Explore authentication, authorization, and accounting (AAA) and how multi-factor authentication, least privilege, and comprehensive logging with SIEM tools like Splunk enable secure access and auditing.

Explore how web-based session management uses session IDs, timeouts, and secure termination to prevent hijacking, with client-side versus server-side data storage considerations.

Learn how registration and proofing shape identity and access management through NIST SP 863A’s three phases—resolution, validation, and verification—and provisioning of authentication items for new hires or customers.

Explore federated identity management and single sign-on, where an identity provider authenticates you to service providers using tokens like OAuth, SAML, or JWT.

Learn how credential management securely stores and manages usernames, passwords, and secrets with vaults like Bitwarden, offering secure storage, password health, MFA, access controls, and secret generation.

Explore how single sign-on simplifies access to multiple services while enabling just-in-time access and least-privilege through context-aware provisioning and role-based access control.

Compare role-based access control and rule-based access control, illustrate with firewall access lists, explain privilege creep, implicit deny, and how order and hierarchy affect access decisions.

Explore mandatory access control with label-based policies and lattice concepts, and contrast it with discretionary access control through object ownership and access control lists, plus Cisco TrustSec's security tag.

Explore niche access control methods beyond classic models by examining attribute-based access control and risk-based access control, with examples like geolocation, time, device characteristics, and risk scoring.

Master how access policy enforcement uses peps, pdps, pips, and paps to decide and enforce access, using subject and object data from directories and identity and access management systems.

Learn how to conduct account access review within the identity and access management life cycle, audit access controls, prevent privilege creep, verify account management and audit logs with Splunk.

Master onboarding and offboarding in identity and access management, covering provisioning and deprovisioning. Address documentation, compliance, and equipment return to ensure secure transitions.

Define a new role and privilege escalation within identity lifecycle, emphasize least privilege, auditing, and preventing privilege creep through controlled access and just-in-time models.

Explore how service accounts, often called application accounts, enable machine-to-machine and API communications with elevated privileges, and learn password best practices, risk of default passwords, and defense through monitoring.

Explore the differences between authentication and authorization through OAuth 2.0 and OpenID Connect, showing how token‑based authorization enables third‑party apps to access services without sharing credentials.

Explain how SAML enables web-based single sign-on through federation, and how Kerberos provides ticket-based single sign-on inside private networks.

Explore RADIUS and TACACS+ as remote access AAA protocols, compare UDP versus TCP, and examine authentication, authorization, accounting, and encrypted traffic.

Designing security tests teaches automating basic security tests to verify controls. It covers resources, criticality, misconfiguration, independence, and NIST 853A guidance.

Identify vulnerabilities with automated assessments, network discovery scans, and web or database scanners, and use the security content automation protocol, the CVE database, and CVSS to prioritize remediation.

Explore penetration testing—from ethical hacking and vulnerability testing to red, blue, and purple teams, using black, white, and gray box methods—through planning, discovery, attacks, and reporting, including AWS cloud rules.

Discover testing practices beyond vulnerability scans and pen tests, including SIEM log reviews with Splunk, NTP time accuracy, synthetic transactions, code review, and breach and attack simulations.

Collect security process data by gathering technical details on access controls, privilege management, training, backups, disaster recovery and business continuity, and compliance, then analyze delta between intended and actual privileges.

Analyze test results to produce a remediation report with executive summary, findings, risk, and recommendations; emphasize exception handling, documentation, and ethical disclosure for executives and information technology leadership.

Explore internal, external, and third-party security audits, learn how to maintain independence, prepare documentation, and address multi-cloud data locations to strengthen organizational security.

Understand digital evidence and investigations by applying NIST, ISO/IEC 27037, and IOCE guidelines; identify, preserve, collect, and analyze data with forensics tools and chain-of-custody.

Explore intrusion detection and prevention systems, SIEM and SOAR, and how continuous monitoring, threat intelligence, threat hunting, and user behavior analytics drive secure log management across networks and endpoints.

Learn how configuration management establishes and maintains the integrity of IT systems, covering identification, control, baselining and automation to enforce security standards and support change management.

Explore foundational security operations concepts such as need to know, least privilege, segregation of duties, privileged access management, job rotation, and service level agreements.

Learn to protect resources and media through secure handling, storage, and disposal, using encryption, access control, and secure transport to ensure confidentiality, integrity, and availability.

Follow the seven-step incident response process—from detection to lessons learned—and learn how to identify confirmed incidents, coordinate timely responses, mitigate, report, recover, remediate, and review.

Explore detection and preventative measures in networks, including firewalls, IDS/IPS, honeypots and honeynets, anti-malware and EDR, whitelisting versus blacklisting, sandboxing, and AI-driven threat analytics.

Organize a continuous inventory of IT assets, then manage vulnerabilities and patch deployment. Acquire patches from vendors, test them, secure approvals, plan rollout, verify effectiveness, and document results.

Learn how to initiate, assess, authorize, plan, and implement changes through a formal RFC process, CAB approvals, and rollback planning to reduce risk and align with business objectives.

Implement recovery strategies to maintain business continuity. Explore backup storage: onsite, offsite, and cloud, recovery sites, fault tolerance, and RPO and RTO with full, incremental, and differential backups.

Activate the disaster recovery plan, assess impacts, and coordinate the disaster recovery team with clear roles and communications to restore critical systems efficiently.

Test disaster recovery plans through read-throughs, checklists, tabletop exercises, structured walkthroughs, simulations, parallel tests, and full interruption tests, while coordinating with stakeholders and regulators.

Explore seven contingency planning steps for business continuity, including policy statements, business impact analysis (BIA), preventative controls, recovery strategies, ISCP, testing and plan maintenance, guided by NIST and FIPS.

Implement and manage physical security as the outer layer of defense in depth, covering lighting, CCTV, guards, access control, mantraps, fencing, and architectural measures to protect people and assets.

Protect personnel safety and security by addressing travel risks, data exposure, and theft of information. Train staff on insider threats, duress, and emergency planning using SP 800-series guidance and OEP.

Explore how to integrate software development security across the sdlc, from risk management and compliance to threat modeling, secure coding, testing, and maintenance.

Explore how to choose a software development methodology by weighing size and complexity, flexibility, customer involvement, team experience, time constraints, and costs to avoid costly missteps.

Explore process-driven software development methodologies such as waterfall, iterative, spiral, and the V model. Understand the trade-offs of rigidity, milestones, risk management, and early feedback with testing shaping outcomes.

Explore agile based methodologies like Kanban, Scrum, and XP, focusing on working code and user stories over documentation.

Explore how the capability maturity model integrates with the SDLC to advance software maturity from level zero to five. Learn how this framework drives predictability, quality, and risk management.

Learn to adopt SAMM, the software assurance maturity model, to self-assess and improve security across governance, design, implementation, verification, and operations with three maturity levels.

Unite security, IT, risk management, compliance, and developers into an integrated product team to align requirements and accelerate early detection of errors for higher quality software.

Manage post-deployment expectations by maintaining operations and maintenance, monitoring performance and security, applying change management and governance, and ensuring compliance through audits and regulatory frameworks.

Learn how to bake security into every phase of the software development lifecycle with preventive, detective, and corrective controls, including secure coding, threat modeling, and DevSecOps automation.

Identify programming language risks in the SDLC, including buffer overflows, memory leaks, and SQL injection. Learn mitigation through input validation, memory management, sanitizing, and keeping libraries up to date.

Explore the software development life cycle and the security considerations for libraries, tool sets, IDEs, runtimes, and CI/CD, including secure configuration, code repositories, and vulnerability assessments.

Drive secure software development by embracing software configuration management as a discipline that tracks and controls changes through version control, build and release management, and formal change processes.

Learn to incorporate application security testing using SAST, DAST, IAST, SCA, and fuzzing, and implement unit to acceptance testing to secure software supply chains.

Explore how auditing and logging track software changes to protect integrity, identify risks, and ensure compliance through version control, CI/CD, and application logs.

Learn risk analysis and mitigation in the SDLC by identifying and prioritizing vulnerabilities, applying secure coding and encryption strategies, and validating outcomes through testing and a risk management plan.

Explore evaluating commercial off-the-shelf software and third-party security, comparing licensing, open source versus proprietary, and assessing risk, security practices, and service level agreements.

Learn to evaluate managed services and open source software security in a cloud based analytics platform, using RS Tech Solutions to compare source components, licensing, privacy, vulnerability history, and compliance.

Evaluate cloud services security by understanding IaaS, PaaS, and SaaS models, identifying shared responsibilities, and applying provider security features, patch management, and access controls.

Explore the five levels of coding languages, from machine to high level, plus tools like compilers, assemblers, and interpreters, and how these languages influence security, malware analysis, and secure coding.

Identify design and implementation flaws at the source code level, focusing on injection attacks, broken authentication, data exposure, and cross-site scripting, with emphasis on input validation and secure coding practices.

Learn how APIs enable cross-system communication, including REST, SOAP, RPC, and WebSocket. Master core security practices like authentication, authorization, tokens, API keys, validation, encryption, rate limiting, and secure error handling.

Explore SDN and SDsec in cloud networks, using a centralized controller with northbound and southbound APIs to implement dynamic security, segmentation, and zero trust.