CISSP Certification Details - Zetlan Technologies

Login Signup

info@zetlantechnologies.com +91-8680961847

/ ISC2 Certification / CISSP Certification

CISSP - Certified Information Systems Security Professional

Earn the CISSP - The World's Premier Cybersecurity Certification

Accelerate your cybersecurity career with the CISSP certification. Earning the CISSP proves you have what it takes to effectively design, implement and manage a best-in-class cybersecurity program.

With a CISSP, you validate your expertise and become an ISC2 member, unlocking a broad array of exclusive resources, educational tools and peer-to-peer networking opportunities.

Prove your skills, advance your career, help earn the salary you want and gain the support of a community of cybersecurity leaders here to support you throughout your career.

Who Earns the CISSP?

The CISSP is ideal for experienced security practitioners, managers and executives interested in proving their knowledge across a wide array of security practices and principles, including those in the following positions:

Chief Information Security Officer
Chief Information Officer
Director of Security
IT Director/Manager
Security Systems Engineer
Security Analyst
Security Manager
Security Auditor
Security Architect
Security Consultant
Network Architect

Course Details

1. Security and Risk Management

Understand, adhere to, and promote professional ethics

ISC2 Code of Professional Ethics
Organizational code of ethics

Understand and apply security concepts

Confidentiality, integrity, and availability, authenticity, and nonrepudiation (5 Pillars of Information Security)

Evaluate and apply security governance principles

Alignment of the security function to business strategy, goals, mission, and objectives
Organizational processes (e.g., acquisitions, divestitures, governance committees)
Organizational roles and responsibilities
Security control frameworks

International Organization for Standardization (ISO)
National Institute of Standards and Technology (NIST)
Control Objectives for Information and Related Technology (COBIT)
Sherwood Applied Business Security Architecture (SABSA)
Payment Card Industry (PCI)
Federal Risk and Authorization Management Program (FedRAMP)

Due care/due diligence

Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context

Cybercrimes and data breaches
Licensing and Intellectual Property requirements
Import/export controls
Transborder data flow
Issues related to privacy

General Data Protection Regulation (GDPR)
California Consumer Privacy Act
Personal Information Protection Law
Protection of Personal Information Act

Contractual, legal, industry standards, and regulatory requirements

Understand requirements for investigation types

Administrative
Criminal
Civil
Regulatory
Industry Standards

Develop, document, and implement security policy, standards, procedures, and guidelines

Alignment of the security function to business strategy, goals, mission, and objectives
Organizational processes (e.g., acquisitions, divestitures, governance committees)
Organizational roles and responsibilities
Security control frameworks

International Organization for Standardization (ISO)
National Institute of Standards and Technology (NIST)
Control Objectives for Information and Related Technology (COBIT)
Sherwood Applied Business Security Architecture (SABSA)
Payment Card Industry (PCI)
Federal Risk and Authorization Management Program (FedRAMP)

Due care/due diligence

Identify, Analyze, Assess, Prioritize, and Implement Business Continuity (BC) requirements

Business impact analysis (BIA)
External dependencies

Contribute to and enforce personnel security policies and procedures

Candidate screening and hiring
Employment agreements and policy driven requirements
Onboarding, transfers, and termination processes
Vendor, consultant, and contractor agreements and controls

Understand and apply risk management concepts

Threat and vulnerability identification
Risk analysis, assessment, and scope
Risk response and treatment (e.g., cybersecurity insurance)
Applicable types of controls (e.g., preventive, detection, corrective)
Control assessments (e.g., security and privacy)
Continuous monitoring and measurement
Reporting (e.g., internal, external)
Continuous improvement (e.g., risk maturity modeling)
Risk frameworks

International Organization for Standardization (ISO)
National Institute of Standards and Technology (NIST)
Control Objectives for Information and Related Technology (COBIT)
Sherwood Applied Business Security Architecture (SABSA)
Payment Card Industry (PCI)

Understand and apply threat modeling concepts and methodologies
Apply Supply Chain Risk Management (SCRM) concepts

Risks associated with the acquisition of products and services from suppliers and providers (e.g., product tampering, counterfeits, implants)
Risk mitigations

Third-party assessment and monitoring
Minimum Security Requirements
Service level requirements
Silicon root of trust
Physically unclonable function
Software bill of materials

Establish and maintain a security awareness, education, and training program

Methods and techniques to increase awareness and training

Social Engineering
Phishing
Security Champions
Gamification

Periodic content reviews to include emerging technologies and trends

Cryptocurrency
Artificial Intelligence (AI)
Blockchain

Program effectiveness evaluation

2. Asset Security

Identify and classify information and assets

Data classification
Asset Classification

Establish information and asset handling requirements
Provision information and assets securely

Information and asset ownership
Asset inventory (e.g., tangible, intangible)
Asset management

Manage data lifecycle

Data roles (i.e., owners, controllers, custodians, processors, users/subjects)
Data collection
Data location
Data maintenance
Data retention
Data remanence
Data destruction

Ensure appropriate asset retention (e.g., End of Life (EOL), End of Support)
Determine data security controls and compliance requirements

Data states (e.g., in use, in transit, at rest)
Scoping and tailoring
Standards selection
Data protection methods

Digital Rights Management (DRM)
Data Loss Prevention (DLP)
Cloud Access Security Broker (CASB)

3. Security Architecture and Engineering

Research, implement and manage engineering processes using secure design principles

Threat modeling
Least privilege
Defense in depth
Secure defaults
Fail securely
Segregation of Duties (SoD)
Keep it simple and small
Zero trust or trust but verify
Privacy by design
Shared responsibility
Secure access service edge

Understand the fundamental concepts of security models

Biba
Star Model
Bell-LaPadula

Select controls based upon systems security requirements
Understand security capabilities of Information Systems (IS)

Memory Protection
Trusted Platform Module (TPM)
Encryption/Decryption

Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements

Client-based systems
Server-based systems
Database systems
Cryptographic systems
Industrial Control Systems (ICS)
Cloud-based systems

Software as a Service (SaaS)
Infrastructure as a Service (IaaS)
Platform as a Service (PaaS)

Distributed systems
Internet of Things (IoT)
Microservices (e.g., application programming interface (API))
Containerization
Serverless
Embedded systems
High-Performance Computing systems
Edge computing systems
Virtualized systems

Select and determine cryptographic solutions

Cryptographic life cycle (e.g., keys, algorithm selection)
Cryptographic methods (e.g., symmetric, asymmetric, elliptic curves, quantum)
Public key infrastructure (PKI) (e.g., quantum key distribution

Understand methods of cryptanalytic attacks

Brute force
Ciphertext only
Known plaintext
Frequency analysis
Chosen ciphertext
Implementation attacks
Side-channel
Fault injection
Timing
Man-in-the-Middle (MITM)
Pass the hash
Kerberos exploitation
Ransomware

Apply security principles to site and facility design
Design site and facility security controls

Wiring closets/intermediate distribution facilities
Server rooms/data centers
Media storage facilities
Evidence storage
Restricted and work area security
Utilities and Heating, Ventilation, and Air Conditioning (HVAC)
Environmental issues (e.g., natural disasters, man-made)
Fire prevention, detection, and suppression
Power (e.g., redundant, backup)

Manage the information system lifecycle

Stakeholders needs and requirements
Requirements analysis
Architectural design
Development /implementation
Integration
Verification and validation
Transition/deployment
Operations and maintenance/sustainment
Retirement/disposal

4. Communication and Network Security

Apply secure design principles in network architectures

Open System Interconnection (OSI) and Transmission Control Protocol/Internet Protocol (TCP/IP) models
Internet Protocol (IP) version 4 and 6 (IPv6)

Unicast
Broadcast
Multicast
Anycast

Secure protocols

Internet Protocol Security (IPSec)
Secure Shell (SSH)
Secure Sockets Layer (SSL) / Transport Layer Security (TLS)

Implications of multilayer protocols
Converged protocols

Internet Small Computer Systems Interface (iSCSI)
Voice over Internet Protocol (VoIP)
InfiniBand over Ethernet
Compute Express Link)

Transport architecture

Topology
Data/Control/Management Plane
Cut-Through/Store-and-forward

Performance metrics

Bandwidth
latency
Jitter
Throughput
Signal-to-noise ratio

Traffic flows (e.g., north-south, east-west)
Physical segmentation (e.g., in-band, out-of-band, air-gapped)
Logical segmentation

Virtual local area networks (VLANs)
Virtual private networks (VPNs)
Virtual routing and forwarding
Virtual domain

Micro-Segmentation

Network overlays/encapsulation
Distributed Firewalls
Routers
Intrusion Detection System (IDS)/intrusion prevention system (IPS)
Zero Trust

Edge networks (e.g., ingress/egress, peering)
Wireless networks (e.g., Bluetooth, Wi-Fi, Zigbee, satellite)
Cellular/mobile networks (e.g., 4G, 5G)
Content distribution networks (CDN)
Software defined networks (SDN)

Application Programming Interface (API)
Software-Defined Wide- Area Network
Network Functions Virtualization

Virtual Private Cloud (VPC)
Monitoring and management

Network Observability
Traffic flow/shaping
Capacity Management
Fault Detection and Handling

Secure network components

Operation of infrastructure (e.g., Redundant Power, Warranty, Support)
Transmission media (e.g., Physical Security of Media, Signal Propagation Quality)
Network Access Control (NAC) systems (e.g., Physical, and Virtual Solutions)
Endpoint security (e.g., Host-Based)

Implement secure communication channels according to design

Voice, video, and collaboration (e.g., Conferencing, Zoom rooms)
Remote access (e.g., Network Administrative Functions)
Data communications (e.g., Backhaul Networks, Satellite)
Third-party connectivity (e.g., Telecom Providers, Hardware Support)

5. Identify and Access Management (IAM)

Control physical and logical access to assets

Information
Systems
Devices
Facilities
Applications
Services

Design identification and authentication strategy (e.g., people, devices, and services)

Groups and Roles
Authentication, Authorization and Accounting (AAA) (e.g., multi-factor authentication (MFA), password-less authentication)
Session management
Registration, proofing, and establishment of identity
Federated Identity Management (FIM)
Credential management systems (e.g., Password vault)
Single sign-on (SSO)
Just-In-Time

Federated identity with a third-party service

On-premise
Cloud
Hybrid

Implement and manage authorization mechanisms

Role-based access control (RBAC)
Rule based access control
Mandatory access control (MAC)
Discretionary access control (DAC)
Attribute-based access control (ABAC)
Risk based access control
Access policy enforcement (e.g., policy decision point, policy enforcement point)

Manage the identity and access provisioning lifecycle

Account access review (e.g., user, system, service)
Provisioning and deprovisioning (e.g., on /off boarding and transfers)
Role definition and transition (e.g., people assigned to new roles)
Privilege escalation (e.g., use of sudo, auditing its use)
Service accounts management

Implement authentication systems

6. Security Assessment and Testing

Design and validate assessment, test, and audit strategies

Internal (e.g., within organization control)
External (e.g., outside organization control)
Third-party (e.g., outside of enterprise control)
Location (e.g., on-premises, cloud, hybrid)

Conduct security control testing

Vulnerability assessment
Penetration testing (e.g., red, blue, and/or purple team exercises)
Log reviews
Synthetic transactions/benchmarks
Code review and testing
Misuse case testing
Coverage analysis
Interface testing (e.g., user interface, network interface, application programming interface (API))
Breach attack simulations
Compliance checks

Collect security process data (e.g., technical and administrative)

Account management
Management review and approval
Key performance and risk indicators
Backup verification data
Training and awareness
Disaster Recovery (DR) and Business Continuity (BC)

Analyze test output and generate report

Remediation
Exception handling
Ethical disclosure

Conduct or facilitate security audits

Internal (e.g., within organization control)
External (e.g., outside organization control)
Third-party (e.g., outside of enterprise control)
Location (e.g., on-premises, cloud, hybrid)

7. Security Operation

Understand and comply with investigations

Evidence collection and handling
Reporting and documentation
Investigative techniques
Digital forensics tools, tactics, and procedures
Artifacts (e.g., data, computer, network, mobile device)

Conduct logging and monitoring activities

Intrusion detection and prevention (IDPS)
Security Information and Event Management (SIEM)
Continuous monitoring and tuning
Egress monitoring
Log management
Threat intelligence (e.g., threat feeds, threat hunting)
User and Entity Behavior Analytics (UEBA)

Perform Configuration Management (CM) (e.g., provisioning, baselining, automation)
Apply foundational security operations concepts

Need-to-know/least privilege
Separation of Duties (SoD) and responsibilities
Privileged account management
Job rotation
Service-level agreements (SLA)

Apply resource protection

Media management
Media protection techniques
Data at rest/data in transit

Conduct incident management

Detection
Response
Mitigation
Reporting
Recovery
Remediation
Lessons learned

Operate and maintain detection and preventative measures

Firewalls (e.g., next generation, web application, network)
Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)
Whitelisting/blacklisting
Third-party provided security services
Sandboxing
Honeypots/honeynets
Anti-malware
Machine learning and Artificial Intelligence (AI) based tools

Implement and support patch and vulnerability management
Understand and participate in change management processes
Implement recovery strategies

Backup storage strategies (e.g., cloud storage, onsite, offsite)
Recovery site strategies (e.g., cold vs. hot, resource capacity agreements)
Multiple processing sites
System resilience, high availability (HA), Quality of Service (QoS), and fault tolerance

Implement Disaster Recovery (DR) processes

Response
Personnel
Communications (e.g., methods)
Assessment
Restoration
Training and awareness
Lessons learned

Test Disaster Recovery Plans (DRP)

Read-through/tabletop
Walkthrough
Simulation
Parallel
Full interruption
Communications (e.g., stakeholders, test status, regulators)

Participate in Business Continuity (BC) planning and exercises
Implement and manage physical security

Perimeter security controls
Internal security controls

Address personnel safety and security concerns

Travel
Security training and awareness

Insider threat
Social Media Impacts
Two-factor Authentication (2FA) Fatigue

Emergency management
Duress

8. Software Development Security

Understand and integrate security in the Software Development Life Cycle (SDLC)

Development methodologies (e.g., Agile, Waterfall, DevOps, DevSecOps, Scaled Agile Framework)
Maturity models (e.g., Capability Maturity Model (CMM), Software Assurance Maturity Model (SAMM))
Operation and maintenance
Change management
Integrated Product Team

Identify and apply security controls in software development ecosystems

Programming languages
Libraries
Tool sets
Integrated Development Environment
Runtime
Continuous Integration and Continuous Delivery (CI/CD)
Software configuration management (CM)
Code repositories
Application security testing

Static application security testing (SAST)
Dynamic application security testing (DAST)
Software composition analysis
Interactive Application Security Test (IAST)

Assess the effectiveness of software security

Auditing and logging of changes
Risk analysis and mitigation

Assess security impact of acquired software

Commercial-off-the-shelf (COTS)
Open source
Third-party
Managed services (e.g., enterprise applications)
Cloud services

Software as a Service (SaaS)
Infrastructure as a Service (IaaS)
Platform as a Service (PaaS)

Define and apply secure coding guidelines and standards

Security weaknesses and vulnerabilities at the source-code level
Security of application programming interfaces (API)
Secure coding practices
Software-defined security

Video Packages
Online Live Class

Fees Structure :	15500 INR / 185 USD
Total No of Class :	130 Video Class
Class Duration :	82:00 Working Hours
Download Feature :	Download Avalable
Technical Support :	Call / Whatsapp : +91 8680961847
Working Hours :	Monday to Firday 9 AM to 6 PM
Payment Mode :	Credit Card / Debit Card / NetBanking / Wallet (Gpay/Phonepay/Paytm/WhatsApp Pay)

Brochure Buy Now Sample Demo

Fees Structure :	30000 INR / 355 USD
Class Duration :	60 Days
Class Recording :	Live Class Recording available
Class Time :	Monday to Firday 1.5 hours per day / Weekend 3 Hours per day
Technical Support :	Call / Whatsapp : +91 8680961847
Working Hours :	Monday to Firday 9 AM to 6 PM
Payment Mode :	Credit Card / Debit Card / NetBanking / Wallet (Gpay/Phonepay/Paytm/WhatsApp Pay)

Download Brochure Pay Online

Information Technologies

More Info

About Us Contact Us Privacy Policy Terms & Condition Refund Policy FAQs & Help

Account

My Account Course Details Shopping Cart Wishlist Order History Payment Details

Zetlan Technologies, All right reserved.