Certified Information Systems Security Professional (CISSP)

Offered in both classroom and online formats to accommodate different learning preferences and schedules.

Certified Information Systems Security Professional Course

CISSP

Certified Information Systems Security Professional

CISSP covers 8 domains of cybersecurity: Security and Risk Management, Asset Security, Security Architecture and Engineering, Communication and Network Security, Identity and Access Management (IAM), Security Assessment and Testing, Security Operations, and Software Development Security. The course prepares professionals to design, implement, and manage cybersecurity programs, focusing on risk management, cryptography, incident response, secure architecture, and governance. Candidates must pass an exam and have at least 5 years of cumulative, paid work experience in 2 or more of the domains to earn CISSP certification.

What You Will Learn

Participants will learn:

Detailed understanding of the eight CISSP domains: Security & Risk Management, Communication & Network Security, Asset Security, Security Architecture & Engineering, Identity & Access
Management, Security Assessment & Testing, Security Operations, and Software Development Security.
Practical application of risk management and its fundamental principles and how to apply them in real-world scenarios.
Techniques for implementing secure architectures and engineering processes.
Ways and techniques to secure communication and network security protocols.
Strategies for identity and access management to protect organizational assets.

Skills You Will Acquire

Advance skills in risk management and mitigation strategies.
Expertise in cryptography and secure communications.
The capacity to design and implement secure architectures.
Competence in incident response and management.
Proficiency in security assessment and testing methodologies.

Key Features

Comprehensive coverage of CISSP domains with real-world case studies.
Interactive sessions led by experienced CISSP-certified instructors.
Access to study materials and resources to aid exam preparation.
Realistic tasks and practical mock-ups to emphasize learning.
Guidance on the CISSP exam application and preparation process.

Course details

💰Course Fee: R̶M̶ 9̶,0̶0̶0̶ RM 7,000 (excluding USD750 exam fee)

🔥Mode: Offered in both classroom and online formats to accommodate different learning preferences and schedules.

🕒Duration: Typically, 5 days (40 hours), offered on weekdays or weekends

Enroll Now

Whatsapp Us

Highlights

✅Holistic Security Knowledge: Gain deep understanding across 8 essential security domains.

✅Risk Management Proficiency: Master techniques for identifying and managing cybersecurity risks.

✅Advanced Encryption Expertise: Learn sophisticated encryption protocols and techniques.

✅Incident Response Mastery: Acquire skills to effectively handle and respond to security incidents.

✅Security Architecture Competence: Design robust security architectures for organizations.

Prerequisites

However, individuals with at least 1-2 years of work experience implementing Cisco services and solutions would benefit more.

It is also suggested, but not required that participants have a basic understanding and read about these topics on IP addressing and networking principles.

Who Should Enroll

This workshop is ideal for:

Information security professionals looking for career advancement.
IT managers and directors responsible for cybersecurity initiatives.
Security consultants and auditors seeking a globally recognized credential.
Anyone preparing for roles such as Chief Information Security Of cer (CISO) or Security Analyst.

Course Benefits

Globally recognized certification enhancing career prospects.
Validation of expertise in cybersecurity principles and practices.
Access to an international network of cybersecurity professionals.
The elevation of professional credibility and earning potential.
Ongoing educational opportunities to stay current in the field.

Inquiry Process

The inquiry process comprises three simple steps.

Submit Inquiry- Tell us a bit about yourself and the questions you want to enquire about. Use our CHAT feature or submit an enquiry form. You can also WhatsApp us on +601112216870 (Mr Vaheed)
Reviewing–Your questions will be processed and answered within a day or two
Response–Answers will typically be sent through email. However, you may tell us the option you prefer us to contact you in

Training Mode

Offered in both classroom and online formats to accommodate different learning preferences and schedules.

form

Course Outline

Understand, adhere to, and promote professional ethics.

(ISC)2 Code of Professional Ethics
Organizational code of ethics

Understand and apply security concepts.

Confidentiality, integrity, and availability, authenticity and nonrepudiation

Evaluate and apply security governance principles.

Alignment of the security function to business strategy, goals, mission, and objectives
Organizational processes (e.g., acquisitions, divestitures, governance committees)
Organizational roles and responsibilities
Security control frameworks
Due care/due diligence

Determine compliance and other requirements

Contractual, legal, industry standards, and regulatory requirements
Privacy requirements
Understand legal and regulatory issues that pertain to information security in a holistic context
Cybercrimes and data breaches
Licensing and Intellectual Property (IP) requirements
Import/export controls
Transborder data flow
Privacy

Understand requirements for investigation types (i.e., administrative, criminal, civil, regulatory, industry standards)
Develop, document, and implement security policy, standards, procedures, and guidelines
Identify, analyze, and prioritize Business Continuity (BC) requirements

Business Impact Analysis (BIA)
Develop and document the scope and the plan

Contribute to and enforce personnel security policies and procedures

Candidate screening and hiring
Employment agreements and policies
Onboarding, transfers, and termination processes
Vendor, consultant, and contractor agreements and controls
Compliance policy requirements
Privacy policy requirements

Understand and apply risk management concepts

Identify threats and vulnerabilities
Risk assessment/analysis
Risk response
Countermeasure selection and implementation
Applicable types of controls (e.g., preventive, detective, corrective)
Control assessments (security and privacy)
Monitoring and measurement
Reporting
Continuous improvement (e.g., Risk maturity modeling)
Risk frameworks

Understand and apply threat modelling concepts and methodologies
Apply Supply Chain Risk Management (SCRM) concepts

Risks associated with hardware, software, and services
Third-party assessment and monitoring
Minimum security requirements
Service level requirements

Establish and maintain a security awareness, education, and training program

Methods and techniques to present awareness and training (e.g., social engineering, phishing, security champions, gamification)
Periodic content reviews
Program effectiveness evaluation

Identify and classify information and assets

Data classification
Asset Classification

Establish information and asset handling requirements
Provision resources securely

Information and asset ownership
Asset inventory (e.g., tangible, intangible)
Asset management

Manage data lifecycle

Data roles (i.e., owners, controllers, custodians, processors, users/subjects)
Data collection
Data location
Data maintenance
Data retention
Data remanence
Data destruction

Ensure appropriate asset retention (e.g., End-of-Life (EOL), End-of-Support (EOS))
Determine data security controls and compliance requirements

Data states (e.g., in use, in transit, at rest)
Scoping and tailoring
Standards selection
Data protection methods (e.g., Digital Rights Management (DRM), Data Loss Prevention (DLP),
Cloud Access Security Broker (CASB))

Research, implement and manage engineering processes using secure design principles

Threat modeling
Least privilege
Defense in depth
Secure defaults
Fail securely
Separation of Duties (SoD)
Keep it simple
Zero Trust
Privacy by design
Trust but verify
Shared responsibility

Understand the fundamental concepts of security models (e.g., Biba, Star Model, Bell-LaPadula)
Select controls based upon systems security requirements
Understand security capabilities of Information Systems (IS) (e.g., memory protection, Trusted Platform Module (TPM), encryption/ decryption)
Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements

Client-based systems
Server-based systems
Database systems
Cryptographic systems
Industrial Control Systems (ICS)
Cloud-based systems (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS))
Distributed systems
Internet of Things (IoT)
Microservices
Containerization
Serverless
Embedded systems
High-Performance Computing (HPC) systems
Edge computing systems
Virtualized systems

Select and determine cryptographic solutions

Cryptographic life cycle (e.g., keys, algorithm selection)
Cryptographic methods (e.g., symmetric, asymmetric, elliptic curves, quantum)
Public Key Infrastructure (PKI)
Key management practices
Digital signatures and digital certificates
Non-repudiation
Integrity (e.g., hashing)

Understand methods of cryptanalytic attacks

Brute force
Ciphertext only
Known plaintext
Frequency analysis
Chosen ciphertext
Implementation attacks
Side-channel
Fault injection
Timing
Man-in-the-Middle (MITM)
Pass the hash
Kerberos exploitation
Ransomware

Apply security principles to site and facility design
Design site and facility security controls

Wiring closets/intermediate distribution facilities
Server rooms/data centers
Media storage facilities
Evidence storage
Restricted and work area security
Utilities and Heating, Ventilation, and Air Conditioning (HVAC)
Environmental issues
Fire prevention, detection, and suppression
Power (e.g., redundant, backup)

Assess and implement secure design principles in network architectures
Secure network components

Open System Interconnection (OSI) and Transmission Control Protocol/Internet Protocol (TCP/IP) models
Internet Protocol (IP) networking (e.g., Internet Protocol Security (IPSec), Internet Protocol (IP) v4/6)
Secure protocols
Implications of multilayer protocols
Converged protocols (e.g., Fiber Channel Over Ethernet (FCoE), Internet Small Computer Systems Interface (iSCSI), Voice over Internet Protocol (VoIP))
Micro-segmentation (e.g., Software Defined Networks (SDN), Virtual eXtensible Local Area Network (VXLAN), Encapsulation, Software-Defined Wide Area Network (SD-WAN))
Wireless networks (e.g., Li-Fi, Wi-Fi, Zigbee, satellite)
Cellular networks (e.g., 4G, 5G)
Content Distribution Networks (CDN)

Secure network components

Operation of hardware (e.g., redundant power, warranty, support)
Transmission media
Network Access Control (NAC) devices
Endpoint security

Implement secure communication channels according to design

Voice
Multimedia collaboration
Remote access
Data communications
Virtualized networks
Third-party connectivity

Control physical and logical access to assets

Information
Systems
Devices
Facilities
Applications

Manage identification and authentication of people, devices, and services

Identity Management (IdM) implementation
Single/Multi-Factor Authentication (MFA)
Accountability
Session management
Registration, proofing, and establishment of identity
Federated Identity Management (FIM)
Credential management systems
Single Sign On (SSO)
Just-In-Time (JIT)

Federated identity with a third-party service

On-premise
Cloud
Hybrid

Implement and manage authorization mechanisms

Role Based Access Control (RBAC)
Rule based access control
Mandatory Access Control (MAC)\
Discretionary Access Control (DAC)
Attribute Based Access Control (ABAC)
Risk based access control

Manage the identity and access provisioning lifecycle

Account access review (e.g., user, system, service)
Provisioning and deprovisioning (e.g., on /off boarding and transfers)
Role definition (e.g., people assigned to new roles)
Privilege escalation (e.g., managed service accounts, use of sudo, minimizing its use)

Implement authentication systems

OpenID Connect (OIDC)/Open Authorization (Oauth)
Security Assertion Markup Language (SAML)
Kerberos
Remote Authentication Dial-In User Service (RADIUS)/Terminal Access Controller Access Control System Plus (TACACS+)

Design and validate assessment, test, and audit strategies

Internal
External
Third-party

Conduct security control testing

Vulnerability assessment
Penetration testing
Log reviews
Synthetic transactions
Code review and testing
Misuse case testing
Test coverage analysis
Interface testing
Breach attack simulations
Compliance checks

Collect security process data (e.g., technical and administrative)

Account management
Management review and approval
Key performance and risk indicators
Backup verification data
Training and awareness
Disaster Recovery (DR) and Business Continuity (BC)

Analyze test output and generate report

Remediation
Exception handling
Ethical disclosure

Conduct or facilitate security audits

Internal
External
Third-party

Understand and comply with investigations

Evidence collection and handling
Reporting and documentation
Investigative techniques
Digital forensics tools, tactics, and procedures
Artifacts (e.g., computer, network, mobile device)

Conduct logging and monitoring activities

Intrusion detection and prevention
Security Information and Event Management (SIEM)
Continuous monitoring
Egress monitoring
Log management
Threat intelligence (e.g., threat feeds, threat hunting)
User and Entity Behavior Analytics (UEBA)

Perform Configuration Management (CM) (e.g., provisioning, baselining, automation)
Apply foundational security operations concepts

Need-to-know/least privilege
Separation of Duties (SoD) and responsibilities
Privileged account management
Job rotation
Service Level Agreements (SLAs)

Apply resource protection

Media management
Media protection techniques

Conduct incident management

Detection
Response
Mitigation
Reporting
Recovery
Remediation
Lessons learned

Operate and maintain detective and preventative measures

Firewalls (e.g., next generation, web application, network)
Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)
Whitelisting/blacklisting
Third-party provided security services
Sandboxing
Honeypots/honeynets
Anti-malware
Machine learning and Artificial Intelligence (AI) based tools

Implement and support patch and vulnerability management
Understand and participate in change management processes
Implement recovery strategies

Backup storage strategies
Recovery site strategies
Multiple processing sites
System resilience, High Availability (HA), Quality of Service (QoS), and fault tolerance

Implement Disaster Recovery (DR) processes

Response
Personnel
Communications
Assessment
Restoration
Training and awareness
Lessons learned

Test Disaster Recovery Plans (DRP)

Read-through/tabletop
Walkthrough
Simulation
Parallel
Full interruption

Participate in Business Continuity (BC) planning and exercises
Implement and manage physical security

Perimeter security controls
Internal security controls

Address personnel safety and security concerns

Travel
Security training and awareness
Emergency management
Duress

Understand and integrate security in the Software Development Life Cycle (SDLC)

Development methodologies (e.g., Agile, Waterfall, DevOps, DevSecOps)
Maturity models (e.g., Capability Maturity Model (CMM), Software Assurance Maturity Model (SAMM))
Operation and maintenance
Change management
Integrated Product Team (IPT)

Identify and apply security controls in software development ecosystems

Programming languages
Libraries
Tool sets
Integrated Development Environment (IDE)
Runtime
Continuous Integration and Continuous Delivery (CI/CD)
Security Orchestration, Automation, and Response (SOAR)
Software Configuration Management (SCM)
Code repositories
Application security testing (e.g., Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST))

Assess the effectiveness of software security

Auditing and logging of changes
Risk analysis and mitigation

Assess security impact of acquired software

Commercial-off-the-shelf (COTS)
Open source
Third-party
Managed services (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS))

Define and apply secure coding guidelines and standards

Security weaknesses and vulnerabilities at the source-code level
Security of Application Programming Interfaces (APIs)
Secure coding practices
Software-defined security

Enroll Now

Whatsapp Us

Frequently asked questions

WHY NEXPERTS ACADEMY

CERTIFIED TRAINERS

LIFETIME ACCESS TO
RECORDED SESSIONS

HIGHLY EXPERIENCED
WITH INTERVIEW PREPARATION

FLEXIBLE SCHEDULE

24/7 SUPPORT

Certified Information Systems Security Professional (CISSP)

Offered in both classroom and online formats to accommodate different learning preferences and schedules.

Certified Information Systems Security Professional Course