PURNAMA ACADEMY TRAINING PROGRAM (BANDUNG, JAKARTA, SURABAYA)
ONLINE/ OFFLINE , For Details Call/Whatsapp : 0838-0838-0001
Certified Information Systems Security Professional (CISSP)
Durations
5 Days (09.00 – 16.00)
Descriptions :
The CISSP certification training develops your expertise in defining the IT architecture and in designing, building, and maintaining a secure business environment using globally approved information security standards. The CISSP training covers industry best practices and prepares you for the CISSP certification exam held by (ISC)².
A CISSP certification validates your skills in IT security. Cybersecurity Ventures predicts a total of 3.5 million Cyber Security jobs by 2021. The global Cyber Security market is expected to reach USD $282.3 Billion by 2024, growing at a rate of 11.1-percent annually.
Objectives :
This Certified Information Systems Security Professional (CISSP) certification course. To obtain the CISSP certification, candidates need to pass an exam that consists of mostly multiple-choice questions. The purpose of this course is to prepare you for the certification exam by introducing you to the concepts and terminology you need to know to pass.
This course is designed to provide you with extensive knowledge, learning strategies, and instructor support along the way. In addition to the exam, you must meet a few other requirements in order to become a Certified Information Systems Security Professional. You must demonstrate that you follow the CISSP Code of Ethics, have a minimum of five years full-time paid work experience in the systems security field, and hold an IS or IT degree. With that in mind, before enrolling in this course, be sure that this is the right course for you.
This course is designed for people who want to become certified security professionals and are looking for jobs that require the CISSP certification. The prerequisites for this course are basic knowledge in networking and some knowledge of systems operations. Throughout this course, you will learn about the basics of asset security, cryptography, security and risk management, and various threats and attacks. This is a theoretical course — not a practical one — and we will cover many regulations, laws, policies, standards, and encryption protocols. With the flashcards, interactive diagrams, video lessons, and instructor support included with this course, you are equipped with everything you need to successfully pass the exam and earn your CISSP certification.
Participants :
The CISSP Course is ideal for experienced security practitioners, managers and executives interested in proving their knowledge across a wide array of security practices and principles, including those in the following positions:
• Chief Information Security Officer
• Chief Information Officer
• Director of Security
• IT Director/Manager
• Security Systems Engineer
• Security Analyst
• Security Manager
• Security Auditor
• Security Architect
• Security Consultant
• Network Architect
Prerequisites :
Roughly five years of direct full-time security work experience is recommended, but not required
Outlines :
DAY 1
CISSP Introduction
DOMAIN 1 : SECURITY AND RISK MANAGEMENT
Understand and Apply Concepts of Confidentiality, Integrity, and Availability
Information Security
Evaluate and Apply Security Governance Principles
Alignment of Security Functions to Business Strategy, Goals, Mission,
and Objectives
Vision, Mission, and Strategy
Governance
Due Care
Determine Compliance Requirements
Legal Compliance
Jurisdiction
Legal Tradition
Legal Compliance Expectations
Understand Legal and Regulatory Issues That Pertain to Information Security in a
Global Context
Cyber Crimes and Data Breaches
Privacy
Understand, Adhere to, and Promote Professional Ethics
Ethical Decision-Making
Established Standards of Ethical Conduct
(ISC)² Ethical Practices
Develop, Document, and Implement Security Policy, Standards, Procedures,
and Guidelines
Organizational Documents
Policy Development
Policy Review Process
Identify, Analyze, and Prioritize Business Continuity Requirements
Contribute to and Enforce Personnel Security Policies and Procedures
Understand and Apply Risk Management Concepts
Understand and Apply Threat Modeling Concepts and Methodologies
Apply Risk-Based Management Concepts to the Supply Chain
Establish and Maintain a Security Awareness, Education, and Training Program
Questions & Answers
DOMAIN 2 : ASSET SECURITY
Asset Security Concepts
Data Policy
Data Governance
Data Quality
Data Documentation
Data Organization
Identify and Classify Information and Assets
Asset Classification
Determine and Maintain Information and Asset Ownership
Asset Management Lifecycle
Software Asset Management
Protect Privacy
Cross-Border Privacy and Data Flow Protection
Data Owners
Data Controllers
Data Processors
Data Stewards
Data Custodians
Data Remanence
Data Sovereignty
Data Localization or Residency
Government and Law Enforcement Access to Data
Collection Limitation
Understanding Data States
Data Issues with Emerging Technologies
Ensure Appropriate Asset Retention
Retention of Records
Determining Appropriate Records Retention
Retention of Records in Data Lifecycle
Records Retention Best Practices
Determine Data Security Controls
Technical, Administrative, and Physical Controls
Establishing the Baseline Security
Scoping and Tailoring
Standards Selection
Data Protection Methods
Establish Information and Asset Handling Requirements
Marking and Labeling
Handling
Declassifying Data
Storage
Questions & Answers
DAY 2
DOMAIN 3: SECURITY ARCHITECTURE AND ENGINEERING
Implement and Manage Engineering Processes Using Secure Design Principles
Saltzer and Schroeder’s Principles
ISO/IEC
Defense in Depth
Using Security Principles
Understand the Fundamental Concepts of Security Models
Select Controls Based upon Systems Security Requirements
Understand Security Capabilities of Information Systems
Assess and Mitigate the Vulnerabilities of Security Architectures, Designs, and
Assess and Mitigate Vulnerabilities in Web-Based Systems
Assess and Mitigate Vulnerabilities in Mobile Systems
Insecure Devices
Mobile Device Management
Assess and Mitigate Vulnerabilities in Embedded Devices
Apply Cryptography
Cryptographic Lifecycle
Cryptographic Methods
Public Key Infrastructure
Key Management Practices
Digital Signatures
Non-Repudiation
Integrity
Understand Methods of Cryptanalytic Attacks
Digital Rights Management
Apply Security Principles to Site and Facility Design
Implement Site and Facility Security Controls
Physical Access Controls
Wiring Closets/Intermediate Distribution Facilities
Server Rooms/Data Centers
Media Storage Facilities
Evidence Storage
Restricted and Work Area Security
Utilities and Heating, Ventilation, and Air Conditioning
Environmental Issues
Fire Prevention, Detection, and Suppression
Questions & Answers
DOMAIN 4 : COMMUNICATION AND NETWORK SECURITY
Implement Secure Design Principles in Network Architectures
Open Systems Interconnection and Transmission Control
Internet Protocol Networking
Implications of Multilayer Protocols
Converged Protocols
Software-Defined Networks
Wireless Networks
Internet, Intranets, and Extranets
Demilitarized Zones
Virtual LANs
Secure Network Components
Firewalls
Network Address Translation
Intrusion Detection System
Security Information and Event Management
Network Security from Hardware Devices
Transmission Media
Endpoint Security
Implementing Defense in Depth
Content Distribution Networks
Implement Secure Communication Channels According to Design
Secure Voice Communications
Multimedia Collaboration
Remote Access
Data Communications
Virtualized Networks
Questions & Answers
DAY 3
DOMAIN 5 : IDENTITY AND ACCESS MANAGEMENT
Control Physical and Logical Access to Assets
Information
Systems
Devices
Facilities
Manage Identification and Authentication of People, Devices, and Services
Identity Management Implementation
Single Factor/Multifactor Authentication
Accountability
Session Management
Registration and Proofing of Identity
Federated Identity Management
Credential Management Systems
Integrate Identity as a Third-Party Service
On-Premise
Cloud
Federated
Implement and Manage Authorization Mechanisms
Role-Based Access Control
Rule-Based Access Control
Mandatory Access Control
Discretionary Access Control
Attribute-Based Access Control
Manage the Identity and Access Provisioning Lifecycle
User Access Review
System Account Access Review
Provisioning and Deprovisioning
Auditing and Enforcement
Questions & Answers
DAY 4
DOMAIN 6 : SECURITY ASSESSMENT AND TESTING
Design and Validate Assessment, Test, and Audit Strategies
Assessment Standards
Conduct Security Control Testing
Vulnerability Assessment
Penetration Testing
Log Reviews
Synthetic Transactions
Code Review and Testing
Misuse Case Testing
Test Coverage Analysis
Interface Testing
Collect Security Process Data
Account Management
Management Review and Approval
Key Performance and Risk Indicators
Backup Verification Data
Training and Awareness
Disaster Recovery and Business Continuity
Analyze Test Output and Generate Report
Conduct or Facilitate Security Audits
Internal Audits
External Audits
Third-Party Audits
Integrating Internal and External Audits
Auditing Principles
Audit Programs
Questions & Answers
DOMAIN 7: SECURITY OPERATIONS
Understand and Support Investigations
Evidence Collection and Handling
Reporting and Documentation
Investigative Techniques
Digital Forensics Tools, Techniques, and Procedures
Understand Requirements for Investigation Types
Administrative
Criminal
Civil
Regulatory
Industry Standards
Conduct Logging and Monitoring Activities
Define Auditable Events
Time
Protect Logs
Intrusion Detection and Prevention
Security Information and Event Management
Continuous Monitoring
Ingress Monitoring
Egress Monitoring
Securely Provision Resources
Asset Inventory
Asset Management
Configuration Management
Understand and Apply Foundational Security Operations Concepts
Need to Know/Least Privilege
Separation of Duties and Responsibilities
Privileged Account Management
Job Rotation
Information Lifecycle
Service Level Agreements
Apply Resource Protection Techniques to Media
Marking
Protecting
Transport
Sanitization and Disposal
Conduct Incident Management
An Incident Management Program
Detection
Response
Mitigation
Reporting
Recovery
Remediation
Lessons Learned
Third-Party Considerations
Operate and Maintain Detective and Preventative Measures
White-listing/Black-listing
Third-Party Security Services
Honeypots/Honeynets
Anti-Malware
Implement and Support Patch and Vulnerability Management
Understand and Participate in Change Management Processes
Implement Recovery Strategies
Backup Storage Strategies
Recovery Site Strategies
Multiple Processing Sites
System Resilience, High Availability, Quality of Service, and Fault Tolerance
Implement Disaster Recovery Processes
Response
Personnel
Communications
Assessment
Restoration
Training and Awareness
Test Disaster Recovery Plans
Read-Through/Tabletop
Walk-Through
Simulation
Parallel
Full Interruption
Participate in Business Continuity Planning and Exercises
Implement and Manage Physical Security
Physical Access Control
The Data Center
Address Personnel Safety and Security Concerns
Travel
Duress
Questions & Answers
DAY 5
DOMAIN 8: SOFTWARE DEVELOPMENT SECURITY
Understand and Integrate Security in the Software Development Lifecycle
Development Methodologies
Maturity Models
Operations and Maintenance
Change Management
Integrated Product Team
Identify and Apply Security Controls in Development Environments
Security of the Software Environment
Configuration Management as an Aspect of Secure Coding
Security of Code Repositories
Assess the Effectiveness of Software Security
Logging and Auditing of Changes
Risk Analysis and Mitigation
Assess the Security Impact of Acquired Software
Acquired Software Types
Software Acquisition Process
Relevant Standards
Software Assurance
Certification and Accreditation
Define and Apply Secure Coding Standards and Guidelines
Security Weaknesses and Vulnerabilities at the
Security of Application Programming Interfaces
Secure Coding Practices
Questions & Answers
