CISSP study guide
CISSP · Work through your exam, one topic at a time.
The Certified Information Systems Security Professional (CISSP) is a vendor-neutral credential from ISC2 aimed at experienced security practitioners who design, engineer and manage an organization's overall security posture rather than administer a single product. It is commonly pursued by security managers, architects, analysts, auditors, consultants and directors, as well as IT leaders moving into security leadership. The CISSP study guide has 8 sections and about 2,283 words.
01Security and Risk Management
Every risk question reduces to a few precise definitions. A threat is a potential cause of harm; a vulnerability is a weakness a threat can exploit; exposure is the state of being susceptible.
305 words, about 2 min02Asset Security
Data is protected according to its value. Classification schemes (public, internal, confidential, restricted, or regulatory labels such as PII and PHI) drive labeling, handling, retention, and destruction.
285 words, about 1 min03Security Architecture and Engineering
Bell-LaPadula protects confidentiality: no read up, no write down. Biba protects integrity and mirrors it: no read down, no write up.
294 words, about 1 min04Communication and Network Security
OSI questions reward locating the failure first: cabling (1), MAC/ARP/VLAN (2), IP/routing (3), TCP/UDP ports (4), sessions (5), TLS and encoding (6), applications (7). A switch is layer 2, a router layer 3, a next-generation firewall commonly inspects at 3, 4, and 7.
288 words, about 1 min05Identity and Access Management
Identification is claiming an identity; authentication is proving it; authorization is what may be done; accounting records it. Questions routinely conflate authentication with authorization.
274 words, about 1 min06Security Assessment and Testing
A vulnerability assessment enumerates weaknesses; a penetration test exploits them to demonstrate impact; an audit checks evidence against a standard; a security review examines design. Written authorization, scope, and rules of engagement precede any active test.
286 words, about 1 min07Security Operations
Lifecycle: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Containment choices - isolating a host, blocking a port, segmenting a network - are driven by business impact.
291 words, about 1 min08Software Development Security
Security requirements belong in the requirements phase; waiting until testing is the standard wrong answer. Waterfall, spiral, iterative, and agile change when risk analysis occurs.
260 words, about 1 min