CISSP Training - United Kingdom

CISSP-ISSAP Training & Certification Outline

The bulk of the course will consist of reviews of the material from each of the six CISSP-ISSAP domains:

• Competence of the Six Major Domains of the Information Systems Security Architecture Professional (ISSAP) Concentration
• Consultative and Analytical Process of Information Security
• Key Concepts and Requirements
• The Framework of Architecture and Design
• The Six Domains of the CISSP-ISSAP CBK
• Access Control Systems and Methodology
• Critical Requirements
• Physical Infrastructure
• Cryptography
• Cryptographic Methodologies
• Communication, Compromise, and Misuse
• Physical Security Integration
• Physical Security and Personnel Controls
• Information Systems Security Model
• Requirements Analysis and Security Standards
• Awareness of Threats
• Identification of the Risks and Values of Data
• Business Continuity Planning (BCP)
• Disaster Recovery Planning (DRP)
• Telecommunications and Network Security

This teaching will be supported by discussion sessions and exercises to help you understand and master the material. There will also be final exam preparation and the chance to try practice questions.

Chief Information Security Officer Training​ Course Outline

Module 1: Governance and Risk Management

• Governance
• Information Security Management Structure
• Principles of Information Security
• Risk Management
• Management and Technical Information Security Elements
• Compliance
• Privacy
  • Privacy Impact Assessment
  • Privacy and Security
• Laws and Regulatory Drivers
• Standards and Frameworks
  • ISO/IEC 27000 Series
  • ISO/IEC 27001
  • NIST Cybersecurity Framework
  • Federal Information Processing Standards
  • NIST Special Publications
  • Privacy Shield
  • COBIT
• Information Security Trends and Best Practices
  • Open Web Application Security Project
  • Cloud Security Alliance
  • Centre for Internet Security
• Information Security Training and Certifications
• Ethics

Module 2: Information Security Controls, Compliance, and Audit Management

• Information Security Controls
  • Control Fundamentals
  • Control Frameworks
• Information Security Control Life Cycle Frameworks
  • NIST Risk Management Framework
  • NIST Cybersecurity Framework
  • ISO/IEC 27000
• Information Security Control Life Cycle
  • Risk Assessment
  • Design
  • Implementation
  • Assessment
  • Monitoring
• Exploring Information Security Control Frameworks
• Auditing for the CISO
  • Audit Management
  • Audit Process
  • Control Self-Assessments
  • Continuous Auditing
  • Specific Types of Audits and Assessments

Module 3: Security Programme Management and Operations

• Security Programme Management
  • Security Areas of Focus
  • Security Streams of Work
  • Asset Security Management
  • Security Projects
• Security Programme Budgets, Finance, and Cost Control
  • Establishing the Budget
  • Managing and Monitoring Spending
• Security Programme Resource Management: Building the Security Team
  • Project Management
  • Project Management Fundamentals
• Project Management
  • Phases of Project Management
  • Initiating
  • Planning
  • Executing
  • Monitoring and Controlling
  • Closing

Module 4: Information Security Core Competencies

• Malicious Software and Attacks
  • Malware
  • Scripting and Vulnerability – Specific Attacks
• Social Engineering
  • Types of Social Engineering Attacks
  • Why Employees Are Susceptible to Social Engineering
  • Social Engineering Defences
• Asset Security
  • Asset Inventory and Configuration
  • Management
  • Secure Configuration Baselines
  • Vulnerability Management
  • Asset Security Techniques
• Data Security
  • Data at Rest
  • Data in Transit
  • Data in Use
  • Data Life Cycle
• Identity and Access Management
  • Identity and Access Management Fundamentals
  • Identity Management Technologies
  • Authentication Factors and Mechanisms
  • Access Control Principles
  • Access Control Models
  • Access Control Administration
  • Identity and Access Management Life Cycle
• Communication and Network Security
  • WANs and LANs
  • IP Addressing
  • Network Address Translation
  • Network Protocols and Communications
  • Wireless
  • Network Technologies and Defences
• Cryptography
  • Cryptographic Definitions
  • Cryptographic Services
  • Symmetric, Asymmetric, and Hybrid Cryptosystems
  • Hash Algorithm s
  • Message Authentication Codes
  • Digital Signatures
  • Public Key Infrastructure
• Cloud Security
  • Cloud Computing Characteristics
  • Cloud Deployment Models
  • Cloud Service Models
  • Cloud Security Risks and Assurance Levels
  • Cloud Security Resources
• Physical Security
  • Physical Security Threats
  • Physical Security Programme Planning
  • Physical Security Resources
  • Physical Security Controls
  • Physical Security Auditing and Measurement
• Personnel Security
  • Software Development Security
  • Integrating Security into the SDLC
  • Security SDLC Roles and Responsibilities
  • Software Vulnerabilities
  • Secure Coding Practices
  • Software Vulnerability Analysis and Assessments
• Forensics, Incident Handling, and Investigations
  • Relevant Law
  • Logging and Monitoring
  • Incident Response and Investigations
  • Forensics and Digital Evidence
• Security Assessment and Testing
  • Vulnerability Assessments
  • Penetration Testing
  • Regulatory Compliance Assessments
  • Security Programme Assessments
• Business Continuity and Disaster Recovery
  • Continuity Planning Initiation
  • Business Impact Analysis
  • Identify Preventive Controls
  • Develop Recovery Strategies and Solutions
  • Develop the Plan
  • Test the Plan
  • Maintain the Plan

Module 5: Strategic Planning, Finance, Procurement, and Vendor Management

• Strategic Planning
  • Organisational Strategic Planning
  • Organisational Strategic Planning Teams
  • Strategic Planning Process
  • Security Strategic Plan
• Making Security Decisions
• Financial Management
  • Accounting and Finance Basics
  • Information Security Annual Budget
• Procurement and Vendor Management
  • Procurement Core Principles and Processes
  • Types of Contracts
  • Scope Agreements
  • Third-Party Vendor Risk Management

Information Systems Security Management Training Course Outline

Module 1: Information Systems

• Introduction to Information Systems
• Components
• Types
• Acquiring Information Systems and Services
• Managing Information Systems
• Information Systems Security and Control
• Impacts of Information Security Systems

Module 2: Information Security

• What is Information Security?
• Need
• Information Security Triad
• Threats
• Active and Passive Attacks
• Password Security
• Virtual Private Networks
• Personal Information Security

Module 3: Information Security Types

• Application Security
• Infrastructure Security
• Cloud Security
• Cryptography
• Incident Response
• Vulnerability Management
• Disaster Recovery

Module 4: Major Challenges to Information Systems Security

• Networked Systems
• Asymmetry Between Defence and Offense
• Ease-Of-Use Compromises
• Perimeter Defence
• Use of Cots Components
• Threats Posed by Insiders
• Passive Defence

Module 5: Common Information Security Risks

• Social Engineering Attacks
• Advanced Persistent Threats (APT)
• Insider Threats
• Cryptojacking
• Distributed Denial of Service (DDoS)
• Ransomware
• Man-in-the-Middle (MitM) Attacks

Module 6: Information Security Technologies

• Firewalls
• Security Incident and Event Management (SIEM)
• Data Loss Prevention (DLP)
• Intrusion Detection System (IPS)
• User Behavioural Analytics (UBA)
• Blockchain Cybersecurity
• Endpoint Detection and Response (EDR)
• Cloud Security Posture Management (CSPM)