CISSP Training - Taiwan, Province of China

CISSP Training Course Outline

Domain 1: Security and Risk Management

• Understand, Adhere to, and Promote Professional Ethics
  • Code of Professional Ethics
  • Organisational Code of Ethics
• Understand and Apply Security Concepts
  • Overview
  • Confidentiality
  • Integrity
  • Availability
  • Authenticity
  • Nonrepudiation
• Evaluate and Apply Security Governance Principles
  • Security Governance
  • Alignment of Security Function to Business Strategy, Goals, Mission, and Objectives
  • Organisational Processes
  • Organisational Roles and Responsibilities
  • Security Control Frameworks
  • Due Care and Due Diligence
• Legal and Regulatory Issues that Pertain to Information Security in a Global Context
  • Cybercrimes and Data Breaches
  • Licensing and Intellectual Property Requirements
  • Import/Export Controls
  • Transborder Data Flow
  • Issues Related to Privacy
  • Contractual, Legal, Industry Standards, and Regulatory Requirements
• Requirements for Investigation Types (i.e., Administrative, Criminal, Civil, Regulatory, Industry Standards) 
  • Understand Requirements for Investigation Types
• Develop, Document, and Implement Security Policy, Standards, Procedures, and Guidelines 
  • Introduction
  • Security Policies
  • Security Policies and Individuals
  • Acceptable Use Policy
  • Security Standards, Baselines, and Guidelines
• Identify, Analyse, and Prioritise Business Continuity (BC) Requirements
  • Introduction
  • Business Impact Analysis
  • External Dependencies
• Contribute to and Enforce Personnel Security Policies and Procedures 
  • Candidate Screening and Hiring
  • Employment Agreements and Policy Driven Requirements
  • Onboarding, Transfers, and Termination Processes
  • Vendor, Consultant, and Contractor Agreements and Controls
• Understand and Apply Risk Management Concepts 
  • Threat and Vulnerability Identification
  • Risk Analysis, Assessment, and Scope
  • Risk Response and Treatment
  • Applicable Types of Controls
  • Control Assessments
  • Continuous Monitoring and Measurement
  • Reporting
  • Continuous improvement 
  • Risk frameworks
• Understand and Apply Threat Modeling Concepts and Methodologies
  • Introduction
  • Identifying Threats
  • Determining and Diagramming Potential Attacks
  • Performing Reduction Analysis
  • Prioritisation and Response
• Apply Supply Chain Risk Management (SCRM) Concepts
  • Risks Associated with the Acquisition of Products and Services from Suppliers and Providers
  • Risk Mitigations
• Establish and Maintain a Security Awareness, Education, and Training Program
  • Methods and Techniques to Increase Awareness and Training
  • Periodic Content Reviews to Include Emerging Technologies and Trends 
  • Program Effectiveness Evaluation

Domain 2: Asset Security

• Identify and Classify Information and Assets
  • Data Classification
  • Asset Classification
• Establish Information and Asset Handling Requirements
  • Establish Information and Asset Handling Requirements
• Provision Information and Assets Securely
  • Information and Asset Ownership
  • Asset Inventory
  • Asset Management
• Manage Data Lifecycle (e.g., EOL and EOS)
  • Data Roles
  • Data Collection
  • Data Location
  • Data Maintenance
  • Data Retention
  • Data Remanence
  • Data Destruction
• Ensure Appropriate Asset Retention 
  • Ensure Appropriate Asset Retention (e.g., EOL and EOS)
• Determine Data Security Controls and Compliance Requirements
  • Data States
  • Scoping and Tailoring
  • Standards Selection
  • Data Protection Methods

Domain 3: Security Architecture and Engineering

• Research, Implement and Manage Engineering Processes Using Secure Design Principles
  • Overview of Research, Implement and Manage Engineering Processes
• Understand the Fundamental Concepts of Security Models
  • Fundamental Concepts of Security Models 
• Select Controls Based Upon Systems Security Requirements
  • Overview of Select Controls Based Upon Systems Security Requirements
• Understand Security Capabilities of Information Systems
  • Security Capabilities of Information Systems
• Assess And Mitigate the Vulnerabilities of Security Architectures, Designs, and Solution Elements
  • Assess and Mitigate Security Vulnerabilities
• Select and Determine Cryptographic Solutions
  • Cryptographic Lifecycle
  • Cryptographic Methods
  • Public Key Infrastructure
• Understand Methods of Cryptanalytic Attacks
  • Methods of Cryptanalytic Attacks
• Apply Security Principles to Site And Facility Design
  • Overview of Apply Security Principles to Site and Facility Design
• Design Site And Facility Security Controls
  • Design Site and Facility Security Controls
  • Wiring Closets
  • Server Rooms/Data Centres
  • Media Storage Facilities
  • Evidence Storage
  • Restricted and Work Area Security
  • Utilities and HVAC
  • Environmental Issues
  • Fire prevention, detection, and suppression
  • Power
• Manage the information system lifecycle
  • Stakeholders Needs and Requirements
  • Requirements Analysis
  • Architectural Design
  • Development/Implementation
  • Integration
  • Verification and Validation
  • Transition/Deployment
  • Operations and Maintenance/Sustainment
  • Retirement/Disposal

Domain 4: Communication and Network Security

• Apply Secure Design Principles in Network Architectures
  • Open System Interconnection (OSI) and Transmission Control Protocol
  • Internet Protocol (IP) Version 4 and 6 (IPv6)
  • Secure Protocols 
  • Implications of Multilayer Protocols
  • Converged Protocols
  • Transport Architecture
  •  Performance Metrics
  • Traffic Flows
  • Physical Segmentation
  • Logical Segmentation
  • Micro-Segmentation
  • Edge Networks
  • Wireless Networks
  • Cellular/Mobile Networks 
  • Content Distribution Networks
  • Software Defined Networks (SDN)
  • Virtual Private Cloud (VPC)
  • Monitoring and Management
• Secure Network Components
  • Operation of Infrastructure
  • Transmission Media
  • Network Access Control
  • Endpoint Security
• Implement Secure Communication Channels According to Design 
  • Voice, Video, and Collaboration 
  • Remote Access
  • Data Communications
  • Third-party Connectivity

Domain 5: Identity and Access Management (IAM)

• Control Physical and Logical Access to Assets
  • Information
  • Systems
  • Devices
  • Facilities
  • Applications
  • Services 
• Design Identification and Authentication Strategy
  • Groups and Roles
  • Authentication, Authorisation and Accounting (AAA)
  • Session Management
  • Registration, Proofing, and Establishment of Identity
  •  Federated Identity Management (FIM)
  • Credential Management Systems
  • Single sign-on (SSO)
  • Just-In-Time
• Integrate Identity as a Third-Party Service 
  • On-premises
  • Cloud
  • Hybrid 
• Implement and Manage Authorisation Mechanisms
  • Role-Based Access Control (RBAC)
  • Rule based access control
  • Mandatory Access Control (MAC)
  • Discretionary Access Control (DAC)
  • Attribute-based Access Control (ABAC)
  •  Risk-based Access Control
  • Access Policy Enforcement
• Manage the Identity and Access Provisioning Lifecycle 
  • Account Access Review
  • Provisioning and Deprovisioning
  • Role Definition and Transition
  • Privilege Escalation
  • Service Accounts Management
• Implement Authentication Systems 
  • Overview of Implement Authentication Systems 

Domain 6: Security Assessment and Testing

• Design and Validate Assessment, Test, and Audit Strategies 
  • Internal
  • External
  • Third-party
  • Location 
• Conduct Security Control Testing 
  • Vulnerability Assessment
  • Penetration Testing
  • Log Reviews
  • Synthetic Transactions/Benchmarks
  • Code Review and Testing
  • Misuse Case Testing
  • Coverage Analysis
  • Interface Testing
  • Breach Attack Simulations
  • Compliance Checks 
• Collect Security Process Data 
  • Account Management
  • Management Review and Approval
  • Key Performance and Risk Indicators
  • Backup Verification Data
  • Training and Awareness
  • Disaster Recovery (DR) and Business Continuity (BC)
• Analyse Test Output and Generate Report 
  • Remediation
  • Exception Handling
  • Ethical Disclosure
• Conduct or Facilitate Security Audits 
  • Internal
  • External
  • Third-party
  • Location

Domain 7: Security Operations

• Understand and Comply with Investigations 
  • Evidence Collection and Handling  
  • Reporting and Documenting
  • Investigative Techniques
  • Digital Forensics Tools, Tactics, and Procedures
  • Artifacts (E.G., Data, Computer, Network, Mobile Device) 
• Conduct Logging and Monitoring Activities 
  • Intrusion Detection and Prevention
  • Security Information and Event Management
  • Continuous Monitoring
  • Egress Monitoring
  • Log Management
  • Threat Intelligence (E.G., Threat Feeds, Threat Hunting)
  • User and Entity Behaviour Analytics (UEBA)
• Perform Configuration Management
  • Apply Foundational Security Operations Concepts 
  • Applying Security Operations 
  • Need-to-know and Least Privilege 
  • Separation of Duties and Responsibilities 
  • Privileged Account Management 
  • Job Rotation
  • Service-Level Agreements 
• Apply Resource Protection
  • Media Management
  • Media Protection Techniques
  • Data at Rest/Data in Transit
• Conduct Incident Management
  • Detection
  • Response
  • Mitigation
  • Reporting
  • Recovery
  • Remediation
  • Lessons learned
• Operate and Maintain Detective and Preventative Measures 
  • Sandboxing
  • Honeypots/Honeynets 
  • Anti-Malware 
  • Machine Learning and Artificial Intelligence (AI) Based Tools
• Implement and Support Patch and Vulnerability Management
• Participate in Change Management Processes
  • Change Management 
• Implement Recovery Strategies
  • Backup Storage Strategies
  • Recovery Site Strategies
  • Multiple Processing Sites
  • System Resilience, High Availability (HA), Quality of Service (Qos), and Fault Tolerance
• Implement Disaster Recovery Processes
  • Response
  • Personnel
  • Communications
  • Assessment
  • Restoration
  • Training and Awareness
  • Lessons learned
• Test Disaster Recovery Plans
• Participate in Business Continuity (BC) Planning and Exercises 
• Implement and Manage Physical Security
• Address Personnel Safety and Security Concerns 
  • Travel
  • Security Training and Awareness 
  • Emergency Management
  • Duress

Domain 8: Software Development Security

• Understand and Integrate Security in the Software Development Life Cycle (SDLC)
  • Development Methodologies
  • Maturity Models 
  • Operation and Maintenance
  • Change Management
  • Integrated Product Team
• Identify and Apply Security Controls in Software Development Ecosystems
  • Programming Languages
  • Libraries
  • Tool Sets
  • Integrated Development Environment
  • Runtime
  • Continuous Integration and Continuous Delivery (CI/CD)
  • Software Configuration Management (CM)
  • Code Repositories
  • Application Security Testing
• Assess the Effectiveness of Software Security
  • Auditing and Logging of Changes
  • Risk Analysis and Mitigation
• Assess Security Impact of Acquired Software 
  • Commercial-off-the-shelf (COTS)
  • Open Source
  • Third-party
  • Managed Services
  • Cloud Services
• Define and Apply Secure Coding Guidelines and Standards
  • Security Weaknesses and Vulnerabilities at the Source-code Level 
  • Security of Application Programming Interfaces (API)
  • Secure Coding Practices
  • Software-defined Security
     

Who Should Attend this CISSP Training?

This CISSP Training is suitable for experienced IT and cyber security professionals who want to strengthen their knowledge across information security, governance, risk, architecture, and security operations. The following professionals can benefit from this training:

• Information Security Professionals
• Security Consultants
• Security Managers
• Security Analysts
• Risk Management Specialists
• Network Architects
• Compliance Officers

Prerequisites for the CISSP Training

There are no formal prerequisites to attend this CISSP Training. However, prior knowledge of information security, networking, governance, risk management, or security operations will help delegates engage effectively with the course content.

CISSP Training Overview

CISSP Training introduces delegates to the principles and practices used to manage and protect information across complex organisational environments. It covers security and risk management, architecture, network security, IAM, operations, and software development security.

Delegates develop skills in assessing risks, evaluating controls, managing access, interpreting security requirements, and supporting secure operations. They also strengthen their understanding of architecture, testing, incident response, and security governance.

This 5-Day course helps delegates build structured information security knowledge across technical and management domains. They will be better equipped to support security decisions, risk management, and organisational security objectives.

CISSP Training Course Objectives

• To understand key CISSP domains, including security and risk management and asset security
• To explore security architecture, IAM, assessment, and testing principles
• To understand legal, ethical, regulatory, and governance requirements
• To develop knowledge of security policies, standards, procedures, and guidelines
• To understand cryptographic principles and methods for protecting information
• To explore secure architecture, engineering, and design approaches

Learning Outcomes of CISSP Training Course

Upon completing this CISSP Training, delegates will understand how security governance, risk management, architecture, access control, and operational security work together. They will be better equipped to interpret security requirements and support informed information security decisions.

What’s Included in this CISSP Training Course?

• World-Class Training Sessions from Experienced Instructors
• Interactive Learning with 24*7 Support
• Digital Delegate Pack