Download Careers360 App

    CISSP – Certified Information Systems Security Professional Certification Training 2024

    BY
    Infosec Train

    Become a certified information security professional by enrolling in Infosec Train’s Certified Information Systems Security Professional programme.

    Brochure Enquire
    Mode

    Online

    Quick Facts

    particular details
    Medium of instructions English
    Mode of learning Self study, Virtual Classroom
    Mode of Delivery Video and Text Based

    Course overview

    CISSP is one of the most esteemed certifications in the information security domain. Infosec Train’s CISSP (ISC) ² certification programme aims to equip you with in-demand administrative and technical competence to architect, manage, and design an organisation’s security structure through internationally approved information security standards. 

    The Certified Information Systems Security Professional training offers in-depth knowledge of eight domains included in the CISSP common body knowledge (CBK) and helps you prepare for the CISSP exam held by the (ISC) ². Obtaining this certification will enhance your career opportunities by leaps and bounds, as it’s a highly reputed standard of achievement and an objective measure of excellence worldwide.

    With the Certified Information Systems Security Professional online programme, you’ll receive 48 hours of training by accredited instructors, along with online test simulations. You’ll also get access to recorded sessions for convenient learning. Prashant M, Ajit, and Prabh Nair will be your course educators.

    Also Read:
    The CISSP Certification Training Course

    The highlights

    • 48 hours of instructor-led training
    • Accredited and experienced instructors
    • Online test simulations
    • 3 learning options
    • Full 8-domain exam practice
    • Extensive curriculum
    • Access to recorded sessions
    • Globally-recognised certification
    • One-to-one training
    • Online curriculum
    • Completion certificate

    Program offerings

    • Full 8-domain exam practice
    • Online test simulations
    • Comprehensive training
    • Extensive curriculum
    • Online training
    • One-to-one training
    • Access to recorded sessions
    • 48 hours of instructor-led training.

    Course and certificate fees

    certificate availability

    Yes

    certificate providing authority

    Infosec Train

    Who it is for

    System security analyst

    The Certified Information Systems Security Professional training is best-suited for:

    • Security Architect
    • IT Director/Manager
    • Security Manager
    • Security Auditor
    • Network Architect
    • Security Systems Engineer
    • Security Consultant
    • Chief Information Officer
    • Security Analyst
    • Director of Security
    • Chief Information Security Officer

    Eligibility criteria

    To enrol in the Certified Information Systems Security Professional training programme, you must have a minimum of 5 years of work experience in at least 2 out of 8 domains listed under the (ISC) ² CISSP Common Body of Knowledge (CBK). One year of work experience required can be waived if you have a 4-year college degree or additional credit from the list approved by (ISC) ².

    Certification qualifying details

    To receive the certification, you must procure at least 700 marks out of 1000 in the CISSP certification exam. 

    What you will learn

    Communication skills Risk management

    Upon completing the Certified Information Systems Security Professional course syllabus, you will be able to:

    • Implement and understand fundamental concepts related to IT security
    • Identify potential risks and assess specific vulnerabilities, threats, and controls
    • Apply logical and physical access controls
    • Interpret and protect SLC (system lifecycle) and SDLC (software development lifecycle)
    • Deploy appropriate security countermeasures to optimise an organisation’s operational capacity
    • Understand network security and communication
    • Align organisational goals with security implementations and functions
    • Understand the principles, concepts, standards, and structure to design, implement, secure, and monitor operating systems, applications, networks, and other controls required to maintain CIA triad
    • Design, test, and audit strategies that facilitate a secure business environment
    • Understand the concept of network security and communication
    • Determine cryptography’s importance in providing modern-day security services
    • Understand various physical security elements and apply proper physical security protection measures
    • Protect valuable assets of an organisation
    • Interpret various access controls models essential for business security

    The syllabus

    Domain 1: Security and Risk Management

    1.1 Understand, adhere to, and promote professional ethics
    • ISC2 Code of Professional Ethics
    • Organizational code of ethics
    1.2 Understand and apply security concepts
    • Confidentiality, integrity, and availability, authenticity, and nonrepudiation (5 Pillars of Information Security)
    1.3 Evaluate and apply security governance principles
    • Alignment of the security function to business strategy, goals, mission, and objectives
    • Organizational processes (e.g., acquisitions, divestitures, governance committees)
    • Organizational roles and responsibilities
    • Security control frameworks (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST), Control Objectives for Information and Related Technology (COBIT), Sherwood Applied Business Security Architecture (SABSA), Payment Card Industry (PCI), Federal Risk and Authorization Management Program (FedRAMP))
    • Due care/due diligence
    1.4 – Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context
    • Cybercrimes and data breaches
    • Licensing and Intellectual Property requirements
    • Import/export controls
    • Transborder data flow
    • Issues related to privacy (e.g., General Data Protection Regulation (GDPR), California Consumer Privacy Act, Personal Information Protection Law, Protection of Personal Information Act)
    • Contractual, legal, industry standards, and regulatory requirements
    1.5 – Understand requirements for investigation types (i.e., administrative, criminal, civil, regulatory, industry standards)
    1.6 – Develop, document, and implement security policy, standards, procedures, and guidelines
    1.7 Identify, analyze, assess, prioritize, and implement Business Continuity (BC) requirements
    • Business impact analysis (BIA)
    • External dependencies
    1.8 Contribute to and enforce personnel security policies and procedures
    • Candidate screening and hiring
    • Employment agreements and policy driven requirements
    • Onboarding, transfers, and termination processes
    • Vendor, consultant, and contractor agreements and controls
    1.9 Understand and apply risk management concepts
    • Threat and vulnerability identification
    • Risk analysis, assessment, and scope
    • Risk response and treatment (e.g., cybersecurity insurance)
    • Applicable types of controls (e.g., preventive, detection, corrective)
    • Control assessments (e.g., security and privacy)
    • Continuous monitoring and measurement
    • Reporting (e.g., internal, external)
    • Continuous improvement (e.g., risk maturity modeling)
    • Risk frameworks (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST), Control Objectives for Information and Related Technology (COBIT), Sherwood Applied Business Security Architecture (SABSA), Payment Card Industry (PCI))
    1.10 – Understand and apply threat modeling concepts and methodologies
    1.11 – Apply Supply Chain Risk Management (SCRM) concepts
    • Risks associated with the acquisition of products and services from suppliers and providers (e.g., product tampering, counterfeits, implants)
    • Risk mitigations (e.g., third-party assessment and monitoring, minimum security requirements, service level requirements, silicon root of trust, physically unclonable function, software bill of materials)
    1.12 – Establish and maintain a security awareness, education, and training program
    • Methods and techniques to increase awareness and training (e.g., social engineering, phishing, security champions, gamification)
    • Periodic content reviews to include emerging technologies and trends (e.g., cryptocurrency, artificial intelligence (AI), blockchain)
    • Program effectiveness evaluation

    Domain 2: Asset Security

    2.1 Identify and classify information and assets
    • Asset Classification
    • Data classification
    2.2 Establish information and asset handling requirements
    2.3 Provision information and assets securely
    • Information and asset ownership
    • Asset inventory (e.g., tangible, intangible)
    • Asset management
    2.4 Manage data lifecycle
    • Data roles (i.e., owners, controllers, custodians, processors, users/subjects)
    • Data collection
    • Data location
    • Data maintenance
    • Data retention
    • Data remanence
    • Data destruction
    2.5 – Ensure appropriate asset retention (e.g., End of Life (EOL), End of Support)
    2.6 Determine data security controls and compliance requirements
    • Data states (e.g., in use, in transit, at rest)
    • Scoping and tailoring
    • Standards selection
    • Data protection methods (e.g., Digital Rights Management (DRM), Data Loss Prevention (DLP), Cloud Access Security Broker (CASB))

    Domain 3: Security Architecture and Engineering

    3.1 Research, implement and manage engineering processes using secure design principles
    • Threat modeling
    • Least privilege
    • Defense in depth
    • Secure defaults
    • Fail securely
    • Segregation of Duties (SoD)
    • Keep it simple and small
    • Zero trust or trust but verify
    • Privacy by design
    • Shared responsibility
    • Secure access service edge
    3.2 Understand the fundamental concepts of security models (e.g., Biba, Star Model, Bell-LaPadula)
    3.3 Select controls based upon systems security requirements
    3.4 Understand security capabilities of Information Systems (IS) (e.g., memory protection, Trusted Platform Module (TPM), encryption/decryption)
    3.5Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements
    • Client-based systems
    • Server-based systems
    • Database systems
    • Cryptographic systems
    • Industrial Control Systems (ICS)
    • Cloud-based systems (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS))
    • Distributed systems
    • Internet of Things (IoT)
    • Microservices (e.g., application programming interface (API))
    • Containerization
    • Serverless
    • Embedded systems
    • High-Performance Computing systems
    • Edge computing systems
    • Virtualized systems
    3.6 – Select and determine cryptographic solutions
    • Cryptographic life cycle (e.g., keys, algorithm selection)
    • Cryptographic methods (e.g., symmetric, asymmetric, elliptic curves, quantum)
    • Public key infrastructure (PKI) (e.g., quantum key distribution)
    3.7 – Understand methods of cryptanalytic attacks
    • Brute force
    • Ciphertext only
    • Known plaintext
    • Frequency analysis
    • Chosen ciphertext
    • Implementation attacks
    • Side-channel
    • Fault injection
    • Timing
    • Man-in-the-Middle (MITM)
    • Pass the hash
    • Kerberos exploitation
    • Ransomware
    3.8 – Apply security principles to site and facility design
    3.9 – Design site and facility security controls
    • Wiring closets/intermediate distribution facilities
    • Server rooms/data centers
    • Media storage facilities
    • Evidence storage
    • Restricted and work area security
    • Utilities and Heating, Ventilation, and Air Conditioning (HVAC)
    • Environmental issues (e.g., natural disasters, man-made)
    • Fire prevention, detection, and suppression
    • Power (e.g., redundant, backup)
    3.10 – Manage the information system lifecycle
    • Stakeholders needs and requirements
    • Requirements analysis
    • Architectural design
    • Development /implementation
    • Integration
    • Verification and validation
    • Transition/deployment
    • Operations and maintenance/sustainment
    • Retirement/disposal

    Domain 4: Communication and Network Security

    4.1 – Apply secure design principles in network architectures
    • Open System Interconnection (OSI) and Transmission Control Protocol/Internet Protocol (TCP/IP) models
    • Internet Protocol (IP) version 4 and 6 (IPv6) (e.g., unicast, broadcast, multicast, anycast)
    • Secure protocols (e.g., Internet Protocol Security (IPSec), Secure Shell (SSH), Secure Sockets Layer (SSL)/ Transport Layer Security (TLS))
    • Implications of multilayer protocols
    • Converged protocols (e.g., Internet Small Computer Systems Interface (iSCSI), Voice over Internet Protocol (VoIP), InfiniBand over Ethernet, Compute Express Link)
    • Transport architecture (e.g., topology, data/control/management plane, cut-through/store-and-forward)
    • Performance metrics (e.g., bandwidth, latency, jitter, throughput, signal-to-noise ratio)
    • Traffic flows (e.g., north-south, east-west)
    • Physical segmentation (e.g., in-band, out-of-band, air-gapped)
    • Logical segmentation (e.g., virtual local area networks (VLANs), virtual private networks (VPNs), virtual routing and forwarding, virtual domain)
    • Micro-segmentation (e.g., network overlays/encapsulation; distributed firewalls, routers, intrusion detection system (IDS)/intrusion prevention system (IPS), zero trust)
    • Edge networks (e.g., ingress/egress, peering)
    • Wireless networks (e.g., Bluetooth, Wi-Fi, Zigbee, satellite)
    • Cellular/mobile networks (e.g., 4G, 5G)
    • Content distribution networks (CDN)
    • Software defined networks (SDN), (e.g., application programming interface (API), Software-Defined Wide- Area Network, network functions virtualization)
    • Virtual Private Cloud (VPC)
    • Monitoring and management (e.g., network observability, traffic flow/shaping, capacity management, fault detection and handling)

    Domain 4: Communications and Network Security

    4.2 – Secure network components
    • Operation of infrastructure (e.g., redundant power, warranty, support)
    • Transmission media (e.g., physical security of media, signal propagation quality)
    • Network Access Control (NAC) systems (e.g., physical, and virtual solutions)
    • Endpoint security (e.g., host-based)
    4.3 – Implement secure communication channels according to design
    • Voice, video, and collaboration (e.g., conferencing, Zoom rooms)
    • Remote access (e.g., network administrative functions)
    • Data communications (e.g., backhaul networks, satellite)
    • Third-party connectivity (e.g., telecom providers, hardware support)

    Domain 5: Identity and Access Management (IAM)

    5.1 – Control physical and logical access to assets
    • Information
    • Systems
    • Devices
    • Facilities
    • Applications
    • Services
    5.2 – Design identification and authentication strategy (e.g., people, devices, and services)
    • Groups and Roles
    • Authentication, Authorization and Accounting (AAA) (e.g., multi-factor authentication (MFA), password-less authentication)
    • Session management
    • Registration, proofing, and establishment of identity
    • Federated Identity Management (FIM)
    • Credential management systems (e.g., Password vault)
    • Single sign-on (SSO)
    • Just-In-Time
    5.3 – Federated identity with a third-party service
    • On-premise
    • Cloud
    • Hybrid
    5.4 – Implement and manage authorization mechanisms
    • Role-based access control (RBAC)
    • Rule based access control
    • Mandatory access control (MAC)
    • Discretionary access control (DAC)
    • Attribute-based access control (ABAC)
    • Risk based access control
    • Access policy enforcement (e.g., policy decision point, policy enforcement point)
    5.5 – Manage the identity and access provisioning lifecycle
    • Account access review (e.g., user, system, service)
    • Provisioning and deprovisioning (e.g., on /off boarding and transfers)
    • Role definition and transition (e.g., people assigned to new roles)
    • Privilege escalation (e.g., use of sudo, auditing its use)
    • Service accounts management
    5.6 – Implement authentication systems

    Domain 6: Security Assessment and Testing

    6.1 – Design and validate assessment, test, and audit strategies
    • Internal (e.g., within organization control)
    • External (e.g., outside organization control)
    • Third-party (e.g., outside of enterprise control)
    • Location (e.g., on-premises, cloud, hybrid)
    6.2 – Conduct security control testing
    • Vulnerability assessment
    • Penetration testing (e.g., red, blue, and/or purple team exercises)
    • Log reviews
    • Synthetic transactions/benchmarks
    • Code review and testing
    • Misuse case testing
    • Coverage analysis
    • Interface testing (e.g., user interface, network interface, application programming interface (API))
    • Breach attack simulations
    • Compliance checks
    6.3 – Collect security process data (e.g., technical and administrative)
    • Account management
    • Management review and approval
    • Key performance and risk indicators
    • Backup verification data
    • Training and awareness
    • Disaster Recovery (DR) and Business Continuity (BC)
    6.4 – Analyze test output and generate report
    • Remediation
    • Exception handling
    • Ethical disclosure
    6.5 – Conduct or facilitate security audits
    • Internal (e.g., within organization control)
    • External (e.g., outside organization control)
    • Third-party (e.g., outside of enterprise control)
    • Location (e.g., on-premises, cloud, hybrid)

    Domain 7: Security Operations

    7.1 – Understand and comply with investigations
    • Evidence collection and handling
    • Reporting and documentation
    • Investigative techniques
    • Digital forensics tools, tactics, and procedures
    • Artifacts (e.g., data, computer, network, mobile device)

    Domain 7: Security Operations

    7.2 – Conduct logging and monitoring activities
    • Intrusion detection and prevention (IDPS)
    • Security Information and Event Management (SIEM)
    • Continuous monitoring and tuning
    • Egress monitoring
    • Log management
    • Threat intelligence (e.g., threat feeds, threat hunting)
    • User and Entity Behavior Analytics (UEBA)
    7.3 – Perform Configuration Management (CM) (e.g., provisioning, baselining, automation)
    7.4 – Apply foundational security operations concepts
    • Need-to-know/least privilege
    • Separation of Duties (SoD) and responsibilities
    • Privileged account management
    • Job rotation
    • Service-level agreements (SLA)
    7.5 – Apply resource protection
    • Media management
    • Media protection techniques
    • Data at rest/data in transit
    7.6 – Conduct incident management
    • Detection
    • Response
    • Mitigation
    • Reporting
    • Recovery
    • Remediation
    • Lessons learned
    7.7 – Operate and maintain detection and preventative measures
    • Firewalls (e.g., next generation, web application, network)
    • Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)
    • Whitelisting/blacklisting
    • Third-party provided security services
    • Sandboxing
    • Honeypots/honeynets
    • Anti-malware
    • Machine learning and Artificial Intelligence (AI) based tools
    7.8 – Implement and support patch and vulnerability management
    7.9 – Understand and participate in change management processes
    7.10 – Implement recovery strategies
    • Backup storage strategies (e.g., cloud storage, onsite, offsite)
    • Recovery site strategies (e.g., cold vs. hot, resource capacity agreements)
    • Multiple processing sites
    • System resilience, high availability (HA), Quality of Service (QoS), and fault tolerance
    7.11 – Implement Disaster Recovery (DR) processes
    • Response
    • Personnel
    • Communications (e.g., methods)
    • Assessment
    • Restoration
    • Training and awareness
    • Lessons learned
    7.12 – Test Disaster Recovery Plans (DRP)
    • Read-through/tabletop
    • Walkthrough
    • Simulation
    • Parallel
    • Full interruption
    • Communications (e.g., stakeholders, test status, regulators)
    7.13 – Participate in Business Continuity (BC) planning and exercises
    7.14 – Implement and manage physical security
    • Perimeter security controls
    • Internal security controls
    7.15 – Address personnel safety and security concerns
    • Travel
    • Security training and awareness (e.g., insider threat, social media impacts, two-factor authentication (2FA) fatigue)
    • Emergency management
    • Duress

    Domain 8: Software Development Security

    8.1 – Understand and integrate security in the Software Development Life Cycle (SDLC)
    • Development methodologies (e.g., Agile, Waterfall, DevOps, DevSecOps, Scaled Agile Framework)
    • Maturity models (e.g., Capability Maturity Model (CMM), Software Assurance Maturity Model (SAMM))
    • Operation and maintenance
    • Change management
    • Integrated Product Team
    8.2 – Identify and apply security controls in software development ecosystems
    • Programming languages
    • Libraries
    • Tool sets
    • Integrated Development Environment
    • Runtime
    • Continuous Integration and Continuous Delivery (CI/CD)
    • Software configuration management (CM)
    • Code repositories
    • Application security testing (e.g., static application security testing (SAST), dynamic application security testing (DAST), software composition analysis, Interactive Application Security Test (IAST))
    8.3 – Assess the effectiveness of software security
    • Auditing and logging of changes
    • Risk analysis and mitigation
    8.4 – Assess security impact of acquired software
    • Commercial-off-the-shelf (COTS)
    • Open source
    • Third-party
    • Managed services (e.g., enterprise applications)
    • Cloud services (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS))
    8.5 – Define and apply secure coding guidelines and standards
    • Security weaknesses and vulnerabilities at the source-code level
    • Security of application programming interfaces (API)
    • Secure coding practices
    • Software-defined security

    Admission details

    • https://www.infosectrain.com/courses/cissp-certification-training/ Here’s the link for the Certified Information Systems Security Professional course website.
    • Go through the course details carefully upon landing on the page. Once you’re satisfied with the curriculum outcomes, scroll down to the “Choose Your Preferred Learning Mode” section, choose one that suits you, and select “Enroll Now.”
    • An admission form will pop up on your screen. Fill in the required details and hit ‘Submit Now.’
    • You will receive an email or phone call from the programme counsellors shortly.

    Filling the form

    While enrolling for the Certified Information Systems Security Professional online course, you will have to fill a short form. Here, you must provide details like your name, phone number, email address, and country name. If you’re applying for corporate training, you’ll also have to declare your organisation's employee strength and your company’s name.

    Evaluation process

    The CISSP (ISC) ² certification test is a 3-hour exam consisting of 150 MCQ-type questions. It is delivered in CAT (computerised adaptive testing) method and is available in many languages. 

    How it helps

    Undertaking the Certified Information Systems Security Professional online programme, you get access to expert-curated training material, and online test simulations mapped to every domain of the CISSP syllabus. Also, certified instructors deliver the course, ensuring that you receive only the most relevant content. 

    Recorded sessions and one free session redo are also available to help you get back on track if you miss a lecture. With all these benefits, you’re sure to ace the CISSP certification exam.

    Instructors

    Mr Prabh Nair
    Instructor
    Freelancer

    FAQs

    Who conducts the CISSP certification exam?

    The International Information Systems Security Certification Consortium (ISC) 2 conducts the CISSP certification exam.

    What if I miss a live session?

    If, for some reason, you miss a session, don’t worry. You will be able to access the recordings of all live sessions.

    Do I mandatorily need 5 years of work experience to appear for the CISSP exam?

    Yes, 5 years of work experience is a necessary eligibility criterion that one must fulfil to sit for the CISSP exam. However, you can get a waiver of one year if you have a 4-year college degree or additional credentials from the (ISC) ² approved lists.

    How long is the CISSP certification exam?

    The exam is 3 hours long.

    Trending Courses

    Digital Marketing Courses Fashion Design Courses Data Science Courses Interior Design Courses Graphic Designing Courses Cyber Security Courses Nursing Courses Tally Courses Data Analysis Courses Web Designing Courses Artificial Intelligence Courses Ethical Hacking Courses Free Digital Marketing Courses And certifications Free Artificial Intelligence Courses And Certifications Free Data Analysis Courses And Certifications Free Cyber Security Courses And Certifications Free Data Science Courses And Certifications Free Cloud Computing Courses And Certifications Free Python Courses And Certifications Free Fashion And Textiles Courses And Certifications Free Graphic Designing Courses And Certifications Free Web Designing Courses And Certifications

    Popular Courses

    General Management Courses Public Health Courses Teaching and Education Courses Financial Management Courses Web Development Courses Mathematics Courses Programming Courses Data Science Courses Cyber Security Courses Digital Marketing Courses Law Courses Mechanical Engineering Courses Explore all courses

    Popular Platforms

    upGrad Courses Udemy Courses Swayam Courses Edx Courses Coursera Courses NPTEL Courses Futurelearn Courses Mindmajix Technologies Courses Vskills Courses IIT Kharagpur Courses IIT Kanpur Courses Emeritus Courses Explore all platforms

    Learn more about the Courses

    10 Reasons to Enrol Yourself in a Digital Marketing Course 8 Must-Have Skills for AWS Cloud Architects Planning to Upskill Yourself? Enrol for a Program in Data Science 25+ Tips for Improving Your Graphic Design Skills Top Universities in India Offering Cyber Security Courses 15+ Courses for Learning Data Mining How to Make a Career in the Field of Artificial Intelligence Top 10 Benefits Of Holding A Certification In Business Intelligence Which are the best certification courses for Photography in India A Beginner's Guide to Pursue Python Programming Want to Pursue a Career in Blockchain Technology? Here is all that you need to Know How Entrepreneurs Can Use Machine Learning to Make their Business Successful? The Scope of Artificial Intelligence in India Top 10 Online Courses for Travel Lovers 10 Best Certification Courses After Hospital and Healthcare Management
    Providers
    Close
    Download Careers360 App
    All this at the convenience of your phone

    • Regular Exam Updates

    • Best College Recommendations

    • College & Rank predictors

    • Detailed Books and Sample Papers

    • Question and Answers

    google play
    students
    400M+ Students
    Colleges
    36K+ Colleges
    Exams
    500+ Exams
    eBooks
    3K+ eBooks
    Certification
    16K+ Certifications
    mobile