KnowledgeStep: CISSP/CISO Preparation Bootcamp

Schedule View
Course Description

Start Date	End Date	Price	Location	Register
No scheduled dates - call for info		$

Course Description: The CISSP/CISSO is a premier security certification and one of the most difficult certifications to achieve, making training an important part of exam preparation. This 5-day course is designed to ensure a solid understanding of the popular 10 Security Domains areas of the Common Body of Knowledge (CBK). Students will learn about security policy development, secure software development procedures, network vulnerabilities, attack types and corresponding countermeasures, cryptography concepts and their uses, disaster recovery plans and procedures, risk analysis, crucial laws and regulations, forensics basics, computer crime investigation procedures, and physical security. Mile2's “in-depth” course focuses on the preparation of passing both mile2's CISSO and ISC2's CISSP exam. Upon completion, the student will be fully prepared to take and successfully pass the CISSP/CISSO exam.

Audience: Individuals interested in pursuing the CISSP/CISSO examination.

Prerequisites: (ISC)2 requires exam candidates to have a minimum of five years of relevant work experience in two or more of the ten domains, four years of work experience with an applicable college degree, or a credential from the (ISC)2-approved list.

Course Contents

Building a Successful Security Infrastructure

Defending a Changing Business
Responsible Roles for Security
The Security Domains
Security Infrastructure
Security Challenges
The Evolution
Access Control
Cryptography
Physical Security
Security Architecture
Business Continuity Planning and Risk Management
Telecommunications and Network Security
Application and System Development
Operations Security
Law, Investigation and Ethics
Security Services
Security Strategies
Policy Compliance
Security Model
Top 10 Security Strategies
4APIN
D-PAST
SHANK
Security Stoplight Chart

Information Security and Risk Management

Components of the CBK
CBK Key Concepts
Confidentiality
Integrity
Availability
A.A.D. – Disclosure, Alteration and Destruction
Authorization, Identification, authentication, Accountability and Privacy
Due Care, Due Diligence, Separation of Duties and Rotation of Duties
Baselines, Procedures, and Safeguards
Relationships Between Different Security Components
Risk Analysis and Assessment
Risk Management, Threat, Exposure, Vulnerability and Risk Mitigation
Information Asset, Qualitative, Quantitative, Risk Analysis and Risk Assessment
Resistance to Risk Management
Risk Management Steps
Value of Information Assets
Risk Management Tools
Risk Analysis and Assessment
Threats, Vulnerabilities and Risks
Risk Management Metrics
EF, SLE, ARO, and ALE
Single Loss Expectance (SLE)
Annualized Rate of Occurrence (ARO)
Annualized Loss Expectancy (ALE)
Safeguard Cost Analysis
Information Classification
Data Classification
Objectives of Classification Scheme
Criteria by Which Data is Classified
Commercial Data Classification
Government Data Classification
Roles and Responsibilities
Senior Management
Security Management
Organizational Position
Policies, Procedures, Standards, Baselines and Guidelines
Written Guidance
Policies and Standards – Policy Elements and Policy Creation Guidelines
Management Responsibilities and Policy Enforcement
Standards
Procedures
Guidelines
Employment Policies
Hiring Practices
Background Check
Termination Policies
Job Descriptions
Employee Education Programs
Security Awareness
Training
Knowledge of a Threat
Change Management
Change Control
Total Quality Management
ISO-9000
Best Management Practices

Access Control

General Concepts
Pillars of Information Assurance
Controls
Data Ownership
Identification
Authentication
Access Control
Access Control Principles
Access Control Types
Access Control Categories
Access Control Techniques
Discretionary Access Control
Mandatory Access Control
Role Based Access Control
Lattice Based Access Control
Rule Based Access Control
Access Control Lists
Access Control Models
State Machine Model
Bell-Lapadula Model
Criticisms of the Bell-Lapadula Model
Bida Model
Clark and Wilson Model
Non-Interference Model
Access Matrix Model
Information Flow Model
Authentication Methods
Password
Password Attacks
Problems with Passwords
Pass Phrase
One-Time Password
Token Devices
One-Time Password Attacks
Smart Card
Smart Card Issues
Order of Effectiveness
Order of Acceptance
Issues with Characteristics Based Authentication
Multi-Factor Authentication
Access Control Systems
Single Sign On
Kerberos
Sesame
Access Administration
Centralized
Decentralized
Hybrid
Radius
Object Reuse Issues
Monitoring
Accountability
Intrusion Detection Systems
Attack Signatures
Anomaly Identification
Intrusion Response
Databases
Database Monitoring
Best Practices

Cryptography

Defining Cryptography
How Does it Work?
Defining Algorithms
What are Keys?
Crypto Terms
One-Time Pad
Cryptanalysis Terms
Services Provided by Cryptography
Symmetric Encryption
Block and Stream Ciphers
Common Algorithms for Symmetric Keys
AES – Blowfish
Symmetric Encryption Strengths and Weaknesses
What is a Hash Function?
Rainbow Crack
Common Hash Algorithms
Asymmetric Encryption
Digital Signatures
Asymmetric Encryption Strengths and Weaknesses
Hybrid Encryption
Hybrid Decryption
PKI
X.509 Certificate
The TCP-IP Stack
IPSEC Protocols
SSL
SSH
PGP
Cracking Techniques
Hackability of Wireless
Sniffling, snooping and Eavesdropping

Physical Security

What Does Physical Security Include?
Environmental Protection
External Threats
Liability Concerns
Program Goals
Risks and Countermeasures
Physical Security Program
Crime Prevention
Site Design and Configuration Considerations
Boundary Protection
Data Center Controls
Computing Facility Requirements – Walls and Doors
Windows/Opening and Computer and Equipment Room
Electrical Power
Preventative Steps
Dedicated Circuits, Controlled Access
Backup Power
Air Conditioning
Humidity Controls, Air Quality and Water Protection
Positive Pressurization
Fire Prevention
Fire Suppression
Fire Extinguishing Systems
Fire Classes and Combustibles
Carbon Dioxide
Halon
Secure Storage Areas
Media Protection
Protecting Wiring
Personnel Access Control
Locks
Tokens
Types of Access Cards
Biometrics
Distributed Processing – Threats
Office Area Controls

Security Architecture and Design

Computer Organization
Abstract Levels of Modern Computer Systems
Computer Hardware
CPU Models and Protection Rings
Computer Hardware
Computer Software
Memory Management
System Recovery
Single Processor System
Multi-Processor System
Types of Data Storage
Information Security Architecture
Execution Domain, Least Privilege
Protections Mechanisms, Process Isolation and Resource Access Control
Process Isolation
Open and Closed Systems
Access Control Techniques
Access Controls
Architectural Foundation
Modes of Operation
Information Security Structures
Certification and Accreditation
ITSEC Standard
TCSEC Standard
Common Criteria
Criteria Comparison
Bell Lapadula
Bida
Security Models
Clark and Wilson
Common Flaws
Covert Channels

Business Continuity and Disaster Recovery Planning

Who is Really Ready?
The DRBCP Basics
Reasons for BCP
BCP Components
BCP Key Concepts
BCP Definitions
The Business Continuity Lifecycle
NIST SP800-34
BCP Phases
Phase 1 – Project Initiation
BIA Steps
BIA
Define Threats
Categorize Events
Maximum Tolerable Downtime
Recovery Cost Balancing
Recovery Strategies
Electronic Vaulting
Alternate Sites
Off-Site Storage
Alternate Site Planning
Data Redundancy
Raid
Raid Levels
System Backups
Plan Development
Types of Testing
Stages of an Incident
Integrating Security

Applications and Systems Development

General Security Principles
Problems
Databases and Data Warehousing
Relational Database
Relational Database Controls
Query Language
Object-Oriented Database
DAC Object-Oriented Models
MAC Object-Oriented Models
Object-Oriented Issues
Programming/Data Attacks
Applications Beyond the Database
Definitions
Application System Development
Controls
Compiled vs. Interpreted
Vulnerabilities
Vulnerability Definition
The Evolving Threat
Exploit Timeline
Potential Vulnerabilities
Zombie
Botnet
Vulnerability Assessment
Vulnerability Identification
National Vulnerability Database
Nessus

Operations Security

Controls and Protections
Categories of Controls
Accountability
Separation of Duties
Trusted Recovery
Configuration/Change Management Control
Administrative Controls
Least Privilege
Due Care and Due Diligence
Resource Protection
Hardware Controls
Software Controls
Email Security
Fax Security
Privileged Entity Controls
Media Security Controls
Physical Access Controls
Security Auditing
Monitoring Techniques
Audit Trails
Event/Log Management
Problem Management Concepts
Threats and Vulnerabilities
Controls Summary
Defense In Depth

Legal, Regulations, Compliance and Investigations

The Building Blocks of Information Security
Ethics
Code of Ethics
Computer Ethics Institute
Guidance Organization
Laws and Legal System
Types of Laws
Civil Laws
Administrative/Regulatory Concepts
Intellectual Property Definitions
Proprietary Rights and Obligations
Protection for Computer Objects
Computer Security, Privacy and Crime Laws – US
Computer Security, Privacy and Crime Laws – Canada
EU Privacy Principles
Privacy Regulations
Electronic Monitoring
Liability
Computer Crime Investigation
Looking for Criminals
Hackers Profiles
Computer Crime
Computer Crime Laws
Civil Law
International Laws
Computer Investigation
CI Issues
Investigation Steps
Computer Forensics
Computer Forensics – Canada Law
Evidence Admissibility
Rules Evidence
Exceptions to the Hearsay Rule

Course ITSEC01: CISSP/CISO Preparation Bootcamp

Course Contents

Building a Successful Security Infrastructure

Information Security and Risk Management

Access Control

Cryptography

Physical Security

Security Architecture and Design

Business Continuity and Disaster Recovery Planning

Telecommunications and Network Security

Applications and Systems Development

Operations Security

Legal, Regulations, Compliance and Investigations

Training

Consulting

Services

Maximize your ROI

[email protected]