ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

Contents

• Introduction Introduction

  • Earning your CISSP

    1m 4s
  • What you should know

    43s
  • Study resources

    1m 48s
• 1. The CISSP Exam 1. The CISSP Exam

  • The CISSP exam

    1m 13s
  • Is the CISSP right for you?

    4m 45s
  • Careers in information security

    3m 33s
  • Value of certification

    2m 50s
• 2. Inside the CISSP Exam 2. Inside the CISSP Exam

  • Registering for the exam

    3m 7s
  • Exam environment

    3m 13s
  • Question types

    5m 12s
  • Computerized adaptive testing

    1m 28s
  • Passing the exam

    2m 28s
• 3. Preparing for the Exam 3. Preparing for the Exam

  • Exam tips

    1m 5s
  • Practice tests

    1m 22s
• 4. Experience Requirement 4. Experience Requirement

  • Meeting the experience requirement

    5m 16s
  • Continuing education requirements

    4m 6s
• 5. Domain 1: Security and Risk Management 5. Domain 1: Security and Risk Management

  • Overview of the Security and Risk Management domain

    44s
• 6. Security Fundamentals 6. Security Fundamentals

  • The five pillars of information security

    3m 39s
  • Confidentiality

    1m 32s
  • Integrity

    2m 58s
  • Availability

    1m 39s
  • Authenticity and nonrepudiation

    3m 37s
• 7. Security Governance 7. Security Governance

  • Aligning security with the business

    3m 24s
  • Organizational processes

    3m 13s
  • Security roles and responsibilities

    2m 30s
  • Control and risk frameworks

    8m 54s
• 8. Compliance and Ethics 8. Compliance and Ethics

  • Legal and compliance risks

    2m 19s
  • Data privacy

    4m
  • General Data Protection Regulation (GDPR)

    7m 12s
  • California privacy law

    5m 56s
  • National data privacy laws

    2m 48s
  • Computer crimes

    1m 49s
  • Software licensing

    2m 54s
  • Intellectual property

    4m 22s
  • Import and export controls

    1m 42s
  • Data breaches

    2m 16s
  • Ethics

    1m 32s
• 9. Security Policy 9. Security Policy

  • Security policy framework

    4m 13s
  • Security policies

    4m 13s
• 10. Business Continuity 10. Business Continuity

  • Business continuity planning

    3m 44s
  • Business continuity controls

    3m 32s
  • High availability and fault tolerance

    5m 27s
• 11. Personnel Security 11. Personnel Security

  • Personnel security

    2m 51s
  • Security in the hiring process

    3m 30s
  • Employee termination process

    2m 38s
  • Employee privacy

    1m 57s
  • Social networking

    2m 56s
• 12. Risk Management 12. Risk Management

  • Risk analysis, assessment, and scope

    6m 36s
  • Quantitative risk assessment

    6m 10s
  • Risk treatment

    6m
  • Security control selection and implementation

    5m 17s
  • Continuous monitoring, measurement, and tuning

    4m 52s
  • Risk management frameworks

    3m 4s
  • Risk visibility and reporting

    5m 4s
• 13. Threat Modeling 13. Threat Modeling

  • Threat intelligence

    3m 21s
  • Managing threat indicators

    3m 37s
  • Intelligence sharing

    2m 6s
  • Threat research

    2m 20s
  • Identifying threats

    2m 24s
  • Automating threat intelligence

    3m 48s
  • Threat hunting

    3m 50s
• 14. Supply Chain Risk Management 14. Supply Chain Risk Management

  • Managing vendor relationships

    4m 17s
  • Vendor agreements

    3m 49s
  • Vendor information management

    1m 41s
  • Cloud audits

    3m 26s
• 15. Awareness and Training 15. Awareness and Training

  • Security awareness training

    5m 49s
  • Compliance training

    3m 7s
  • User habits

    3m 7s
  • Measuring compliance and security posture

    1m 47s
• 16. Domain 2: Asset Security 16. Domain 2: Asset Security

  • Overview of the Asset Security domain

    35s
• 17. Data Security 17. Data Security

  • Understanding data security

    3m 7s
  • Data security policies

    5m 2s
  • Data security roles

    4m 50s
  • Limiting data collection

    2m 50s
  • The data lifecycle

    5m 13s
• 18. Data Security Controls 18. Data Security Controls

  • Developing security baselines

    4m
  • Leveraging industry standards

    3m 7s
  • Customizing security standards

    2m 14s
  • Cloud storage security

    4m 30s
  • Information classification

    2m 54s
  • Digital rights management

    2m 46s
  • Data loss prevention

    5m 17s
• 19. Change and Configuration Management 19. Change and Configuration Management

  • Change management

    2m 21s
  • Configuration and asset management

    2m 31s
  • Physical asset management

    3m 9s
  • Supply chain risks and mitigations

    6m 47s
• 20. Domain 3: Security Engineering 20. Domain 3: Security Engineering

  • Overview of the Security Architecture and Engineering domain

    40s
• 21. Secure Design 21. Secure Design

  • Secure design principles

    4m 56s
  • Security models

    3m 57s
  • Security evaluation models

    3m 7s
  • Segregation of duties

    3m 18s
  • Privacy by design

    3m 2s
  • Secure defaults

    3m 18s
  • Information system lifecycle

    3m 10s
• 22. Virtualization and Cloud Computing 22. Virtualization and Cloud Computing

  • What is the cloud?

    3m 53s
  • Cloud computing roles

    2m 35s
  • Drivers for cloud computing

    3m 17s
  • Security service providers

    2m 38s
  • Multitenant computing

    2m 15s
  • Virtualization

    4m 48s
  • Desktop and application virtualization

    2m 38s
  • Cloud compute resources

    7m 52s
  • Containerization

    1m 58s
  • Cloud activities and the cloud reference architecture

    2m 48s
  • Cloud deployment models

    2m 45s
  • Cloud service categories

    4m 47s
  • Edge and fog computing

    1m 46s
• 23. Hardware Security 23. Hardware Security

  • Memory protection

    3m 8s
  • Hardware encryption

    5m 23s
  • Hardware and firmware security

    4m 38s
• 24. Server Security Issues 24. Server Security Issues

  • Server and database security

    3m 51s
  • NoSQL databases

    6m 36s
  • Distributed and high-performance computing

    4m 29s
• 25. Embedded Systems Security 25. Embedded Systems Security

  • Industrial control systems and operational technology

    5m 9s
  • Internet of things

    3m 6s
  • Securing smart devices

    3m 7s
  • Secure networking for smart devices

    2m 23s
  • Embedded systems

    4m 29s
  • Communications for embedded devices

    1m 27s
• 26. Encryption 26. Encryption

  • Understanding encryption

    2m 49s
  • Symmetric and asymmetric cryptography

    4m 18s
  • Goals of cryptography

    3m 47s
  • Codes and ciphers

    3m 5s
  • Cryptographic math

    2m 38s
  • Choosing encryption algorithms

    3m 27s
  • The perfect encryption algorithm

    3m 21s
  • The cryptographic lifecycle

    2m 33s
• 27. Symmetric Cryptography 27. Symmetric Cryptography

  • Data encryption standard

    2m 49s
  • 3DES

    2m 49s
  • AES, Blowfish, and Twofish

    5m 47s
  • RC4

    2m
  • Cipher modes

    3m 39s
  • Steganography

    3m 57s
• 28. Asymmetric Cryptography 28. Asymmetric Cryptography

  • Rivest-Shamir-Adelman (RSA)

    2m 47s
  • PGP and GnuPG

    10m 47s
  • Elliptic curve and quantum cryptography

    3m 8s
• 29. Key Management 29. Key Management

  • Key management practices

    3m 4s
  • Key exchange

    2m 42s
  • Diffie-Hellman

    4m 33s
  • Key escrow

    2m 58s
  • Key stretching

    1m 43s
  • Hardware security modules

    1m 36s
• 30. Public Key Infrastructure 30. Public Key Infrastructure

  • Trust models

    2m 52s
  • PKI and digital certificates

    4m 5s
  • Hash functions

    7m 38s
  • Digital signatures

    3m 51s
  • Digital signature standard

    1m 39s
  • Create a digital certificate

    4m 55s
  • Revoke a digital certificate

    1m 41s
  • Certificate stapling

    2m 29s
  • Certificate authorities

    6m 13s
  • Certificate subjects

    3m 35s
  • Certificate types

    2m 55s
  • Certificate formats

    2m 30s
• 31. Cryptanalytic Attacks 31. Cryptanalytic Attacks

  • Brute-force attacks

    2m 57s
  • Knowledge-based attacks

    2m 41s
  • Eavesdropping attacks

    4m 12s
  • Implementation attacks

    1m 40s
  • Limitations of encryption algorithms

    2m 42s
  • Ransomware

    7m 39s
• 32. Physical Security 32. Physical Security

  • Site and facility design

    3m 24s
  • Data center environmental controls

    3m 49s
  • Data center environmental protection

    5m 5s
  • Power control

    2m 32s
  • Physical access control

    4m 56s
  • Visitor management

    1m 30s
  • Physical security personnel

    2m 12s
• 33. Software Security Architecture 33. Software Security Architecture

  • SOAP and REST

    2m 25s
  • SOA and microservices

    1m 39s
• 34. Domain 4: Communication and Network Security 34. Domain 4: Communication and Network Security

  • Introducing the Communication and Network Security domain

    33s
• 35. TCP/IP Networking 35. TCP/IP Networking

  • Introducing TCP/IP

    5m 50s
  • IP addresses and DHCP

    3m 55s
  • Network traffic

    2m 54s
  • Domain name system (DNS)

    4m 22s
  • Network ports

    3m 37s
  • ICMP

    3m 16s
  • Multilayer protocols

    1m 58s
• 36. Secure Network Design 36. Secure Network Design

  • Public and private addressing

    5m 51s
  • Subnetting

    3m 3s
  • Security zones

    3m 52s
  • Isolating sensitive systems

    2m 59s
  • VLANs and logical segmentation

    4m 37s
  • Security device placement

    6m 17s
  • Software defined networking (SDN)

    4m 58s
  • Transmission media

    2m 50s
  • Cloud networking

    2m 30s
  • Zero trust and SASE

    5m 32s
• 37. Network Security Devices 37. Network Security Devices

  • Routers, switches, and bridges

    3m 6s
  • Network topologies

    3m 4s
  • Transport architecture

    2m 52s
  • Firewalls

    6m 7s
  • Proxy servers

    2m 41s
  • Load balancers

    4m 9s
  • VPNs and VPN concentrators

    4m 29s
  • Network intrusion detection and prevention

    5m 1s
  • Protocol analyzers

    8m 57s
  • Unified threat management

    1m 57s
  • Content distribution networks

    4m 4s
• 38. Network Security Techniques 38. Network Security Techniques

  • Restricting network access

    2m 8s
  • Network access control

    5m 33s
  • Firewall rule management

    4m 9s
  • Router configuration security

    4m 5s
  • Switch configuration security

    3m 42s
  • Maintaining network availability

    2m 34s
  • Network monitoring

    2m 30s
  • Firewall and network logs

    4m 1s
  • Network performance metrics

    2m 59s
  • SNMP

    2m 54s
  • Isolating sensitive systems

    1m 58s
  • Deception technologies

    2m 51s
  • Network support

    2m 4s
• 39. Specialized Networking 39. Specialized Networking

  • Telephony

    2m 13s
  • Multimedia collaboration

    4m 41s
  • Storage networks

    3m 20s
• 40. Transport Encryption 40. Transport Encryption

  • TLS and SSL

    5m 5s
  • IPsec

    2m 49s
  • Remote network access

    4m 59s
• 41. Wireless Networking 41. Wireless Networking

  • Understanding wireless networking

    3m 25s
  • Wireless encryption

    2m 52s
  • Wireless authentication

    4m 42s
  • Wireless signal propagation

    2m 48s
  • Wireless networking equipment

    1m 43s
• 42. Mobile Device Security 42. Mobile Device Security

  • Mobile connection methods

    2m 36s
  • Mobile device security

    2m 27s
  • Mobile device management

    6m 28s
  • Mobile device tracking

    3m 5s
  • Mobile application security

    3m 54s
  • Mobile security enforcement

    3m 54s
  • Bring your own device (BYOD)

    4m 35s
  • Mobile deployment models

    2m 54s
• 43. Host Security 43. Host Security

  • Operating system security

    8m 44s
  • Malware prevention

    7m 25s
  • Application management

    5m 23s
  • Host-based network security controls

    7m 44s
  • File integrity monitoring

    4m 9s
• 44. Domain 5: Identity and Access Management 44. Domain 5: Identity and Access Management

  • Introducing the Identity and Access Management (IAM) domain

    36s
• 45. Identification 45. Identification

  • Authentication, authorization, and accounting (AAA)

    3m 31s
  • Usernames and access cards

    3m 23s
  • Biometrics

    2m 42s
  • Registration and identity proofing

    4m 11s
• 46. Authentication 46. Authentication

  • Authentication factors

    3m 26s
  • Multifactor authentication

    2m 35s
  • Something you have

    4m 23s
  • Password authentication protocols

    3m 10s
  • Single sign-on and federation

    3m 9s
  • RADIUS

    2m 18s
  • Kerberos and LDAP

    5m 18s
  • SAML

    2m 35s
  • Identity as a service (IDaaS)

    2m 50s
  • OAuth and OpenID Connect

    2m 55s
  • Certificate-based authentication

    5m 25s
  • Passwordless authentication

    3m 23s
• 47. Accountability 47. Accountability

  • Accountability

    2m 41s
  • Session management

    1m 50s
• 48. Account Management 48. Account Management

  • Understand account and privilege management

    3m 9s
  • Account types

    3m 52s
  • Account policies

    3m 31s
  • Password policies

    4m 19s
  • Manage roles

    3m 44s
  • Account monitoring

    3m 48s
  • Provisioning and deprovisioning

    4m 18s
• 49. Authorization 49. Authorization

  • Understand authorization

    3m 51s
  • Mandatory access controls

    2m 34s
  • Discretionary access controls

    2m 28s
  • Access control lists

    4m 50s
  • Database access control

    4m 4s
  • Advanced authorization concepts

    5m 36s
• 50. Access Control Attacks 50. Access Control Attacks

  • Social engineering

    5m 29s
  • Impersonation attacks

    4m 39s
  • Identity fraud and pretexting

    2m 56s
  • Watering hole attacks

    2m 33s
  • Physical social engineering

    2m 31s
• 51. Domain 6: Security Assessment and Testing 51. Domain 6: Security Assessment and Testing

  • Introducing the Security Assessment and Testing domain

    34s
• 52. Vulnerability Scanning 52. Vulnerability Scanning

  • What is vulnerability management?

    5m 2s
  • Identify scan targets

    4m 24s
  • Scan configuration

    5m 20s
  • Scan perspective

    4m 24s
  • Analyzing scan reports

    4m 30s
  • Correlating scan results

    2m 20s
• 53. Penetration Testing 53. Penetration Testing

  • Penetration testing

    5m 49s
  • Ethical disclosure

    3m
  • Bug bounty

    3m 48s
  • Cybersecurity exercises

    2m 40s
• 54. Log Reviews 54. Log Reviews

  • Logging security information

    5m 30s
  • Security information and event management

    4m 8s
  • Continuous security monitoring

    4m 13s
  • Endpoint monitoring

    2m 56s
• 55. Code Testing 55. Code Testing

  • Code review

    2m 31s
  • Code tests

    4m 8s
  • Fuzz testing

    6m 48s
  • Interface testing

    3m 42s
  • Misuse case testing

    2m 21s
  • Test coverage analysis

    2m 28s
  • Code repositories

    6m 57s
  • Third-party code

    3m 38s
  • Software risk analysis and mitigation

    2m 52s
• 56. Disaster Recovery Planning 56. Disaster Recovery Planning

  • Disaster recovery

    4m 24s
  • Backups

    4m 38s
  • Restoring backups

    2m 11s
  • Disaster recovery sites

    4m 14s
  • Testing BC/DR plans

    3m 58s
  • After action reports

    2m 39s
• 57. Assessing Security Processes 57. Assessing Security Processes

  • Collect security process data

    3m 19s
  • Management review and approval

    2m 52s
  • Security metrics

    2m 56s
  • Audits and assessments

    5m 56s
  • Control management

    2m 31s
• 58. Domain 7: Security Operations 58. Domain 7: Security Operations

  • Introducing the Security Operations domain

    40s
• 59. Investigations and Forensics 59. Investigations and Forensics

  • Conducting investigations

    3m 50s
  • Evidence types

    3m 28s
  • Introduction to forensics

    3m 21s
  • System and file forensics

    4m 26s
  • Network forensics

    4m 1s
  • Software forensics

    4m 25s
  • Mobile device forensics

    1m 10s
  • Embedded device forensics

    2m 30s
  • Chain of custody

    1m 50s
  • Reporting and documenting incidents

    3m 58s
  • Electronic discovery (eDiscovery)

    3m 3s
• 60. Privilege Management 60. Privilege Management

  • Need to know and least privilege

    2m 34s
  • Privileged account management

    2m 31s
• 61. Incident Management 61. Incident Management

  • Build an incident response program

    4m 13s
  • Creating an incident response team

    2m 15s
  • Incident communications plan

    2m 42s
  • Incident identification

    4m 26s
  • Escalation and notification

    2m 29s
  • Mitigation

    2m 22s
  • Containment techniques

    3m
  • Incident eradication and recovery

    5m 28s
  • Validation

    2m 24s
  • Post-incident activities

    3m 50s
• 62. Personnel Safety 62. Personnel Safety

  • Personnel safety

    2m 25s
  • Emergency management

    2m
• 63. Domain 8: Software Development Security 63. Domain 8: Software Development Security

  • Introducing the Software Development Security domain

    35s
• 64. Software Development Lifecycle 64. Software Development Lifecycle

  • Software platforms

    2m 7s
  • Development methodologies

    7m 16s
  • Scaled agile framework

    3m 11s
  • Maturity models

    4m 11s
  • Automation and DevOps

    4m 42s
  • Programming languages

    2m 34s
  • Acquired software

    2m 57s
• 65. Application Attacks 65. Application Attacks

  • OWASP top ten

    4m 45s
  • Application security

    4m 3s
  • Preventing SQL injection

    4m 25s
  • Understanding cross-site scripting

    3m 17s
  • Request forgery

    4m 8s
  • Defending against directory traversal

    3m 4s
  • Overflow attacks

    3m 21s
  • Explaining cookies and attachments

    4m 7s
  • Session hijacking

    4m 8s
  • Code execution attacks

    2m 43s
  • Privilege escalation

    1m 56s
  • Driver manipulation

    2m 16s
  • Memory vulnerabilities

    3m 34s
  • Race condition vulnerabilities

    2m 13s
• 66. Secure Coding Practices 66. Secure Coding Practices

  • Input validation

    2m 37s
  • Parameterized queries

    3m
  • Authentication/session management issues

    1m 49s
  • Output encoding

    3m 13s
  • Error and exception handling

    3m
  • Code signing

    2m 8s
  • Database security

    3m 53s
  • Data de-identification

    2m 44s
  • Data obfuscation

    2m 12s
• 67. What's Next 67. What's Next

  • Preparing for the exam

    1m 16s