CISSP

متخصص معتمد في أمن نظم المعلومات

→ Threat modeling
→ Least privilege
→ Defense in depth
→ Secure defaults
→ Fail securely
→ Separation of Duties (SoD)
→ Keep it simple
→ Zero Trust
→ Privacy by design
→ Trust but verify
→ Shared responsibility

→ Client-based systems
→ Server-based systems
→ Database systems
→ Cryptographic systems
→ Industrial Control Systems (ICS)
→ Cloud-based systems (e.g., Software as a Service
(SaaS), Infrastructure as a Service (IaaS), Platform as
a Service (PaaS))
→ Distributed systems
→ Internet of Things (IoT)
→ Microservices
→ Containerization
→ Serverless
→ Embedded systems
→ High-Performance Computing (HPC) systems
→ Edge computing systems
→ Virtualized systems

→ Cryptographic life cycle (e.g., keys, algorithm
selection)
→ Cryptographic methods (e.g., symmetric,
asymmetric, elliptic curves, quantum)
→ Public Key Infrastructure (PKI)
→ Key management practices
→ Digital signatures and digital certificates
→ Non-repudiation
→ Integrity (e.g., hashing) 

→ Brute force
→ Ciphertext only
→ Known plaintext
→ Frequency analysis
→ Chosen ciphertext
→ Implementation attacks
→ Side-channel
→ Fault injection
→ Timing
→ Man-in-the-Middle (MITM)
→ Pass the hash
→ Kerberos exploitation
→ Ransomware  

 Wiring closets/intermediate distribution facilities
→ Server rooms/data centers
→ Media storage facilities
→ Evidence storage
→ Restricted and work area security
→ Utilities and Heating, Ventilation, and Air
Conditioning (HVAC)
→ Environmental issues
→ Fire prevention, detection, and suppression
→ Power (e.g., redundant, backup) 

 Open System Interconnection (OSI) and Transmission Control Protocol/Internet Protocol (TCP/IP) models
→ Internet Protocol (IP) networking (e.g., Internet Protocol Security (IPSec), Internet Protocol (IP) v4/6)
→ Secure protocols
→ Implications of multilayer protocols
→ Converged protocols (e.g., Fiber Channel Over Ethernet (FCoE),
Internet Small Computer Systems Interface (iSCSI), Voice over Internet Protocol (VoIP))
→ Micro-segmentation (e.g., Software Defined Networks (SDN), Virtual eXtensible Local Area Network (VXLAN),
Encapsulation, Software-Defined Wide Area Network (SD-WAN))
→ Wireless networks (e.g., Li-Fi, Wi-Fi, Zigbee, satellite)
→ Cellular networks (e.g., 4G, 5G)
→ Content Distribution Networks (CDN)

 →Operation of hardware
(e.g., redundant power, warranty, support)
→ Transmission media
→ Network Access Control (NAC) devices
→ Endpoint security

→ Voice
→ Multimedia collaboration
→ Remote access
→ Data communications
→ Virtualized networks
→ Third-party connectivity

→ Information
→ Systems
→ Devices
→ Facilities
→ Applications

→ Identity Management (IdM) implementation
→ Single/Multi-Factor Authentication (MFA)
→ Accountability
→ Session management
→ Registration, proofing, and establishment
of identity
→ Federated Identity Management (FIM)
→ Credential management systems
→ Single Sign On (SSO)
→ Just-In-Time (JIT)

→ On-premise
→ Cloud
→ Hybrid

→ Role Based Access Control (RBAC)
→ Rule based access control
→ Mandatory Access Control (MAC)
→ Discretionary Access Control (DAC)
→ Attribute Based Access Control (ABAC)
→ Risk based access control

→ Account access review (e.g., user, system, service)
→ Provisioning and deprovisioning
(e.g., on /off boarding and transfers)
→ Role definition (e.g., people assigned to new roles)
→ Privilege escalation (e.g., managed service
accounts, use of sudo, minimizing its use)

→ OpenID Connect (OIDC)/Open Authorization
(Oauth)
→ Security Assertion Markup Language (SAML)
→ Kerberos
→ Remote Authentication Dial-In User Service
(RADIUS)/Terminal Access Controller Access
Control System Plus (TACACS+) 

→ Internal
→ External
→ Third-party

→ Vulnerability assessment
→ Penetration testing
→ Log reviews
→ Synthetic transactions
→ Code review and testing
→ Misuse case testing
→ Test coverage analysis
→ Interface testing
→ Breach attack simulations
→ Compliance checks

→ Account management
→ Management review and approval
→ Key performance and risk indicators
→ Backup verification data
→ Training and awareness
→ Disaster Recovery (DR) and Business Continuity
(BC)

→ Remediation
→ Exception handling
→ Ethical disclosure

→ Internal
→ External
→ Third-party

→ Evidence collection and handling
→ Reporting and documentation
→ Investigative techniques
→ Digital forensics tools, tactics, and procedures
→ Artifacts (e.g., computer, network, mobile device)

→ Intrusion detection and prevention
→ Security Information and Event Management
(SIEM)
→ Continuous monitoring
→ Egress monitoring
→ Log management
→ Threat intelligence (e.g., threat feeds, threat
hunting)
→ User and Entity Behavior Analytics (UEBA)

→ Need-to-know/least privilege
→ Separation of Duties (SoD) and responsibilities
→ Privileged account management
→ Job rotation
→ Service Level Agreements (SLAs) 

→ Media management
→ Media protection techniques

→ Detection
→ Response
→ Mitigation
→ Reporting
→ Recovery
→ Remediation
→ Lessons learned 

→ Firewalls (e.g., next generation, web
application, network)
→ Intrusion Detection Systems (IDS) and Intrusion
Prevention Systems (IPS)
→ Whitelisting/blacklisting
→ Third-party provided security services
→ Sandboxing
→ Honeypots/honeynets
→ Anti-malware
→ Machine learning and Artificial Intelligence (AI)
based tools

→ Backup storage strategies
→ Recovery site strategies
→ Multiple processing sites
→ System resilience, High Availability (HA), Quality
of Service (QoS), and fault tolerance

→ Response
→ Personnel
→ Communications
→ Assessment
→ Restoration
→ Training and awareness
→ Lessons learned

→ Read-through/tabletop
→ Walkthrough
→ Simulation
→ Parallel
→ Full interruption

→ Perimeter security controls
→ Internal security controls

→ Travel
→ Security training and awareness
→ Emergency management
→ Duress

→ Development methodologies (e.g., Agile, Waterfall, DevOps, DevSecOps)
→ Maturity models (e.g., Capability Maturity Model (CMM), Software Assurance Maturity Model (SAMM))
→ Operation and maintenance
→ Change management
→ Integrated Product Team (IPT)

→ Programming languages
→ Libraries
→ Tool sets
→ Integrated Development Environment (IDE)
→ Runtime
→ Continuous Integration and Continuous Delivery
(CI/CD)
→ Security Orchestration, Automation, and Response
(SOAR)
→ Software Configuration Management (SCM)
→ Code repositories
→ Application security testing (e.g., Static Application
Security Testing (SAST), Dynamic Application
Security Testing (DAST)) 

→ Auditing and logging of changes
→ Risk analysis and mitigation

→ Commercial-off-the-shelf (COTS)
→ Open source
→ Third-party
→ Managed services (e.g., Software as a Service
(SaaS), Infrastructure as a Service (IaaS), Platform
as a Service (PaaS)) 

→ Security weaknesses and vulnerabilities at the source-code level
→ Security of Application Programming Interfaces (APIs)
→ Secure coding practices
→ Software-defined security