ISC2 Certified Information Systems Security Professional

Risk analysis is the core judgment of the profession. You work through threat modeling, qualitative and quantitative analysis, treatment and monitoring, then connect it to business continuity planning, supply chain risk and the people side of security.

• Risk analysis: asset value, threat, vulnerability, exposure
• Annualized loss expectancy and its limits
• Risk treatment and residual risk acceptance
• Supply chain and third-party risk
• Business impact analysis and continuity planning
• Hiring, onboarding, transfer and termination controls
• Threat modeling as input to risk

You build A risk assessment and business impact analysis for one business service, with treatment decisions.

Security professionals answer to law as well as to managers. You sort out intellectual property, licensing, privacy regimes, cross-border data flows and investigation rules, and hold to the ISC2 code of ethics when interests collide.

• Criminal, civil and administrative law in security cases
• Intellectual property: patents, copyright, trade secrets
• Privacy principles and major privacy regimes
• Cross-border data transfer and data residency
• Compliance obligations and audit expectations
• Investigation types, evidence and legal holds
• Applying the ISC2 code of ethics to a dilemma

You build A compliance obligations register for a multinational service, with ethics decisions recorded for three dilemmas.

You cannot protect what you have not identified. This module follows information from creation to destruction: classification, ownership, handling, retention, privacy controls and the sanitization that keeps retired media from leaking.

• Asset inventory and classification schemes
• Data owners, custodians and stewards
• Data states: at rest, in transit, in use
• Retention, archiving and legal requirements
• Data security controls and data loss prevention
• Media sanitization: clearing, purging, destroying
• Privacy engineering and data minimization

You build A data classification and handling standard, with a lifecycle map for one regulated data set.

Systems are secure by design or not at all. You study the principles behind secure architecture, the formal models that describe access and integrity, and the weaknesses specific to distributed, embedded, virtualized and cloud systems.

• Secure design principles: least privilege, fail secure, defense in depth
• Bell-LaPadula, Biba, Clark-Wilson and Brewer-Nash models
• Evaluation criteria and assurance, including Common Criteria
• Trusted platform, secure boot and hardware roots of trust
• Virtualization, containers and cloud architecture risks
• Industrial control, embedded and IoT systems
• Vulnerabilities in architectures and how to mitigate them

You build A secure architecture review of a multi-tier system, naming each design principle it applies or breaks.

Encryption and locks answer the same question: who can reach this? You cover cryptographic methods and their management, attacks on them, and the layered physical controls that protect sites, rooms and equipment.

• Symmetric, asymmetric and hybrid cryptosystems
• Hashing, message authentication and digital signatures
• Public key infrastructure and certificate management
• Key management across the lifecycle
• Cryptanalytic attacks and side channels
• Site and facility design: perimeter to server room
• Fire, water, power and environmental protection

You build A cryptography and key management standard plus a physical security plan for a data center.

Data is only as safe as the paths it takes. You design networks with segmentation and defense in depth, secure the protocols and devices on them, and protect remote access, wireless, voice and cloud connections.

• OSI and TCP/IP models and where attacks land
• Secure network design: zones, segmentation, zero trust ideas
• Firewalls, proxies, intrusion systems and gateways
• Securing routing, switching, DNS and email protocols
• Wireless and cellular security
• VPNs, remote access and software-defined networking
• Voice, collaboration and multimedia communications

You build A network security architecture for a company with a data center, cloud tenancy and remote staff.

Access is the control point that most attacks aim at. You design how identities are proven, authorized and governed across on-premises and cloud systems, and how access is provisioned, reviewed and revoked.

• Authentication factors, biometrics and error rates
• Federation, SSO, SAML, OAuth and OpenID Connect
• Authorization models: DAC, MAC, RBAC, ABAC, rule-based
• Identity lifecycle and provisioning workflows
• Privileged access management
• Access reviews, attestation and entitlement creep
• Attacks on authentication and how they are countered

You build An identity and access architecture for an organization moving to cloud applications, with governance reviews.

Controls that are not tested are assumptions. You plan and run audits, vulnerability scans and penetration tests, collect the data that shows control performance, and report results in a form that leads to fixes.

• Assessment, audit and test strategy
• Internal, external and third-party audits
• Vulnerability assessment and penetration testing
• Log review and synthetic transactions
• Code review, interface and misuse case testing
• Security process data: metrics, KPIs and KRIs
• Reporting findings and tracking remediation

You build An annual assessment plan covering audits, scans and a penetration test, with a reporting template.

Operations is where policy meets the attacker. You cover monitoring, detection and incident management, investigations and evidence, change and configuration control, resilience, and the disaster recovery that brings a business back.

• Logging, monitoring, SIEM and detection engineering
• Incident management lifecycle and roles
• Digital forensics and evidence handling
• Configuration, change and patch management
• Resource protection, backup and media management
• Disaster recovery strategies and recovery sites
• Business continuity exercises and lessons learned
• Physical and personnel safety in operations

You build An incident response and disaster recovery plan for a critical service, with exercise scenarios.

Software is where many breaches begin. You build security into the development lifecycle, choose controls for code, builds, dependencies and APIs, and learn how to assess the security of software you acquire.

• Development methodologies and where security fits
• Secure coding standards and common weaknesses
• Source control, build pipelines and release controls
• Software testing: static, dynamic, fuzzing
• Dependencies, open source and software bills of materials
• API and web application security
• Assessing acquired and outsourced software

You build A secure development lifecycle for a delivery team, with gates and checks at each stage.

The profession is judged on how the domains fit together. You review a single organization from governance to code, find where a control in one area undermines another, and recommend changes a leadership team could act on.

• Scoping a whole-program review
• Tracing one asset through every domain
• Finding conflicts between controls and the business
• Choosing the changes that reduce the most risk
• Presenting recommendations to executives
• Defining what to measure next year

You build A cross-domain security program review with recommendations a board could approve.