CISSP — ISC2

CISSP — ISC2

Credential header

• Credential: Certified Information Systems Security Professional (CISSP)
• Issuing body: ISC2 (International Information System Security Certification Consortium)
• Jurisdiction: Global
• Level: Advanced/managerial — the de facto senior security-management credential; ANSI/ISO/IEC 17024 accredited
• Prerequisites: 5 years of cumulative paid security work experience in 2 or more of the 8 domains (1-year waiver for a relevant degree or an approved certification); pass the exam; then be endorsed by an ISC2-certified member who attests to your experience (endorsement must be completed within 9 months of passing — verify the current window on isc2.org). Candidates lacking the experience can pass the exam and become an Associate of ISC2, earning the full CISSP once the experience is accrued.
• Renewal: 3-year cycle: 120 CPE credits (minimum 40 per year) + Annual Maintenance Fee (reported $135/year — verify current fee on isc2.org)

Exam format

• CAT (Computerized Adaptive Testing) for English exams: 100–150 questions, 3 hours, adaptive — the exam stops when it has determined pass/fail with sufficient confidence. Non-English exams are linear fixed-form (reported 250 questions, 6 hours — verify if you test in another language).
• Passing score: 700 out of 1000, scaled — not a percentage. Because it's adaptive, you cannot skip-and-return the way you can on linear exams; treat each question as final.
• Question types: multiple choice plus "advanced innovative" items (drag-and-drop, hotspot). Exam fee reported $749 — verify current pricing.
• Effective outline: April 15, 2024 (the current JTA-based outline; ISC2 refreshes every ~3 years).

The 8 domains (2024 weights — sum to 100%)

1. Security and Risk Management — 16%
2. Asset Security — 10%
3. Security Architecture and Engineering — 13%
4. Communication and Network Security — 13%
5. Identity and Access Management — 13%
6. Security Assessment and Testing — 12%
7. Security Operations — 13%
8. Software Development Security — 10%

Domain 1 — Security and Risk Management (16%)

Governance, policy, risk, compliance, law, ethics — the "think like a manager" domain and the heaviest weight. Key content:

• Risk management: identify → assess → treat → monitor. Risk = threat × vulnerability × asset value (conceptually). Treatment options: accept, avoid, mitigate, transfer (insurance), and assign/escalate.
• Quantitative risk: Single Loss Expectancy SLE = Asset Value × Exposure Factor; Annualized Rate of Occurrence ARO (events/year); Annualized Loss Expectancy ALE = SLE × ARO. Compare ALE against control cost: implement the control only if (ALE_before − ALE_after) > annual control cost.
• Qualitative risk: risk matrices, Delphi technique, scenario analysis — used when numbers aren't credible.
• Governance: board accountability, security policies (top-down: policy → standards → procedures → guidelines), data classification and ownership (data owner sets classification; custodian implements controls).
• Frameworks: NIST RMF and CSF 2.0, ISO 27001/27002, COBIT, SABSA, TOGAF (enterprise architecture).
• Law: computer crime law, privacy regimes (GDPR, CCPA/CPRA), intellectual property, import/export (crypto), liability. Digital forensics chain of custody.
• Ethics: the ISC2 Code of Ethics — protect society and the commonwealth first; questions testing ethics almost always resolve to "protect people, then principles, then the employer."

Domain 2 — Asset Security (10%)

Data classification (e.g., top secret/secret/confidential/unclassified or commercial equivalents), ownership vs custodianship, data states (at rest, in transit, in use) and appropriate controls for each, data retention and destruction (crypto-erasure, degaussing, physical destruction — and clearing vs purging vs destroying per media type), data remanence, privacy (data minimization, purpose limitation, anonymization vs pseudonymization).

Domain 3 — Security Architecture and Engineering (13%)

The most technical domain. Core models — know each model's rule cold:

• Bell-LaPadula (confidentiality): no read up, no write down. Subjects can't read data above their clearance; can't write to lower levels (prevents leaking secrets downward). *-property (star property) = no write down; simple security property = no read up.
• Biba (integrity): no read down, no write up — the mirror image. Protects integrity: don't read low-integrity data, don't write to high-integrity objects.
• Clark-Wilson (commercial integrity): constrained data items manipulated only via certified transformation procedures; separation of duties; audit trails. The model for banking/transaction systems.
• Brewer-Nash / Chinese Wall (conflict of interest): dynamic access control preventing consultants from accessing competing clients' data.
• Graham-Denning: formal access-control matrix model (subjects, objects, rights). Harrison-Ruzzo-Ullman: safety analysis of access-control systems.

Evaluation criteria: Common Criteria (EAL1–EAL7 — higher = more assurance, not more security features), FIPS 140-3 (crypto module validation), TCSEC/Orange Book (legacy, C2/B1 etc. — know it existed).

Crypto fundamentals:

• Symmetric (AES-128/192/256, 3DES legacy, ChaCha20): fast, one shared key, key-distribution problem. Asymmetric (RSA, ECC, Diffie-Hellman, DSA/ECDSA): slow, key pairs, solves distribution and enables signatures.
• Hashing (SHA-2/SHA-3 family; MD5/SHA-1 broken for collision resistance): integrity, no key, irreversible. HMAC adds a key.
• Digital signatures: sign with private key, verify with public key — provides authentication, integrity, non-repudiation.
• PKI: CAs issue X.509 certificates binding identity to public key; validation via chain of trust, CRLs and OCSP for revocation. Key escrow vs key recovery.
• TLS handshake (conceptual): negotiate cipher suite → authenticate server (certificate) → establish session keys (via RSA key transport or (EC)DHE for forward secrecy) → encrypted session. Perfect forward secrecy (ephemeral DH) means a later key compromise doesn't decrypt past traffic.
• IPSec: AH (authentication, no encryption) vs ESP (encryption + authentication); transport vs tunnel mode; IKE for key exchange. Common VPN protocols: IPSec, SSL/TLS VPN, WireGuard.
• Key lengths matter comparatively: 256-bit symmetric ≈ 3072-bit RSA ≈ 256-bit ECC (roughly — the point is ECC gives equivalent strength at far smaller keys).

Systems: cloud (IaaS/PaaS/SaaS shared-responsibility boundaries), virtualization (hypervisor types, VM escape), distributed systems, IoT/embedded constraints, physical security (defense in depth: deter, detect, delay, respond; CPTED).

Domain 4 — Communication and Network Security (13%)

• OSI vs TCP/IP: know the layers and what lives where (e.g., IP at network/L3, TCP/UDP at transport/L4, TLS at session/presentation boundary). Encapsulation order.
• Transmission media and attacks: eavesdropping, MITM, replay, spoofing; countermeasures (encryption, mutual auth, nonces/timestamps).
• Network devices and their security role: firewalls (packet-filtering, stateful, NGFW/application-aware; DMZ architectures — screened subnet), IDS vs IPS (detect vs prevent; signature vs anomaly vs heuristic), proxies, VPN concentrators, DLP, NAC.
• Wireless: WPA3 (SAE) > WPA2 (AES-CCMP) > WPA (TKIP) > WEP (broken); rogue APs, evil twins.
• Secure communications: VoIP (SRTP), email (S/MIME, PGP), instant messaging; network segmentation (VLANs, microsegmentation, zero trust — "never trust, always verify").
• Network attacks catalog: DoS/DDoS (volumetric, protocol, application), SYN flood (counter: SYN cookies), Smurf, DNS poisoning/cache poisoning (counter: DNSSEC), ARP spoofing (counter: dynamic ARP inspection), VLAN hopping, MAC flooding.

Domain 5 — Identity and Access Management (13%)

• AAA: identification (claim), authentication (prove), authorization (permission), accountability (audit).
• Authentication factors: something you know / have / are (+ somewhere you are, something you do). MFA combines factors from different categories — two passwords is not MFA.
• Access control models: DAC (owner discretion, e.g., file ACLs), MAC (system-enforced labels, e.g., SELinux — Bell-LaPadula heritage), RBAC (roles), ABAC (attributes/policies — most flexible), RuBAC (rules). Authorization creep is the classic RBAC failure.
• Protocols: Kerberos (tickets, TGT, symmetric, single sign-on within a realm — know the ticket flow conceptually), SAML (XML-based SSO federation), OAuth 2.0 (delegated authorization — not authentication), OpenID Connect (authentication layer on OAuth 2.0), RADIUS vs TACACS+ (network device admin: TACACS+ separates AAA and encrypts the full packet; RADIUS encrypts only the password).
• Identity lifecycle: provisioning, deprovisioning (orphaned accounts are an exam favorite), periodic access reviews, privileged access management (vaulting, just-in-time elevation).
• Biometrics: FAR vs FRR trade-off (tuning: lower FAR raises FRR); enrollment quality dominates accuracy; biometric data can't be revoked — protect templates.

Domain 6 — Security Assessment and Testing (12%)

Test strategies (black/white/gray box), vulnerability assessments vs penetration tests (pen test is goal-oriented exploitation with rules of engagement), security audits (internal vs external; SOC 2 Type I vs Type II), code review (SAST static vs DAST dynamic vs IAST interactive; fuzzing), test coverage, misconfiguration scanning, log reviews, synthetic transactions, interface testing (API). Key management metric: track remediation, not just findings. Know that penetration testing requires written authorization — the exam's favorite legal trap.

Domain 7 — Security Operations (13%)

• SOC operations: SIEM, SOAR (orchestration/automation), threat intelligence, UEBA.
• Incident response lifecycle: preparation → detection & analysis → containment → eradication → recovery → lessons learned (NIST 800-61). Containment before eradication (preserve evidence); escalation criteria.
• BCP/DRP: Business Impact Analysis first (identify critical processes, RTO/RPO, MTD — maximum tolerable downtime; RTO ≤ MTD always), then strategy, plan development, testing (walkthrough → simulation → parallel → full interruption, increasing fidelity), maintenance. Backup types (full/incremental/differential) and recovery sites (hot/warm/cold; reciprocal agreements).
• Investigations: digital forensics (order of volatility: registers/cache → RAM → network state → disk; bit-stream imaging, hashing to prove integrity, chain of custody), eDiscovery.
• Operational controls: least privilege, separation of duties, job rotation, mandatory vacations (fraud detection), change management, patch management, vulnerability management, configuration management, media handling.

Domain 8 — Software Development Security (10%)

• SDLC security: shift-left; security gates at each phase; threat modeling (STRIDE: Spoofing, Tampering, Repudiation, Information disclosure, DoS, Elevation of privilege; DREAD for ranking).
• OWASP Top 10 (injection, broken access control, cryptographic failures, etc.) — know the categories and canonical defenses (parameterized queries, output encoding, least privilege).
• Secure coding: input validation (allowlist > denylist), error handling (fail securely, no stack traces to users), session management, race conditions (TOCTOU), buffer overflows (bounds checking, ASLR/DEP/NX as mitigations).
• Databases: inference and aggregation attacks, polyinstantiation; encryption and access controls.
• DevSecOps: SAST/DAST in CI/CD pipelines, software composition analysis (SCA) for third-party components, SBOMs, code signing, environment separation.
• Maturity models: SAMM, BSIMM.

Worked examples

Example 1 — ALE and control justification (Domain 1). A customer database is valued at $2,000,000. A breach scenario has exposure factor 0.4 and ARO 0.25 (once every 4 years). SLE = 2,000,000 × 0.4 = $800,000. ALE = 800,000 × 0.25 = $200,000/year. A proposed DLP + encryption program costs $120,000/year and would cut the exposure factor to 0.1: new SLE = $200,000, new ALE = $50,000. ALE reduction = $150,000 > $120,000 cost — the control is economically justified. Note the assumption doing the work: the EF and ARO estimates. In the exam, when numbers are given, compute; when they're absent, the answer is qualitative.

Example 2 — Bell-LaPadula vs Biba (Domain 3). A subject cleared to Secret wants to (a) read a Top Secret file, (b) write a report to an Unclassified shared drive. Under Bell-LaPadula: (a) denied — no read up (simple security property); (b) denied — no write down (star property) — writing Secret-derived content to Unclassified risks leaking. Under Biba (integrity): the rules invert — no read down, no write up. Exam questions often ask which model fits a scenario: military classification → Bell-LaPadula; financial transaction integrity → Clark-Wilson; consultancy conflicts → Brewer-Nash.

Example 3 — Symmetric vs asymmetric selection (Domain 3). You must encrypt a 4 TB backup nightly and also let 200 branch offices verify the backup manifest's authenticity. Bulk encryption: AES-256 (symmetric — fast enough for terabytes; asymmetric would be orders of magnitude too slow). Manifest authenticity: ECDSA signature with the backup server's private key; branches verify with the public key (non-repudiation + integrity without sharing secrets). This hybrid pattern — asymmetric for key exchange/signatures, symmetric for bulk data — is the standard answer shape.

Example 4 — RTO/RPO/MTD ordering (Domain 7). BIA results: MTD for order processing = 24 hours. Proposed RTO = 30 hours, RPO = 4 hours. Analysis: RTO (30h) exceeds MTD (24h) — unacceptable by definition; the recovery strategy must bring RTO ≤ 24h (e.g., hot site instead of warm). RPO = 4h means backups at least every 4 hours. The exam tests this ordering relentlessly: MTD is the business's pain threshold; RTO is IT's recovery promise and must fit inside it.

Example 5 — OAuth vs SAML vs Kerberos (Domain 5). Scenario: employees log into a cloud HR app with corporate credentials via the browser. Correct: SAML or OpenID Connect federation (SSO to a third party). Scenario: a mobile app wants scoped access to a user's cloud storage without seeing the password. Correct: OAuth 2.0 delegated authorization. Scenario: Windows domain workstation accessing file shares. Correct: Kerberos. The exam rewards matching the protocol to the trust topology.

Pitfalls and exam strategy

1. Think like a manager, not an engineer. The exam's famous mindset: when torn between a technical fix and a governance answer (policy, risk assessment, management approval), the governance answer usually wins. Human safety first, then the organization's mission, then technical elegance.
2. CAT dynamics. The exam feeds you harder questions as you succeed — feeling like it's getting harder means you're doing well. You can't go back; commit and move on. Pace: 150 questions in 180 minutes ≈ 72 seconds each at the maximum length.
3. "MOST," "BEST," "FIRST." These adverbs are doing heavy lifting. "What should be done FIRST?" after a breach → contain/assess, not eradicate. "BEST control?" → the one addressing the root cause at the right layer.
4. Never skip the authorization question. Any testing/investigation scenario: written authorization and defined scope come before tools.
5. Key-length and algorithm trivia is comparative, not absolute — know rankings (AES-256 > AES-128 in strength; ECC shorter keys than RSA for equivalent strength; SHA-256 > SHA-1 > MD5), not bit-exact equivalences.
6. Associate of ISC2 is a legitimate strategy: pass the exam without the 5 years, then accrue experience. Don't let the experience requirement delay your exam date.
7. CPE planning: 120 per 3 years with 40/year minimum — the per-year floor trips up binge-learners. Log as you go.

Practice problems

1. Asset value $500,000, EF 0.6, ARO 0.5. Compute SLE and ALE. A $90,000/year control halves the EF. Justified?
2. Under Bell-LaPadula, can a Confidential-cleared analyst write to a Secret file? Read it? Explain both using the property names.
3. Order the following by relative cryptographic strength and justify: AES-128, RSA-1024, ECC-256, 3DES.
4. BIA gives MTD = 8 hours for the trading platform. The DR plan proposes RTO = 12 hours with a cold site. Identify the two problems.
5. A developer wants the mobile app to authenticate users against the corporate directory without handling passwords, and also call a payments API on the user's behalf. Which protocols solve each half?
6. During incident response, the team wants to immediately wipe and rebuild a compromised server. What phase-ordering error is this, and what should happen first?

Answers: 1. SLE = 500,000 × 0.6 = $300,000; ALE = 300,000 × 0.5 = $150,000/year. New EF 0.3 → new ALE $75,000; reduction $75,000 < $90,000 cost — not justified on ALE alone (recheck qualitative factors before final decision). 2. Write to Secret: allowed under BLP? No — wait: no write down means writing to a lower level is prohibited; writing up to Secret is permitted by the star property (it can't leak downward). Read Secret: denied — no read up (simple security property). 3. Strongest to weakest: ECC-256 ≈ AES-128 (both ~128-bit security level) > 3DES (~112-bit effective) > RSA-1024 (~80-bit, deprecated). Justification: compare effective security bits, not raw key length. 4. RTO (12h) > MTD (8h) — violates the ordering; and a cold site (days to provision) cannot meet an 8-hour MTD — needs hot/warm site or cloud-based recovery. 5. Authentication: OpenID Connect (identity layer on OAuth 2.0) against the corporate IdP; API delegation: OAuth 2.0 access tokens with narrow scopes. 6. Wiping is eradication before containment/evidence preservation — violates the lifecycle order. First: contain (isolate from network), preserve forensic images with chain of custody, then eradicate and recover.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.