Security and Risk Management (16%)
- Quantitative risk: SLE = Asset Value × Exposure Factor; ALE = SLE × Annualized Rate of Occurrence. A safeguard is justified when its annual cost is below the ALE reduction.
- Due diligence = investigating and assessing risk; due care = acting prudently on it (the 'prudent person' standard). Residual risk = what remains after controls; the owner accepts, transfers, or further mitigates it.
- Governance: policy (mandatory, high level) → standards → procedures → guidelines. Senior-management support is the top success factor.
- IP: patent (limited term, full disclosure), copyright (expression), trademark (brand), trade secret (indefinite, no disclosure, must be kept confidential). ISC2 Code of Ethics first canon: protect society, the common good, and the infrastructure.
Asset Security (10%) and Architecture/Engineering (13%)
- Roles: data owner sets classification; custodian implements controls; user follows handling rules.
- Data remanence: SSDs need cryptographic erase or physical destruction (degaussing and single overwrites are unreliable on flash). Anonymisation is irreversible; pseudonymisation/tokenisation keep a reversible mapping.
- Models: Bell-LaPadula protects confidentiality (no read up / no write down); Biba protects integrity (no write up / no read down); Clark-Wilson uses well-formed transactions.
- Reference monitor: non-bypassable (complete mediation), tamperproof, small enough to be verified. TPM = hardware root of trust for measured boot. Fail-secure protects assets; fail-safe protects life.
Communication and Network Security (13%)
- OSI: L2 = MAC/framing, L3 = IP addressing and routing, L4 = TCP/UDP end-to-end. TLS gives confidentiality + integrity + authentication in transit only.
- Segmentation (VLANs, microsegmentation, air gap) limits lateral movement and shrinks blast radius.
- DNSSEC provides origin authentication and integrity for DNS responses (anti-spoofing) — not confidentiality. DNS over TLS/HTTPS adds confidentiality.
- Know secure protocols vs their cleartext originals (SSH/Telnet, HTTPS/HTTP, SFTP-FTPS/FTP, SNMPv3, LDAPS).
Identity and Access Management (13%)
- Models: DAC (owner's discretion), MAC (system labels + clearances), RBAC (by job function, managed centrally), ABAC/rule-based (attributes / global rules).
- Federation: SAML for browser SSO across independent web apps; OAuth 2.0 for delegated authorization; OIDC for identity on top of OAuth.
- Kerberos: the KDC's Authentication Server issues the TGT; the Ticket-Granting Service issues service tickets. Time-sensitive; single realm.
- Biometrics: Type I error = False Rejection Rate, Type II = False Acceptance Rate, Crossover Error Rate is where they meet (lower is better).
Assessment/Testing (12%), Operations (13%), Software Dev (10%)
- Vulnerability assessment identifies and rates; penetration test authorised-exploits to prove impact. Black/grey/white box = no/partial/full knowledge. Periodic access recertification catches privilege creep.
- Incident response: preparation → detection and analysis → containment → eradication → recovery → lessons learned. Separation of duties + job rotation + mandatory vacation deter and detect fraud/collusion.
- RAID 0 (stripe, no redundancy), 1 (mirror), 5 (stripe + distributed parity, survives one disk), 6 (survives two), 10 (mirror + stripe). Differential restore = last full + latest differential; incremental restore = last full + every incremental.
- Build security in from requirements and design (shift left / threat modeling). Injection defence: parameterised queries + allow-list validation + context-aware output encoding. Source-code escrow protects the customer if the vendor fails.
Test yourself on CISSP
Reading a summary is the easy part. Take the free 10-question diagnostic to see which of these domains you actually have, then drill the rest.
Also free: 15 CISSP sample questions with answers and the CISSP study guide.