CISSP Prep Course

Lesson 1 • Security Governance Fundamentals

Explains how policies, standards, procedures, and guidelines form a governance hierarchy. Grounds candidates in organizational accountability structures.

Lesson 2 • Risk Management Basics

Defines threat, vulnerability, and risk, then introduces qualitative and quantitative analysis. Prepares candidates for deeper risk topics in later chapters.

Lesson 3 • Core Security Concepts

Introduces confidentiality, integrity, and availability as the CIA triad. Connects foundational vocabulary to real-world security decisions.

Lesson 1 • Privacy and Data Protection Principles

Covers privacy-by-design, data minimization, and regulatory privacy concepts. Connects asset protection to organizational compliance obligations.

Lesson 2 • Data Lifecycle Management

Traces data from creation through destruction and maps controls to each phase. Reinforces governance concepts introduced in Chapter 1.

Lesson 3 • Asset Handling and Media Controls

Addresses physical and logical controls for media containing sensitive data. Extends classification into operational handling procedures.

Lesson 1 • Security Models and Frameworks

Examines Bell-LaPadula, Biba, Clark-Wilson, and other formal models. Connects theoretical models to real access-control implementations.

Lesson 2 • Physical Security in Architecture

Addresses site selection, perimeter controls, and environmental threats to infrastructure. Integrates physical protection into the overall security architecture.

Lesson 3 • Cryptography Fundamentals

Covers symmetric, asymmetric, and hashing algorithms along with key management. Provides the cryptographic knowledge needed for network and identity chapters.

Lesson 4 • Secure Design Principles

Introduces fail-safe defaults, open design, and separation of privilege as foundational engineering principles. Builds the design mindset required for architecture evaluation.

Lesson 1 • Network Attacks and Countermeasures

Analyzes DoS, man-in-the-middle, and spoofing attacks with corresponding mitigations. Prepares candidates to identify and counter common network threats.

Lesson 2 • Secure Network Architecture Design

Examines segmentation, DMZ design, and network zoning strategies. Applies defense-in-depth from Chapter 1 to network topology decisions.

Lesson 3 • Network Models and Protocols

Reviews OSI and TCP/IP models and maps security controls to each layer. Establishes the protocol knowledge base for all network security topics.

Lesson 4 • Secure Communication Channels

Addresses VPN technologies, TLS/SSL, and secure remote access methods. Builds on cryptography from Chapter 3 to secure data in transit.

Lesson 1 • Privileged Access and Accountability

Addresses privileged account management, session monitoring, and audit trails. Reinforces least privilege and accountability principles from Chapter 1.

Lesson 2 • Identity Management Concepts

Defines identity proofing, provisioning, and the identity lifecycle. Grounds IAM in the governance and asset concepts from earlier chapters.

Lesson 3 • Access Control Models

Examines DAC, MAC, RBAC, and ABAC models and their appropriate use cases. Extends the formal models introduced in Chapter 3 to operational access decisions.

Lesson 4 • Single Sign-On and Federation

Covers SSO architectures, SAML, OAuth, and OpenID Connect protocols. Builds on cryptography and network knowledge to explain federated trust.

Lesson 1 • Common Software Vulnerabilities

Covers injection flaws, broken authentication, and insecure deserialization from established vulnerability lists. Connects vulnerability classes to secure coding countermeasures.

Lesson 2 • Software Supply Chain Security

Addresses third-party libraries, open-source risks, and software bill of materials (SBOM). Extends asset management from Chapter 2 to software components.

Lesson 3 • Secure Development Lifecycle Models

Compares waterfall, agile, and DevSecOps models with security integration points. Builds on testing concepts from Chapter 6 to embed security earlier in development.

Lesson 4 • Secure Coding Practices

Teaches input validation, error handling, and secure API design as coding standards. Provides actionable controls developers apply to prevent vulnerabilities.

Lesson 1 • Software Testing for Security

Introduces code review, SAST, DAST, and fuzz testing as software assurance methods. Prepares candidates for the software security domain in Chapter 7.

Lesson 2 • Security Assessment Strategies

Distinguishes vulnerability scans, assessments, and audits by scope and rigor. Frames testing as a continuous validation of controls from all prior chapters.

Lesson 3 • Security Audits and Log Review

Addresses audit types, log management, and evidence collection for compliance. Reinforces accountability mechanisms introduced in Chapter 5.

Lesson 4 • Penetration Testing Methodology

Walks through reconnaissance, exploitation, and reporting phases of a pen test. Applies network and IAM knowledge from Chapters 4 and 5 to offensive scenarios.

Lesson 1 • Incident Response Lifecycle

Walks through preparation, detection, containment, eradication, and recovery phases. Applies assessment and testing skills from Chapter 6 to real incident scenarios.

Lesson 2 • Security Operations Center Functions

Defines SOC roles, monitoring workflows, and alert triage processes. Integrates SIEM and log review skills from Chapter 6 into operational practice.

Lesson 3 • Operational Security Controls

Covers change management, configuration management, and patch management as daily controls. Ties together controls from all prior domains into operational practice.

Lesson 4 • Business Continuity and Disaster Recovery

Addresses BIA, RTO/RPO targets, and recovery strategy selection. Connects risk management from Chapter 1 to operational resilience planning.