Duration
5 days
Overview
CISSP-ISSAP certification training is a specialized course for information security professionals. It covers advanced topics like access control systems, communications and network security, cryptography, security architecture analysis, technology-related business continuity planning, and legal regulations. This certification not only deepens one's technical understanding in the field of information security but also strengthens managerial skills, enabling them to excel as senior/lead security architect roles.
Course Prerequisites
- Minimum of two years cumulative, paid, full-time work experience in one or more of the six domains of the CISSP-ISSAP CBK.
- Valid CISSP certification.
- Endorsement by another (ISC)² certified professional.
- Submission of the appropriate application and certification fees.
- Adherence to the (ISC)² Code of Ethics.
Target Audience
- Information security professionals
- CISSP holders looking for specialization
- IT consultants
- System, security, and network architects
- Senior IT management (CIOs, CTOs, Directors)
- IT auditors
- Security planners and analysts
- Systems and network analysts
- Technology and security risk managers
- Security operations personnel
- CISOs, and cybersecurity consultants.
Skills Measured
After completing CISSP-ISSAP certification training, an individual becomes skilled in various facets of information security architecture. They gain comprehensive knowledge about access control systems, telecommunications and networking, cryptography, disaster recovery planning, as well as law, investigations, and ethics. Moreover, their understanding of secure business architecture as well as system and physical security design is substantially enhanced. They also obtain the capability of determining data security controls and providing operational effectiveness for organizations.
Learning Objectives
The learning objectives of the CISSP-ISSAP course are to provide participants with exposure to advanced technical skillsets and knowledge required to architect and design a secure enterprise environment. Participants will learn to address complex security architecture challenges, understand and apply security design principles, manage risk and boost the security posture of organizations. The course aims to equip participants with the ability to govern an organization's security architecture, control security capabilities, design a cryptography solution, meet legal and compliance requirements, ensure secure operations management, and ensure security subsystems are integrated and aligned.
Course Content
Domain 1: Architect for Governance, Compliance and Risk Management
- Determine legal, regulatory, organizational and industry requirements
- Manage Risk
Domain 2: Security Architecture Modeling
- Identify security architecture approach
- Verify and validate design (e.g., Functional Acceptance Testing (FAT), regression)
Domain 3: Infrastructure Security Architecture
- Develop infrastructure security requirements
- Design defense-in-depth architecture
- Secure shared services (e.g., wireless, e-mail, Voice over Internet Protocol (VoIP), Unified Communications (UC), Domain Name System (DNS), Network Time Protocol (NTP))
- Integrate technical security controls
- Design and integrate infrastructure monitoring
- Design infrastructure cryptographic solutions
- Design secure network and communication infrastructure (e.g., Virtual Private Network (VPN), Internet Protocol Security (IPsec), Transport Layer Security (TLS))
- Evaluate physical and environmental security requirements
Domain 4: Identity and Access Management (IAM) Architecture
- Design identity management and lifecycle
- Design access control management and lifecycle
- Design identity and access solutions
Domain 5: Architect for Application Security
- Integrate Software Development Life Cycle (SDLC) with application security architecture (e.g., Requirements Traceability Matrix (RTM), security architecture documentation, secure coding)
- Determine application security capability requirements and strategy (e.g., open source, Cloud Service Providers (CSP), Software as a Service (SaaS)/Infrastructure as a Service (IaaS)/ Platform as a Service (PaaS) environments)
- Identify common proactive controls for applications (e.g., Open Web Application Security Project (OWASP))
Domain 6: Security Operations Architecture
- Gather security operations requirements (e.g., legal, compliance, organizational, and business requirements)
- Design information security monitoring (e.g., Security Information and Event Management (SIEM), insider threat, threat intelligence, user behavior analytics, Incident Response (IR) procedures)
- Design Business Continuity (BC) and resiliency solutions
- Validate Business Continuity Plan (BCP)/Disaster Recovery Plan (DRP) architecture
- Design Incident Response (IR) management
Programme scope, delivery arrangements and suitability are confirmed during enquiry.