CISSP — 8-Domain Study Notes

Domain 1: Security and Risk Management

CIA Triad and Extensions

• Confidentiality — preventing unauthorized disclosure of information.
• Integrity — preventing unauthorized modification; data is accurate and trustworthy.
• Availability — authorized users can access data/systems when needed.
• Authenticity — genuineness of data or its origin.
• Nonrepudiation — a party cannot deny having performed an action (supported by digital signatures, logging).

Security Governance

• Security strategy must align with business strategy, mission, and objectives — security exists to enable the business, not obstruct it.
• Governance structures: Board of Directors → executive management → steering committees → security function. Due care (reasonable steps) vs. due diligence (research/verification before acting) are legal standards used to judge organizational responsibility.
• Organizational roles: data owner (accountable for classification/protection decisions), data custodian (implements controls), system owner, business/mission owner, users, auditors.

Legal, Regulatory, and Compliance

• IP protections: Copyright (expression, not idea), Patent (invention, 20 yrs), Trademark (brand identifiers), Trade secret (indefinite, requires active protection).
• Privacy regimes: GDPR (EU) — consent, data subject rights, DPO requirements, breach notification (72h); sectoral US laws (HIPAA, GLBA); data residency/sovereignty considerations for cross-border transfers.
• Contract/procurement security: SLAs, right-to-audit clauses, data processing agreements, third-party risk management (TPRM), supply chain risk (SCRM).

Risk Management

Core risk formula

Risk = Threat × Vulnerability × Impact (Asset Value) — likelihood combined with consequence.

Risk analysis approaches

Risk response/treatment

• Avoid — eliminate the activity causing risk.
• Mitigate — apply controls to reduce likelihood/impact.
• Transfer — insurance, outsourcing, contractual risk-shifting.
• Accept — formally accept residual risk (must be documented/approved).

Control types & categories

Frameworks: ISO 31000 (risk mgmt), ISO/IEC 27001 (ISMS), NIST RMF / SP 800-37, NIST CSF, COBIT (IT governance), COSO.

Threat Modeling

• STRIDE — Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.
• DREAD, PASTA, Attack Trees — alternative/complementary modeling approaches.
• Best done during design phase (shift-left), iteratively updated.

Business Continuity & Disaster Recovery

• BCP keeps critical business functions running during disruption; DRP restores IT systems/infrastructure after disruption. DRP is a subset of BCP.
• BIA (Business Impact Analysis) identifies critical processes and quantifies impact of downtime — drives RTO/RPO.

• Alternate sites: Hot (near-instant failover, expensive), Warm (partially configured, hours), Cold (empty shell, days/weeks).
• BCP/DRP must be tested regularly: tabletop, walkthrough, simulation, parallel, full interruption tests.

Security Awareness & Training

• Distinguish: education (why/concepts, long-term), training (how, skill-based), awareness (what, behavior change).
• Program effectiveness measured via phishing simulation click rates, incident trends, completion metrics.

Domain 2: Asset Security

Data/Asset Classification

• Classification based on sensitivity/criticality — drives handling requirements (e.g., Public, Internal, Confidential, Restricted/Secret).
• Classification vs. categorization: classification = sensitivity level; categorization = grouping by type/function (e.g., NIST FIPS 199 categorization by CIA impact levels: Low/Moderate/High).
• Labeling and marking make classification visible (headers/footers, metadata tags, physical labels).

Data Lifecycle & Roles

Typical lifecycle: Create → Store → Use → Share → Archive → Destroy.

• Data owner — accountable for classification and protection decisions (usually a business role).
• Data custodian — implements technical controls per owner's direction (usually IT).
• Data processor — processes data on behalf of a controller (GDPR terminology).
• Data controller — determines purposes/means of processing (GDPR terminology).

Data States & Protection

Data Remanence & Sanitization

Reference: NIST SP 800-88 for media sanitization guidance.

Privacy & Data Protection Concepts

• Data minimization — collect only what's necessary for the stated purpose.
• Purpose limitation — use data only for the purpose it was collected for.
• PII/PHI handling requirements often driven by regulation (GDPR, HIPAA).
• Data retention policies must balance legal/regulatory requirements against minimization principles and storage cost/risk.

Asset Management

• Maintain an accurate asset inventory (hardware, software, data, cloud resources) — you cannot protect what you don't know you have.
• Configuration Management Database (CMDB) tracks asset relationships and configuration state.
• Scoping and tailoring — adjusting a baseline security standard to fit organizational context (scoping = removing what doesn't apply; tailoring = customizing what remains).

Domain 3: Security Architecture and Engineering

Security Engineering Principles

• Defense in depth — layered, overlapping controls.
• Least privilege / need to know — minimum access necessary.
• Separation of duties / Two-person control — no single individual controls a critical process end-to-end.
• Fail-secure vs. fail-open — on failure, does the system default to denying or allowing access? (security vs. safety trade-off).
• Zero trust — never trust, always verify; no implicit trust based on network location.

Security Models (conceptual)

System Architecture & Evaluation

• TCB (Trusted Computing Base) — the totality of protection mechanisms within a system that enforce security policy.
• Reference monitor — abstract concept mediating all subject-object access; implemented as the security kernel.
• Common Criteria (ISO 15408) — evaluation framework using EALs (Evaluation Assurance Levels 1–7) replacing the older Orange Book (TCSEC).
• Virtualization/Cloud: hypervisor Type 1 (bare-metal) vs. Type 2 (hosted); shared responsibility model varies by IaaS/PaaS/SaaS.

Cryptography Fundamentals

• Hybrid cryptography — asymmetric to exchange a symmetric session key, then symmetric for bulk data (used in TLS).
• Digital signature = hash of message encrypted with sender's private key → provides integrity, authenticity, nonrepudiation.
• PKI — CA (issues/signs certs), RA (verifies identity), CRL/OCSP (revocation checking).
• Key management — generation, distribution, storage, rotation, destruction; HSMs for secure key storage.

Cryptanalysis & Attacks

• Brute force, known/chosen plaintext, birthday attack (hash collisions), man-in-the-middle, downgrade attacks.

Physical Security

• CPTED (Crime Prevention Through Environmental Design) — natural surveillance, access control, territorial reinforcement.
• Layered physical controls: perimeter (fencing, bollards) → building (locks, badges) → room (mantraps, biometrics) → asset (cable locks, safes).
• Fire suppression: water (sprinklers), gas (clean agents like FM-200 for data centers), considerations for Class A/B/C/D/K fires.
• HVAC, power redundancy (UPS, generators), EMI/RFI shielding (Faraday cage/TEMPEST) round out facility controls.

Domain 4: Communication and Network Security

OSI Model

Mnemonic: "All People Seem To Need Data Processing" (top to bottom).

TCP/IP Model

Application → Transport → Internet → Network Access (maps roughly to OSI 7/6/5, 4, 3, 2/1).

Key Protocols & Concepts

• TCP — connection-oriented, reliable (3-way handshake: SYN, SYN-ACK, ACK).
• UDP — connectionless, unreliable, faster (DNS, VoIP, streaming).
• DNS security: DNSSEC (integrity of records), risks of cache poisoning/spoofing.
• NAT/PAT — address translation for private-to-public IP mapping.
• VLANs — logical network segmentation at Layer 2.

Secure Network Design

• Segmentation/Zoning — DMZ for public-facing services, separating trust zones.
• Firewalls: packet-filtering (stateless) → stateful → application-layer (proxy) → next-gen (NGFW with IPS/app-awareness).
• IDS/IPS: signature-based (known patterns) vs. anomaly/behavior-based (baseline deviation); network-based (NIDS) vs. host-based (HIDS).
• VPN: IPsec (network layer, tunnel/transport mode, AH/ESP) vs. TLS/SSL VPN (application layer).
• SD-WAN, SASE, Zero Trust Network Access (ZTNA) — modern architecture trends replacing traditional perimeter-based VPN.

Wireless Security

• WPA3 (current standard) > WPA2 > WEP (broken, avoid); WPA2/3-Enterprise uses 802.1X/RADIUS for per-user authentication.
• Rogue AP and evil twin attacks are core wireless threats.

Voice, Multimedia & Converged Communications

• VoIP risks: eavesdropping, toll fraud, SIP-based attacks — mitigate with SRTP, network segmentation.

Domain 5: Identity and Access Management (IAM)

AAA Framework

• Identification — claiming an identity (username).
• Authentication — proving the identity (password, token, biometric).
• Authorization — determining what the authenticated identity can do.
• Accountability — logging/auditing actions tied to identity (supports nonrepudiation).

Authentication Factors

MFA requires ≥2 different factor categories (not two of the same category). Biometric performance is measured by FRR (false rejection), FAR (false acceptance), and CER (crossover error rate — lower is better).

Access Control Models

Identity Lifecycle & Federation

• Provisioning → review/recertification → deprovisioning — joiner/mover/leaver process; timely deprovisioning is a top audit finding area.
• SSO (Single Sign-On) — one authentication grants access to multiple systems.
• Federation protocols: SAML (XML-based, enterprise SSO), OAuth 2.0 (authorization/delegated access), OpenID Connect (identity layer on OAuth2), Kerberos (ticket-based, symmetric-key, uses KDC/TGT for on-prem AD environments).
• Directory services: LDAP, Active Directory — centralized identity stores.

Privileged Access Management (PAM)

• Just-in-time (JIT) elevated access, credential vaulting, session recording for privileged accounts.
• Principle of least privilege applied specifically to admin/service accounts — a frequent real-world control gap.

Domain 6: Security Assessment and Testing

Assessment Types

Pen test knowledge levels: Black box (no prior knowledge), White box (full knowledge), Gray box (partial knowledge).

Testing Techniques

• Static (SAST) — analyzes source code without executing it.
• Dynamic (DAST) — tests running application from the outside.
• Interactive (IAST) — combines static and dynamic, instrumented at runtime.
• Fuzzing — feeding malformed/random input to find crashes/vulnerabilities.
• Code review — manual/peer inspection of source code.

Audit & Compliance

• Internal vs. external audits — internal for continuous improvement, external for independent assurance (e.g., certification audits).
• SOC reports: SOC 1 (financial controls), SOC 2 (security/availability/confidentiality — Type I = design at a point in time, Type II = operating effectiveness over a period).
• Log review, account management review, key performance/risk indicators (KPIs/KRIs) as ongoing assessment mechanisms.

Security Process Data

• Metrics should be actionable and tied to business risk, not just "more data" — avoid vanity metrics.
• Management review and reporting close the loop back to governance (Domain 1).

Domain 7: Security Operations

Incident Management Lifecycle

1. Detection — identifying that an event may be a security incident.
2. Response — initial handling, triage.
3. Mitigation — containment to limit damage.
4. Reporting — internal/regulatory notification as required.
5. Recovery — restoring normal operations.
6. Remediation — fixing root cause.
7. Lessons learned — post-incident review to improve future response.

Digital Forensics

• Order of volatility (most to least volatile): CPU registers/cache → RAM → network state → running processes → disk → backups/archival media.
• Chain of custody — documented handling of evidence to preserve admissibility.
• Evidence must be collected using forensically sound methods (write blockers, hashing for integrity verification).

Logging & Monitoring

• SIEM — centralizes log collection, correlation, and alerting.
• SOAR — adds automation/orchestration of response playbooks.
• Centralized, time-synchronized (NTP) logging is essential for correlation and forensic timelines.
• UEBA (User and Entity Behavior Analytics) — detects anomalies based on behavioral baselines.

Resilience & Recovery

• Redundancy: RAID levels, clustering, load balancing, failover.
• Backup types: Full, incremental (changes since last backup, fast backup/slow restore), differential (changes since last full, faster restore than incremental chain).
• High availability targets (e.g., "five nines" = 99.999% uptime).

Change & Configuration Management

• Formal change control process: request → assess/approve (CAB) → implement → verify → document.
• Patch management, configuration baselines, and hardening standards (CIS Benchmarks) reduce attack surface.

Physical & Personnel Security (Operational)

• Ongoing physical monitoring (guards, CCTV review), visitor management.
• Personnel security: background checks, termination procedures (immediate access revocation), separation of duties/job rotation to detect fraud.

Domain 8: Software Development Security

SDLC Models

Shift-left — embedding security earlier in the SDLC (requirements/design) rather than only at the end.

Secure Coding Concepts

• Input validation — the single most important defense against injection-class vulnerabilities.
• OWASP Top 10 — industry-standard list of critical web app risks (injection, broken access control, cryptographic failures, etc.) — worth knowing the current categories at a high level.
• Secure defaults — fail closed, deny by default.
• Output encoding — prevents injection into downstream interpreters (e.g., XSS mitigation).

Common Vulnerability Classes

• SQL Injection — untrusted input alters database queries; mitigated by parameterized queries/prepared statements.
• XSS (Cross-Site Scripting) — injecting malicious scripts into web pages viewed by others.
• CSRF — tricking an authenticated user's browser into making unwanted requests.
• Buffer overflow — writing beyond allocated memory bounds; classic memory-safety issue (more relevant to lower-level languages like C/C++).
• Race conditions / TOCTOU (time-of-check to time-of-use) — exploiting timing gaps between a check and its use.

Application Security Testing & Supply Chain

• SAST/DAST/IAST (overlap with Domain 6) applied specifically within CI/CD pipelines.
• SCA (Software Composition Analysis) — scans third-party/open-source dependencies for known vulnerabilities (CVEs).
• SBOM (Software Bill of Materials) — inventory of software components, increasingly required by regulation/procurement.

Database & Data-Layer Security

• Aggregation — combining low-sensitivity data points to infer higher-sensitivity information.
• Inference — deducing restricted information from available data without directly accessing it.
• Database security controls: views, stored procedures, parameterized access, field-level encryption.

Change Management for Code

• Version control, code review/approval gates, separation between development/test/production environments, and controlled release/deployment processes.