FILED UNDER
Topics
The CISSP material, sorted by where it lives in the exam.
Identity & Access Management
Proving who someone is, then deciding what they may reach: authentication, single sign-on, and the access control models. Kerberos goes deepest, with the attack chain built on it (golden tickets, silver tickets, Kerberoasting). CISSP Domain 5.
Security Architecture
How a system is designed to be secure before anything is bolted on: the formal models that decide who may read and write what, the cryptography underneath, and the principles that hold when real systems get messy. CISSP Domain 3.
Business Continuity
Planning for the day the system is gone: how long you can be down, how much data you can afford to lose, and where you fail over to. Impact analysis, recovery sites, and the metrics that all sit on one timeline. CISSP Domains 1 and 7.
Exam Strategy
How to think like a manager on exam day: reading a scenario for what it is really asking, spotting the distractors, and holding the fine distinctions that decide close questions. Scoping against tailoring, due care against due diligence.
Risk Management & Governance
Putting a number on risk, then deciding what to do about it: quantification, treatment and appetite, control types, and threat modeling. Plus the data governance vocabulary that decides classification questions. CISSP Domains 1 and 2.
Network Security
How networks are secured and attacked: the OSI model layer by layer, the protocols that encrypt traffic in transit, and segmentation from VLANs up to micro-segmentation, so that one breach cannot reach everything. CISSP Domain 4.
Security Operations
Running security day to day: watching what is happening now, testing your own defences before somebody else does, and handling it properly when something goes wrong, from incident response to chain of custody. CISSP Domains 6 and 7.
Software Development Security
Building security into software rather than bolting it on afterwards: where security fits in the development life cycle, what DevSecOps changes, and the testing that finds flaws in your code and in your dependencies. CISSP Domain 8.