Học CISSP ở đâu? Hướng dẫn đăng ký thi chứng chỉ CISSP mới nhất 2024

Học CISSP ở đâu tại Hà Nội chất lượng – uy tín – có kinh nghiệm đào tạo từ năm 2005. Mời các bạn tham khảo Khóa học CISSP tại PNH.

Tổng quan về chứng chỉ CISSP

CISSP (Certified Information Systems Security Professional) là chứng chỉ bảo mật hệ thống thông tin chuyên nghiệp. Đây là một chứng chỉ nâng cao do (ISC) ² cấp và nổi tiếng nhất trong lĩnh vực an toàn thông tin.

CISSP là chứng chỉ đầu tiên trong lĩnh vực bảo mật thông tin đáp ứng các yêu cầu nghiêm ngặt của Tiêu chuẩn ANSI/ISO/IEC 17024.

Yêu cầu đầu vào: có trên 5 năm kinh nghiệm làm việc trong lĩnh vực Security.

Ai nên học chứng chỉ CISSP

Trưởng phòng an ninh thông tin
Giám đốc Thông tin
Giám đốc an ninh
Giám đốc/Quản lý CNTT
Kỹ sư hệ thống an ninh
Nhà phân tích bảo mật
Quản lí an ninh
Kiểm toán viên an ninh
Kiến trúc sư bảo mật
Tư vấn an ninh
Kiến trúc sư mạng

Tổng quan về bài thi chứng chỉ CISSP

Thời gian làm bài: 180 phút (3 tiếng)
Tổng số câu hỏi: dao động từ 100 – 150 câu hỏi
Điểm pass: 700/1000 điểm
Lệ phí thi: $749
Đổi lịch thi: $50
Huỷ bài thi: $100

Cấu trúc đề thi

Domains	Average Weight
1. Security and Risk Management	16%
2. Asset Security	10%
3. Security Architecture and Engineering	13%
4. Communication and Network Security	13%
5. Identity and Access Management (IAM)	13%
6. Security Assessment and Testing	12%
7. Security Operations	13%
8. Software Development Security	10%
Total	100%

Chính sách thi lại

Thí sinh có thể dự thi (ISC)² tối đa 3 lần trong khoảng thời gian 12 tháng:

Nếu thí sinh không vượt qua kỳ thi lần đầu, bạn có thể thi lại sau đó 30 ngày.
Nếu thí sinh không vượt qua kỳ thi lần thứ hai, bạn có thể thi lại sau 90 ngày miễn thi bổ sung.
Nếu thí sinh không vượt qua kỳ thi lần thứ ba, bạn có thể thi lại sau 180 ngày không thi kể từ lần thi thứ hai.

Học CISSP ở đâu tại Hà Nội? Tại sao bạn nên học CISSP ở PNH

Được thành lập từ năm 2005, PNH là một trong số những trung tâm đào tạo CNTT lâu đời nhất ở Hà Nội
Là học viện có số học viên theo học trực tiếp đông nhất tại Hà Nội
Với hơn 19 năm làm trong lĩnh vực đào tạo, PNH hiểu rõ các bạn cần học những kiến thức nào để đáp ứng công việc
Đội ngũ giáo viên được tuyển chọn chất lượng, là những người đã và đang làm các công việc liên quan đến những kiến thức được đào tạo trong khóa học
Kiến thức luôn luôn được cập nhật liên tục để đáp ứng nhu cầu cải tiến, phát triển của công nghệ ngày nay.
Học trực tiếp là cách tốt nhất để bạn tập trung học tập và được giáo viên hỗ trợ tận nơi. PNH luôn khuyến khích các bạn nếu có điều kiện hãy tới tham gia học trực tiếp tại PNH để được đảm bảo chất lượng tốt nhất.

Nội dung đào tạo

Chapter 1: Security and Risk Management

1.1 – Understand, adhere to, and promote professional ethics

ISC2 Code of Professional Ethics
Organizational code of ethics

1.2 – Understand and apply security concepts

Confidentiality, integrity, and availability, authenticity, and nonrepudiation (5 Pillars of Information Security)

1.3 – Evaluate and apply security governance principles

Alignment of the security function to business strategy, goals, mission, and objectives
Organizational processes (e.g., acquisitions, divestitures, governance committees)
Organizational roles and responsibilities
Security control frameworks (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST), Control Objectives for Information and Related Technology (COBIT), Sherwood Applied Business Security Architecture (SABSA), Payment Card Industry (PCI), Federal Risk and Authorization Management Program (FedRAMP))
Due care/due diligence

1.4 – Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context

Cybercrimes and data breaches
Licensing and Intellectual Property requirements
Import/export controls
Transborder data flow
Issues related to privacy (e.g., General Data Protection Regulation (GDPR), California Consumer Privacy Act, Personal Information Protection Law, Protection of Personal Information Act)
Contractual, legal, industry standards, and regulatory requirements

1.5 – Understand requirements for investigation types (i.e., administrative, criminal, civil, regulatory, industry standards)

1.6 – Develop, document, and implement security policy, standards, procedures, and guidelines

Alignment of the security function to business strategy, goals, mission, and objectives
Organizational processes (e.g., acquisitions, divestitures, governance committees)
Organizational roles and responsibilities
Security control frameworks (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST), Control Objectives for Information and Related Technology (COBIT), Sherwood Applied Business Security Architecture (SABSA), Payment Card Industry (PCI), Federal Risk and Authorization Management Program (FedRAMP))
Due care/due diligence

1.7 – Identify, analyze, assess, prioritize, and implement Business Continuity (BC) requirements

Business impact analysis (BIA)
External dependencies

1.8 – Contribute to and enforce personnel security policies and procedures

Candidate screening and hiring
Employment agreements and policy driven requirements
Onboarding, transfers, and termination processes
Vendor, consultant, and contractor agreements and controls

1.9 – Understand and apply risk management concepts

Threat and vulnerability identification
Risk analysis, assessment, and scope
Risk response and treatment (e.g., cybersecurity insurance)
Applicable types of controls (e.g., preventive, detection, corrective)
Control assessments (e.g., security and privacy)
Continuous monitoring and measurement
Reporting (e.g., internal, external)
Continuous improvement (e.g., risk maturity modeling)
Risk frameworks (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST), Control Objectives for Information and Related Technology (COBIT), Sherwood Applied Business Security Architecture (SABSA), Payment Card Industry (PCI))

1.10 – Understand and apply threat modeling concepts and methodologies

1.11 – Apply Supply Chain Risk Management (SCRM) concepts

Risks associated with the acquisition of products and services from suppliers and providers (e.g., product tampering, counterfeits, implants)
Risk mitigations (e.g., third-party assessment and monitoring, minimum security requirements, service level requirements, silicon root of trust, physically unclonable function, software bill of materials)

1.12 – Establish and maintain a security awareness, education, and training program

Methods and techniques to increase awareness and training (e.g., social engineering, phishing, security champions, gamification)
Periodic content reviews to include emerging technologies and trends (e.g., cryptocurrency, artificial intelligence (AI), blockchain)
Program effectiveness evaluation

Chapter 2: Asset Security

2.1 – Identify and classify information and assets

Data classification
Asset Classification

2.2 – Establish information and asset handling requirements

2.3 – Provision information and assets securely

Information and asset ownership
Asset inventory (e.g., tangible, intangible)
Asset management

2.4 – Manage data lifecycle

Data roles (i.e., owners, controllers, custodians, processors, users/subjects)
Data collection
Data location
Data maintenance
Data retention
Data remanence
Data destruction

2.5 – Ensure appropriate asset retention (e.g., End of Life (EOL), End of Support)

2.6 – Determine data security controls and compliance requirements

Data states (e.g., in use, in transit, at rest)
Scoping and tailoring
Standards selection
Data protection methods (e.g., Digital Rights Management (DRM), Data Loss Prevention (DLP), Cloud Access Security Broker (CASB))

Chapter 3: Security Architecture and Engineering

3.1 – Research, implement and manage engineering processes using secure design principles

Threat modeling
Least privilege
Defense in depth
Secure defaults
Fail securely
Segregation of Duties (SoD)
Keep it simple and small
Zero trust or trust but verify
Privacy by design
Shared responsibility
Secure access service edge

3.2 – Understand the fundamental concepts of security models (e.g., Biba, Star Model, Bell-LaPadula)

3.3 – Select controls based upon systems security requirements

3.4 – Understand security capabilities of Information Systems (IS) (e.g., memory protection, Trusted Platform Module (TPM), encryption/decryption)

3.5 – Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements

Client-based systems
Server-based systems
Database systems
Cryptographic systems
Industrial Control Systems (ICS)
Cloud-based systems (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS))
Distributed systems
Internet of Things (IoT)
Microservices (e.g., application programming interface (API))
Containerization
Serverless
Embedded systems
High-Performance Computing systems
Edge computing systems
Virtualized systems

3.6 – Select and determine cryptographic solutions

Cryptographic life cycle (e.g., keys, algorithm selection)
Cryptographic methods (e.g., symmetric, asymmetric, elliptic curves, quantum)
Public key infrastructure (PKI) (e.g., quantum key distribution

3.7 – Understand methods of cryptanalytic attacks

Brute force
Ciphertext only
Known plaintext
Frequency analysis
Chosen ciphertext
Implementation attacks
Side-channel
Fault injection
Timing
Man-in-the-Middle (MITM)
Pass the hash
Kerberos exploitation
Ransomware

3.8 – Apply security principles to site and facility design

3.9 – Design site and facility security controls

Wiring closets/intermediate distribution facilities
Server rooms/data centers
Media storage facilities
Evidence storage
Restricted and work area security
Utilities and Heating, Ventilation, and Air Conditioning (HVAC)
Environmental issues (e.g., natural disasters, man-made)
Fire prevention, detection, and suppression
Power (e.g., redundant, backup)

3.10 – Manage the information system lifecycle

Stakeholders needs and requirements
Requirements analysis
Architectural design
Development /implementation
Integration
Verification and validation
Transition/deployment
Operations and maintenance/sustainment
Retirement/disposal

Chapter 4: Communication and Network Security

4.1 – Apply secure design principles in network architectures

Open System Interconnection (OSI) and Transmission Control Protocol/Internet Protocol (TCP/IP) models
Internet Protocol (IP) version 4 and 6 (IPv6) (e.g., unicast, broadcast, multicast, anycast)
Secure protocols (e.g., Internet Protocol Security (IPSec), Secure Shell (SSH), Secure Sockets Layer (SSL)/ Transport Layer Security (TLS))
Implications of multilayer protocols
Converged protocols (e.g., Internet Small Computer Systems Interface (iSCSI), Voice over Internet Protocol (VoIP), InfiniBand over Ethernet, Compute Express Link)
Transport architecture (e.g., topology, data/control/management plane, cut-through/store-and-forward)
Performance metrics (e.g., bandwidth, latency, jitter, throughput, signal-to-noise ratio)
Traffic flows (e.g., north-south, east-west)
Physical segmentation (e.g., in-band, out-of-band, air-gapped)
Logical segmentation (e.g., virtual local area networks (VLANs), virtual private networks (VPNs), virtual routing and forwarding, virtual domain)
Micro-segmentation (e.g., network overlays/encapsulation; distributed firewalls, routers, intrusion detection system (IDS)/intrusion prevention system (IPS), zero trust)
Edge networks (e.g., ingress/egress, peering)
Wireless networks (e.g., Bluetooth, Wi-Fi, Zigbee, satellite)
Cellular/mobile networks (e.g., 4G, 5G)
Content distribution networks (CDN)
Software defined networks (SDN), (e.g., application programming interface (API), Software-Defined Wide- Area Network, network functions virtualization)
Virtual Private Cloud (VPC)
Monitoring and management (e.g., network observability, traffic flow/shaping, capacity management, fault detection and handling)

4.2 – Secure network components

Operation of infrastructure (e.g., redundant power, warranty, support)
Transmission media (e.g., physical security of media, signal propagation quality)
Network Access Control (NAC) systems (e.g., physical, and virtual solutions)
Endpoint security (e.g., host-based)

4.3 – Implement secure communication channels according to design

Voice, video, and collaboration (e.g., conferencing, Zoom rooms)
Remote access (e.g., network administrative functions)
Data communications (e.g., backhaul networks, satellite)
Third-party connectivity (e.g., telecom providers, hardware support)

Chapter 5: Identity and Access Management (IAM)

5.1 – Control physical and logical access to assets

Information
Systems
Devices
Facilities
Applications
Services

5.2 – Design identification and authentication strategy (e.g., people, devices, and services)

Groups and Roles
Authentication, Authorization and Accounting (AAA) (e.g., multi-factor authentication (MFA), password-less authentication)
Session management
Registration, proofing, and establishment of identity
Federated Identity Management (FIM)
Credential management systems (e.g., Password vault)
Single sign-on (SSO)
Just-In-Time

5.3 – Federated identity with a third-party service

On-premise
Cloud
Hybrid

5.4 – Implement and manage authorization mechanisms

Role-based access control (RBAC)
Rule based access control
Mandatory access control (MAC)
Discretionary access control (DAC)
Attribute-based access control (ABAC)
Risk based access control
Access policy enforcement (e.g., policy decision point, policy enforcement point)

5.5 – Manage the identity and access provisioning lifecycle

Account access review (e.g., user, system, service)
Provisioning and deprovisioning (e.g., on /off boarding and transfers)
Role definition and transition (e.g., people assigned to new roles)
Privilege escalation (e.g., use of sudo, auditing its use)
Service accounts management

5.6 – Implement authentication systems

Chapter 6: Security Assessment and Testing

6.1 – Design and validate assessment, test, and audit strategies

Internal (e.g., within organization control)
External (e.g., outside organization control)
Third-party (e.g., outside of enterprise control)
Location (e.g., on-premises, cloud, hybrid)

6.2 – Conduct security control testing

Vulnerability assessment
Penetration testing (e.g., red, blue, and/or purple team exercises)
Log reviews
Synthetic transactions/benchmarks
Code review and testing
Misuse case testing
Coverage analysis
Interface testing (e.g., user interface, network interface, application programming interface (API))
Breach attack simulations
Compliance checks

6.3 – Collect security process data (e.g., technical and administrative)

Account management
Management review and approval
Key performance and risk indicators
Backup verification data
Training and awareness
Disaster Recovery (DR) and Business Continuity (BC)

6.4 – Analyze test output and generate report

Remediation
Exception handling
Ethical disclosure

6.5 – Conduct or facilitate security audits

Internal (e.g., within organization control)
External (e.g., outside organization control)
Third-party (e.g., outside of enterprise control)
Location (e.g., on-premises, cloud, hybrid)

Chapter 7: Security Operations

7.1 – Understand and comply with investigations

Evidence collection and handling
Reporting and documentation
Investigative techniques
Digital forensics tools, tactics, and procedures
Artifacts (e.g., data, computer, network, mobile device)

7.2 – Conduct logging and monitoring activities

Intrusion detection and prevention (IDPS)
Security Information and Event Management (SIEM)
Continuous monitoring and tuning
Egress monitoring
Log management
Threat intelligence (e.g., threat feeds, threat hunting)
User and Entity Behavior Analytics (UEBA)

7.3 – Perform Configuration Management (CM) (e.g., provisioning, baselining, automation)

7.4 – Apply foundational security operations concepts

Need-to-know/least privilege
Separation of Duties (SoD) and responsibilities
Privileged account management
Job rotation
Service-level agreements (SLA)

7.5 – Apply resource protection

Media management
Media protection techniques
Data at rest/data in transit

7.6 – Conduct incident management

Detection
Response
Mitigation
Reporting
Recovery
Remediation
Lessons learned

7.7 – Operate and maintain detection and preventative measures

Firewalls (e.g., next generation, web application, network)
Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)
Whitelisting/blacklisting
Third-party provided security services
Sandboxing
Honeypots/honeynets
Anti-malware
Machine learning and Artificial Intelligence (AI) based tools

7.8 – Implement and support patch and vulnerability management

7.9 – Understand and participate in change management processes

7.10 – Implement recovery strategies

Backup storage strategies (e.g., cloud storage, onsite, offsite)
Recovery site strategies (e.g., cold vs. hot, resource capacity agreements)
Multiple processing sites
System resilience, high availability (HA), Quality of Service (QoS), and fault tolerance

7.11 – Implement Disaster Recovery (DR) processes

Response
Personnel
Communications (e.g., methods)
Assessment
Restoration
Training and awareness
Lessons learned

7.12 – Test Disaster Recovery Plans (DRP)

Read-through/tabletop
Walkthrough
Simulation
Parallel
Full interruption
Communications (e.g., stakeholders, test status, regulators)

7.13 – Participate in Business Continuity (BC) planning and exercises

7.14 – Implement and manage physical security

Perimeter security controls
Internal security controls

7.15 – Address personnel safety and security concerns

Travel
Security training and awareness (e.g., insider threat, social media impacts, two-factor authentication (2FA) fatigue)
Emergency management
Duress

Chapter 8: Software Development Security

8.1 – Understand and integrate security in the Software Development Life Cycle (SDLC)

Development methodologies (e.g., Agile, Waterfall, DevOps, DevSecOps, Scaled Agile Framework)
Maturity models (e.g., Capability Maturity Model (CMM), Software Assurance Maturity Model (SAMM))
Operation and maintenance
Change management
Integrated Product Team

8.2 – Identify and apply security controls in software development ecosystems

Programming languages
Libraries
Tool sets
Integrated Development Environment
Runtime
Continuous Integration and Continuous Delivery (CI/CD)
Software configuration management (CM)
Code repositories
Application security testing (e.g., static application security testing (SAST), dynamic application security testing (DAST), software composition analysis, Interactive Application Security Test (IAST))

8.3 – Assess the effectiveness of software security

Auditing and logging of changes
Risk analysis and mitigation

8.4 – Assess security impact of acquired software

Commercial-off-the-shelf (COTS)
Open source
Third-party
Managed services (e.g., enterprise applications)
Cloud services (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS))

8.5 – Define and apply secure coding guidelines and standards

Security weaknesses and vulnerabilities at the source-code level
Security of application programming interfaces (API)
Secure coding practices
Software-defined security

Các bạn có câu hỏi thắc mắc về khóa học CISSP xin vui lòng liên hệ để được giải đáp:

HỌC VIỆN PNH – 19 NĂM ĐÀO TẠO & THI CHỨNG CHỈ CNTT QUỐC TẾ TẠI HÀ NỘI

Fanpage: Học viện đào tạo quản trị mạng PNH TẠI ĐÂY

Hotline 1 & Zalo: 0906 289 618 (Ms. Linh)

Hotline 2 & Zalo: 0904 508 838 (Ms.Thủy)

Điạ chỉ: P301, tầng 03 tòa nhà DETECH, số 8A Tôn Thất Thuyết, Hà Nội

Tiktok: hocvien_pnh

Youtube: Học viện đào tạo quản trị mạng PNH

học CISSP ở đâu? học CISSP ở đâu? học CISSP ở đâu? học CISSP ở đâu? học CISSP ở đâu? học CISSP ở đâu? học CISSP ở đâu?