CISSP Certified Information Systems Security Professional — 8 Domains

CISSP (Certified Information Systems Security Professional) von ISC² ist eine der prestigeträchtigsten Cybersecurity-Zertifizierungen weltweit — gilt als „Goldstandard" für Senior Security-Profis und Security-Architekten. Voraussetzung: 5 Jahre dokumentierte Erfahrung in mindestens 2 von 8 Domains. Der Kurs deckt das Common Body of Knowledge (CBK) ab. Block Domain 1 — Security & Risk Management (15 % der Prüfung): Security-Governance-Prinzipien, Compliance-Anforderungen, gesetzliche Vorgaben (DSGVO, NIS2, DORA, SOX, HIPAA), Berufsethik (ISC²-Code of Ethics), Sicherheits-Dokumentation (Policies, Standards, Guidelines, Procedures), Risikomanagement (Identifikation, Bewertung, Behandlung), Threat Modeling (STRIDE, PASTA, DREAD), Business Continuity Planning, Akquisitions-Strategie, Personnel Security (Background-Checks, Onboarding, Offboarding), Security Awareness Training. Block Domain 2 — Asset Security (10 %): Asset-Klassifizierung (Public, Internal, Confidential, Restricted), Schutz von Personally Identifiable Information (PII), Data Lifecycle (Creation, Storage, Use, Sharing, Archival, Destruction), Data Roles (Data Owner, Data Custodian, Data Processor), Data Remanence und Secure Disposal (Wiping, Degaussing, Physical Destruction). Block Domain 3 — Security Architecture and Engineering (13 %): Engineering-Prozesse mit Security-by-Design, Security Models (Bell-LaPadula für Confidentiality, Biba für Integrity, Clark-Wilson für Commercial), Trusted Computing Base, TPM (Trusted Platform Module), Cryptography (Symmetrisch, Asymmetrisch, Hash, PKI), Site und Facility Security. Block Domain 4 — Communication and Network Security (13 %): OSI- und TCP/IP-Modelle, Secure Network Architecture (DMZ, Network Segmentation, Zero Trust), Network Security Devices (Firewalls, IDS/IPS, WAF), Secure Communication Channels (VPN, TLS, SSH), Wireless Security (WPA3, 802.1X). Block Domain 5 — Identity and Access Management (13 %): Physical und Logical Access Controls, Identification, Authentication (Knowledge, Possession, Inherence), Authorization Models (DAC, MAC, RBAC, ABAC), SSO und Federation (SAML, OAuth2, OIDC), Privileged Access Management (PAM). Block Domain 6 — Security Assessment and Testing (12 %): Assessment-Strategien, Security Audits (Internal, External, SOC), Penetration Testing, Vulnerability Assessments, Log-Review und Monitoring, Disaster Recovery-Tests. Block Domain 7 — Security Operations (13 %): Investigations und Forensics, Logging und Monitoring (SIEM), Resource Protection, Incident Management, Disaster Recovery, BCP-Implementierung. Block Domain 8 — Software Development Security (11 %): Secure SDLC, Security-Anforderungen in jeder Phase, OWASP Top 10, Secure Coding-Praktiken, Code Review, Application Security Testing (SAST, DAST, IAST), DevSecOps.