ISC2 CISSP

Security & Risk Management — governance, legal/regulatory, ethics, risk frameworks (NIST RMF/FAIR), ALE calculation, STRIDE threat modeling, policies, personnel security.

Asset Security — classification, data ownership (Owner/Custodian/User), data lifecycle, GDPR compliance, DLP technologies, retention & destruction (NIST 800-88), data sovereignty.

Security Architecture & Engineering — Bell-LaPadula/Biba models, SABSA/TOGAF, design principles, TCB, TPM/HSM, side-channel attacks, physical security, cryptographic implementation.

Communication & Network Security — OSI security per layer, TLS 1.3, DNSSEC, NGFW, Zero Trust (ZTNA), SD-WAN, cloud VPC/NSG, BGP hijacking, PAM/bastion host.

Identity & Access Management — joiner/mover/leaver, SAML/OAuth2/OIDC, PAM/PIM, IGA, Zero Trust Identity, biometrics (FAR/FRR/CER), FIDO2/WebAuthn, Azure Entra ID.

Security Assessment & Testing — VA vs pentest vs red team, PTES/OWASP methodology, OWASP Top 10 (2021), SAST/DAST/IAST, security audit types, fuzzing, DevSecOps pipeline.

Security Operations — SOC tiers, SIEM correlation, threat hunting (MITRE ATT&CK), digital forensics lifecycle, chain of custody, eDiscovery, DR/BCP exercises, EDR operations.

Software Development Security — SDLC security, secure design patterns, OWASP Top 10 (dev view), SAST/SCA (Semgrep/SonarQube), secure API design, container security, SBOM, CI/CD pipeline security.