Overview What You Will Learn Curriculum Instructor

Course Overview

Cybersecurity is essential for protecting organizational assets, sensitive information, networks, applications, and digital infrastructure from evolving threats. The Certified Information Systems Security Professional (CISSP) body of knowledge provides a comprehensive foundation for understanding security principles, managing organizational risks, designing secure systems, and establishing effective security governance and operational practices. This course begins with Security and Risk Management, covering security governance, risk assessment, compliance, business continuity, and disaster recovery. It progresses through Asset Security, Security Architecture and Engineering, Communication and Network Security, and Identity and Access Management. Learners also explore Security Assessment and Testing, Security Operations, Software Development Security, and Emerging Technologies and Advanced Security Strategy. The course incorporates cryptography, access controls, vulnerability assessment, penetration testing, incident response, digital forensics, cloud security, secure software development, artificial intelligence security, and real-world cybersecurity case studies. By completing this course, learners will understand core cybersecurity domains, assess security risks, strengthen security controls, and apply security principles to protect organizational systems and information. The necessary resources for this course are in the "Resources" section of Video 1.1.

What You Will Learn

  • Security Governance and Risk Management: Understand security principles, risk assessment methodologies, compliance requirements, security policies, and business continuity planning.
  • Asset Protection and Security Architecture: Learn data classification, asset lifecycle management, encryption, secure system design, cloud security, and security engineering principles.
  • Network Security and Identity Management: Understand network protocols, firewalls, intrusion detection and prevention, secure remote access, authentication, authorization, and identity governance.
  • Security Assessment and Operations: Explore vulnerability assessment, penetration testing fundamentals, security audits, incident response, digital forensics, threat hunting, security monitoring, and disaster recovery.
  • Secure Development and Emerging Technologies: Understand secure software development, application security testing, DevSecOps, artificial intelligence security, post-quantum cryptography, blockchain security, and Zero Trust Architecture.

Program Curriculum

  • Course and Trainer Intro
  • (ISC)² Code of Ethics
  • Professional Responsibilities and Organizational Ethics
  • The CIA Triad: Confidentiality, Integrity, and Availability
  • Identification, Authentication, Authorization, and Accountability (IAAA)
  • Governance vs. Management and Security Policy Hierarchy
  • Standards, Baselines, Guidelines, and Procedures
  • Risk Management Terminology: Asset, Threat, and Vulnerability
  • Quantitative Risk Formulas: SLE, ARO, and ALE
  • Qualitative vs. Quantitative Risk Analysis
  • Risk Response: Mitigation, Assignment, Acceptance, and Avoidance
  • NIST Risk Management Framework (RMF) Steps 1–3
  • NIST Risk Management Framework (RMF) Steps 4–7
  • Case Study: Capital One Breach and RMF Analysis
  • Security Control Categories: Administrative, Technical, and Physical
  • Control Types: Preventive, Detective, and Corrective
  • Control Types: Recovery and Deterrent
  • Practice Test: Governance and Risk Management
  • Business Continuity Planning (BCP) Foundations
  • Business Impact Analysis (BIA) and Identifying Criticality
  • Understanding MTD, RTO, RPO, and WRT
  • Supply Chain Risk Management (SCRM) and SolarWinds Case Study
  • Personnel Security: Onboarding and Background Checks
  • Job Rotation and Mandatory Vacations
  • Security Awareness vs. Training vs. Education
  • Legal Systems: Common Law vs. Civil Law
  • Intellectual Property: Copyrights, Patents, and Trademarks
  • Privacy Regulations: GDPR Deep Dive
  • Privacy Regulations: HIPAA, HITECH, GLBA, and COPPA
  • Export/Import Restrictions and The Wassenaar Arrangement
  • Third-party Risk Management: SLAs and MOUs
  • Risk Frameworks: ISO 27001/27002 and COBIT 5
  • Threat Modeling: STRIDE, PASTA, and VAST
  • Attack Trees and Reduction Analysis
  • Social Engineering: Phishing, Vishing, Smishing, and Baiting
  • Physical Social Engineering: Tailgating and Piggybacking
  • Disaster Recovery Plan (DRP) Development and Maintenance
  • Due Care vs. Due Diligence
  • Security Governance Committees and M&A Risk
  • Cyber Insurance and Security Control Assessment (SCA)
  • Risk Monitoring, Reporting, and Continuous Monitoring (ConMon)
  • Managing the Risk Register
  • Threat Actor Identification and The Cyber Kill Chain
  • MITRE ATT&CK Framework Basics
  • Crisis Management and Emergency Response
  • Remote Work and Telecommuting Security Policies
  • Incident Response Team (IRT) Structure and Metrics
  • Privacy Impact Assessments (PIA) and the DPO Role
  • Case Study: The Uber Breach (Ethics and Reporting)
  • Case Study: NotPetya Ransomware and BCP Failure
  • Domain 1 Summary
  • Chapter 1 Quiz

  • Information Identification and Classification
  • Data Sensitivity vs. Data Criticality
  • Government and Private Sector Classification Levels
  • Case Study: WikiLeaks and Unauthorized Disclosure
  • Data States: At Rest, In Transit, and In Use
  • Data Policy Roles: Owner, Custodian, and User
  • Data Loss Prevention (DLP) and Retention Policies
  • Secure Disposal: Clearing, Purging, and Degaussing
  • Asset Inventory and Management Tools
  • Data Remanence and SSD Sanitization Challenges
  • Data Owners vs. Data Controllers (GDPR)
  • Protecting Physical Media and Labeling Standards
  • Asset Lifecycle Management (ALM)
  • Cloud Data Storage and DRM
  • Database Sharding and Big Data Security
  • PII, PHI, and IP Identification and Discovery
  • Anonymization, Pseudonymization, and Tokenization
  • Legal Hold and E-Discovery Basics
  • Storage Encryption and Tape Backup Security
  • CASB Basics and Information Lifecycle Management (ILM)
  • Data Sovereignty and Third-party Data Agreements
  • Hardware Asset Destruction and Environmental Controls
  • Practice Test: Data Classification and Retention
  • Case Study: Morgan Stanley Data Leak
  • Domain 2 Summary
  • Chapter 2 Quiz

  • Secure Design: Defense in Depth and Fail-Safe/Secure
  • Security Models: Bell-LaPadula and Biba
  • Clark-Wilson and Brewer-Nash Models
  • Common Criteria (ISO 15408)
  • Memory Protection: ASLR and DEP
  • TPM, HSM, and Hardware Root of Trust
  • Virtualization Security and Hypervisor Vulnerabilities
  • Cloud Computing: IaaS, PaaS, SaaS
  • Cloud Shared Responsibility and Multi-tenancy
  • Intro to Cryptography and History
  • Symmetric Encryption: AES and DES
  • Asymmetric Encryption: RSA and ECC
  • Hashing Algorithms: MD5, SHA-1, and SHA-256
  • Digital Signatures and Non-repudiation
  • PKI: Certificates, CAs, and RAs
  • IPsec Architecture: AH and ESP
  • TLS/SSL Handshake and Lifecycle
  • Steganography and Watermarking
  • Site Selection and Perimeter Security
  • Fencing, Gates, Bollards, and Lighting
  • CCTV and Motion Detectors
  • Fire Suppression: Classes A–K
  • Fire Suppression: Wet, Dry, and Pre-action Pipes
  • OS Hardening and Mobile Device Management (MDM)
  • Container and Microservices Security
  • IoT, ICS, and SCADA Security
  • Fog, Edge, and Serverless Computing Security
  • Side-channel Attacks (Spectre/Meltdown)
  • Cryptanalysis: Brute-force and Birthday Attacks
  • Block Ciphers vs. Stream Ciphers
  • Cipher Modes: ECB, CBC, CTR, and GCM
  • Key Management and Diffie-Hellman
  • Quantum Cryptography and Salts/Pepper
  • Certificate Revocation: CRL and OCSP
  • Secure Boot, UEFI, and BIOS Security
  • Physical Security: Locks, Keys, and Mantraps
  • HVAC, Power (UPS/Generators), and Surges
  • EMR and TEMPEST Shielding
  • Physical Security Audits and Surveys
  • Secure Crypto-processors and CWPP
  • API and Identity-centric Architecture
  • Database and Storage Architecture (SAN/NAS)
  • Secure Hardware Procurement and Supply Chain
  • Web Application Architecture Security
  • Security in the System Life Cycle
  • Open Design vs. Obscurity
  • Principle of Least Privilege and Psychological Acceptability
  • Design for Auditability
  • Case Study: Smart Grid and Finance App Architecture
  • Virtualization Attacks and VM Sprawl
  • Secure Enclaves (Intel SGX) and Key Escrow
  • Digital Certificates: Wildcard vs. Multi-domain
  • Cryptographic Lifecycle Management
  • 3D Printing and Biometric Hardware Integrity
  • Case Study: Stuxnet (SCADA Attacks)
  • Case Study: RSA Breach (Seed Value Compromise)
  • Case Study: Marriott Breach (Database Architecture)
  • Case Study: Colonial Pipeline (Operational Continuity)
  • Practice Test: Security Architecture and Engineering
  • Domain 3 Summary
  • Chapter 3 Quiz

  • Domain 4 Summary
  • Chapter 4 Quiz

  • Identification: Usernames and Biometrics
  • Authentication Types: Something You Know, Have, Are
  • MFA Implementation and Fatigue Attacks
  • Single Sign-on (SSO) and SAML
  • OAuth and OpenID Connect
  • Kerberos Authentication Process
  • RADIUS, TACACS+, and LDAP
  • Directory Services (Active Directory) and Federation
  • Identity-as-a-Service (IDaaS)
  • Identity Provisioning Lifecycle
  • Privileged Access Management (PAM)
  • RBAC vs. ABAC vs. MAC vs. DAC
  • Context-aware and Passwordless Authentication
  • Biometric Accuracy (FAR, FRR, CER)
  • Iris, Retina, Face, and Behavioral Biometrics
  • OTP, HMAC (HOTP/TOTP), and Smart Cards
  • Just-in-Time (JIT) Access and SoD in IAM
  • Access Recertification and Entitlement Creep
  • Service Accounts and Secrets Management
  • Centralized vs. Decentralized IAM
  • Identity Proofing and SSPR
  • Account Lockout and FIM
  • Cross-Domain Identity (SCIM) and Shibboleth
  • Conditional Access and Hybrid Identity
  • Identity Governance and Administration (IGA)
  • Detecting Brute-force, Spraying, and Stuffing
  • Offline vs. Online Password Cracking
  • Social Media Identity Risks and Guest Management
  • Privileged User Monitoring and Compliance
  • Case Study: Snowden Leaks (Insider Threats)
  • Practice Test: Authentication and SSO
  • Case Study: Equifax Breach (IAM Focus)
  • Practice Test: Access Control Models
  • Case Study: Okta Breach (Session Hijacking)
  • Domain 5 Summary
  • Chapter 5 Quiz

  • Designing a Security Assessment Program
  • Internal vs. External and Third-party Assessments
  • Testing Technical, Administrative, and Physical Controls
  • Vulnerability Assessment: Scoping and Network Scanning
  • Agent-based vs. Agentless and Authenticated Scans
  • Pentesting: Planning, Recon, and Analysis
  • Pentesting: Exploitation and Reporting
  • SIEM Integration and Log Generation
  • Log Normalization, Analysis, and Retention
  • Performance Monitoring: Synthetic vs. RUM
  • Software Testing: Unit, Integration, and System
  • Regression Testing and UAT
  • SAST, DAST, and IAST Explained
  • Misuse Case Testing and Fuzzing
  • API and UI/UX Security Checks
  • KPIs and KRIs for Security Testing
  • Audit Foundations and Audit Types
  • Defining Audit Scope and Selecting Teams
  • The Audit Process: Planning to Reporting
  • Management Review and Audit Approval
  • SOC 1, SOC 2 (Type I vs. II), and SOC 3 Reports
  • Compliance Testing: PCI-DSS and HIPAA
  • Continuous Security Monitoring (CSM) and Automation
  • Case Study: Shadow Brokers Leak (Zero-days)
  • Practice Test: Vulnerability and Pentesting
  • Case Study: Target Audit Failure (Compliance vs. Security)
  • Practice Test: Software Testing Methodologies
  • Case Study: Heartland Payment Systems
  • Practice Test: Audit Standards and SOC
  • Case Study: Log4j Discovery
  • Domain 6 Summary
  • Case Study: Colonial Pipeline Operations and Triage
  • Practice Test: Disaster Recovery and Continuity
  • Case Study: Capital One DevSecOps Failures
  • Course Conclusion: Final Exam Checklist and Strategy
  • Chapter 6 Quiz

  • Introduction to Security Operations and Digital Forensics
  • Evidence Collection and Preservation: The Order of Volatility
  • Chain of Custody and Forensic Imaging Techniques
  • Logging and Monitoring: SIEM, SOAR, and Log Management
  • Investigating Security Incidents: Triage and Analysis
  • The Incident Response Lifecycle: Preparation for Lessons Learned
  • Endpoint Detection and Response (EDR) vs. XDR
  • Intrusion Detection and Prevention Systems (IDPS) Operations
  • Patch and Vulnerability Management Operations
  • Change and Configuration Management: Ensuring Stability
  • Backup and Recovery Strategies: Offsite and Cloud Storage
  • Disaster Recovery Planning (DRP) and Testing Types
  • Business Continuity Management (BCM) in Operations
  • Understanding High Availability (HA) and Fault Tolerance
  • Physical Security Operations: Monitoring and Surveillance
  • Managing Third-party and Supply Chain Operations Risk
  • Identity and Access Management (IAM) Operations
  • Asset Management: Secure Provisioning and Hardening
  • Malware Defense: Sandboxing and Anti-malware Operations
  • Threat Hunting: Proactive Security Analysis
  • Network Security Operations: Firewall and VPN Management
  • Cloud Security Operations: Monitoring Shared Resources
  • Secure Remote Work Operations and Telecommuting
  • Data Loss Prevention (DLP) Operational Workflows
  • Legal and Regulatory Requirements in Operations
  • E-discovery and Legal Holds: Operational Requirements
  • Vulnerability Scanning and Remediation Cycles
  • Security Awareness Training for Operational Staff
  • Crisis Management and Emergency Communication Plans
  • Case Study: SolarWinds Orion Incident Response
  • Case Study: MGM Resorts Ransomware Attack
  • Case Study: FireEye Red Team Tool Theft
  • Case Study: Southwest Airlines System Failure
  • Case Study: Kaseya VSA Supply Chain Attack
  • Case Study: Toyota Supply Chain Disruption
  • Domain 7 Summary
  • Chapter 7 Quiz

  • Introduction to Secure Software Development Foundations
  • The Software Development Life Cycle (SDLC) Models: Waterfall to Agile
  • Integrating Security in the SDLC: "Shift-left" Strategy
  • Software Configuration Management (SCM) and Version Control
  • Security Requirements and Threat Modeling in Software
  • Secure Coding Standards and Best Practices (OWASP, CERT)
  • Understanding Memory Safety and Buffer Overflows
  • Injection Vulnerabilities: SQLi, XSS, and CSRF8
  • Secure API Development and Management
  • Authentication and Authorization in Software: OAuth and SAML
  • Database Security and Secure Data Handling in Apps
  • Web Application Firewalls (WAF) and App-level Defense
  • Mobile Application Security: iOS vs. Android Challenges
  • Cloud-native Security: Microservices and Containers
  • Infrastructure as Code (IaC) and Serverless Security
  • Software Testing Methodologies: SAST, DAST, and IAST
  • Manual Code Reviews vs. Automated Security Scanning
  • Fuzz Testing and Misuse Case Analysis
  • Software Composition Analysis (SCA) and Dependency Risks
  • Managing Technical Debt and Security Patches in Software
  • Software Acquisition and Third-party Library Security
  • Software-defined Networking (SDN) Security
  • Secure Deployment and CI/CD Pipeline Security
  • DevSecOps: Culture, Automation, and Metrics
  • Intellectual Property Protection for Software and Code
  • Software Integrity and Digital Signatures
  • Secure Decommissioning and End-of-Life (EOL) Software
  • Privacy by Design in Software Development
  • Database Sharding and Big Data Application Security
  • Advanced Web Vulnerabilities: SSRF and Insecure Deserialization
  • Case Study: Log4Shell (Log4j) Vulnerability Analysis
  • Case Study: Equifax Breach (Unpatched Web Software)
  • Case Study: Microsoft Exchange ProxyLogon Exploits
  • Case Study: SolarWinds (The Compromised Build Environment)
  • Case Study: T-Mobile Data Breach (API Insecurity)
  • Case Study: Slack Secret Key Leak
  • Domain 8 Summary
  • Chapter 8 Quiz

  • Introduction to AI Security: Risks and Opportunities
  • Securing Generative AI and Large Language Models (LLMs)
  • Adversarial Machine Learning: Evasion and Poisoning Attacks
  • Quantum Computing Threats to Classical Cryptography
  • Post-Quantum Cryptography (PQC) Transition Planning
  • Blockchain and Distributed Ledger Technology (DLT) Security
  • Smart City Security and Large-scale IoT Ecosystems
  • Zero Trust Maturity Models: From Theory to Implementation
  • Security Orchestration, Automation, and Response (SOAR) Strategies
  • Digital Sovereignty and Geopolitical Cyber Risk
  • Cyber Resilience vs. Cyber Security: Designing for Survival
  • Advanced Threat Intelligence Integration and Sharing
  • Case Study: AI-driven Phishing and Deepfake Social Engineering
  • Domain 9 Summary
  • Chapter 9 Quiz
Load more modules

Instructor

Sachin Aggarwal

Sachin Aggarwal is a Lead Trainer at GIMIT and an Authorized Training Partner Instructor specializing in CompTIA Security+, CISSP, and AI governance. He helps learners build the technical skills to defend against evolving cyber threats and the strategic expertise to govern AI responsibly. His practical, clear teaching connects complex concepts to real-world challenges, with focused preparation for high-stakes certifications. From aspiring cybersecurity professionals to experienced leaders expanding into AI risk management, Sachin equips learners to apply security, compliance, and ethical principles across today’s organizations.

Join over 1 Million professionals from the most renowned Companies in the world!

certificate

Choose the Pro Plan That Fits Your Learning Journey

Invest in your future with flexible Pro subscription plans. Whether you're starting your cybersecurity journey or expanding your expertise, choose the membership duration that works for you and gain access to our complete learning platform.

Monthly Plans
Annual Plans
Save 20% with our annual plans!

Pro

Ideal for continuous learning, offering extensive resources with 900+ courses and diverse Learning Paths to enhance your skills.

$ 599.00
Billed annually or $69.00 billed monthly
Get Started Now
Start your 7-day trial for $1

What is included

  • Access to 900+ Premium Short Courses
  • 70+ Structured Learning Paths
  • Validation of Completion with All Courses and Learning Paths
  • New Courses Added Every Month
Early Access Offer

Pro +

Experience immersive learning with Practice Labs and CTF Challenges for comprehensive skill-building.

$ 699.00
Billed annually or $79.00 billed monthly
Get Started Now
Start your 7-day trial for $1

Everything in Pro and

  • 600+ Practice Labs with Guided Instructions
  • 400+ CTF Challenges with Detailed Walkthroughs
  • New Practice Labs and Challenges Added Every Month

Related Courses

  • Bootstrap 4 Quick Website Bootstrap Components Course
    Short Course

    Bootstrap 4 Quick Website Bootstrap Components Course

    Software Development

    Explore the basics of Bootstrap and learn to create a website...

    $49.99

    Beginner

    1 hr 30 m

  • CCNA - Understanding Routers and Switches
    Short Course

    CCNA - Understanding Routers and Switches

    Security Architecture and Operations

    A comprehensive guide to understanding the in-depth functioni...

    $49.99

    Intermediate

    2 hr 0 m

  • The Complete Full-Stack JavaScript Course
    Short Course

    The Complete Full-Stack JavaScript Course

    Software Development

    Learn full-stack web development using JavaScript (ReactJS, N...

    $79.99

    Beginner

    24 hr 17 m

  • React.JS for Ecommerce: Building a Store with React.JS
    Short Course

    React.JS for Ecommerce: Building a Store with React.JS

    DevSecOps

    From React.js Fundamentals to Crafting an Online Storefront

    $49.99

    Advanced

    3 hr 30 m

  • CISSP Certification Domains 5, 6, 7, and 8 Video Training
    Short Course

    CISSP Certification Domains 5, 6, 7, and 8 Video Training

    Cybersecurity

    This course is ideal for individuals who desire to pass the I...

    $69.99

    Intermediate

    6 hr 30 m

  • Helm 3 - Package Manager for Kubernetes
    Short Course

    Helm 3 - Package Manager for Kubernetes

    Software Development

    A must tool for every DevOps engineer

    $49.99

    Intermediate

    1 hr 27 m

  • Learn Ethical Hacking by Hacking Real Websites Legally
    Short Course

    Learn Ethical Hacking by Hacking Real Websites Legally

    Vulnerability Assessment and Pentesting

    Fun way to learn ethical hacking by playing online hacking ga...

    $69.99

    Beginner

    4 hr 18 m

  • Mastering Ansible Playbooks: Debugging and Security
    Short Course

    Mastering Ansible Playbooks: Debugging and Security

    Software Development

    Securing and Automating Linux and Windows Systems with Advanc...

    $99.99

    Advanced

    5 hr 34 m

1 50
View all