CISSP Study Notes - 2025 Preparation

Personal Notes for Exam Success

Prepared by: Cybersecurity Professional
Date: December 2025
Status: Active Study - Personal Reference

Table of Contents
1. Domain 1: Security and Risk Management (16%)
2. Domain 2: Asset Security (10%)
3. Domain 3: Security Architecture and Engineering (13%)
4. Domain 4: Communication and Network Security (13%)
5. Domain 5: Identity and Access Management (13%)
6. Domain 6: Security Assessment and Testing (12%)
7. Domain 7: Security Operations (13%)
8. Domain 8: Software Development Security (10%)

Domain 1: Security and Risk Management (16% of Exam)

This is the heaviest domain on the exam and foundational for all other areas. It's the
strategic layer that connects security practices to business objectives.

1.1 Understand Risk Management Concepts

Risk Triangle: Threat × Vulnerability × Asset Value = Risk
The most critical concept to internalize. Every threat assessment should consider all three
elements. A vulnerability without a credible threat is low priority. A threat with no
applicable vulnerability cannot be exploited.
Key Definitions:

Threat: Any potential danger that could exploit a vulnerability

Vulnerability: A weakness in a system, process, or policy
Asset: Anything of value to the organization (data, systems, people)
Likelihood: The probability that a threat will manifest
Impact: The potential damage or consequence if the threat occurs
Types of Risk Analysis:
Qualitative Risk Analysis – Uses descriptive scales (High, Medium, Low) rather than
numerical values. Faster to conduct. Useful for initial assessments. More subjective.

Quantitative Risk Analysis – Assigns numerical values. Uses formulas like Annual Loss
Expectancy (ALE). More rigorous and defensible. More time-intensive. Better for financial
decision-making.
Annual Loss Expectancy (ALE) Formula:
ALE = Asset Value (AV) × Exposure Factor (EF) × Annual Rate of Occurrence (ARO)

Example: If a server is worth $50,000, and we estimate a 0.5 exposure factor from a
potential breach, with an ARO of 2 incidents per year:
ALE = $50,000 × 0.5 × 2 = $50,000 annually

1.2 Risk Treatment Strategies

Mitigation (Reduce) – Implement controls to lower risk. Most common approach.
Examples: firewalls, encryption, access controls.
Avoidance (Eliminate) – Stop the risky activity entirely. Requires discontinuing business
processes. Not always practical but sometimes necessary for extreme risks.
Transfer (Shift) – Use insurance or third-party services. Insurance policies can cover
financial losses. Outsourcing to managed security providers transfers operational risk.

Acceptance (Tolerate) – Accept the risk and its potential consequences. Only viable for
low-impact, low-probability risks or when mitigation costs exceed asset value. Must be
documented and approved by management.

1.3 Security Governance

Governance vs Management:
Governance is the oversight layer—strategic direction, policies, accountability
Management is tactical execution—implementing policies, managing day-to-day
operations

Security Governance Principles:

• Strategic alignment – Security initiatives support business objectives
• Risk-based approach – Investments proportional to risk levels
• Accountability – Clear assignment of responsibilities
• Transparency – Stakeholders understand security decisions
• Compliance – Meeting regulatory and legal requirements
• Continuous improvement – Regular review and enhancement of controls

1.4 Compliance and Regulatory Frameworks

Key Regulations to Know:
GDPR (General Data Protection Regulation) – EU regulation protecting personal
data. Applies globally to organizations processing EU residents' data. Key
requirement: obtaining explicit consent for data processing.
HIPAA (Health Insurance Portability and Accountability Act) – US healthcare
data protection. Requires business associate agreements. Breach notification within
60 days.
PCI DSS (Payment Card Industry Data Security Standard) – Required for
organizations handling credit card data. 12 core requirements. Annual compliance
validation mandatory.
 SOC 2 (Service Organization Control) – For cloud/SaaS providers. Type I (controls
exist at point in time) vs Type II (controls sustained over period).
ISO/IEC 27001 – International information security management standard. Defines
requirements for ISMS (Information Security Management System).

1.5 Threat Modeling

PASTA (Process for Attack Simulation and Threat Analysis)
Seven-stage framework for risk-centric threat modeling:

1. Define Objectives (DO) – Identify business objectives and compliance requirements

(PCI DSS, HIPAA, etc.)
2. Define Technical Scope (DTS) – Map application architecture and data flows
3. Application Decomposition and Analysis (ADA) – Break down components and
trust boundaries
4. Threat Analysis (TA) – Identify potential threats to each component
5. Vulnerability & Weakness Analysis (WVA) – Find existing vulnerabilities that
enable threats
6. Attack Modeling & Simulation (AMS) – Model realistic attack scenarios
7. Risk & Impact Analysis (RIA) – Quantify risk and prioritize mitigation
STRIDE Methodology (alternative threat modeling approach):
Spoofing – Identity spoofing attacks
Tampering – Unauthorized modification of data or systems
Repudiation – Denial of actions (non-repudiation controls needed)
Information Disclosure – Unauthorized access to sensitive data
Denial of Service – Disruption of system availability
Elevation of Privilege – Gaining higher-level access than authorized

Domain 2: Asset Security (10% of Exam)

Asset security focuses on how we classify, handle, store, and protect valuable
organizational information.

2.1 Data Classification

Classification Levels (Most Common):
• Public – No impact if disclosed. Can be published without concern
• Internal Use – Intended for internal use only. Limited damage if disclosed
• Confidential – Restricted to authorized personnel. Significant harm if disclosed
• Restricted/Secret – Highest sensitivity. Only "need-to-know" access granted
Ownership and Responsibilities:

Data Owner – Senior person responsible for the data. Determines classification.
Makes backup/retention decisions. Ultimately liable.
Data Custodian – Implements controls on behalf of the owner. IT department
typically. Manages daily operations.
Data User – End user with authorized access. Must follow policies for handling
classified data.
2.2 Data Handling and Lifecycle
Data Lifecycle Stages:
1. Creation/Collection – Data originates. Classification applied immediately.
2. Processing – Data used for intended purpose. Access controls enforced.
3. Storage – Data at rest. Encryption and access controls required.
4. Transmission – Data in transit. Use of secure channels (TLS, VPN) required.
5. Archival – Data retained for compliance/historical purposes. Continued protection
required.
6. Destruction – Secure disposal. For electronic data: cryptographic erasure or physical
destruction.
Critical for exam: Understand that data doesn't lose its sensitivity classification during
any of these stages. It requires protection throughout its entire lifecycle.

2.3 Information Classification Standards

ISO/IEC 27001 establishes the framework for organizing asset protection. Classification
decisions should be made based on:
Regulatory requirements
Competitive sensitivity
Reputational impact if compromised
Financial value of information

Domain 3: Security Architecture and Engineering (13% of

Exam)
This domain covers the design and implementation of secure systems. Critical for
architects and senior engineers.

3.1 Secure Design Principles

Defense in Depth (Layered Security)
Multiple overlapping security controls. Single point of failure doesn't compromise entire
system. Example: network perimeter firewall + host-based firewall + application-level
access control + data encryption.

Principle of Least Privilege

Users and processes granted only the minimum permissions necessary to perform their
function. Reduces attack surface. Limits damage from compromised accounts. Must
balance security with usability.
Separation of Duties

No single individual can perform all steps of a critical transaction. Prevents fraud and
unauthorized actions. Example: approval of expenses requires reviewer and approver—
never the same person.
3.2 Security Models
Bell-LaPadula Model – Focuses on confidentiality. Two rules:
Simple Security Property: "No read up" – Can't read data at higher classification
*-property (Star Property): "No write down" – Can't write to lower classification
Used in military/government contexts. Protects against information disclosure.

Biba Integrity Model – Inverse of Bell-LaPadula. Focuses on integrity.

No read down – Can't read from lower integrity level
No write up – Can't write to higher integrity level
Prevents untrusted sources from corrupting trusted data.

Chinese Wall Model – Separation of duties for conflict of interest. Example: auditor can't
audit two competing companies. Prevents conflicts of interest and insider threats.

3.3 Cryptography
Symmetric Cryptography – Single shared key for encryption and decryption.
AES (Advanced Encryption Standard) – 128, 192, 256-bit keys. Current standard.
Approved for classified US government data (TOP SECRET with 256-bit keys).
DES (Data Encryption Standard) – Outdated. 56-bit keys. Do not use. Vulnerable to
brute force.
3DES – Multiple DES iterations. Better than DES but slower than AES. Legacy use only.

Asymmetric Cryptography – Public/private key pair.

RSA – Used for encryption and digital signatures. 2048-bit or 4096-bit recommended.
ECC (Elliptic Curve Cryptography) – More efficient than RSA. Smaller key sizes for
equivalent security.
Hash Functions – One-way cryptographic functions. Cannot be reversed.

MD5 – 128-bit output. Broken. Do not use for security.

SHA-1 – 160-bit output. Deprecated. Avoid for new implementations.
SHA-256 – 256-bit output. Current standard. Secure.
SHA-3 – Latest standard. More resilient to attacks than SHA-2.
Key Management:
Keys must be generated securely
Keys must be stored securely (hardware security modules preferred)
Keys must be rotated periodically
Retired keys must be securely destroyed
Key escrow (backup copies) required for business continuity
3.4 Secure Protocols
TLS (Transport Layer Security) – Ensures confidentiality and integrity of data in transit.
TLS 1.2 or higher required. TLS 1.0 and 1.1 deprecated.
Uses asymmetric cryptography for key exchange, symmetric for bulk data
encryption.
Certificate-based authentication.
IPSec – Network-level encryption for VPN and secure network communication.

Operates at Layer 3 (network layer).

Two modes: Transport (host-to-host) and Tunnel (site-to-site).

Domain 4: Communication and Network Security (13% of

Exam)
Protecting data in motion and ensuring reliable secure communication channels.

4.1 Network Architecture

Demilitarized Zone (DMZ) – Network segment with limited access between internal
network and untrusted networks (Internet). Public-facing services placed here. Reduces
exposure of internal systems.
Network Segmentation – Division of network into isolated segments with firewalls
between them. Each segment has specific security requirements. Prevents lateral
movement of attackers.

Virtual Private Networks (VPN) – Creates encrypted tunnel over untrusted network.
Common for remote workers. Uses IPSec or TLS. Ensures confidentiality and
authentication.

4.2 Wireless Security

WPA3 (Wi-Fi Protected Access 3) – Current standard for wireless security.
Replacement for WPA2
Includes individualized data encryption (OWE – Opportunistic Wireless Encryption)
Protects against brute force attacks
Better support for IoT devices
WPA2 – Previous standard. Still widely used. Secure if properly configured. AES-CCMP
required (not TKIP).

WEP – Outdated and broken. Do not use.

4.3 Network Protocols and Standards
OSI Model – 7 layers to understand:
1. Physical – Cables, signals, physical transmission
2. Data Link – MAC addresses, switches
3. Network – IP routing, firewalls
4. Transport – TCP/UDP, ports
5. Session – Session management, authentication
6. Presentation – Encryption, compression, translation
7. Application – HTTP, SMTP, DNS
Understanding the OSI model helps identify where threats occur and where controls should
be placed.

DNS Security (DNSSEC)

Protects against DNS spoofing and cache poisoning
Uses digital signatures to verify DNS records
Not universally deployed but increasingly important

Domain 5: Identity and Access Management (13% of

Exam)
Critical for controlling who has access to what resources. One of the most testable domains.

5.1 Authentication Methods

Something You Know – Password, passphrase, PIN.

Weaknesses: Easily forgotten, susceptible to phishing, dictionary attacks.

Something You Have – Hardware token, smartcard, mobile device.
Strengths: More resistant to phishing than passwords alone. Weaknesses: Can be lost or
stolen.

Something You Are – Biometrics: fingerprint, iris scan, facial recognition.

Strengths: Cannot be forgotten or shared. Weaknesses: Privacy concerns, can be spoofed
with high-quality replicas, biometric data cannot be changed if compromised.
Somewhere You Are – Geographic location, network location.

Less common as sole authentication. Often used as additional factor.

Multi-Factor Authentication (MFA) – Combination of two or more authentication factors.
Significantly reduces account compromise risk
Should use different factor types (not two passwords)
Exam expects you to understand business tradeoffs: security vs usability
5.2 Authorization and Access Control
Role-Based Access Control (RBAC) – Access decisions based on user roles.
Users assigned to roles
Roles granted permissions
Easier to manage at scale than individual user permissions
Common in large enterprises
Attribute-Based Access Control (ABAC) – Fine-grained access decisions based on
attributes.

More flexible than RBAC

Can consider user attributes, resource attributes, environment attributes
Examples: "Grant access if user has clearance level 3 AND from IP range 10.x.x.x AND
timestamp is business hours"
More complex to implement and manage
Access Control Lists (ACL) – Explicit listing of who has access to specific resources.
Used at file system, network device, and application levels.

5.3 Identity Management Lifecycle

Onboarding – New employee joins organization.
Account creation
Role assignment
Permission provisioning
Training on security policies
Ongoing Management – Access reviews, permission adjustments, continued monitoring.

Offboarding – Employee leaves organization.

Account deactivation (not deletion—retain for audit trail)
Permission removal
Equipment retrieval
Data transfer or archival
Critical for exam: Weak offboarding is a major security gap. Terminated employees
retaining access is common vulnerability.

5.4 Single Sign-On (SSO) and Directory Services

LDAP (Lightweight Directory Access Protocol) – Standard for directory services.

Centralized authentication and authorization

Common in enterprise environments
Windows Active Directory uses LDAP
Kerberos – Network authentication protocol. Used by Windows Active Directory.
Ticket-based authentication
Mutual authentication between client and server
 More secure than LDAP alone

Domain 6: Security Assessment and Testing (12% of Exam)

Identifying and validating security controls through systematic assessment.

6.1 Vulnerability Assessment

Purpose: Identify security weaknesses in systems and applications.
Methods:

Automated scanning tools (Nessus, OpenVAS)

Manual testing by security professionals
Configuration reviews
Code analysis
Deliverables: Vulnerability report with findings ranked by severity.

6.2 Penetration Testing

Authorized, simulated attack on systems. Critical: Always have written authorization.

Scope Definition: Must be clearly defined before testing begins.

What systems are included?
What testing methods are allowed?
What's the geographic scope?
Sensitive systems to avoid?
Types:

Black Box – Tester has no prior knowledge. Simulates external attacker.

Gray Box – Tester has limited knowledge (like insider with no privilege).
White Box – Tester has full knowledge and access. Most thorough.
Rules of Engagement: Document must specify:
Approved timeframe
Authorized personnel
Scope and limitations
Escalation procedures if critical issues found

6.3 Compliance Assessment

Verify organization meets regulatory requirements:

GDPR compliance
HIPAA compliance
PCI DSS compliance
ISO 27001 compliance
6.4 Remediation and Reporting
Vulnerability Prioritization:
Risk = (Severity of Vulnerability) × (Likelihood of Exploitation)
High-severity, easily exploitable vulnerabilities must be remediated first.

Management Review: Security leaders must present findings to management for

prioritization of fixes and budget allocation.

Domain 7: Security Operations (13% of Exam)

Execution of security plans through daily operations and incident management.

7.1 Logging and Monitoring

Logging Requirements:
User authentication (successful and failed)
System access and file operations
Privileged access (sudo, administrative actions)
Security events (firewall blocks, IDS alerts)
Configuration changes
Data access and modifications

Retention: Log retention policies must comply with regulations. Generally 1-3 years for
most industries.
Log Protection: Logs themselves are valuable data. Must protect from tampering:
Centralized logging (syslog, SIEM)
Write-once storage when possible
Encryption of log data
Access controls on log repositories

7.2 Incident Response

Phases:

1. Detection – Identify that incident has occurred. Automated alerts, user reports,
security monitoring.
2. Response – Contain the incident. Isolate affected systems. Prevent further damage.
3. Investigation – Determine scope and root cause. Gather evidence. Chain of custody
maintained for forensics.
4. Remediation – Eliminate the threat. Patch vulnerabilities, remove malware, restore
data.
5. Recovery – Bring systems back to normal operation. Testing to ensure functionality.
6. Lessons Learned – Post-incident review. What worked? What didn't? Update
procedures.
Critical: Incident response plan must be developed and tested before an incident occurs.
Do not create the plan during the crisis.
7.3 Business Continuity and Disaster Recovery
Business Continuity Planning (BCP) – Ensures organization continues operating during
disruptions.
Key Concepts:
RTO (Recovery Time Objective) – Maximum acceptable downtime. How quickly
must system be restored?
RPO (Recovery Point Objective) – Maximum acceptable data loss. How much data
can we afford to lose?

Example: "We can tolerate 2 hours of downtime (RTO) but cannot lose more than 15
minutes of data (RPO)"
Backup Strategies:
Full backup – Copy of all data. Time-intensive but enables fastest recovery.
Incremental backup – Only data changed since last backup. Faster but recovery
requires multiple restores.
Differential backup – Changes since last full backup. Middle ground approach.

Disaster Recovery Site Options:

Hot site – Fully operational backup facility. Highest cost. Shortest recovery time.
Warm site – Partially operational with equipment but no current data. Medium cost
and recovery time.
Cold site – Empty facility with connectivity. Lowest cost but longest recovery time.

7.4 Physical Security

Perimeter Security:

Fencing, gates, access control

Surveillance cameras (CCTV)
Barriers to prevent vehicle intrusion
Building Access Control:
Card readers, biometric systems
Turnstiles and mantraps (prevents tailgating)
Security guards

Data Center Security:

Restricted access areas
Video monitoring of all areas
Environmental controls (temperature, humidity)
Fire suppression systems (not water-based near equipment)
Domain 8: Software Development Security (10% of Exam)
Security integrated into the software development process from conception through
decommissioning.

8.1 Secure Development Lifecycle (SDLC)

Phases:
1. Requirement Definition – Security requirements established upfront. Not an
afterthought.
2. Design – Threat modeling conducted. Security architecture defined. Review by
security team.
3. Development – Code developed following secure coding practices. Security code
reviews conducted.
4. Testing – Security testing (SAST, DAST) conducted. Vulnerabilities identified before
production.
5. Deployment – Security controls verified before production release. Hardening
guidelines followed.
6. Maintenance – Patches applied promptly. Security monitoring continued.

8.2 Secure Coding Practices

OWASP Top 10 – Web Application Vulnerabilities:
1. Broken Access Control – Insufficient authorization checks. Users can access
resources they shouldn't.
2. Cryptographic Failures – Inadequate encryption. Sensitive data exposed.
3. Injection – SQL injection, command injection. Attacker inserts malicious input.
4. Insecure Design – Missing security controls in design phase. No threat modeling.
5. Security Misconfiguration – Default credentials, unnecessary services, verbose
error messages.
6. Vulnerable and Outdated Components – Using libraries with known
vulnerabilities. Not patching dependencies.
7. Authentication Failures – Weak authentication, credential exposure, session
fixation.
8. Software and Data Integrity Failures – Insecure CI/CD, unsigned updates, insecure
serialization.
9. Logging and Monitoring Failures – Insufficient security logging. Cannot detect
attacks.
10. Server-Side Request Forgery (SSRF) – Application makes requests on behalf of
attacker. Can access internal resources.

8.3 Code Analysis

Static Application Security Testing (SAST)
Source code analyzed without executing it
Detects coding flaws, hardcoded credentials, vulnerabilities
Can have high false positive rate
Examples: SonarQube, Checkmarx
Dynamic Application Security Testing (DAST)
Testing against running application
Detects runtime vulnerabilities
Cannot see source code flaws directly
Examples: Burp Suite, OWASP ZAP

8.4 Supply Chain Security

Third-Party Risk Management:

Assess security posture of vendors

Require security certifications (SOC 2, ISO 27001)
Conduct vendor audits
Include security requirements in contracts
Monitor vendor compliance

Key Exam Strategy Notes

Understanding vs Memorization
The CISSP is not about memorizing facts—it's about understanding security principles and
their application in real-world scenarios. Exam questions require judgment calls and
decision-making.
Time Management

100-150 questions in 3 hours. Average ~1.5 minutes per question. Don't spend excessive time
on single questions. Mark for review and move forward.
Common Question Types:
Scenario-based: "Your organization wants to implement access control. Which
approach provides the most flexibility?" Requires understanding the tradeoffs.
Best practice: "Which of the following is the most important security consideration
when..."
Regulatory/compliance: "Under GDPR, what action must occur within 72 hours?"

Study Approach for Remaining Prep:

1. Deep dive on weak domains – Identify which domain you're least confident in and
focus there
2. Practice questions – Essential for exam format familiarity
3. Scenario analysis – Work through real-world situations applying CISSP concepts
4. Review official ISC2 materials – The Official CISSP CBK Reference is authoritative
Personal Study Progress
[ ] Complete review of all 8 domains
[ ] Take at least 2 full-length practice exams
[ ] Score above 75% on practice exams before attempting real exam
[ ] Review weak domains with practice questions
[ ] Finalize endorsement and submit application
Remember: CISSP is a marathon, not a sprint. Thorough understanding of concepts is more
valuable than memorizing facts.