CISSP Security Foundations Course
Five lessons that build CISSP foundations: governance, risk, asset security, architecture, cryptography, network security, IAM, operations, and secure development.
What you will learn
- Explain security governance, risk response, and compliance.
- Classify assets and protect data across its lifecycle.
- Use architecture and cryptography to protect systems.
- Apply network segmentation and identity access controls.
- Run secure operations, testing, and development practices.
Before you start
- Basic IT and networking knowledge.
- Familiarity with security concepts such as passwords and firewalls.
- About 75 minutes of study plus regular practice.
Lesson 1 Security Governance, Risk, and Compliance
CISSP Security and Risk Management covers governance, risk analysis, compliance, ethics, and business continuity. Policies are high-level management direction, supported by standards, procedures, and guidelines. Risk assessment identifies threats, vulnerabilities, and impact, then management accepts, avoids, transfers, or mitigates residual risk. Separation of duties and least privilege reduce the chance of fraud. A BCP keeps critical functions running during disruption, while a DRP restores IT after a disaster.
Risk response drill: for each risk, decide between avoid, transfer, mitigate, and accept. Avoid removes the activity, transfer shifts the cost to insurance or a vendor, mitigate reduces likelihood or impact, and accept records the residual risk with management approval.
Example
A company applies least privilege to finance roles and requires two approvals for large transfers to enforce separation of duties.
Worked example: A legacy system has a known vulnerability that is expensive to fix.
Management may accept the risk, add compensating controls, and document the decision with a risk owner.
Lesson 2 Asset Security and Data Lifecycle
Asset Security manages data classification, ownership, retention, and handling. Data can be classified as public, internal, confidential, or restricted, and each class receives different controls. The data lifecycle includes creation, storage, use, sharing, archiving, and destruction. Data at rest, in transit, and in use each need appropriate protection. When decommissioning media, sanitization or destruction prevents data remanence. Labeling, encryption, and access controls support the classification policy.
Lifecycle checklist: classify data when created, assign an owner, label handling requirements, protect data at rest, in transit, and in use, retain according to policy, and destroy securely when no longer needed. Match controls to classification level.
Example
A confidential database is encrypted at rest, backed up with retention rules, and its old disks are securely erased before disposal.
Worked example: A laptop containing confidential data is retired.
Destroy the disk or use a verified wipe, then update the asset inventory and document the disposal.
Lesson 3 Security Architecture and Cryptography
Security Architecture and Engineering designs secure systems using concepts such as defense in depth, trust boundaries, and secure defaults. Cryptography protects confidentiality, integrity, authentication, and non-repudiation. Symmetric algorithms like AES are fast and use shared keys; asymmetric algorithms like RSA use key pairs; hashes such as SHA-256 verify integrity. Key management, secure protocols, and hardware trust anchors protect the architecture. Systems should fail securely and isolate components to limit blast radius.
Crypto selection: use symmetric encryption for bulk data speed, asymmetric encryption for key exchange and digital signatures, and hashing for integrity checks. Do not confuse encryption with hashing: hashing is one-way and does not hide data by reversible keying.
Example
A web application uses TLS for transport, hashes for integrity checks, and stores secrets in a hardware-backed key vault.
Worked example: Two servers need to establish a secure channel.
Use TLS: asymmetric cryptography exchanges a session key, then symmetric encryption protects the bulk traffic.
Lesson 4 Network Security and Identity Access
Communication and Network Security protects data in transit through segmentation, firewalls, VPNs, TLS, and monitoring. VLANs separate logical networks, DMZs expose only public services, and intrusion prevention systems inspect traffic. IAM controls identity lifecycle, authentication, authorization, and auditing. SSO improves usability, MFA strengthens logins, and privileged access management protects admin accounts. Least privilege, role-based access control, and account reviews reduce excessive permissions.
Segmentation drill: group systems by trust level: public web in the DMZ, internal applications behind firewalls, sensitive data in restricted subnets. Apply IAM at every boundary: authenticate users, authorize with least privilege, and audit access.
Example
Remote employees authenticate with MFA over a VPN, and only their role-based permissions are granted inside the network.
Worked example: A compromised web server must not reach the database directly.
Put the database in a private subnet and allow only the application tier to connect through specific security group rules.
Lesson 5 Operations, Assessment, and Secure Development
Security Operations keeps systems running safely through monitoring, patching, vulnerability management, and incident response. SIEM collects logs, SOAR automates response, and playbooks guide handling. The incident lifecycle includes preparation, detection, containment, eradication, recovery, and lessons learned. Security Assessment and Testing validates controls with audits, vulnerability scans, and penetration tests. Secure development adds input validation, threat modeling, secure defaults, and testing to the SDLC, including DevSecOps practices.
Incident response loop: prepare, detect, contain, eradicate, recover, and learn. After an incident, hold a lessons-learned review, update playbooks, and add controls so the same event is detected earlier next time.
Example
A security team uses a SIEM alert to contain an infected host, then patches the vulnerability and records lessons learned.
Worked example: A phishing email reaches several users.
Contain by resetting credentials, investigate the mailbox logs, remove the threat, and train users with the new example.