Security Assessment and Testing
CISSP Domain 6 in depth at a management level: tests, assessments and audits, scope, rules of engagement and written authorization under the CFAA, vulnerability management and prioritization with CVSS, EPSS and KEV, penetration testing methodology and reports, control testing, sampling and continuous control monitoring, log reviews and synthetic transactions, security testing in the software life cycle with SBOMs, SOC 1, SOC 2 and SOC 3 reports, ISO/IEC 27001 and PCI DSS assessments and FedRAMP, security process data, KPIs and KRIs, risk-based reporting and exceptions, ending in an assessment program capstone.
CISSP-115 12 lessons · 6 h 5 min
Offered by HSM University · CISSP Exam Prep
This is the American version of this course. See the Canadian version.
What you'll learn
- Distinguish tests, assessments and audits, and design assessment, testing and audit strategies that are internal, external or third-party as the objective requires
- Scope assessments, set rules of engagement and obtain written authorization in line with Canadian and US computer crime law and contractual obligations
- Run a vulnerability management program with asset coverage, authenticated scanning, service levels and verification of remediation
- Prioritize vulnerabilities using CVSS, EPSS and known exploited vulnerability catalogs together with asset context
- Explain penetration testing phases and methodologies at a management level, oversee engagements safely and act on reports
- Test control design and operating effectiveness, select evidence and sample sizes, and evaluate continuous control monitoring
- Organize log reviews and protect log integrity and retention, and use synthetic transactions and real user monitoring as control evidence
- Evaluate security testing in the software life cycle, including code review, SAST, DAST, IAST, software composition analysis, SBOMs and misuse cases
- Plan and support audits, and interpret SOC reports, ISO/IEC 27001 certificates, PCI DSS assessments and government cloud assessment results
- Collect trustworthy security process data on accounts, approvals, KPIs and KRIs, backups, awareness and recovery exercises
- Analyze findings into risk-ranked themes, manage remediation, exceptions and ethical disclosure, and report to each audience
- Design an annual assessment and testing program with independence, budget and metrics, and apply effective strategies to Domain 6 exam questions
Course content
12 lessons · 6 h 5 min total · final exam
- 1 Assessment, testing and audit strategies 33 min · quiz
- 2 Designing and validating assessments: scope, rules of engagement and authorization 28 min · quiz
- 3 Vulnerability management and scanning 29 min · quiz
- 4 Vulnerability scoring and prioritization: CVSS, EPSS and KEV 30 min · quiz
- 5 Penetration testing methodology and reporting 31 min · quiz
- 6 Control testing and continuous control monitoring 33 min · quiz
- 7 Log reviews, monitoring and synthetic transactions 32 min · quiz
- 8 Security testing in the software life cycle 31 min · quiz
- 9 Audits and compliance assessments 32 min · quiz
- 10 Collecting security process data 29 min · quiz
- 11 Analyzing results and reporting to management 28 min · quiz
- 12 Capstone: building an assessment and testing program 29 min · quiz
- E Final exam 20 questions
Requirements
Recommended background. You can start any course at any time.
Description
CISSP Domain 6 in depth at a management level: tests, assessments and audits, scope, rules of engagement and written authorization under the CFAA, vulnerability management and prioritization with CVSS, EPSS and KEV, penetration testing methodology and reports, control testing, sampling and continuous control monitoring, log reviews and synthetic transactions, security testing in the software life cycle with SBOMs, SOC 1, SOC 2 and SOC 3 reports, ISO/IEC 27001 and PCI DSS assessments and FedRAMP, security process data, KPIs and KRIs, risk-based reporting and exceptions, ending in an assessment program capstone.