Security Operations
CISSP Domain 7 in depth at a management level: least privilege, separation of duties and the SOC, investigations, chain of custody and Federal Rules of Evidence admissibility, logging, SIEM and retention sizing, secure baselines, change and patch management, incident response aligned to NIST SP 800-61r3 and ISO/IEC 27035 with severity, escalation and triage capacity, containment, recovery and lessons learned, detective and preventive measures and insider risk, breach reporting under state laws, HIPAA, SEC Form 8-K Item 1.05 and CIRCIA, business impact analysis, 3-2-1-1-0 backups and restore testing, recovery sites and DR testing, and physical security and personnel safety, ending in a capstone.
CISSP-116 12 lessons · 5 h 36 min
Offered by HSM University · CISSP Exam Prep
This is the American version of this course. See the Canadian version.
What you'll learn
- Apply least privilege, need to know, separation of duties, job rotation and privileged access management, and design SOC staffing, tiers and sourcing with service levels
- Distinguish investigation types and manage evidence with chain of custody, integrity hashing, order of volatility, legal holds and Canadian and US admissibility rules
- Decide what to log, size tiered log retention, and measure detection rule precision and analyst workload in SIEM and SOAR operations
- Maintain secure baselines from CIS Benchmarks, route changes by security risk, and run patch management against severity-based service levels
- Prepare an incident response capability aligned to NIST SP 800-61r3 and ISO/IEC 27035, with a severity matrix, escalation paths, MTTD and MTTR reporting and adequate triage capacity
- Make containment, eradication, recovery and communication decisions at a process level, and run blameless lessons-learned reviews with tracked actions
- Govern detective and preventive measures, including firewalls, IDS and IPS, allow lists, honeypots and AI-based tools, and run a proportionate insider risk program
- Assess and meet incident reporting duties under PIPEDA, Quebec Law 25, US state breach laws, HIPAA and SEC rules, and engage the right law enforcement and national agencies
- Conduct a business impact analysis that sets maximum tolerable downtime, RTO, RPO and recovery priority while respecting dependencies
- Design backup and resilience strategies that follow the 3-2-1-1-0 rule, protect backups from compromise and prove recoverability through restore testing
- Select recovery sites by cost and RTO, write disaster recovery plans with declaration criteria, and run a progressive test and exercise program
- Operate layered physical security and CPTED, audit badge access, address travel, duress and emergency concerns, and apply a manager's judgment to Domain 7 exam questions
Course content
12 lessons · 5 h 36 min total · final exam
- 1 Security operations foundations: principles and the security operations center 30 min · quiz
- 2 Investigations and evidence 30 min · quiz
- 3 Logging, monitoring and detection 29 min · quiz
- 4 Configuration, change and patch management for security 28 min · quiz
- 5 Incident management I: preparation, detection and triage 28 min · quiz
- 6 Incident management II: containment, recovery, communication and lessons learned 27 min · quiz
- 7 Detective and preventive measures and insider risk governance 28 min · quiz
- 8 Incident reporting: legal, regulatory and law enforcement obligations 28 min · quiz
- 9 Business impact analysis and recovery priorities 26 min · quiz
- 10 Backup, resilience and recovery strategies 26 min · quiz
- 11 Disaster recovery sites, plans and testing 27 min · quiz
- 12 Physical security, personnel safety and Domain 7 review 29 min · quiz
- E Final exam 20 questions
Requirements
Recommended background. You can start any course at any time.
Description
CISSP Domain 7 in depth at a management level: least privilege, separation of duties and the SOC, investigations, chain of custody and Federal Rules of Evidence admissibility, logging, SIEM and retention sizing, secure baselines, change and patch management, incident response aligned to NIST SP 800-61r3 and ISO/IEC 27035 with severity, escalation and triage capacity, containment, recovery and lessons learned, detective and preventive measures and insider risk, breach reporting under state laws, HIPAA, SEC Form 8-K Item 1.05 and CIRCIA, business impact analysis, 3-2-1-1-0 backups and restore testing, recovery sites and DR testing, and physical security and personnel safety, ending in a capstone.