CISSP Central

5.3 Federated identity with a third-party service

• 5.3.1 On-Premises
• 5.3.2 Cloud
• 5.3.3 Hybrid

5.2 Design identification and authentication Strategy (e.g., people, devices, and services)

• 5.2.1 Groups and Roles
• 5.2.2 Authentication, Authorization and Accounting (AAA) (e.g., MFA, password-less authentication)
• 5.2.3 Session management
• 5.2.4 Registration, proofing, and establishment of identity
• 5.2.5 Federated Identity Management (FIM)
• 5.2.6 Credential Management Systems (e.g. Password vault)
• 5.2.7 Single Sign-on (SSO)
• 5.2.8 Just-in-Time (JIT)

5.0 DOMAIN 5: IDENTITY & ACCESS MANAGEMENT (IAM)

5.1 Control physical and logical access to assets

• 5.1.1 Information
• 5.1.2 Systems
• 5.1.3 Devices
• 5.1.4 Facilities
• 5.1.5 Applications
• 5.1.6 Services

4.3 Implement secure communication channels according to design

• 4.3.1 Voice, video, and collaboration (e.g., conferencing, Zoom rooms)
• 4.3.2 Remote access (e.g., network administrative functions)
• 4.3.3 Data communications (e.g., backhaul networks, satellite)
• 4.3.4 Third-party connectivity (e.g., telecom providers, h/w support)

4.2 Secure Network Components

• 4.2.1 Operation of infrastructure
• 4.2.2 Transmission Media
• 4.2.3 Network Access Control (NAC) devices
• 4.2.4 Endpoint Security (e.g. host-based)

4.0 DOMAIN 4: COMMUNICATION AND NETWORK SECURITY

4.1 Apply secure design principles in network architectures

• 4.1.1 Open System Interconnection (OSI) and Transmission Control Protocol/Internet Protocol (TCP/IP) models
• 4.1.2 Internet Protocol (IP) version 4 and 6 (IPv6)
• 4.1.3 Secure Protocols: IPsec, SSH, SSL/TLS
• 4.1.4 Implications of multilayer protocols
• 4.1.5 Converged Protocols (iSCSI, VoIP, etc.)
• 4.1.6 Transport Architecture (Data/control/Management Plan, etc.)
• 4.1.7 Performance Metrics (Bandwidth, Latency, Jitter, etc.)
• 4.1.8 Traffic Flows (E.g., North-south, east-west)
• 4.1.9 Physical Segmentation E.g., In-band, Out-of-band, air-gapped
• 4.1.10 Logical Segmentation, E.g. VLANs, VPNs, Virtual Routing, etc.
• 4.1.11 Microsegmentation
• 4.1.12 Edge Networks (e.g., ingress/egress, peering)
• 4.1.13 Wireless Networks (e.g. Bluetooth, Wi-Fi, Zigbee, Satellite)
• 4.1.14 Cellular Networks (E.g. 4G, 5G)
• 4.1.15 Content Distribution Network (CDN)
• 4.1.16 Software Defined Networks (SDN)
• 4.1.17 Virtual Private Cloud (VPC)
• 4.1.18 Monitoring and Management

3.10 Manage the information system lifecycle

• 3.10.1 Stakeholder needs & requirements
• 3.10.2 Requirements Analysis
• 3.10.3 Architectural design
• 3.10.4 Development / Implementation
• 3.10.5 Integration
• 3.10.6 Verification & Validation
• 3.10.7 Transition / deployment
• 3.10.8 Operations and maintenance/sustainment
• 3.10.9 Retirement / disposal

3.9 Design Site and Facility security controls

• 3.9.1 Wiring closets/intermediate distribution frame
• 3.9.2 Server rooms/data centers
• 3.9.3 Media storage facilities
• 3.9.4 Evidence storage
• 3.9.5 Restricted and work area security
• 3.9.6 Utilities and Heating, Ventilation, and Air Conditioning (HVAC)
• 3.9.7 Environmental issues (e.g., natural disasters, man-made)
• 3.9.8 Fire prevention, detection, and suppression
• 3.9.9 Power (e.g., redundant, backup)

3.8 Apply security principles to site and facility design

• 3.8.1 Facility Design
• 3.8.2 Implement Site and Facility Security Controls
• 3.8.3 Physical Security Threats
• 3.8.4 Layered Defense Model

3.7 Understand methods of cryptanalytic attacks

• 3.7.1 Brute-force
• 3.7.2 Ciphertext only
• 3.7.3 Known Plaintext
• 3.7.4 Frequency Analysis
• 3.7.5 Chosen Ciphertext
• 3.7.6 Implementation Attacks
• 3.7.7 Side-channel Attack (SCA)
• 3.7.8 Fault injection
• 3.7.9 Timing Attacks
• 3.7.10 Man-in-the-Middle (MITM)
• 3.7.11 Pass the hash
• 3.7.12 Kerberos Exploitation
• 3.7.13 Ransomware
• 3.7.14 Other Key Attacks