text (9K)

Information Security Professional
(CISSP Preparation)

Texas State Working Connections
Mon, July 12 - Fri, July 16, Frisco, TX
Sam Bowne

Schedule · Lecture Notes · Projects · Links · Home Page


Class Description

Covers information security thoroughly, including access control, application security, business continuity, cryptography, risk management, legal issues, physical security, and telecommunications and network security. This class helps to prepare students for the Certified Information Systems Security Professional (CISSP) credential, which is essential for high-level information security professionals. Students are strongly encouraged to practice with the Transcender prep tests before taking the exam, and access to those tests will be included in the class.

There will be many hands-on projects, but they will not be typical artificial homework assignments. Instead, the class will work in small teams, led by students selected to be managers. Each team will have different projects, and we will all work together as a company to perform a real security audit of a real network. Students will be required to sign and honor a non-disclosure agreement, because we will be finding real security problems, violations, and confidential data. Our tasks will involve using technical skills to locate and analyze problems, and also using social, business, and communication skills to help the network's administrators understand and fix problems.

Students who are not willing to be bound by a non-disclosure agreement should not take this class, and they should not be pursuing a career in information security, either. The reason the CISSP certification is so highly valued is that certified professionals can be trusted--they are technically competent, responsible, and aware of their role and their limitations. This class provides both academic training and real-world experience to help develop those virtues.

Prerequsites: Students should have Network+ and Security+ level understanding of networking and security. Previous experience of hacking is helpful but not required.

Upon successful completion of this course, the student will be able to:

  1. Explain security and risk management.
  2. Define and implement access controls.
  3. Assess application security.
  4. Plan for business continuity and disaster recovery.
  5. Apply cryptography correctly to protect information.
  6. Explain legal regulations and ensure compliance.
  7. Perform investigations, preserve evidence, and cooperate with law enforcement authorities.
  8. Explain codes of conduct and ethical issues.
  9. Maintain security of operations.
  10. Assess physical and environmental security.
  11. Design security architecture.
  12. Explain telecommunications and network security.


CISSP Guide to Security Essentials, 1st Edition, by Peter Gregory ISBN-10: 1435428196 Buy from Amazon


Date Topic
Mon, July 12  Ch 1: Information Security and Risk Management
Ch 2: Access controls
Tue, July 13  Ch 3: Application Security
OWASP's Top Ten Web Application Risks
Ch 4: Business Continuity and Disaster Recovery Planning
Wed, July 14  Ch 5: Cryptography
Ch 6: Legal, Regulations, Compliance and Investigations
Thu, July 15  Ch 7: Operations Security
Ch 8: Physical and Environmental Security
Ch 9: Security Architecture and Design
Fri, July 16  Ch 10: Telecommunications and Network Security

Lecture Notes

Student Agreement
Introduction to CNIT 125
Encrypted email setup guide
1: Information Security and Risk Management    PowerPoint    PowerPoint with iClicker Questions
2: Access controls    PowerPoint    PowerPoint with iClicker Questions
3: Application Security    PowerPoint    PowerPoint with iClicker Questions
   OWASP's Top Ten Web Application Risks
4: Business Continuity and Disaster Recovery Planning    PowerPoint    PowerPoint with iClicker Questions
5: Cryptography    PowerPoint    PowerPoint with iClicker Questions
6: Legal, Regulations, Compliance and Investigations    PowerPoint    PowerPoint with iClicker Questions
7: Operations Security    PowerPoint    PowerPoint with iClicker Questions
8: Physical and Environmental Security    PowerPoint    PowerPoint with iClicker Questions
9: Security Architecture and Design    PowerPoint    PowerPoint with iClicker Questions
10: Telecommunications and Network Security    PowerPoint    PowerPoint with iClicker Questions
The lectures are in Word and PowerPoint formats.
If you do not have Word or PowerPoint you will need to install the
Free Word Viewer 2003 and/or the Free PowerPoint Viewer 2003.

Back to Top


Instead of the usual homework assignments, students will all work together in teams, led by student managers, to perform real security audits of real information systems. Every student will be required to sign a non-disclosure agreement. The security issues we find will be held in confidence, and we will contact the administrators of the vulnerable systems and try to convince them to amend the problems.

Students are required to prepare professional resumes, and encouraged to include their participation in this class as work experience.

New for Summer 2010

Encrypted email with Gnu & Thuinderbird

From Spring 2010

Encrypted Email Setup
Backing up a Private Key
NDA from Spring 2010

Back to Top


Introduction to CISSP and CNIT 125

CISSP 1: CISSP Education & Certification
CISSP 2: (ISC)2 | Certified Information Security Education
CISSP 3: CISSP was the third highest salaried certification in 2009
CISSP 4: DOD 8570 requires CISSP, Sec+, and other certs for all gov\'t Information Assurance employees
CISSP 5: CISSP exam prices
CISSP 6: (ISC)2 Code of Ethics
CISSP 7: Associate of (ISC) Certification
CISSP 8: SSCP Education & Certification
CISSP 9: Exam Prices (pdf)
CISSP 10: Test Prep: 10 Tips For Preparing and Passing the CISSP Exam
CISSP 11: How to get continuing education credit for CISSP certification holders
CISSP 12: GIAC Research in the Common Body of Knowledge -- Good white papers for the ten CISSP domains
CISSP 13: DoD Directive 8570.1 M - DoD Approved Baseline Certifications
CISSP 14: Associate of (ISC)^2 FAQ
CISSP 16: How I Prepared for the CISSP Exam--Sam Bowne
CISSP 17: A CISSP Study Plan Memoir
CISSP 18: CISSP Practice Test
CISSP 19: San Francisco Bay Area ISSA--CISSP Study Sessions
CISSP 20: CPE Requirements
CISSP 21: (ISC)^2 SF Chapter
CISSP 22: Average CISSP Salary 2017
CISSP 23: Exam Prices 2017
CISSP 24: Dilbert : How the CISSP Exam was Written
CISSP 25: Your Guide to the Certified Information Systems Security Professional (CISSP) Exam
CISSP 26: CyberVista Practice Exam (Recommended as of 2021)
CISSP 27: CASP vs. CISSP: The Real Fight Is For Candidates' Attention
CISSP 28: CISSP Certification Cheat Sheet, Study Guides & Best Courses
CISSP 29: ISC2 Launches New CISSP Exam Format to Help Bring More Cybersecurity Professionals into the Field
CISSP 30: Official (ISC)^2 CISSP Study App

Links for Chapter Lectures

Ch 2a: Octomom's hospital records accessed, 15 workers fired (from 2009)
Ch 2b: Three Primary Analytics Lessons Learned from 9/11 (2012)
Ch 2c: The Shadow Factory: The NSA from 9/11 to the Eavesdropping on America: James Bamford: 9780307279392: Amazon.com: Books
Ch 2d: Chelsea Manning explains why she leaked secret military documents, fought for transgender rights behind bars
Ch 2e: WikiLeaks Q & A: who is Bradley Manning and what did he do?
Ch 2f: Chelsea Manning - Wikipedia
Ch 2g: U.S.-EU & U.S.-Swiss Safe Harbor Frameworks
Ch 2h: Privacy Shield
Ch 2i: Privacy Shield -- Is Safe Harbour's Replacement Up To The Job In 2017? (May, 2017)

Ch 3a: DOD Directive 5200.28 defining security modes

Ch 4a: Memory segmentation - Wikipedia
Ch 4b: Trusted Computer System Evaluation Criteria - Wikipedia
Ch 4c: Internet of Shit (@internetofshit) | Twitter
Ch 4d: OWASP Top Ten Project
Ch 4e: Secret Service codename - Wikipedia
Ch 4f: Pretty Rindjael Animation
Ch 4g: IPsec - Wikipedia

Ch 5a: 64-bit Global Identifier (EUI-64)
Ch 5b: How FTP port requests challenge firewall security
Ch 5c: Online Dig | Men & Mice

Ch 6a: Call It Super Bowl Face Scan I (From 2001)
Ch 6b: Obama Eyeing Internet ID for Americans (from 2011)

Ch 9a: Metasploit Module Source Code in Ruby

Other Links

A Beginner's Guide to Data Compliance
HIPAA certification HCISPP vs CSCS
Certified Security Compliance Specialist
How to Reverse Engineering with Radare2 -- INTERESTING FOR PROJECTS
COBIT 5 Laminate
Describe the main differences in due dilligence and due care
DREAD (risk assessment model) - Wikipedia
US-EU Safe Harbor Data-Transfer Talks Enter Final Week (1-25-16)
Separation of Duties in Information Technology
Top 20 CIS Critical Security Controls (CSC) You Need to Implement
OWASP Top 10 Security Risks - Part V
The Phoenix Project

New Unsorted Links

Certified Information Systems Security Professional (CISSP) | Practice Test Free Trial - CyberVista
RSA 2022 Volunteers
2022-05-03: CCSF Sleep-Out Protest
2023-05-10: KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

Back to Top
Last Updated: 7-13-10 8:16 am