I'm a big fan of your explanation. Great job!! Honestly I see can pass the exam with your study method.
@InsideCloudAndSecurity
3 жыл бұрын
Thank you! Glad to hear it's helpful. Reach out if questions as you prepare! 😉
@alimotiwala570
3 жыл бұрын
@@InsideCloudAndSecurity Thank you. A quick question if I may? I'm getting above 75% percent doing Sybex questions and only Exam 4 outstanding that I will do tomorrow. I know few areas of concern that I need to revise before the big day on 08th April. Do you think I need to do more study and extra questions to pass the exam. I heard people saying taking as much as 5k questions before write the exam.
@vasudhakota972
2 жыл бұрын
3:10 Code vs Cipher 3:43 Stream Cipher(Eg Caesar, Vigenere, One Time Pad of varying key lengths) vs Block Cipher; Substitution & Transposition, IV 6:13 Exam Tidbit 7:05 Zero-Knowledge Proof Concept 7:45 Split Knowledge - role separation 8:27 Work Function/Factor 9:30 Importance of Key Security 10:15 Symmetric (single shared secret key, not scalable, faster) vs Asymmetric (public-private key pair(s), scalable, stronger) 11:53 CIA Triad 12:46 5 basic operational modes of data encryption standard 13:01 ECB 13:19 CBC 13:33 CFB 14:01 OFB 14:20 CTR 14:32 3DES 14:50 XOR Cipher 15:24 Key Clustering 16:31 Asymmetric/Public-Key Cryptography 17:57 Asymmetric Cryptography solves 3 problems - data encryption, providing Digital Signatures, secure transmission/distribution of a shared-key 18:48 Requirements of Hash-functions 19:54 Cryptographic Salts 20:34 Digital Signature Standard 21:04 PKI for certs that are used in a web network & email security 22:09 Securing Traffic 22:30 IPSec 23:36 Common Cryptographic Attacks - Brute Force, Man/Meet-in-the-middle, Birthday, Replay 25:20 Digital Rights Management 25:51 Symmetric Cryptographic Algorithms - chunking 27:46 Hash Algorithms 28:54 3 Major Public Key Cryptosystems - RSA, El Gamal, ECC 30:01 Digital Signatures; approved encryption algorithms - DSA, RSA, ECDSA 30:25 Asymmetric Algorithms 31:21 Security Models based on Integrity & Confidentiality 33:06 Exam Tidbit 33:40 Bell-LaPadula 35:59 Biba Model 36:36 Clark-Wilson - 37:08 Access Control Triple 37:31 Other Security Models - 37:52 Graham-Denning Model & Rules 38:34 Security Modes 40:05 State Machine Model 40:45 Information Flow Model - Bell-LaPadula, Biba 41:33 Trusted Computing Base 41:54 Security Perimeter 42:22 Reference Monitor/Model & Security Kernel 43:03 Common Criteria - TCSEC was replaced by ITSEC which was later replaced by the global security evaluation framework - Common Criteria . 44:36 Covert Channels eg Steganography - Covert Timing & Covert Storage Channel - Out of band (may have extra info about the receiver and are outside the scope of the normal communication channels) 46:06 TPM 46:36 Types of Access Control - Discretionary & Non-Discretionary 47:46 Role-Based Access Control 48:34 MAC 49:37 Terms 50:56 Techniques for ensuring CIA 51:30 MFA 52:07 AuthN & AuthZ 52:56 Multi-Tasking & Multi-Threading 53:32 Multi-processing & Multi-programming 54:07 Single State & Multistate processors 54:25 Processor Operating Modes - (End)User & Privileged(System or Administrative) Operations 55:08 Memory Types 55:59 Types of Storage - 56:36 Security Issues with Storage 57:21 Security Risks of Input/Output devices 58:04 Securing a wiring closet - Purpose of Firmware 58:23 Vulnerabilities, Threats & Counter-measures 59:20 Role of Security Policy - (eg PCI DSS), in Cloud Computing 1:00:54 Hypervisor - Type I, Type II 1:01:56 CASB - used in Shadow IT 1:02:34 Security -aaS 1:03:05 Smart Devices 1:03:21 IoT 1:03:50 Mobile Device & Mobile App Security 1:05:54 Embedded Systems 1:06:20 Static Environment 1:07:06 Privilege & Accountability - principle of least privilege & separation of privilege (role/duty) 1:08:34 Common Flaws & Vulnerabilities - buffer overflow, TOCToTOU, Replay Attacks 1:10:15 Functional Order of Security Controls - Deterrence, Denial, Detection, Delay 1:12:00 Physical Security Control - logical, administrative, physical 1:15:45 Fire Suppression Agents - Class A B C D K 1:17:37 Categories of fire detection - smoke sensing, flame sensing, heat sensing 1:17:45 Table of Fire Extinguisher Classes 1:17:58 Voltage & Noise - Electro-Magnetic Interference, RF Interference 1:18:27 Static Voltage & Damage 1:18:48 Damage from Fire & Fire Suppression 1:19:46 Water Suppression System 1:21:10 Gas Discharge Systems 1:22:06 Lock Types 1:23:37 Site Selection & Facility Design 1:24:43 Secure Work Area Configuration & Design 1:25:52 Threats to physical Access Control 1:26:41 Securing a wiring Closet 1:27:14 Physical Security Requirements 1:27:57 Needs for Media Storage; Concerns & Protections 1:29:48 Evidence Storage 1:30:36 Audit Trails & Access Logs 1:32:00 Need for Clean Power
@dshaw2416
3 жыл бұрын
I must say you have some of the best CISSP training videos I've seen in the last 2 years. One suggestion I think would benefit you, in the long run, is to change the name of your channel 'Inside Azure Mgmt' to something more neutral. I think you're missing out on a large population of CISSP wannabe's like myself. I know it's easier said than done, but I really enjoy your content and want to see your channel grow. One day you'll be mentioned with the likes of Luke A, Kelly H, Adam G, Rob W, Mike C, and Larry G. Keep up the great work!
@InsideCloudAndSecurity
3 жыл бұрын
I appreciate your feedback. You make a good point, and I will definitely think on that. Some of my broader security content outside Azure was not part of the plan, but seemed like content people needed. I expect this trend to continue.
@dshaw2416
3 жыл бұрын
@@InsideCloudAndSecurity Understood....When do you plan on posting domains 4-8 ?
@InsideCloudAndSecurity
3 жыл бұрын
@@dshaw2416 will be completing 4-8 in the series over the next 10-12 days
@johnhelt5475
2 жыл бұрын
Great videos. One note about EPROMs and EEPROMS (0:55:52). The EPROM is the general reference for a UVEPROM which has the window which allows erasure using UV light. The EEPROM is electronically erasable (EE). Sybex Official Study Guide, 9th edition p362
@InsideCloudAndSecurity
2 жыл бұрын
Thanks for the heads up John! 👍 Working on a 2022 update to my cissp content for release in March, so your timing is perfect!
@alekline
2 жыл бұрын
Excellent content. Thank you for putting the time to share this. For clarification on minute 47:43, Mandatory Access control is in fact a type of non-discretionary access control, according to NIST
@InsideCloudAndSecurity
2 жыл бұрын
Correct, which is "access policy determined by the system" as described at that point in the video, which I believe is the key characteristic to remember for the exam. 👍
@fva100500
2 жыл бұрын
Cool wrap-up of the domain, very useful. I think there's a type at 1:20:25 where you have a wet pipe billet, but talking about a dry pipe in its description
@InsideCloudAndSecurity
2 жыл бұрын
Thanks for calling attention to that. 👍Will ensure i that is addressed in the course update I have planned for March.
@siiva-light-siiva3722
3 жыл бұрын
@9:13 WF @10:14 (for English as 2nd language) Sym (Shared) Faster: validity can be denied, difficult to distribute and cannot be changed in size or scale Asym (Private & Public) Stronger: undeniable validity, easy to distribute, and can be changed in size or scale i.e. flexible
@InsideCloudAndSecurity
3 жыл бұрын
Thanks for sharing. Let me know if any questions as you study.
@ambleskwok
3 жыл бұрын
I LOVE YOUR CONTENT! A request: can you make a video to help us bridge the content gap between 2008 curriculum and 2021 curriculum? We know that there is a lot of differences. It would be nice to have a video just to help study for the NEW material only.
@InsideCloudAndSecurity
3 жыл бұрын
Thanks and Done! Enjoy! kzitem.info/news/bejne/qJdmp3uucWWaoqQ
@sijoser
3 жыл бұрын
you make this domains so interesting to listen & watch, good job.
@InsideCloudAndSecurity
3 жыл бұрын
Thank you! 😁
@waynesrealworld5801
3 жыл бұрын
Great content for quick reviews, not just blather but what matters
@InsideCloudAndSecurity
3 жыл бұрын
Thanks for saying so. I try to be brief and laser-focused on key points you need to find the right answers on the exam. Good luck! 👍
@devcodes312
3 жыл бұрын
Listening to this to re-review for my test tomorrow!!!! Thank you so much for such a thorough explanation!
@InsideCloudAndSecurity
3 жыл бұрын
Good luck! 👍 Since you're on Domain 3, check out the last 3-4 min of the Cryptography video I dropped Monday. The closing is net new info. kzitem.info/news/bejne/mZWEsoR6i36Xmmk
@devcodes312
3 жыл бұрын
@@InsideCloudAndSecurity Thank you so much for all your hard work! It is sincerely appreciated :) Thank you for continuing to educate our community and educating it well!
@InsideCloudAndSecurity
3 жыл бұрын
@@devcodes312 Really tough exam. I hope it goes/went well for you. Wish you best of luck on the big day.
@redsoxwinagain2007
2 жыл бұрын
How did you do?
@devcodes312
2 жыл бұрын
@@redsoxwinagain2007 I did not pass 🤣 but I had a lot of trouble deciphering the questions on the exam. Good luck folks!!
@DressCode2005
2 жыл бұрын
Man Domain 3 is a Beast of Memory things.
@InsideCloudAndSecurity
2 жыл бұрын
All the cryptography content is tough. See the following video in the CISSP Exam Cram playlist to help - "CISSP Cryptography Drill-Down - kzitem.info/news/bejne/mZWEsoR6i36Xmmk"
@ariarahimi4705
2 жыл бұрын
Your teaching and materials are better than (ISC)²
@InsideCloudAndSecurity
2 жыл бұрын
I am glad to hear the series is helpful! Reach out anytime with questions as you prepare for the exam. 👍
@krzysztofszukaa4176
3 жыл бұрын
Hey, This is really great material. I saw that regarding domain 4 you published coresponding pdf. Is there a possibility you would publish the rest of presentations. I am specially interested in domain 3. Thanks in advance.
@InsideCloudAndSecurity
3 жыл бұрын
Thanks! On the pdf, yes I am planning to make that happen. Should be available for download in the next few hours.
@krzysztofszukaa4176
3 жыл бұрын
@@InsideCloudAndSecurity That is a great news! Thanks once more.
@InsideCloudAndSecurity
3 жыл бұрын
@Krzysztof, here's the PDF for DOMAIN 3 - 1drv.ms/b/s!AmhtzcmYt5AViK90kSZSS3wnuyW7Vw?e=CBKdVg
@krzysztofszukaa4176
3 жыл бұрын
@@InsideCloudAndSecurity Thank you. I got it !
@ErickAlpizar
2 жыл бұрын
Hi! I have a question, in minute 33:09 (under TIPS). If the question is LATTICE, aren't Bell-Lapadula / Biba (inverse BLP) the lattice based models? (Clark-Wilson does not require the lattice approach as it uses the three part function). Also, the content of the Clark Wilson slide is basically a copy of the Biba model but not the actual explanation for Clark-Wilson (it has no properties as BLP and BIBA do). At least these points don't match the CISSP CBK... please clarify?
@InsideCloudAndSecurity
2 жыл бұрын
Erick, sorry that is errata (intended to say if "NOT lattice-based" in that qote) I'll address in a course update coming in the next few weeks. From a previous response I made in comments: Lattice-based access control models include Bell-LaPadula, Biba, and Brewer and Nash (aka Chinese Wall).
@SecurityMadeSimple
2 жыл бұрын
Absolutely awesome , Thanks Pete
@InsideCloudAndSecurity
2 жыл бұрын
Thanks! You're very welcome! Best of luck on the exam! 🤞🍀
@silkeholtmanns6514
2 жыл бұрын
Hi, the best preparation video I saw so far! Most other videos just confused me..... Just a small comment on the cryptographic symmetric algorithm summary slide (the big table with all algorithms). RC6 is missing and RC5 is no longer very strong. There is also an error on that in the CISSP study guide from sybex in the practice questions. On the collusion / key clustering comparison that was confusing me a bit. In the end, collusion you have two different messages and try to get the same hash. With key clustering you have ciphertext message (encrypted message) and try to find "another key" to decrypt, but you only have one plaintext message. I.e. in key clustering you try make decryption an easier task (as not only one key works...) Could you also briefly say a word how SHA-3 fits in with SHA-2 and SHA-family? Small typo on the asymmetric algorithms comparison slide RSA -->1024 (not 1025).
@InsideCloudAndSecurity
2 жыл бұрын
Silke, thank you for the detailed comment. I am planning to enhance this course in a few weeks, and will add your feedback to the list. Good luck on the exam! 🍀🤞
@kapil28300
3 жыл бұрын
Nice video. At 36:57 the slide says Clark-Wilson is a Lattice based model with No Write-up / No Read-down
@InsideCloudAndSecurity
3 жыл бұрын
That's errata. Will have that edited out. Thanks for catching that.
@babisbugbount3693
2 жыл бұрын
I have one question, the official study guide refers to humidity in a computer room should be maintained between 20 and 80 percent. You have it 40-60% is this an error or it applies to something else?
@InsideCloudAndSecurity
2 жыл бұрын
My information is correct at 40-60%. 20% is too dry (static electricity risk) and 80% too humid (moisture condensation issues, corrosion risk). In addition to multiple other well-known exam study sources, here are other sources that agree with my data: www.itperfection.com/cissp/security-architecture-and-engineering/site-facility-design-principles-security-controls-part-2/ and serverscheck.com/sensors/temperature_best_practices.asp#:~:text=Did%20you%20know%20that%20the,resulting%20in%20permanent%20equipment%20failures.
@Nunya24
3 жыл бұрын
Compartmented mode is access approval for some
@InsideCloudAndSecurity
3 жыл бұрын
Hello Lee. Definitely some fined grained differences between access modes. The major difference between Compartmented mode systems and System High mode systems is that users of a compartmented mode system do not necessarily have access approval for all the information on the system. Another way to say it is that in Compartmented mode, the user must have access approval AND valid need to know for ANY info they will have access to. In System High mode, the user needs approval for ALL, but need to know for only SOME.
@SatheeshKumar-lu4xr
2 жыл бұрын
I am started to watch your videos then going to read the official sybex book. This will works? Thanks
@InsideCloudAndSecurity
2 жыл бұрын
It will, but you can use my videos and the Sybex study bundle more efficiently using the strategy I describe in this video - kzitem.info/news/bejne/mYqasmVssot_l2U
@shaunixtech5486
2 ай бұрын
the substitution Cipher definition is incorrect. It should be explained as taking a plain text message and shifting each character down the Alphabet by a set number of places. Think you have IV definition in its place by mistake. That said ❤ your video series!!!!!!!
@InsideCloudAndSecurity
2 ай бұрын
Yes, this errata was corrected in the full course video available at: CISSP Exam Cram Full Course (All 8 Domains) - Good for 2024 exam! kzitem.info/news/bejne/wKSvwJyPp3V_f3Y. Glad you’re finding the series helpful! 👍
@PaulEllisBIGDATA
3 жыл бұрын
Thank you. You're appreciated
@InsideCloudAndSecurity
3 жыл бұрын
Thanks Paul! 😊
@mohamedhaneef6379
3 жыл бұрын
Thank you 😊
@InsideCloudAndSecurity
3 жыл бұрын
My pleasure. Reach out if questions as you prepare.
@joedonohue1855
3 жыл бұрын
This is great material. Sound greedy asking this, but where can I find the memory tips video you keep referring to?
@joedonohue1855
3 жыл бұрын
Never mind. I found it. Thanks
@InsideCloudAndSecurity
3 жыл бұрын
Glad you found it. Ping me if questions as you prepare.
@callclif
3 жыл бұрын
very good and terse explanation... has the domain 4-8 been released please?..thanks
@InsideCloudAndSecurity
3 жыл бұрын
Yes, all eight domains and several supplemental videos on me CISSP Exam Cram playlist at kzitem.info/door/PL7XJSuT7Dq_XPK_qmYMqfiBjbtHJRWigD
@shubh11234
2 жыл бұрын
32:12 , Isn't the Brewer and Nash model, aka Chinese wall model provides integrity ? You have listed it under confidentiality.
@InsideCloudAndSecurity
2 жыл бұрын
Confidentiality is where it belongs. See franckybox.com/brewer-and-nash-security-model/ and www.cs.utexas.edu/~byoung/cs361/lecture25.pdf and which confirm this. Search on 'confidential' in each of these docs.
@mrfluffiness6228
3 жыл бұрын
Hi, when you say pass each domain, is that a 70 in each domain?
@InsideCloudAndSecurity
3 жыл бұрын
Yes, that is the intent. Must pass each domain.
@vanamstel_nl
3 жыл бұрын
Made it to the end 😇
@InsideCloudAndSecurity
3 жыл бұрын
Nice! 👍
@Marcell456
2 жыл бұрын
The Substitution cipher and Initialization vector cipher have the exact same definitions, is this correct?
@InsideCloudAndSecurity
2 жыл бұрын
Sorry Marcel, that's errata I'll note. Actually, substitution ciphers use the encryption algorithm to replace each character or bit of the plaintext message with a different character. An example is a Caesar cipher. You generally won't see substitution ciphers used much today.
@Study_Information_Security
3 жыл бұрын
4:19 Substitution Is the definition correct?
@InsideCloudAndSecurity
3 жыл бұрын
That looks like an "Nonce cipher" (thanks for reporting this). Will post the errata and get it corrected in the next update. Substitution ciphers use the encryption algorithm to replace each character or bit of the plaintext message with a different character.
@strcelrau
3 жыл бұрын
I would have expected Delay in front of Detect. Interesting...
@InsideCloudAndSecurity
3 жыл бұрын
You can't delay an action before you've detected that it exists.😉
Пікірлер: 74