2018 CISSP-ISSMP Exam Outline (Threat Intelligence)

rbcarleton

I've been studying the CISSP-ISSMP CBK (2nd Addition) getting prepared for the test. I noticed the addition of Threat Intelligence in the re-organization of the domains.  These two from the (ISC)2 references seem applicable:

1) Threat Modeling: Designing for Security, First Edition by Adam Shostack. Publisher: Wiley (2014)

2) Information Security Handbook: Develop a Threat Model and Incident Response Strategy to Build a Strong Information Security Framework by Darren Death. Publisher: Packt Publishing. (2017)

Are there any other Threat Intelligence references that are specifically applicable to the ISSMP?

JDMurray

I would say that the references you found are the ones to study. Those are suppose to be the references used by the ISSMP exam item writers themselves. The problem is you may need to purchase those titles to study the material. And consider in the reference (ISC)2 lists there may be TI info from sources that don't have "threat" in their title. Also note that the TI ISSMP objectives are from an "establish and maintain a TI program" angle and not performing the actual TI procedural operations themselves.

JDMurray

ISSMP is a management certification, so I can't imagine that detailed technical knowledge of TI is required. Maybe just an understanding of how TI and TM, in conjunction with IR and SOC, help protect the business processes and interests of an organization. 

rbcarleton

This is what is in the exam outline:

Establish and Maintain Threat Intelligence Program:

• Synthesize relevant data from multiple threat intelligence sources
• Conduct baseline analysis
• Review anomalous behavior patterns for potential concerns
• Conduct threat modeling
• Identify ongoing attacks
• Correlate related attacks
• Create actionable alerting to appropriate resources

The 2nd edition of the CBK doesn't really have much on Threat Intelligence. I'm just curious what references were sourced for the exam outline, beyond what I already listed.

rbcarleton

I'll add that I'm in a position where get briefed on intelligence, detection and response along with other SOC operations. I have a general knowledge of what the intelligence products are and how they become actionable, but I probably need to take a deeper dive. I took the CISSP in 2015, prior to threat becoming more widely appreciated.

rbcarleton

I already ordered them. I'll have to do some digging in the other references and see if they might have some of that. Thanks.