CISSP exam advice 2015
So, I passed the CISSP exam this week. Without divulging specific questions, here is some advice for those preparing. Obviously your exam may be drastically different from mine, and this is by no means a comprehensive list of stuff you should know - it's just my personal feeling about which areas of the CBK are most helpful to have a strong grasp of, based on my single experience of a CISSP exam.
Most of the people who failed on my exam were bemoaning the amount of questions on governance, risk management, and business continuity. Know these topics well. If in doubt, remember the basics that are important - getting management buy-in, and starting at the top with good policies. Remembering these basics could help find the right answer in a number of questions.
CLOUD IS A BIG DEAL. Be aware of security issues around cloud. This is one area where the old CBK isn't massively helpful (my copy is from around 2009).
SCADA systems are new for 2015. You don't need to know loads, but be aware that they are mostly legacy systems with little or no security.
Understand crypt, particularly how PKI works and the different types of cipher. Know the most common symmetric and asymmetric algorithms (not in detail - just be able to identify or list them and know where you might use them, ie ECC for mobile devices). Details about how many rounds AES does and block sizes are less important. I massively over-prepared for this area, but it's all good knowledge I guess!
Be aware of well known attacks, including various kinds of Denial of Service. Know Fraggle from Smurf, and know how to mitigate them.
Know your security models. You absolutely must know the difference between Bell La-Padula and Biba, Clark-Wilson and Brewer-Nash. Which models are for integrity, which for confidentiality? Which would you use to manage conflict of interest? These can be confusing at first, but you can probably nail them in an afternoon of study.
A lot of physical security is common sense, but it wouldn't hurt to know your fire suppression techniques, requirements for secure areas, etc. I learnt all this just in case, but TBH didn't need much of it and most questions the right answer was fairly easy to find simply by process of elimination. I'd suggest that if you're pressed for study time, you can spend less time on this area.
Learn the software development lifecycle, and know what activities are at each stage.
Know the generic risk assessment process. You should be able to do a basic calculation for a quantitative risk assessment (working out ALE and making recommendations on which controls are most cost effective).
Know the 7 layer OSI model. You need to know what each layer does, common protocols at each layer, and the security concerns - which attacks are layer 3, for instance? My older study materials spent lots of time on port numbers, different kinds of cable and how many channels a T1 line had etc. The focus appears to have moved away from this level of detail.
Be aware of wireless networking and the issues with WEP/WPA.
Study prep advice:
Don't underestimate the prep time required. I set aside 2 hours a day for the 2 months leading up to the exam, and took one day a week to spend longer on CISSP. I mostly studied from the CBK and an Eric Conrad book (which I personally found a lot better than the Shon Harris ones), looking up concepts online where I needed to. I did a weeklong review seminar with the exam at the end. The course wasn't great, and would by no means have compensated for a lack of prep beforehand! It was really just a high-level review of things we were already expected to know. I suspect the majority of people who failed the course didn't put the time in beforehand.
Do lots of practice tests but choose carefully. There's a lot of questions online that are either misleading or plain WRONG and rarely representative of what is actually on the exam. Choose from known, respected authors (Eric Conrad, Shon Harris) and use new materials. As mentioned above, the focus of the exam appears to have moved away from knowing random technical facts and is much more about how you apply what you know (which is the best way to mitigate X, etc). Many older books will bang on about the block size of DES, clipper chips, etc, so throw away any hand-me-down study materials and buy something published in the past 12 months.
Hope this helps someone. Good luck!
