Certified Information Systems Security Professional

From Wikipedia, the free encyclopedia

Certified Information Systems Security Professional (CISSP) is an independent information security certification governed by the International Information Systems Security Certification Consortium (commonly known as (ISC)²). As of April 11, 2007, (ISC)² has reported certifying 48,598 information security professionals in more than 120 countries.^[1] In June, 2004, the CISSP program earned the ANSI ISO/IEC Standard 17024:2003 accreditation, the first IT certification to have done so.^[2] It is formally approved by the U.S. Department of Defense (DoD) in both their Information Assurance Technical (IAT) and Managerial (IAM) categories.^[3] The CISSP has been adopted as a baseline for the U.S. National Security Agency's ISSEP program, which further extends the significance of the credential.^[4]

Contents 1 Certification subject matter 2 Requirements 2.1 Specialized concentrations 2.2 Ongoing certification 3 Promotion 4 Criticisms of the CISSP examination 5 References 6 See also 7 External links

[edit] Certification subject matter

The CISSP curriculum covers subject matter in a variety of Information Security topics. The CISSP examination is based on what (ISC)² terms the Common Body of Knowledge (or CBK). According to (ISC)², "the CISSP CBK is a taxonomy -- a collection of topics relevant to information security professionals around the world. The CISSP CBK establishes a common framework of information security terms and principles that allow information security professionals worldwide to discuss, debate and resolve matters pertaining to the profession with a common understanding."^[5]

The CISSP CBK is fundamentally based on the CIA triad, the core information security and assurance tenets: confidentiality, integrity and availability^[6] , and attempts to balance the three across ten areas of interest, which are also called domains. The ten CBK domains are^[7]:

• Access Control
  • Categories and Controls
  • Control Threats and Measures
• Application Security
  • Software Based Controls
  • Software Development Lifecyle and Principles
• Business Continuity and Disaster Recovery Planning
  • Response and Recovery Plans
  • Restoration Activities
• Cryptography
  • Basic Concepts and Algorithms
  • Signatures and Certification
  • Cryptanalysis
• Information Security and Risk Management
  • Policies, Standards, Guidelines and Procedures
  • Risk Management Tools and Practices
  • Planning and Organization
• Legal, Regulations, Compliance and Investigations
  • Major Legal Systems
  • Common and Civil Law
  • Regulations, Laws and Information Security
• Operations Security
  • Media, Backups and Change Control Management
  • Controls Categories
• Physical (Environmental) Security
  • Layered Physical Defense and Entry Points
  • Site Location Principles
• Security Architecture and Design
  • Principles and Benefits
  • Trusted Systems and Computing Base
  • System and Enterprise Architecture
• Telecommunications and Network Security
  • Network Security Concepts and Risks
  • Business Goals and Network Security

[edit] Requirements

Candidates for the CISSP must meet several requirements.

• They must have a minimum of five years of professional experience in information security. One year may be waived for having either a four-year college degree, a Master's degree in Information Security, or for possessing one of a number of other certifications from other organizations^[8].

• They must attest to the truth of their assertions regarding professional experience and accept the CISSP Code of Ethics.^[9].
• They must attest to lack of criminal history and related background.^[9]

• They must pass the CISSP exam with a scaled score of 700 points or greater. The exam consists of 250 questions to be answered over a period of six hours^[10].

• They must have their qualifications endorsed by another CISSP or other qualified professional. The endorser attests that the candidate's assertions regarding professional experience are true to the best of their knowledge, and that the candidate is in good standing within the information security industry.^[10]

[edit] Specialized concentrations

Experienced information security professionals with an (ISC)² credential in good standing can progress to meet requirements for (ISC)² Concentrations to demonstrate further knowledge of select CBK domains. A passing score on a concentration examination is intended to demonstrate proven capabilities and subject-matter expertise beyond that required for the CISSP.

Current concentrations for CISSPs include the:

• Information Systems Security Architecture Professional (ISSAP), Concentration in Architecture
• Information Systems Security Engineering Professional (ISSEP), Concentration in Engineering
• Information Systems Security Management Professional (ISSMP), Concentration in Management

[edit] Ongoing certification

The CISSP credential is valid for only three years, after which it must be renewed. The credential can be renewed by re-taking the exam, however the more common method is to report at least 120 Continuing Professional Education (CPE) credits since the previous renewal. Currently, to maintain the CISSP certification, a member is required to earn and submit a total of 120 CPEs by the end of their three-year certification cycle and pay the Annual Membership Fee of US$85 during each year of the three-year certification cycle before the annual anniversary date. With the new changes effective 30 April 2008, CISSPs are required to earn and post a minimum of 20 CPEs (of the 120 CPE certification cycle total requirement) and pay the AMF of US$85 during each year of the three-year certification cycle before the member’s certification or recertification annual anniversary date. For CISSPs who hold one or more concentrations, CPEs submitted for the CISSP concentration(s) will be counted toward the annual minimum CPEs required for the CISSP.^[11].

CPEs can be earned through several paths, including taking classes, attending conferences and seminars, teaching others, undertaking volunteer work, professional writing, etc., all in areas covered by the CBK. Most activities earn 1 CPE for each hour of time spent, however preparing (but not delivering) training for others is weighted at 4 CPEs/hour, published articles are worth 10 CPEs, and published books 40 CPEs^[12].

[edit] Promotion

(ISC)2 promotes the CISSP certification as the "international gold standard" against which other security certifications are measured.

IT professionals with security expertise are often in high demand, and the CISSP is one metric by which that expertise can be demonstrated. In 2005, CertMag surveyed 35,167 IT professionals in 170 countries on compensation and found that CISSPs led their list of certificates ranked by salary, with the Certified Information Systems Security Management Professional (CISSP-ISSMP) program drawing $116,970 annually and the Certified Information Systems Security Architecture Professional (CISSP-ISSAP) earning $111,870.” A 2006 Certification Magazine salary survey also ranked the CISSP credential highly at $94,070 per year, and ranked CISSP concentration certifications as the top best paid credentials in IT, with CISSP-ISSAPs averaging at $114,210 per year and CISSP-ISSMP at $111,280 per year.^[13]. These numbers correlate with compensation advantages enjoyed by IT security professionals in general, as well as with advantages accruing to the seniority and management roles that intersect with the concentration certificates.^[14]

According to the (ISC)2, as of April 11, 2007 there are a total of 48,598 people holding the CISSP certification in 126 countries, with the majority of CISSP holders in the United States (30,385). ^[15]

[edit] Criticisms of the CISSP examination

Some critics have raised the issues below concerning the CISSP examination, its contents, and its processes.

• Critics claim the exam is very long and tough to pass for an ordinary security professional and requires extensive preparation to pass the exam.
• Critics say the CISSP exam covers information security topics "a mile wide, and an inch deep"^[16] meaning the test has insufficient depth.
• The exam sometimes includes outdated information. Critics say that although organizations still use legacy technology, the exam should focus only on current technologies.^{[citation needed]}
• Some questions on CISSP tests and information in the CBK may be technically inaccurate or incomplete.^{[citation needed]}
• The CISSP test is formulated so that candidates are asked to choose the best answer from among a group of correct answers. Some feel these are "trick" questions that unnecessarily distract capable candidates.^{[citation needed]}

[edit] References

[edit] See also

• Systems Security Certified Practitioner
• Certified Information Security Manager
• Information Security Management

[edit] External links

• (ISC)²
• The National Centers of Academic Excellence in Information Assurance Education (CAEIAE)
• CCCure.org CISSP Study Resources