When choosing the books you use for your CISSP certification I think it is important to understand your own skill level and how much knowledge you would need to both pass the certification, but ultimately do your job well as an IT security professional. The first 2 books I would
Qualitative Risk Analysis – How likely is it to happen and how bad is it if it happens? This is vague, guessing, a feeling and relatively quick to do. Most often done to know where to focus the Quantitative Risk Analysis. Qualitative Risk Analysis with the Risk Analysis Matrix. Pick
Access Control Defensive Categories and Types: Access Control Types (Many can be multiple types – On the exam look at question content to see which type it is). Preventative: Prevents action from happening – Least Privilege, Drug Tests, IPSs, Firewalls, Encryption. Detective: Controls that detect during or after an attack
Before you can take the exam you will agree to the ISC² Code of Ethics, they are also very testable on the certification. Learn them. ISC² Code of Ethics You agree to this before the exam, and the code of ethics is very testable. There are only four mandatory canons in
Defense in Depth – Also called Layered Defense or Onion Defense. We implement multiple overlapping security controls to protect an asset. This applies both to physical and logical controls. To get to a server you may have to go through multiple locked doors, security guards, man traps. To get to
Liability: If the question is who is ULTIMATELY liable, the answer is Senior Leadership. This does not mean you are not liable; you may be, that depends on Due Care. Who is held accountable, who is to blame, who should pay? Due Diligence and Due Care: Due Diligence – The