CISSP — Certified Information Systems Security Professional

Who classifies data and who protects it are different people with different jobs — data owner vs custodian vs steward, the full data lifecycle, and the NIST Clear/Purge/Destroy framework for choosing the right media sanitization method.

Privacy by design as an architectural stance, not a policy afterthought; why 'keep everything forever, just in case' is a liability rather than a safety net; and why a vendor's security posture is the client organization's risk regardless of whose staff caused the breach.

The first real cold-start gap: why symmetric and asymmetric encryption solve different problems and are usually combined, why hashing isn't 'weak encryption' but a different tool entirely, and how the PKI trust chain lets you trust a stranger's public key.

What a Trusted Computing Base actually is and why it must stay minimal, the security-mode vocabulary for systems handling mixed classification levels, Common Criteria evaluation assurance levels as a trust signal, and the physical-security layering that protects everything else in this domain.

How cryptography actually fails in practice — brute force, known-plaintext, and birthday-style collision attacks — plus the key management lifecycle CISSP treats as more operationally important than algorithm choice: generation, distribution, storage, rotation, and destruction.

The OSI model read as a security map, why segmentation exists beyond performance, the secure-protocol replacements for every legacy insecure one, and ARP poisoning as the canonical layer-2 attack — the domain where Nginx/Cloudflare experience maps almost directly onto CBK vocabulary.

The firewall generations from packet-filtering to next-gen, IPsec's two modes and why one leaks routing metadata the other doesn't, and the WPA2-to-WPA3 handshake fix that closed the KRACK-class vulnerability — the second network lesson, past OSI and segmentation.

DAC/MAC/RBAC/ABAC as the practical mechanisms behind D1's theoretical models, plus SAML and OAuth/OIDC federation vocabulary — the domain where Keycloak-style IAM experience converts fastest into CISSP terminology.

The joiner-mover-leaver lifecycle those access-control mechanisms actually run inside — why de-provisioning, not provisioning, is where real breaches happen, plus the authentication-factor vocabulary CISSP tests precisely.

Black/gray/white-box testing as a knowledge spectrum, why a vulnerability assessment, a penetration test, and an audit are three different deliverables, and SAST vs DAST as complementary rather than competing tools — the domain closest to pentest/audit coordination work.

Why a good security metric must be actionable, not just measurable; log review as a distinct discipline from log collection; and continuous monitoring as the structural answer to the gap point-in-time testing always leaves open.

The formal NIST incident-response lifecycle behind the DDoS/intrusion response you already do by instinct, containment vs eradication vs recovery, and the RTO/RPO/MTD vocabulary that decides which disaster-recovery site strategy is actually justified.

Where RTO and RPO actually come from — the Business Impact Analysis process that produces them — and why an untested continuity plan is, for CISSP purposes, functionally indistinguishable from no plan at all, through the five levels of plan testing.

The second and final cold-start gap: why 'shift-left' isn't a slogan but a cost argument, why parameterized queries structurally eliminate injection rather than just filtering it, and aggregation/inference as the two ways a database can leak more than any single query should — closing the loop back to Lesson 1's opening SQL injection example.

Three more code/data confusion vulnerability classes precisely distinguished from each other and from injection, plus CMMI and SAMM as two different lenses for measuring how mature a secure development process actually is — beyond any single vulnerability finding.

Every domain in one sitting: a 24-question scenario quiz (3 per domain), a cross-domain MCQ set, and a multi-domain case study — the roadmap's final checkpoint before booking the real CAT exam.