Intensified A weblog about wireless, security, culture & geekdom

So you wanna be a CISSP?

Four years verified security experience. An intimidating test. A waiting period that made me lose more hair. This was my CISSP experience. When I took the CISSP it was bubble sheet/Scan Tron. Eight hours for 500 questions from 10 domains ranging from Physical Security to arcane Data Classification used by the military around the time War Games came out. It is to use an oft used descriptor, a mile wide and an inch deep.

I sat for the test in March of 2006. I self studied. It was, to say the least, intense. Did I make it more intense than I needed to? Probably. I tend to over engineer about anything I can. Usually you can judge your level of study and adequacy of your methods by your test score. Trouble is, you don't see that in the CISSP.  To the person, everyone I have talked to has the same comment "When I walked out, I had no idea if I had passed or bombed it!" When I took it, I had no computerized option, bubble sheet and #2 pencils only.  It took 3 weeks to find out if I passed the test.  At least that was via email.  Then started the background validation.  That was another 3 weeks.  How did they tell me I passed?  I got an envelope with Ryan D Gregory, CISSP on it.  Saw it for the first time.  This was a cert I had wanted since the day I heard about it.  Something I sacrificed for, prepped for and lost a lot of sleep to.  Needless to say, I wept like I was watching Rudy.

One of the questions I get asked most often is what materials I used to study.  It's important to stop here and note my study process.  Like everything I do, there is a process.

The Resources:

As a rule, I have 3 forms of all of the study materials on any exam.  I have a primary book.  This is the one I read from, mark up, etc.  I use it for the entire study session.  I have a second source, typically the "next best" version.  I do this as people have different writing styles.  They use different analogies.  They use a different tone and assume different levels of skill and background.  If I am baffled by a concept in book 1, I go to book 2 and read it there.  I also tend to take the chapter and content tests out of the second book, rather than the first.  More on that later.  Third, I have an Exam Cram type book.  One of those skinny, packed with questions, pump and dump type texts.  I certify to build my knowledge, renew my understandings, validate I am still mostly sane, and then the letters after my name.  Considering the price of most exams, and the fact that a lot of employers only pay for your first attempt, the test is ultimately fairly important.  Below are the modern versions of the books I used.  I have suggested them for the last 7 years, as well as my study methods and am proud to say the folks I have coached have passed the first time through!

The Books:

First and foremost, the Shon Harris All-In-One Guide is a must.  This is the Golden Book.  I have known some folks that have used only this resource and passed.

Next is good old Sybex. Sybex have been around a dogs age and I have used them since my NT4 MCSE prep.  They are consistently mediocre, but always a good secondary text.  They employ good writers, have a very clean look and feel, and it's another "voice" to read the text.

Finally, a good Exam Cram guide for cramming, after chapter testing, and the bare bones answers.

The Method:

I'm fortunate enough to be a moderate test taker.  I'm extremely fortunate enough to have had a class on another topic taught by my friend and true instructor, ''KC" Keith Charles.  KC taught me study tips that I use to this day, and share with anyone studying for a cert.  I've developed a project style preparation system as well.  I tend to put together a project plan for everything I do.  A friend once joked that I can't refill my water bottle without a plan, process and system.  So, here it goes:

• Set a date and work back.  If you are paper and penciling it, this is pretty easy.  If you are computer basing it, set the date and build your study plan backwards from that date.
• Set study times.  You're busy.  I'm busy.  Congress is busy.  Get over it, set a specific time.  Lock yourself in a room.  If you dig music and can have it without being distracted, rock that.
• I really like to read a chapter or concept in one book, then test on it from the end of the chapter in another book.  I do this method until I am hitting in the 80% range, recursively study until I hit that number.  I then test in the primary source and the tertiary.  Once it's solid, it's solid.  It goes in the memory bank until the final week or two before the test.  Then I do the whole mugilla, chapter by chapter test.  I will sometimes challenge myself to go back x chapters at the end of a session on an entirely different topic.  With such a theoretical test as the CISSP, this can be a great game to play on yourself.
• Read the exam objectives.  Highlight the areas that are going to be troublesome.  Print those, have them somewhere you can see while you study.  Review and check off what you are comfortable with.
• Have a plan for what you will study each session.  "I will finish this malarky about the Orange Books tonight".  "I will finally be able to explain Elliptical Curve Cryptography to my dog by the end of this session".
• From KC, the power and virtue of NERVOUS NOTES.  The nervous notes concept changed my testing life.  The concept is simple.  You are nervous when you sit for a test.  Doesn't matter who you are, you've got a bit of agita.  These notes affirm what you know, give you crib notes for what you don't.  You write them over and over until it is muscle memory.  It gives you a second applied sense from which to learn, adds some kinesthesia and drives it home in general.  Details on how I use nervous notes:

1. Take out an 8.5x11 sheet of paper at the beginning of your study session.
2. Start making tables, charts, squiggles and notes on the stuff that you are having a hard time with.  For me a good example was EAP types for my CWSP.  Nice little table of type, security level, definition, etc.
3. After your first session, take out the sheet and refine it, copy it by hand.
4. Wash, rinse repeat.
5. As test time gets closer, finish up the notes sheet.  Make a gold image.  Copy it before and after each session, at least once, if not a few times.  Get to where you are NOT thinking as you write it out.  You want to affirm what you know, give crib for what you struggle with and give yourself some time to breath before you hit the begin button or rip open the test book.
6. Get an 8.5x11 sheet of paper at the test center.  VUE will give you one and a pencil if you demand it, and you give them the paper back after.

So, that's what I did.  Again, this may have, in fact probably was overkill preparation.  All I know is that it worked for me and I got those 5 letters I had wanted for so long.

Links that will be useful:

THE site for studying, www.cccure.org. This site has incredible forums, user generated test questions and is the best place for discussing the stuff you are struggling with.  I still troll this site as do many folks that already got the letters.  When I can lend a hand I do.

More links to follow!