Registered Information Security Specialist ExaminationStudy guide

Covers the three core properties of information security—confidentiality, integrity, and availability (CIA)—together with the related properties of authenticity, accountability, non-repudiation, and reliability, plus the OECD Security Guidelines, building the judgment needed to determine which property was compromised in a given incident and which countermeasure should be prioritized.

Covers threats (physical, human, technical) that endanger information assets, the vulnerabilities (bugs, security holes, human vulnerabilities, shadow IT) that make attacks possible, the OWASP Top 10 categorization of common web-application vulnerabilities, and the fraud triangle (opportunity, motive, rationalization) explaining the psychological conditions behind insider fraud.

Covers the self-replicating worm, remotely controlled bots (botnets, C&C servers, connect-back communication), ransom-demanding ransomware, information-stealing spyware and keyloggers, privilege-concealing rootkits, persistent-access backdoors, disk-resident-free fileless malware, and detection-evading polymorphic/metamorphic malware, building the judgment to diagnose the malware type from observed behavior and choose an appropriate containment measure.

Covers password cracking (dictionary attacks, brute force, reverse brute force, rainbow tables, password-list attacks) and the representative web-application attacks XSS (reflected/stored/DOM-based), CSRF, clickjacking, SQL injection, OS command injection, directory traversal, and man-in-the-middle (MITM)/MITB, building the judgment to determine which attack a given vulnerability symptom enables and which countermeasure is effective.

Covers service-disrupting DoS/DDoS attacks (SYN flood, reflection, amplification attacks), targeted attacks/APT aimed at a specific organization and their staged model, the cyber kill chain, the MITRE ATT&CK/CAPEC frameworks that systematize attacker tactics, psychology-exploiting social engineering and business email compromise (BEC), and side-channel attacks that exploit incidental physical information.

Covers when to use common-key (symmetric) cryptography, public-key (asymmetric) cryptography, and hybrid cryptography; the representative public-key schemes RSA and elliptic curve cryptography (ECC/ECDSA); Diffie-Hellman (DH) key exchange and PFS (Perfect Forward Secrecy) for safely sharing keys; and the CRYPTREC Cipher List and SSL/TLS Cipher Suite Configuration Guidelines, which guard against cryptographic compromise (危殆化).

Covers hash functions (such as SHA-256) with the properties of one-wayness and collision resistance, MAC/HMAC which uses a shared key and a hash function to detect message tampering, digital signatures, which use public-key cryptography to also guarantee authenticity and non-repudiation, and timestamping, code signing, and XML digital signatures.

Covers the three authentication factors—knowledge, possession, and biometric—and multi-factor authentication; one-time passwords, challenge-response authentication, and risk-based authentication; the accuracy metrics of biometric authentication (False Rejection Rate (FRR)/False Acceptance Rate (FAR)); FIDO/WebAuthn, which enables passwordless authentication; and Kerberos and RADIUS.

Covers SAML and OpenID Connect, which realize SSO; OAuth 2.0, a protocol strictly for authorization (note: not authentication); the Certificate Authority (CA) and Validation Authority (VA) that make up PKI (public-key infrastructure); digital certificates (root/server/client); revocation checking via CRL and OCSP; and GPKI.

Covers information asset classification, the risk assessment procedure (risk identification, risk analysis, risk evaluation), the distinction between qualitative risk analysis and quantitative risk analysis, the selection criteria for risk treatment (transfer, avoidance, acceptance, reduction), residual risk and the risk matrix, and the approach defined in JIS Q 31000.

Covers ISMS (Information Security Management System) as the organizational framework for information security management, the division of roles between JIS Q 27001, which defines requirements, and JIS Q 27002, which exemplifies controls, the three-tier structure of an information security policy—policy, standards, and procedures—the continuous-improvement PDCA cycle, and the Statement of Applicability produced for certification.

Covers the division of roles between CSIRT, which handles incidents within an organization, and SOC, which handles monitoring and detection; the flow of incident handling from detection to reporting (including triage); the roles of Japan's core organizations JPCERT/CC, NISC, and IPA; the bug bounty vulnerability-reward program; and inter-organization information-sharing frameworks such as J-CSIP.

Covers CVSS (Base, Temporal, and Environmental metrics) for quantifying vulnerability severity, the CVE vulnerability identifier, CWE for classifying vulnerability types, JVN, Japan's aggregator of vulnerability countermeasure information, ISO/IEC 15408 (Common Criteria) and EAL for evaluating security functionality, Japan's JISEC certification scheme, penetration testing, which actually attempts intrusion, and tamper resistance, hardware's resistance to analysis.

Covers system audit (independence, audit procedures, audit trail) conducted from a position independent of the audited department, internal control, which ensures the soundness of business processes, and related laws such as the Act on Prohibition of Unauthorized Computer Access, the Act on the Protection of Personal Information, the Basic Act on Cybersecurity, and the Penal Code provisions on unauthorized creation of electromagnetic records (malware-related offenses).

Covers organizational deterrence measures based on the internal-fraud-prevention guideline, security education via targeted-email drills and red team exercises, the need-to-know (least privilege) principle and privileged access management, log management, entry/exit control including anti-passback and interlock mechanisms, clear desk / clear screen policy, and RASIS, the metric set for system reliability.

Covers malware detection techniques—pattern matching, the behavior method, the heuristic method, dynamic analysis, and static analysis—the concepts of entry-point (ingress) controls, exit-point (egress) controls, and defense in depth, quarantine networks for isolating infected endpoints, the DMZ, vulnerability management (patching), hardening, and secret sharing for splitting a key across multiple holders.

Organizes the diverse landscape of security products—firewall, IDS/IPS (signature-based/anomaly-based), WAF, RASP, UTM, DLP, SIEM, EDR, CASB, SASE, MDM, and IdP—by what each protects and how it detects threats, along with the false positive/false negative trade-off.

Covers zero trust architecture, which discards the assumption that "inside the perimeter is trustworthy" (verify everything, microsegmentation), threat intelligence (OSINT) for gathering and analyzing attacker trends, digital forensics, which emphasizes evidence preservation and integrity, IoT security and operational technology (OT) security, and hardware-level defenses via secure boot, TPM, and SED.

Covers IPsec (transport/tunnel mode, ESP/AH, IKE) for network-layer encryption and authentication, SSL/TLS (the handshake and TLS 1.3) at the transport layer, STARTTLS for upgrading a plaintext protocol to encryption, SSH for protecting remote operations, HTTPS for protecting the web, S/MIME for encrypting and signing email, and WPA2/WPA3 for wireless LANs, building the judgment to select the right protocol for a given communication requirement.

Covers sender domain authentication for anti-spoofing—SPF, DKIM, and DMARC—and how their roles divide, spam countermeasures SMTP-AUTH and OP25B/IP25B, DNSSEC against DNS cache poisoning and DNSBL for identifying spam sources, the authorization standard OAuth, and the user-authentication protocols EAP/EAP-TLS/PEAP, RADIUS, and PSK used for wireless LANs and beyond—all from the perspective of which countermeasure is effective against which threat.

Covers the fundamentals of perimeter defense—packet filtering and stateful inspection—the application gateway that inspects communication content, address translation via NAT/IP masquerading, per-device authentication via authentication VLAN, remote-access VPN (reverse proxy/port forwarding/L2 forwarding), DHCP snooping against rogue DHCP servers, MAC address filtering, and reconnaissance via port scanning—building judgment for selecting the right approach to a given perimeter-defense requirement.

Covers OS-level mandatory access control (MAC), RBAC, least privilege, and trusted OS, database encryption and DB access control, building security in from upstream via security by design/privacy by design/threat modeling, secure programming, vulnerability-detection techniques SAST/DAST/IAST/SCA, the web isolation principles Same Origin Policy/CORS, password protection via salting/stretching, and countermeasures for buffer overflow/XSS/SQL injection—all from the perspective of choosing the right implementation/detection technique to avoid or catch a given vulnerability.

Covers the correspondence between the OSI reference model's seven layers and the TCP/IP four-layer model, subnetting using IP addresses, subnet masks, and CIDR, static routing versus dynamic routing (RIP, OSPF, BGP), the TCP three-way handshake versus UDP, and the role of port numbers—all tied to security design decisions around network segmentation.

Covers HTTP/HTTPS, the DNS protocol behind name resolution (recursive queries, caching), DHCP, mail protocols such as SMTP/POP3/IMAP, forward and reverse proxies, REST, and session management via cookies/session IDs—each paired with its attack surface and secure design judgment.

Covers network management via SNMP polling/traps against the MIB, performance metrics such as bandwidth, throughput, and latency, priority control via QoS, wireless LAN (SSID, channel, roaming), and load balancing—paired with the judgment of choosing a configuration suited to monitoring and performance requirements.