Cyber Security Training and Certification

Learning objective: Learning goal: Learn core security concepts such as confidentiality, integrity, availability, authentication, authorization, vulnerability, threat and risk, along with governance, audit, compliance and security architecture.

• Why cyber security matters
• The CIA triad
• Vulnerability, threat and risk
• Risk governance and risk management
• Security architecture
• Security governance
• Security auditing
• Compliance
• Computer security architecture and design

• Learning goal: Learn the main cryptographic techniques, where each is strong or weak, and how to send messages securely in an enterprise.
• Background of cryptography
• Symmetric cryptography
• DES and Triple DES, and why they are no longer recommended
• The Advanced Encryption Standard (AES)
• IDEA and Blowfish
• RC4, RC5 and RC6
• Asymmetric cryptography
• The Diffie-Hellman algorithm
• RSA
• Elliptic curve cryptography (ECC)
• Cryptographic hash functions
• Attacks on encrypted data
• Digital certificates and their formats (X.509, X.500)
• Certificate authorities, certificate revocation lists and certificate repositories
• The digital certificate life cycle: initialize, issue and revoke

• Learning goal: Understand how networks work, where they are weak and how to secure them.
• Network architecture, protocols and technologies: the OSI model and layered architecture
• TCP/IP and the hybrid TCP/IP model
• Application layer protocols: DNS, POP, SMTP, HTTP and SNMP
• Transport layer protocols: TCP and UDP
• Network layer protocols: IPv4, IPv6 and IPsec
• Link layer protocols: Ethernet, VLANs, ARP, Reverse ARP and Proxy ARP

• Learning goal: Learn application-level security, the secure SDLC and the controls that address common vulnerabilities.
• Why application security matters
• The OWASP Top 10 web application risks
• The secure software development life cycle (SSDLC)

• Learning goal: Learn how to protect data and the devices that hold it.
• Data security
• Data security controls
• Endpoint security
• Host and endpoint security controls

• Learning goal: Ensure the right people have the right access across different technologies, and meet growing compliance demands.
• Authentication
• Authorization
• Access control
• Privilege levels
• The IAM life cycle
• IAM processes and activities, such as single sign-on and role-based access

• Learning goal: Learn how to secure cloud computing environments.
• The cloud computing architectural framework
• Concerns and best practices
• Governance and enterprise risk management
• Legal issues: contracts and electronic discovery
• Compliance and audit management
• Information management and data security
• Interoperability and portability
• Traditional security, disaster recovery and business continuity
• Data center operations
• Incident response
• Application security
• Encryption and key management
• Identity, entitlement and access management
• Virtualization
• Security as a service

• Learning goal: Get an overview of how cyberattacks unfold, phase by phase, and the controls that stop them.
• Identifying and selecting a target
• Packaging an exploit into a payload
• Delivering the payload to the target
• Running code on the target system
• Installing remote access software for persistence
• Setting up a command-and-control channel
• Pursuing objectives such as data exfiltration and lateral movement

• Learning goal: Learn the security practices businesses use to strengthen their existing infrastructure.
• Key security business processes
• Corporate and security governance
• IT strategy management
• Portfolio, program and project management
• Change management
• Supplier (third-party) management
• Problem management
• Knowledge management
• Information security management
• Business continuity planning (BCP)
• IT operations management