Cybersecurity Fundamentals Training Course

DOMAIN 1: CYBERSECURITY CONCEPTS

• 1.1 Understanding information assurance (IA) principles applied to managing risks associated with the use, processing, storage, and transmission of information or data.
• 1.2 Grasping the fundamentals of security management.
• 1.3 Comprehending risk management processes, including the steps and methods used for risk assessment.
• 1.4 Aligning with the organization’s enterprise information technology (IT) goals and objectives.
• 1.5 Recognizing various operational threat environments, such as first-generation [script kiddies], second-generation [non-nation state sponsored], and third-generation [nation state sponsored] actors.
• 1.6 Applying information assurance (IA) principles and organizational requirements related to confidentiality, integrity, availability, authentication, and non-repudiation.
• 1.7 Identifying common adversary tactics, techniques, and procedures (TTPs) relevant to the assigned area of responsibility, including historical country-specific TTPs and emerging capabilities.
• 1.8 Distinguishing between different classes of attacks, such as passive, active, insider, close-in, and distribution-based attacks.
• 1.9 Understanding relevant laws, policies, procedures, and governance requirements.
• 1.10 Knowing the legal, policy, procedural, and governance frameworks that apply to work potentially impacting critical infrastructure.

DOMAIN 2: CYBERSECURITY ARCHITECTURE PRINCIPLES

• 2.1 Understanding network design processes, including the balance between security objectives, operational goals, and trade-offs.
• 2.2 Mastering security system design methods, tools, and techniques.
• 2.3 Comprehending network access, identity, and access management, including public key infrastructure (PKI).
• 2.4 Applying information technology (IT) security principles and methods, such as firewalls, demilitarized zones, and encryption.
• 2.5 Utilizing current industry methods for evaluating, implementing, and deploying IT security assessment, monitoring, detection, and remediation tools and procedures, based on standardized concepts and capabilities.
• 2.6 Exploring network security architecture concepts, including topology, protocols, components, and principles, such as the application of defense in depth.
• 2.7 Learning malware analysis concepts and methodologies.
• 2.8 Employing intrusion detection methodologies and techniques for identifying host- and network-based intrusions through detection technologies.
• 2.9 Understanding defense in depth principles and network security architecture.
• 2.10 Studying encryption algorithms, including Internet Protocol Security (IPSEC), Advanced Encryption Standard (AES), and Generic Routing Encapsulation (GRE).
• 2.11 Gaining knowledge of cryptology.
• 2.12 Understanding encryption methodologies.
• 2.13 Tracing how traffic flows across networks, such as via Transmission Control Protocol and Internet Protocol (TCP/IP) and the Open Systems Interconnection model (OSI).
• 2.14 Understanding network protocols, such as Transmission Control Protocol and Internet Protocol.

DOMAIN 3: SECURITY OF NETWORK, SYSTEM, APPLICATION AND DATA

• 3.1 Using computer network defense (CND) and vulnerability assessment tools, including open-source options, and understanding their capabilities.
• 3.2 Applying basic system administration, network, and operating system hardening techniques.
• 3.3 Evaluating risks associated with virtualization.
• 3.4 Understanding penetration testing principles, tools, and techniques (e.g., Metasploit, Neo4j).
• 3.5 Applying network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.
• 3.6 Grasping the concepts of remote access technology.
• 3.7 Understanding systems administration concepts.
• 3.8 Proficiency in Unix command line operations.
• 3.9 Identifying system and application security threats and vulnerabilities.
• 3.10 Applying system lifecycle management principles, including software security and usability.
• 3.11 Understanding local specialized system requirements (e.g., critical infrastructure systems that may not use standard IT) for safety, performance, and reliability.
• 3.12 Recognizing system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, PL/SQL injections, race conditions, covert channels, replay attacks, return-oriented attacks, and malicious code).
• 3.13 Understanding the social dynamics of computer attackers in a global context.
• 3.14 Applying secure configuration management techniques.
• 3.15 Understanding the capabilities and applications of network equipment, including hubs, routers, switches, bridges, servers, transmission media, and related hardware.
• 3.16 Grasping the communication methods, principles, and concepts that support network infrastructure.
• 3.17 Understanding common networking protocols (e.g., TCP/IP) and services (e.g., web, mail, Domain Name System [DNS]) and their interaction to enable network communications.
• 3.18 Distinguishing between different types of network communication (e.g., LAN, WAN, MAN, WLAN, WWAN).
• 3.19 Understanding virtualization technologies and the development and maintenance of virtual machines.
• 3.20 Identifying application vulnerabilities.
• 3.21 Applying information assurance (IA) principles and methods relevant to software development.
• 3.22 Performing risk and threat assessments.

DOMAIN 4: INCIDENT RESPONSE

• 4.1 Understanding incident categories, response strategies, and timelines.
• 4.2 Developing disaster recovery and continuity of operations plans.
• 4.3 Managing data backup, types of backups (e.g., full, incremental), and recovery concepts and tools.
• 4.4 Applying incident response and handling methodologies.
• 4.5 Using security event correlation tools.
• 4.6 Considering the investigative implications of hardware, operating systems, and network technologies.
• 4.7 Following processes for seizing and preserving digital evidence (e.g., chain of custody).
• 4.8 Recognizing types of digital forensics data.
• 4.9 Applying basic concepts and practices for processing digital forensic data.
• 4.10 Understanding anti-forensics tactics, techniques, and procedures (TTPs).
• 4.11 Configuring and supporting common forensic tools and applications (e.g., VMware, Wireshark).
• 4.12 Analyzing network traffic.
• 4.13 Identifying system files (e.g., log files, registry files, configuration files) that contain relevant information and locating them.

DOMAIN 5: SECURITY OF EVOLVING TECHNOLOGY

• 5.1 Understanding new and emerging information technology (IT) and information security technologies.
• 5.2 Identifying emerging security issues, risks, and vulnerabilities.
• 5.3 Assessing risks associated with mobile computing.
• 5.4 Understanding cloud concepts related to data and collaboration.
• 5.5 Evaluating risks associated with migrating applications and infrastructure to the cloud.
• 5.6 Assessing risks associated with outsourcing.
• 5.7 Understanding supply chain risk management processes and practices.