Cybersecurity Fundamentals Training Course

DOMAIN 1: CYBERSECURITY CONCEPTS

• 1.1 Understanding information assurance (IA) principles utilized for managing risks associated with information or data usage, processing, storage, and transmission.
• 1.2 Comprehension of security management frameworks.
• 1.3 Familiarity with risk management processes, including assessment steps and methodologies.
• 1.4 Awareness of the organization’s enterprise information technology (IT) goals and objectives.
• 1.5 Insight into various operational threat environments, ranging from first-generation [script kiddies] to second-generation [non-nation state sponsored] and third-generation [nation state sponsored] threats.
• 1.6 Application of information assurance (IA) principles and organizational requirements concerning confidentiality, integrity, availability, authentication, and non-repudiation.
• 1.7 Recognition of common adversary tactics, techniques, and procedures (TTPs) within specific areas of responsibility, including historical country-specific TTPs and emerging capabilities.
• 1.8 Identification of different classes of attacks, such as passive, active, insider, close-in, and distribution attacks.
• 1.9 Understanding of relevant laws, policies, procedures, and governance requirements.
• 1.10 Knowledge of legal, policy, procedural, and governance frameworks impacting critical infrastructure operations.

DOMAIN 2: CYBERSECURITY ARCHITECTURE PRINCIPLES

• 2.1 Mastery of network design processes, including the balance between security objectives, operational needs, and trade-offs.
• 2.2 Proficiency in security system design methods, tools, and techniques.
• 2.3 Understanding of network access, identity, and access management mechanisms, such as public key infrastructure (PKI).
• 2.4 Application of information technology (IT) security principles and methods, including firewalls, demilitarized zones, and encryption.
• 2.5 Utilization of current industry standards for evaluating, implementing, and distributing IT security assessment, monitoring, detection, and remediation tools.
• 2.6 Comprehension of network security architecture concepts, including topology, protocols, components, and principles like defence in depth.
• 2.7 Knowledge of malware analysis concepts and methodologies.
• 2.8 Application of intrusion detection methodologies and techniques for identifying host- and network-based intrusions.
• 2.9 Understanding of defence in depth principles within network security architecture.
• 2.10 Familiarity with encryption algorithms, such as internet Protocol Security (IPSEC), Advanced Encryption Standard (AES), and Generic Routing Encapsulation (GRE).
• 2.11 Insight into cryptology.
• 2.12 Proficiency in encryption methodologies.
• 2.13 Understanding of traffic flow across networks, including Transmission Control Protocol and Internet Protocol (TCP/IP) and the Open System Interconnection model (OSI).
• 2.14 Knowledge of network protocols, such as Transmission Control Protocol and Internet Protocol.

DOMAIN 3: SECURITY OF NETWORK, SYSTEM, APPLICATION AND DATA

• 3.1 Familiarity with computer network defence (CND) and vulnerability assessment tools, including open-source options, and their respective capabilities.
• 3.2 Proficiency in basic system administration, network, and operating system hardening techniques.
• 3.3 Awareness of risks associated with virtualization environments.
• 3.4 Understanding of penetration testing principles, tools, and techniques, such as metasploit and neosploit.
• 3.5 Mastery of network systems management principles, models, methods (e.g., end-to-end performance monitoring), and tools.
• 3.6 Insight into remote access technology concepts.
• 3.7 Understanding of systems administration concepts.
• 3.8 Proficiency in using the Unix command line.
• 3.9 Recognition of system and application security threats and vulnerabilities.
• 3.10 Application of system lifecycle management principles, focusing on software security and usability.
• 3.11 Understanding of local specialized system requirements for safety, performance, and reliability, particularly for critical infrastructure systems that may not use standard information technology (IT).
• 3.12 Identification of system and application security threats and vulnerabilities, including buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language (PL/SQL) injections, race conditions, covert channels, replay attacks, return-oriented attacks, and malicious code.
• 3.13 Insight into the social dynamics of computer attackers in a global context.
• 3.14 Application of secure configuration management techniques.
• 3.15 Understanding of network equipment capabilities and applications, including hubs, routers, switches, bridges, servers, transmission media, and related hardware.
• 3.16 Familiarity with communication methods, principles, and concepts supporting network infrastructure.
• 3.17 Understanding of common networking protocols (e.g., Transmission Control Protocol and Internet Protocol [TCP/IP]) and services (e.g., web, mail, Domain Name System [DNS]) and their interaction in facilitating network communications.
• 3.18 Knowledge of different network communication types, including Local Area Network (LAN), Wide Area Network (WAN), Metropolitan Area Network (MAN), Wireless Local Area Network (WLAN), and Wireless Wide Area Network (WWAN).
• 3.19 Proficiency in virtualization technologies, virtual machine development, and maintenance.
• 3.20 Identification of application vulnerabilities.
• 3.21 Application of information assurance (IA) principles and methods in software development.
• 3.22 Understanding of risk threat assessment methodologies.

DOMAIN 4: INCIDENT RESPONSE

• 4.1 Understanding of incident categories, response strategies, and timelines.
• 4.2 Knowledge of disaster recovery and continuity of operations plans.
• 4.3 Familiarity with data backup types (e.g., full, incremental) and recovery concepts and tools.
• 4.4 Application of incident response and handling methodologies.
• 4.5 Utilization of security event correlation tools.
• 4.6 Insight into investigative implications of hardware, operating systems, and network technologies.
• 4.7 Understanding of processes for seizing and preserving digital evidence, including chain of custody.
• 4.8 Recognition of different types of digital forensics data.
• 4.9 Proficiency in basic concepts and practices of processing digital forensic data.
• 4.10 Awareness of anti-forensics tactics, techniques, and procedures (TTPs).
• 4.11 Familiarity with common forensic tool configuration and support applications, such as VMWare and Wireshark.
• 4.12 Application of network traffic analysis methods.
• 4.13 Identification of system files (e.g., log files, registry files, configuration files) containing relevant information and their locations.

DOMAIN 5: SECURITY OF EVOLVING TECHNOLOGY

• 5.1 Awareness of new and emerging information technology (IT) and information security technologies.
• 5.2 Understanding of emerging security issues, risks, and vulnerabilities.
• 5.3 Assessment of risks associated with mobile computing.
• 5.4 Comprehension of cloud concepts related to data and collaboration.
• 5.5 Evaluation of risks involved in migrating applications and infrastructure to the cloud.
• 5.6 Understanding of risks associated with outsourcing.
• 5.7 Familiarity with supply chain risk management processes and practices.