1.1. Define essential security principles.

• Vulnerabilities, threats, exploits and risks; attack vectors; hardening; defense in depth; confidentiality, integrity and availability (CIA); types of attackers; reasons for attacks; code of ethics.

   1.2. Explain common threats and vulnerabilities.

• Malware, ransomware, denial of service, botnets, social engineering attacks (sneaking, spear phishing, phishing, vishing, smishing, etc.), physical attacks, man in the middle, IoT vulnerabilities, insider threats, Advanced Persistent Threat (APT) ).

   1.3. Explain the principles of access management.

• Authentication, Authorization and Accounting (AAA); RADIUS; multi-factor authentication (MFA); password policies.

   1.4. Explain encryption methods and applications

• Types of encryption, hashing, certificates, public key infrastructure (PKI); Strong vs. Strong Encryption Algorithms weak; data states and appropriate encryption (data in transit, data at rest, data in use); protocols that use encryption.

2.1. Describe vulnerabilities in the TCP/IP protocol.

• TCP, UDP, HTTP, ARP, ICMP, DHCP, DNS.

   2.2. Explain how network addresses affect network security.

• IPv4 and IPv6 addresses, MAC addresses, network segmentation, CIDR notation, NAT, public networks vs. private.

   23. Describe network infrastructure and technologies.

• Network security architecture, DMZ, virtualization, cloud, honeypot, proxy server, IDS, IPS.

   2.4. Set up a secure wireless SoHo network.

• MAC address filtering, encryption standards and protocols, SSID.

   2.5. Implement secure access technologies.

• ACL, firewall, VPN, NAC.

   3.1. Describe operating system security concepts.

• Windows, macOS and Linux; security features, including Windows Defender and host-based firewalls; CLI and PowerShell; file and directory permissions; escalation of privileges.

   3.2. Demonstrate familiarity with appropriate endpoint tools that collect security assessment information.

• Netstat, nslookup, tcpdump,

   3.3. Verify that endpoint systems comply with security policies and standards.

• Hardware inventory (asset management), software inventory, program deployment, data backups, regulatory compliance (PCI DSS, HIPAA, GDPR), BYOD (device management, data encryption, application distribution, device management setting).

   3.4. Implement software and hardware updates.

• Windows updates, application updates, device drivers, firmware, patches.

   3.5. Interpret system logs.

• Event viewer, audit logs, system and application logs, syslog, anomaly identification.

   3.6. Demonstrate familiarity with malware removal.

• System scanning, scan log review, malware remediation.

   4.1. Explain vulnerability management.

• Identification, management and mitigation of vulnerabilities; active and passive recognition; testing (port scanning, automation).

   4.2. Use threat intelligence techniques to identify potential network vulnerabilities.

• Uses and limitations of vulnerability databases; industry standard tools used to assess vulnerabilities and make recommendations, policies and reports; Common Vulnerabilities and Exposures (CVE), cybersecurity reports, cybersecurity news, subscription services and collective intelligence; ad hoc and automated threat intelligence; the importance of proactively updating documentation and other forms of communication before, during and after cybersecurity incidents; how to secure, share and update documentation.

   4.3. Explain risk management.

• Vulnerability vs. risk, risk classification, approaches to risk management, risk mitigation strategies, risk levels (low, medium, high, extremely high), risks associated with specific types of data and data classifications, system security assessments IT (information security, change management, computer operations, information assurance).

   4.4. Explain the importance of disaster recovery and business continuity planning.

• Natural and human-caused disasters, characteristics of disaster recovery plans (DRP) and business continuity plans (BCP), backups, disaster recovery controls (detective, preventive and corrective).

   5.1. Monitor security events and know when escalation is necessary.

• Role of SIEM and SOAR, monitoring network data to identify security incidents (packet captures, various log file entries, etc.), identifying suspicious events as they occur.

   5.2. Explain computer forensics processes and attack attribution.

• Cyber Attack Chain, MITER ATT&CK Matrix and Diamond Model; Tactics, Techniques and Procedures (TTP); sources of evidence (artifacts); evidence manipulation (preservation of digital evidence, chain of custody).

   5.3. Explain the impact of compliance frameworks on security incident handling.

• Compliance frameworks (GDPR, HIPAA, PCI DSS, FERPA, FISMA), reporting and notification requirements.

   5.4. Describe the elements of cybersecurity incident response.

• Elements of policies, plans and procedures; stages of the incident response life cycle (NIST Special Publication 800-61 sections 2.3, 3.1-3.4).