Cybersecurity Fundamentals Training Course

DOMAIN 1: CYBERSECURITY CONCEPTS /h3>

• 1.1 Understanding information assurance (IA) principles applied to manage risks associated with the use, processing, storage, and transmission of information or data. /li>
• 1.2 Familiarity with security management practices. /li>
• 1.3 Awareness of risk management processes, including the steps and methods used for risk assessment. /li>
• 1.4 Understanding of the organization’s enterprise information technology (IT) goals and objectives. /li>
• 1.5 Knowledge of various operational threat environments, such as first generation (script kiddies), second generation (non-nation state sponsored), and third generation (nation state sponsored) threats. /li>
• 1.6 Familiarity with information assurance (IA) principles and organizational requirements related to confidentiality, integrity, availability, authentication, and non-repudiation. /li>
• 1.7 Awareness of common adversary tactics, techniques, and procedures (TTPs) within the assigned area of responsibility, including historical country-specific TTPs and emerging capabilities. /li>
• 1.8 Understanding of different classes of attacks, such as passive, active, insider, close-in, and distribution attacks. /li>
• 1.9 Knowledge of applicable laws, policies, procedures, and governance requirements. /li>
• 1.10 Awareness of laws, policies, procedures, or governance frameworks related to work impacting critical infrastructure. /li

DOMAIN 2: CYBERSECURITY ARCHITECTURE PRINCIPLES /h3>

• 2.1 Understanding of network design processes, including security objectives, operational goals, and necessary tradeoffs. /li>
• 2.2 Familiarity with security system design methods, tools, and techniques. /li>
• 2.3 Knowledge of network access and identity/access management concepts, such as public key infrastructure (PKI). /li>
• 2.4 Awareness of information technology (IT) security principles and methods, including firewalls, demilitarized zones, and encryption. /li>
• 2.5 Understanding of current industry methods for evaluating, implementing, and disseminating IT security assessment, monitoring, detection, and remediation tools, utilizing standards-based concepts. /li>
• 2.6 Knowledge of network security architecture concepts, including topology, protocols, components, and principles, such as defence in depth. /li>
• 2.7 Familiarity with malware analysis concepts and methodology. /li>
• 2.8 Awareness of intrusion detection methodologies and techniques for identifying host- and network-based intrusions. /li>
• 2.9 Understanding of defence in depth principles and network security architecture. /li>
• 2.10 Knowledge of encryption algorithms, such as Internet Protocol Security (IPSEC), Advanced Encryption Standard (AES), and Generic Routing Encapsulation (GRE). /li>
• 2.11 Familiarity with cryptology. /li>
• 2.12 Understanding of encryption methodologies. /li>
• 2.13 Awareness of how traffic flows across the network, including Transmission Control Protocol and Internet Protocol (TCP/IP) and the Open System Interconnection model (OSI). /li>
• 2.14 Knowledge of network protocols, such as Transmission Control Protocol and Internet Protocol. /li

DOMAIN 3: SECURITY OF NETWORK, SYSTEM, APPLICATION AND DATA /h3>

• 3.1 Familiarity with computer network defence (CND) and vulnerability assessment tools, including open source options, and their capabilities. /li>
• 3.2 Understanding of basic system administration, network, and operating system hardening techniques. /li>
• 3.3 Awareness of risks associated with virtualization. /li>
• 3.4 Knowledge of penetration testing principles, tools, and techniques, such as Metasploit and Neo4j (neosploit). /li>
• 3.5 Understanding of network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools. /li>
• 3.6 Familiarity with remote access technology concepts. /li>
• 3.7 Awareness of systems administration concepts. /li>
• 3.8 Knowledge of Unix command line usage. /li>
• 3.9 Understanding of system and application security threats and vulnerabilities. /li>
• 3.10 Awareness of system lifecycle management principles, including software security and usability. /li>
• 3.11 Knowledge of local specialized system requirements, such as critical infrastructure systems that may not use standard IT for safety, performance, and reliability. /li>
• 3.12 Familiarity with system and application security threats and vulnerabilities, including buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language (PL/SQL) injections, race conditions, covert channels, replay, return-oriented attacks, and malicious code. /li>
• 3.13 Awareness of the social dynamics of computer attackers in a global context. /li>
• 3.14 Understanding of secure configuration management techniques. /li>
• 3.15 Knowledge of the capabilities and applications of network equipment, including hubs, routers, switches, bridges, servers, transmission media, and related hardware. /li>
• 3.16 Familiarity with communication methods, principles, and concepts supporting network infrastructure. /li>
• 3.17 Understanding of common networking protocols (e.g., TCP/IP) and services (e.g., web, mail, Domain Name System [DNS]) and their interaction in network communications. /li>
• 3.18 Awareness of different types of network communication, such as Local Area Network (LAN), Wide Area Network (WAN), Metropolitan Area Network (MAN), Wireless Local Area Network (WLAN), and Wireless Wide Area Network (WWAN). /li>
• 3.19 Knowledge of virtualization technologies and the development and maintenance of virtual machines. /li>
• 3.20 Familiarity with application vulnerabilities. /li>
• 3.21 Understanding of information assurance (IA) principles and methods applicable to software development. /li>
• 3.22 Awareness of risk threat assessment. /li

DOMAIN 4: INCIDENT RESPONSE /h3>

• 4.1 Knowledge of incident categories, response strategies, and timelines. /li>
• 4.2 Familiarity with disaster recovery and continuity of operations plans. /li>
• 4.3 Understanding of data backup, types of backups (e.g., full, incremental), and recovery concepts and tools. /li>
• 4.4 Awareness of incident response and handling methodologies. /li>
• 4.5 Knowledge of security event correlation tools. /li>
• 4.6 Understanding of the investigative implications of hardware, operating systems, and network technologies. /li>
• 4.7 Familiarity with processes for seizing and preserving digital evidence, such as maintaining the chain of custody. /li>
• 4.8 Knowledge of types of digital forensics data and how to identify them. /li>
• 4.9 Understanding of basic concepts and practices in processing digital forensic data. /li>
• 4.10 Awareness of anti-forensics tactics, techniques, and procedures (TTPs). /li>
• 4.11 Knowledge of common forensic tool configuration and support applications, such as VMWare and Wireshark. /li>
• 4.12 Understanding of network traffic analysis methods. /li>
• 4.13 Awareness of which system files (e.g., log files, registry files, configuration files) contain relevant information and their locations. /li

DOMAIN 5: SECURITY OF EVOLVING TECHNOLOGY /h3>

• 5.1 Knowledge of new and emerging information technology (IT) and information security technologies. /li>
• 5.2 Awareness of emerging security issues, risks, and vulnerabilities. /li>
• 5.3 Understanding of risks associated with mobile computing. /li>
• 5.4 Familiarity with cloud concepts related to data and collaboration. /li>
• 5.5 Awareness of risks involved in moving applications and infrastructure to the cloud. /li>
• 5.6 Understanding of risks associated with outsourcing. /li>
• 5.7 Knowledge of supply chain risk management processes and practices. /li