General Security Concepts
- Types of security controls: technical, managerial, operational and physical; preventive, deterrent, detective, corrective, compensating and directive
- Fundamental concepts: confidentiality, integrity and availability, non-repudiation, AAA, gap analysis, Zero Trust, physical security, deception technologies such as honeypots
- Change management and its importance for security
- Cryptographic solutions: PKI and certificates, encryption, TPM and HSM, hashing and salting, digital signatures, obfuscation, blockchain
Threats, Vulnerabilities and Mitigations
- Threat actors and their motivations
- Attack vectors and attack surfaces, including social engineering
- Vulnerabilities in applications, operating systems, hardware, virtualisation, cloud, the supply chain and mobile devices, misconfigurations and zero-day flaws
- Recognising indicators of malicious activity: malware, physical attacks, network, application, cryptographic and password attacks
- Enterprise mitigations: segmentation, access control, allow listing, isolation, patching, encryption, monitoring, least privilege and hardening
Security Architecture
- Security implications of architecture models: cloud and infrastructure as code, serverless, microservices, on-premises, virtualisation, IoT, ICS/SCADA and embedded systems
- Securing enterprise infrastructure: security zones, device placement, firewalls, IDS/IPS, proxies, secure remote access, SD-WAN and SASE
- Protecting data: data types and classification, data states, data sovereignty, encryption, hashing, masking and tokenisation
- Resilience and recovery: high availability, site considerations, capacity planning, testing, backups and power
Security Operations
- Secure baselines and hardening of servers, endpoints, mobile devices and Wi-Fi, application security
- Managing hardware, software and data assets through to secure disposal
- Vulnerability management: identifying, analysing and prioritising, remediating, validating and reporting
- Alerting and monitoring: log aggregation, SIEM, SCAP, NetFlow, DLP
- Configuring security features: firewall and IDS/IPS rules, web filters, email security with SPF, DKIM and DMARC, EDR/XDR, behavioural analysis
- Identity and access management: provisioning, federation and single sign-on, access control models, multifactor authentication, privileged access management
- Automation and orchestration in security operations
- Incident response: process, exercises, root cause analysis, threat hunting and digital forensics; using data sources for investigations
Security Program Management and Oversight
- Security governance: policies, standards, procedures, roles and responsibilities
- Risk management: identification, assessment and analysis, risk register, risk appetite, business impact analysis
- Third-party risk: evaluating and selecting vendors, agreements, monitoring
- Compliance: reporting, consequences of non-compliance, monitoring, data privacy
- Audits and assessments, including penetration testing
- Security awareness: phishing simulations, recognising anomalous behaviour, training and effectiveness reviews
