Cybersecurity Fundamentals Training Course

DOMAIN 1: CYBERSECURITY CONCEPTS

• 1.1 Understanding information assurance (IA) principles applied to managing risks associated with the use, processing, storage, and transmission of data.
• 1.2 Proficiency in security management practices.
• 1.3 Familiarity with risk management processes, including assessment steps and methodologies.
• 1.4 Awareness of the organization’s enterprise information technology (IT) goals and objectives.
• 1.5 Understanding of different operational threat environments, such as first-generation [script kiddies], second-generation [non-nation state sponsored], and third-generation [nation state sponsored] threats.
• 1.6 Knowledge of information assurance (IA) principles and organizational requirements related to confidentiality, integrity, availability, authentication, and non-repudiation.
• 1.7 Awareness of common adversary tactics, techniques, and procedures (TTPs) within the assigned area of responsibility, including historical country-specific TTPs and emerging capabilities.
• 1.8 Understanding of various attack classifications, including passive, active, insider, close-in, and distribution-based attacks.
• 1.9 Knowledge of applicable laws, policies, procedures, and governance requirements.
• 1.10 Understanding of legal, policy, and governance frameworks relevant to work impacting critical infrastructure.

DOMAIN 2: CYBERSECURITY ARCHITECTURE PRINCIPLES

• 2.1 Understanding of network design processes, including security objectives, operational goals, and associated tradeoffs.
• 2.2 Proficiency in security system design methods, tools, and techniques.
• 2.3 Knowledge of network access, identity, and access management, including public key infrastructure (PKI).
• 2.4 Understanding of information technology (IT) security principles and methods, such as firewalls, demilitarized zones, and encryption.
• 2.5 Awareness of current industry approaches for evaluating, implementing, and disseminating IT security assessment, monitoring, detection, and remediation tools and procedures using standards-based concepts.
• 2.6 Knowledge of network security architecture concepts, including topology, protocols, components, and principles, such as defence in depth.
• 2.7 Understanding of malware analysis concepts and methodologies.
• 2.8 Proficiency in intrusion detection methodologies and techniques for identifying host- and network-based intrusions using intrusion detection technologies.
• 2.9 Knowledge of defence in depth principles and network security architecture.
• 2.10 Understanding of encryption algorithms, such as internet Protocol Security (IPSEC), Advanced Encryption Standard (AES), and Generic Routing Encapsulation (GRE).
• 2.11 Knowledge of cryptology.
• 2.12 Proficiency in encryption methodologies.
• 2.13 Understanding of traffic flow across networks, including Transmission Control Protocol and Internet Protocol (ITCP/IP) and the Open System Interconnection model (OSI).
• 2.14 Knowledge of network protocols, such as Transmission Control Protocol and Internet Protocol.

DOMAIN 3: SECURITY OF NETWORK, SYSTEM, APPLICATION AND DATA

• 3.1 Understanding of computer network defence (CND) and vulnerability assessment tools, including open-source options, and their capabilities.
• 3.2 Proficiency in basic system administration, network, and operating system hardening techniques.
• 3.3 Awareness of risks associated with virtualization.
• 3.4 Knowledge of penetration testing principles, tools, and techniques, such as metasploit and neosploit.
• 3.5 Understanding of network systems management principles, models, methods (e.g., end-to-end performance monitoring), and tools.
• 3.6 Knowledge of remote access technology concepts.
• 3.7 Understanding of systems administration concepts.
• 3.8 Proficiency in the Unix command line.
• 3.9 Awareness of system and application security threats and vulnerabilities.
• 3.10 Knowledge of system lifecycle management principles, including software security and usability.
• 3.11 Understanding of local specialized system requirements for safety, performance, and reliability, such as critical infrastructure systems that may not use standard information technology (IT).
• 3.12 Knowledge of specific system and application security threats and vulnerabilities, including buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language (PL/SQL) injections, race conditions, covert channels, replay attacks, return-oriented attacks, and malicious code.
• 3.13 Awareness of the social dynamics of computer attackers in a global context.
• 3.14 Proficiency in secure configuration management techniques.
• 3.15 Knowledge of network equipment capabilities and applications, including hubs, routers, switches, bridges, servers, transmission media, and related hardware.
• 3.16 Understanding of communication methods, principles, and concepts supporting network infrastructure.
• 3.17 Knowledge of common networking protocols (e.g., Transmission Control Protocol and Internet Protocol [TCP/IP]) and services (e.g., web, mail, Domain Name System [DNS]) and their interaction to enable network communications.
• 3.18 Understanding of different types of network communication, including Local Area Network (LAN), Wide Area Network (WAN), Metropolitan Area Network (MAN), Wireless Local Area Network (WLAN), and Wireless Wide Area Network (WWAN).
• 3.19 Knowledge of virtualization technologies, including virtual machine development and maintenance.
• 3.20 Awareness of application vulnerabilities.
• 3.21 Understanding of information assurance (IA) principles and methods applicable to software development.
• 3.22 Knowledge of risk and threat assessment.

DOMAIN 4: INCIDENT RESPONSE

• 4.1 Understanding of incident categories, response strategies, and timelines.
• 4.2 Knowledge of disaster recovery and continuity of operations plans.
• 4.3 Proficiency in data backup types (e.g., full, incremental), recovery concepts, and tools.
• 4.4 Understanding of incident response and handling methodologies.
• 4.5 Knowledge of security event correlation tools.
• 4.6 Awareness of the investigative implications of hardware, operating systems, and network technologies.
• 4.7 Knowledge of processes for seizing and preserving digital evidence, including chain of custody.
• 4.8 Understanding of different types of digital forensics data and how to identify them.
• 4.9 Knowledge of basic concepts and practices for processing digital forensic data.
• 4.10 Awareness of anti-forensics tactics, techniques, and procedures (TTPS).
• 4.11 Proficiency in configuring and supporting common forensic tools and applications, such as VMWare and Wireshark.
• 4.12 Understanding of network traffic analysis methods.
• 4.13 Knowledge of which system files (e.g., log, registry, and configuration files) contain relevant information and their locations.

DOMAIN 5: SECURITY OF EVOLVING TECHNOLOGY

• 5.1 Awareness of new and emerging information technology (IT) and information security technologies.
• 5.2 Knowledge of emerging security issues, risks, and vulnerabilities.
• 5.3 Understanding of risks associated with mobile computing.
• 5.4 Knowledge of cloud concepts related to data and collaboration.
• 5.5 Awareness of risks involved in migrating applications and infrastructure to the cloud.
• 5.6 Understanding of risks associated with outsourcing.
• 5.7 Knowledge of supply chain risk management processes and practices.