Cybersecurity Fundamentals Training Course

DOMAIN 1: CYBERSECURITY CONCEPTS

• 1.1 Understanding information assurance (IA) principles applied to managing risks associated with the use, processing, storage, and transmission of information or data.
• 1.2 Familiarity with security management practices.
• 1.3 Awareness of risk management processes, including the steps and methods for assessing risk.
• 1.4 Knowledge of the organization’s enterprise information technology (IT) goals and objectives.
• 1.5 Understanding of various operational threat environments, such as first-generation (script kiddies), second-generation (non-nation state sponsored), and third-generation (nation state sponsored) threats.
• 1.6 Grasp of information assurance (IA) principles and organizational requirements pertaining to confidentiality, integrity, availability, authentication, and non-repudiation.
• 1.7 Knowledge of common adversary tactics, techniques, and procedures (TTPs) within assigned areas of responsibility, including historical country-specific TTPs and emerging capabilities.
• 1.8 Understanding of different attack classifications, such as passive, active, insider, close-in, and distribution attacks.
• 1.9 Familiarity with relevant laws, policies, procedures, and governance requirements.
• 1.10 Understanding of laws, policies, procedures, or governance standards related to work impacting critical infrastructure.

DOMAIN 2: CYBERSECURITY ARCHITECTURE PRINCIPLES

• 2.1 Knowledge of network design processes, including an understanding of security objectives, operational goals, and associated trade-offs.
• 2.2 Familiarity with security system design methods, tools, and techniques.
• 2.3 Understanding of network access, identity, and access management, including public key infrastructure (PKI).
• 2.4 Knowledge of information technology (IT) security principles and methods, such as firewalls, demilitarized zones, and encryption.
• 2.5 Awareness of current industry methods for evaluating, implementing, and distributing IT security assessment, monitoring, detection, and remediation tools and procedures, utilizing standards-based concepts and capabilities.
• 2.6 Understanding of network security architecture concepts, including topology, protocols, components, and principles, such as the application of defense in depth.
• 2.7 Knowledge of malware analysis concepts and methodologies.
• 2.8 Familiarity with intrusion detection methodologies and techniques for identifying host- and network-based intrusions using intrusion detection technologies.
• 2.9 Understanding of defense in depth principles and network security architecture.
• 2.10 Knowledge of encryption algorithms, such as Internet Protocol Security (IPSEC), Advanced Encryption Standard (AES), and Generic Routing Encapsulation (GRE).
• 2.11 Familiarity with cryptology.
• 2.12 Understanding of encryption methodologies.
• 2.13 Knowledge of traffic flow across networks, including Transmission Control Protocol and Internet Protocol (TCP/IP) and the Open System Interconnection model (OSI).
• 2.14 Awareness of network protocols, such as Transmission Control Protocol and Internet Protocol.

DOMAIN 3: SECURITY OF NETWORK, SYSTEM, APPLICATION AND DATA

• 3.1 Knowledge of computer network defense (CND) and vulnerability assessment tools, including open-source options, and their capabilities.
• 3.2 Familiarity with basic system administration, network, and operating system hardening techniques.
• 3.3 Understanding of risks associated with virtualization.
• 3.4 Knowledge of penetration testing principles, tools, and techniques, such as Metasploit and NeoSploit.
• 3.5 Awareness of network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.
• 3.6 Understanding of remote access technology concepts.
• 3.7 Familiarity with systems administration concepts.
• 3.8 Knowledge of the Unix command line.
• 3.9 Understanding of system and application security threats and vulnerabilities.
• 3.10 Awareness of system lifecycle management principles, including software security and usability.
• 3.11 Knowledge of local specialized system requirements, such as critical infrastructure systems that may not utilize standard information technology (IT), for safety, performance, and reliability.
• 3.12 Understanding of system and application security threats and vulnerabilities, including buffer overflows, mobile code, cross-site scripting, Procedural Language/Structured Query Language (PL/SQL) and injections, race conditions, covert channels, replay attacks, return-oriented attacks, and malicious code.
• 3.13 Awareness of the social dynamics of computer attackers in a global context.
• 3.14 Knowledge of secure configuration management techniques.
• 3.15 Understanding of the capabilities and applications of network equipment, including hubs, routers, switches, bridges, servers, transmission media, and related hardware.
• 3.16 Familiarity with communication methods, principles, and concepts supporting network infrastructure.
• 3.17 Knowledge of common networking protocols, such as Transmission Control Protocol and Internet Protocol (TCP/IP), and services like web, mail, and Domain Name System (DNS), and how they interact to facilitate network communications.
• 3.18 Understanding of various types of network communication, including Local Area Network (LAN), Wide Area Network (WAN), Metropolitan Area Network (MAN), Wireless Local Area Network (WLAN), and Wireless Wide Area Network (WWAN).
• 3.19 Knowledge of virtualization technologies and virtual machine development and maintenance.
• 3.20 Awareness of application vulnerabilities.
• 3.21 Understanding of information assurance (IA) principles and methods applicable to software development.
• 3.22 Knowledge of risk and threat assessment.

DOMAIN 4: INCIDENT RESPONSE

• 4.1 Understanding of incident categories, response strategies, and response timelines.
• 4.2 Familiarity with disaster recovery and continuity of operations plans.
• 4.3 Knowledge of data backup, types of backups (e.g., full, incremental), and recovery concepts and tools.
• 4.4 Awareness of incident response and handling methodologies.
• 4.5 Understanding of security event correlation tools.
• 4.6 Knowledge of the investigative implications of hardware, operating systems, and network technologies.
• 4.7 Familiarity with processes for seizing and preserving digital evidence, including chain of custody.
• 4.8 Understanding of types of digital forensics data and how to identify them.
• 4.9 Knowledge of basic concepts and practices for processing digital forensic data.
• 4.10 Awareness of anti-forensics tactics, techniques, and procedures (TTPs).
• 4.11 Knowledge of common forensic tool configuration and support applications, such as VMware and Wireshark.
• 4.12 Understanding of network traffic analysis methods.
• 4.13 Knowledge of system files containing relevant information, such as log files, registry files, and configuration files, and how to locate them.

DOMAIN 5: SECURITY OF EVOLVING TECHNOLOGY

• 5.1 Awareness of new and emerging information technology (IT) and information security technologies.
• 5.2 Understanding of emerging security issues, risks, and vulnerabilities.
• 5.3 Knowledge of risks associated with mobile computing.
• 5.4 Familiarity with cloud concepts regarding data and collaboration.
• 5.5 Understanding of risks associated with migrating applications and infrastructure to the cloud.
• 5.6 Awareness of risks associated with outsourcing.
• 5.7 Knowledge of supply chain risk management processes and practices.