Cybersecurity Fundamentals Training Course

DOMAIN 1: CYBERSECURITY CONCEPTS

• 1.1 Understanding information assurance (IA) principles utilized to manage risks associated with the use, processing, storage, and transmission of data.
• 1.2 Insight into security management practices.
• 1.3 Familiarity with risk management processes, including assessment steps and methodologies.
• 1.4 Awareness of the organization’s enterprise IT goals and strategic objectives.
• 1.5 Understanding of various operational threat environments (e.g., first-generation [script kiddies], second-generation [non-nation-state sponsored], and third-generation [nation-state sponsored]).
• 1.6 Knowledge of IA principles and organizational requirements related to confidentiality, integrity, availability, authentication, and non-repudiation.
• 1.7 Understanding of common adversary tactics, techniques, and procedures (TTPs) within specific areas of responsibility (e.g., historical country-specific TTPs, emerging capabilities).
• 1.8 Awareness of different attack classifications (e.g., passive, active, insider, close-in, distribution).
• 1.9 Knowledge of applicable laws, policies, procedures, and governance requirements.
• 1.10 Understanding of laws, policies, and governance frameworks related to work impacting critical infrastructure.

DOMAIN 2: CYBERSECURITY ARCHITECTURE PRINCIPLES

• 2.1 Understanding network design processes, including security objectives, operational goals, and trade-offs.
• 2.2 Knowledge of security system design methods, tools, and techniques.
• 2.3 Insight into network access, identity, and access management (e.g., Public Key Infrastructure [PKI]).
• 2.4 Understanding IT security principles and methods (e.g., firewalls, demilitarized zones, encryption).
• 2.5 Familiarity with current industry standards for evaluating, implementing, and distributing IT security assessment, monitoring, detection, and remediation tools and procedures.
• 2.6 Knowledge of network security architecture concepts, including topology, protocols, components, and principles (e.g., application of defense in depth).
• 2.7 Understanding of malware analysis concepts and methodologies.
• 2.8 Knowledge of intrusion detection methods and techniques for identifying host- and network-based intrusions using detection technologies.
• 2.9 Familiarity with defense in depth principles and network security architecture.
• 2.10 Knowledge of encryption algorithms (e.g., Internet Protocol Security [IPSEC], Advanced Encryption Standard [AES], Generic Routing Encapsulation [GRE]).
• 2.11 Understanding of cryptology.
• 2.12 Knowledge of encryption methodologies.
• 2.13 Awareness of traffic flow across networks (e.g., Transmission Control Protocol and Internet Protocol [TCP/IP], Open Systems Interconnection model [OSI]).
• 2.14 Knowledge of network protocols (e.g., Transmission Control Protocol and Internet Protocol).

DOMAIN 3: SECURITY OF NETWORK, SYSTEM, APPLICATION AND DATA

• 3.1 Understanding of computer network defense (CND) and vulnerability assessment tools, including open-source options, and their capabilities.
• 3.2 Knowledge of basic system administration, network, and operating system hardening techniques.
• 3.3 Awareness of risks associated with virtualization.
• 3.4 Understanding of penetration testing principles, tools, and techniques (e.g., metasploit, neosploit).
• 3.5 Knowledge of network systems management principles, models, methods (e.g., end-to-end performance monitoring), and tools.
• 3.6 Insight into remote access technology concepts.
• 3.7 Understanding of systems administration concepts.
• 3.8 Familiarity with Unix command line operations.
• 3.9 Knowledge of system and application security threats and vulnerabilities.
• 3.10 Understanding of system lifecycle management principles, including software security and usability.
• 3.11 Awareness of local specialized system requirements (e.g., critical infrastructure systems using non-standard IT) for safety, performance, and reliability.
• 3.12 Knowledge of specific system and application threats (e.g., buffer overflow, mobile code, cross-site scripting, PL/SQL injections, race conditions, covert channels, replay, return-oriented attacks, malicious code).
• 3.13 Understanding of the social dynamics of computer attackers in a global context.
• 3.14 Knowledge of secure configuration management techniques.
• 3.15 Familiarity with the capabilities and applications of network equipment such as hubs, routers, switches, bridges, servers, transmission media, and related hardware.
• 3.16 Understanding of communication methods, principles, and concepts supporting network infrastructure.
• 3.17 Knowledge of common networking protocols (e.g., TCP/IP) and services (e.g., web, mail, DNS) and their interaction to enable network communication.
• 3.18 Awareness of various network communication types (e.g., LAN, WAN, MAN, WLAN, WWAN).
• 3.19 Understanding of virtualization technologies and virtual machine development and maintenance.
• 3.20 Knowledge of application vulnerabilities.
• 3.21 Understanding of IA principles and methods applicable to software development.
• 3.22 Knowledge of risk threat assessment.

DOMAIN 4: INCIDENT RESPONSE

• 4.1 Understanding of incident categories, response strategies, and response timelines.
• 4.2 Knowledge of disaster recovery and business continuity plans.
• 4.3 Understanding of data backup types (e.g., full, incremental), recovery concepts, and tools.
• 4.4 Familiarity with incident response and handling methodologies.
• 4.5 Knowledge of security event correlation tools.
• 4.6 Awareness of the investigative implications of hardware, operating systems, and network technologies.
• 4.7 Understanding of processes for seizing and preserving digital evidence (e.g., chain of custody).
• 4.8 Knowledge of digital forensics data types and methods for recognizing them.
• 4.9 Understanding of basic concepts and practices for processing digital forensic data.
• 4.10 Knowledge of anti-forensics tactics, techniques, and procedures (TTPs).
• 4.11 Familiarity with common forensic tool configuration and support applications (e.g., VMWare, Wireshark).
• 4.12 Knowledge of network traffic analysis methods.
• 4.13 Understanding of which system files (e.g., logs, registry, configuration) contain relevant data and where to locate them.

DOMAIN 5: SECURITY OF EVOLVING TECHNOLOGY

• 5.1 Awareness of new and emerging IT and information security technologies.
• 5.2 Understanding of emerging security issues, risks, and vulnerabilities.
• 5.3 Knowledge of risks associated with mobile computing.
• 5.4 Understanding of cloud concepts related to data and collaboration.
• 5.5 Awareness of risks associated with migrating applications and infrastructure to the cloud.
• 5.6 Understanding of risks associated with outsourcing.
• 5.7 Knowledge of supply chain risk management processes and practices.