Cybersecurity Fundamentals Training Course

DOMAIN 1: CYBERSECURITY FOUNDATIONS

• 1.1 Understanding information assurance (IA) principles for managing risks associated with the use, processing, storage, and transmission of information or data.
• 1.2 Understanding security management principles.
• 1.3 Familiarity with risk management processes, including the steps and methods involved in risk assessment.
• 1.4 Awareness of the organization's enterprise information technology (IT) goals and objectives.
• 1.5 Understanding of various operational threat environments (e.g., first-generation [script kiddies], second-generation [non-nation state-sponsored], and third-generation [nation state-sponsored]).
• 1.6 Understanding information assurance (IA) principles and organizational requirements relevant to confidentiality, integrity, availability, authentication, and non-repudiation.
• 1.7 Understanding common adversary tactics, techniques, and procedures (TTPs) within assigned areas of responsibility (e.g., historical country-specific TTPs, emerging capabilities).
• 1.8 Understanding different categories of attacks (e.g., passive, active, insider, close-in, and distribution).
• 1.9 Familiarity with applicable laws, policies, procedures, and governance requirements.
• 1.10 Familiarity with laws, policies, procedures, or governance frameworks related to work impacting critical infrastructure.

DOMAIN 2: CYBERSECURITY ARCHITECTURE PRINCIPLES

• 2.1 Understanding network design processes, including security objectives, operational goals, and associated trade-offs.
• 2.2 Understanding methods, tools, and techniques for security system design.
• 2.3 Understanding network access, identity, and access management (e.g., public key infrastructure [PKI]).
• 2.4 Understanding information technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, encryption).
• 2.5 Understanding current industry methods for evaluating, implementing, and disseminating IT security assessment, monitoring, detection, and remediation tools and procedures, utilizing standards-based concepts and capabilities.
• 2.6 Understanding network security architecture concepts, including topology, protocols, components, and principles (e.g., application of defense in depth).
• 2.7 Understanding concepts and methodologies for malware analysis.
• 2.8 Understanding intrusion detection methodologies and techniques for identifying host- and network-based intrusions using intrusion detection technologies.
• 2.9 Understanding defense in depth principles and network security architecture.
• 2.10 Understanding encryption algorithms (e.g., Internet Protocol Security [IPSEC], Advanced Encryption Standard [AES], Generic Routing Encapsulation [GRE]).
• 2.11 Understanding cryptology.
• 2.12 Understanding encryption methodologies.
• 2.13 Understanding how traffic flows across the network (e.g., Transmission Control Protocol and Internet Protocol [ITCP/IP], Open System Interconnection model [OSI]).
• 2.14 Understanding network protocols (e.g., Transmission Control Protocol and Internet Protocol).

DOMAIN 3: SECURITY OF NETWORK, SYSTEM, APPLICATION AND DATA

• 3.1 Understanding computer network defense (CND) and vulnerability assessment tools, including open-source options, and their capabilities.
• 3.2 Understanding basic system administration, network, and operating system hardening techniques.
• 3.3 Understanding risks associated with virtualization.
• 3.4 Understanding principles, tools, and techniques for penetration testing (e.g., metasploit, neosploit).
• 3.5 Understanding network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.
• 3.6 Understanding concepts related to remote access technology.
• 3.7 Understanding systems administration concepts.
• 3.8 Familiarity with Unix command-line operations.
• 3.9 Understanding security threats and vulnerabilities affecting systems and applications.
• 3.10 Understanding principles of system lifecycle management, including software security and usability.
• 3.11 Understanding local specialized system requirements (e.g., critical infrastructure systems that may not use standard information technology [IT]) for safety, performance, and reliability.
• 3.12 Understanding system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channels, replay, return-oriented attacks, and malicious code).
• 3.13 Understanding the social dynamics of computer attackers in a global context.
• 3.14 Understanding secure configuration management techniques.
• 3.15 Understanding the capabilities and applications of network equipment, including hubs, routers, switches, bridges, servers, transmission media, and related hardware.
• 3.16 Understanding communication methods, principles, and concepts supporting network infrastructure.
• 3.17 Understanding common networking protocols (e.g., Transmission Control Protocol and Internet Protocol [TCP/IP]) and services (e.g., web, mail, Domain Name System [DNS]) and their interaction to provide network communications.
• 3.18 Understanding different types of network communication (e.g., Local Area Network [LAN], Wide Area Network [WAN], Metropolitan Area Network [MAN], Wireless Local Area Network [WLAN], and Wireless Wide Area Network [WWAN]).
• 3.19 Understanding virtualization technologies and the development and maintenance of virtual machines.
• 3.20 Understanding application vulnerabilities.
• 3.21 Understanding information assurance (IA) principles and methods applicable to software development.
• 3.22 Understanding risk and threat assessment.

DOMAIN 4: INCIDENT RESPONSE

• 4.1 Understanding incident categories, response protocols, and timelines for action.
• 4.2 Understanding disaster recovery and continuity of operations plans.
• 4.3 Understanding data backup, types of backups (e.g., full, incremental), and recovery concepts and tools.
• 4.4 Understanding incident response and handling methodologies.
• 4.5 Understanding security event correlation tools.
• 4.6 Understanding the investigative implications of hardware, operating systems, and network technologies.
• 4.7 Understanding processes for seizing and preserving digital evidence (e.g., chain of custody).
• 4.8 Understanding types of digital forensics data and how to identify them.
• 4.9 Understanding basic concepts and practices for processing digital forensic data.
• 4.10 Understanding anti-forensics tactics, techniques, and procedures (TTPS).
• 4.11 Understanding common forensic tool configurations and support applications (e.g., VMWare, Wireshark).
• 4.12 Understanding network traffic analysis methods.
• 4.13 Understanding which system files (e.g., log files, registry files, configuration files) contain relevant information and their locations.

DOMAIN 5: SECURITY OF EVOLVING TECHNOLOGY

• 5.1 Understanding new and emerging information technology (IT) and information security technologies.
• 5.2 Understanding emerging security issues, risks, and vulnerabilities.
• 5.3 Understanding risks associated with mobile computing.
• 5.4 Understanding cloud concepts related to data and collaboration.
• 5.5 Understanding risks associated with migrating applications and infrastructure to the cloud.
• 5.6 Understanding risks associated with outsourcing.
• 5.7 Understanding supply chain risk management processes and practices.