1. Cyber Security Concepts

Cyber Security Concepts

• Defining cyber security
• Cyber security triad
• Cyber security landscape
• Defining assets, threats, vulnerabilities, likelihood, consequence, and risk

Cyber Security Strategy

• Business Strategy
• Governance, Risk Management and Compliance (GRC)
• Cyber Security Policy Framework
• Education, Training, and Awareness

Laws & Regulations

• Privacy laws and principles
• International data protection legislation
• Privacy Impact Assessment (PIA)
• Cyber Crime Law
• Regulations and corporate industry requirements for Directors
• Intellectual property, issues, and attacks

Standards & Frameworks

• ISO/IEC 27001
• NIST Cybersecurity Framework
• Payment Card Industry Data Security Standard (PCI DSS)

Roles & Responsibilities

• Organisational structure
• Ethics

Knowledge Check

• Introduction to the Case Study
• Practical session:
  • Exercise #1 – Development of a cyber asset register

2. Risk Management

Risk Management Concepts and Definitions

• Various states of risk (inherent, current, residual)
• Specialised risk topics (systemic, systematic, aggregation)
• Risk Appetite and Tolerance
• ISO/IEC 31000 Risk Management Process
• Risk Assessment – Identification, Analysis, and Evaluation
• Risk Treatment
• Risk Register and Risk Treatment Plan
• Risk Monitoring Metrics

Risk Management Threats and Opportunities

• Evolution of the Threat Landscape
• Advanced Persistent Threats
• Lockheed Martin Cyber Kill Chain®
• Developing a threat taxonomy
• Threat characteristics
• Common types of malicious software
• Common malware attack methods
• Surface Web, Deep Wen, and Dark Web
• Social Engineering Attacks
• Applets
• Bring Your Own Device
• The Internet of Things

Controls and Enablers
Defence-in-Depth Controls
CERT NZ Critical Controls
ACSC Essential Eight

• Strategies to mitigate Targeted Cyber Intrusions
• The Essential Eight
• The Essential Eight Maturity Model

Knowledge Check

• Practical session:
  • Exercise #2.1 – Development of a threat taxonomy and identification of vulnerabilities
  • Exercise #2.2 – Evaluate current controls and current risk level

3. Security Architecture

Security Architecture Concepts and Definitions

• Security Architecture Frameworks – SABSA and TOGAF
• Security Architecture Design Principles – Viega & McGraw, and Saltzer & Schroeder

Certification and Accreditation

• Evaluation Standards – Common Criteria, TCSEC, ITSEC, CTCPEC
• Common Criteria – Evaluation Assurance Levels
• Internet Engineering Task Force
• FIPS Standards for Encryption
• FIPS 140-3

Service Models

• Insourcing, outsourcing, and managed services
• Single provider, multiple providers, and prime provider

Cloud Computing

• Characteristics of Cloud Computing
• Cloud Computing Building Blocks
• Cloud Service Models
• Cloud Deployment Models
• Shared Responsibility Model
• Cloud Vulnerabilities and Risks
• Server Virtualisation – Benefits and Security Issues
• Storage Virtualisation
• Cloud Access Security Brokers
• Assessing Cloud Environments
• Cloud Security Alliance Pandemic Eleven

Cryptography

• Symmetric algorithms
• Asymmetric algorithms
• Hashing algorithms
• Message Authentication Code
• Digital Signatures

Emerging Technologies

• Artificial Intelligence
• Internet of Things
• Quantum Computing
• BlockChain

Knowledge Check

• Practical session:
  • Exercise #3 – Recommendations for service provider models in addressing risks
  • Exercise #4.1 – Identify the challenges associated with using cloud solutions
  • Exercise #4.2 – Identify security architecture design principles

4. Physical Security

Perimeter Security

• Fences, gates and bollards
• Guards, dogs and lighting
• CCTV

Building Security

• Lock grades and key types
• Lock picking, bump keys and bump guns
• Adjacent buildings and shared tenancy
• Demarcation issues
• Server rooms and storage
• Doors, windows, and walls
• Local crime
• Access control cards
• RFID Tags
• Contraband checks

Physical Access Control

• Tailgating
• Mantraps
• Turnstiles
• Dumpster diving
• Motion detectors

Environmental Controls

• Electricity
• Emergency power
• Electromagnetic interference
• HVAC for environmental control
• Fire Suppression Agents
• Sprinkler Systems

Knowledge Check

5. Network Security

Network Fundamentals

• OSI Model
• TCP/IP Model – Original and Updated
• Encapsulation and De-encapsulation
• Port numbers and TCP/UDP flags
• TCP three-way handshake
• Voice over IP (VoIP)
• Domain Name System (DNS)
• IP Addressing – Classful, Classless, RFC1918
• IP Masquerading and Network Address Translation
• IP version 4 and IP version 6
• Network Topologies
• Network Security Zones
• Zero Trust Networks

Network Security

• Firewalls
• Firewall Designs
• Firewall Implementation Issues
• Intrusion Detection and Prevention Systems (IDPS)
• Secure Email Gateway (SEG)
• Secure Web Gateway (SWG)
• Data Loss Prevention (DLP)
• Public Key Infrastructure (PKI)
• IEE 802.1x Extensible Authentication Protocol (EAP)
• Remote Authentication Dial-in User Service (RADIUS)
• Internet Protocol Security (IPSec)

Knowledge Check

6. Endpoint Security

Endpoint Security

• Servers, desktops, laptops, tablets, mobile devices, wearables
• Endpoint Detection and Response (EDR)
• Extended Detection and Response (XDR)
• Specialised Endpoint Systems

Application Security

• Systems Development Life Cycle
• OWASP Top 10
• STRIDE Threat Modelling
• DREAD Threat Modelling
• Web Application Firewall
• Database Activity Monitor

Data Security

• Data ownership roles and responsibilities
• Data classification and labelling
• Authentication, Authorisation and Accounting (AAA)
• Access control
• Privileged Access Management (PAM)
• Access control models and implementation
• Data governance and lifecycle
• Data remanence

Knowledge Check

• Practical session:
  • Exercise #5.1 – Complete the risk assessment from exercise 2 by recommending controls
  • Exercise #5.2 – Create a data classification scheme

7. Incident Response

Incident Response Management

• Security logging
• Security Information and Event Management (SIEM)
• Security Orchestration Automation & Response (SOAR)
• Security events and incidents
• Incident Response Methodology using NIST SP800-61

Business Continuity and Disaster Recovery

• Business Continuity Planning
• Disaster Recovery Planning
• Standards and Frameworks
• NIST SP800-34
• Business Continuity Institute Good Practice Guide

Digital Forensics

• General phases of the forensic process
• Digital forensics challenges
• Anti-forensics
• Forensic media analysis
• Network forensics
• Embedded device forensics
• eDiscovery

Security Assurance

• Configuration management
• Minimum Security Baselines
• Security Audits
• Security Assessments
• Security Testing
• Vulnerability Assessments
• Penetration Testing

Knowledge Check

• Practical session:
  • Exercise #6 – Identify and rank the three most important business operations
  • Exercise #7 – Examination of insourcing or using a managed service for incident response
• Mock Exam – 2 hours
• Final exam study and preparation
• Final Exam – 2 hours