IT Specialist Cybersecurity (INF-105) Pearson Course

Security Principles

• 1.1 Explain common security principles.
  • Hardening; defense-in-depth; confidentiality, integrity, and availability (CIA); code of ethics; Zero Trust security; privacy (including AI use cases); data classification and retention policies; security governance
• Explain cybersecurity frameworks and industry-accepted best practices.
  • NIST Cybersecurity Framework, ISO/IEC 2700, CIS Critical Security Controls
• Explain vulnerabilities, threats, and common attacks.
  • Vulnerabilities, threats, exploits, and risks; types of attackers; reasons for attacks; attack vectors
  • Types of attacks: Malware, brute force, website and application attacks (SQL injection and buffer overflow), privilege escalation, ransomware, denial of service/DDoS, botnets, physical attacks, man-in-the-middle, IoT vulnerabilities, insider threats, Advanced Persistent Threat (APT), spoofing
• Recognize social engineering attacks.
  • Tailgating and impersonation
  • Spear phishing, phishing, vishing, smishing, whaling, watering holes, pharming, etc.
  • Malicious redirection (QR codes, shortened URLs, and fake websites)
  • Increased attack sophistication due to the use of AI and bots
• Explain access management principles and procedures.
  • Authentication, authorization, and accounting (AAA); RADIUS; methods of multifactor authentication (MFA); password policies; biometric authentication; cloud-based resource sharing
• Explain how encryption protects the confidentiality and integrity of data.
  • Asymmetric and symmetric encryption; hashing; certificates; public key infrastructure (PKI); strong vs. weak encryption algorithms; encryption used for data in transit, data at rest, and data in use

Securing the Network

• Identify vulnerabilities associated with commonly used protocols.
  • TCP, ARP, ICMP, DHCP, DNS, SMTP, ND, CDP/LLDP, SNMP, syslog
  • HTTP/HTTPS, FTP/SFTP, Telnet/SSH
• Describe the role of addressing in network security.
  • Network segmentation (DMZ, VLANs)
  • NAT; public vs. private networks; internal, external, and trusted networks
• Describe the purpose and function of network security technologies.
  • Honeypot, proxy server, IDS, IPS, captive portal, types of firewalls (stateful and stateless), ACLs
  • VPN, NAC, remote desktop tools
  • Cloud security infrastructure (VPC and security groups)
• Validate the security of wireless networks.
  • MAC address filtering, wireless encryption standards and protocols, SSID
• Examine network security logs to identify anomalies.
  • Firewall logs, IDS/IPS logs

Securing Endpoint Devices

• Apply security settings to harden operating systems.
  • Operating Systems: Windows, macOS, and Linux
  • Windows Defender, file and directory permissions, privilege escalation, file and drive encryption, using CIS benchmarks
• Use endpoint tools to gather security assessment information.
  • netstat, nslookup, nmap, zenmap, ss
• Use packet capture utilities to identify anomalies.
  • Wireshark, tcpdump
• Demonstrate familiarity with endpoint security policies and standards.
  • Regulatory compliance (PCI DSS, HIPAA, and GDPR), BYOD, device management (verify status of Windows Updates, application updates, device drivers, firmware, and patches), configuration management
• Interpret system logs to identify anomalies.
  • Event Viewer; console; audit logs; system and application logs; syslog
  • Server and end user devices
• Perform malware removal.
  • Scanning systems, reviewing scan logs, malware remediation, understanding that malware can infect restore points and backups, malware incident response (containment, quarantine, treatment, and inoculation)

Vulnerability Assessment and Risk Management

• Use threat intelligence sources to identify potential network vulnerabilities.
  • Uses and limitations of vulnerability databases; Common Vulnerabilities and Exposures (CVEs), cybersecurity reports, cybersecurity news, subscription services, and collective intelligence; ad hoc and automated threat intelligence; the importance of updating documentation and other forms of communication proactively before, during, and after cybersecurity incidents; how to secure, share and update documentation
• Explain risk management.
  • Vulnerability vs. risk, approaches to risk management, risk mitigation strategies, levels of risk severity (low, medium, high, and extremely high), likelihood of occurrence, risks associated with specific types of data and data classifications, security assessments of IT systems (information security, change management, computer operations, and information assurance)
• Explain the penetration testing process.
  • Vulnerability identification, reporting results to stakeholders, and making recommendations for mitigation; active and passive reconnaissance; testing (port scanning and automation)

Incident Handling

• Monitor security events to determine if escalation is required.
  • Role of SIEM and SOAR, identifying suspicious events as they occur, differentiating between a true or false positive, differentiating between a true or false negative
• Explain the digital forensics process and attack frameworks.
  • Sources of evidence (artifacts); evidence handling (preserving digital evidence, and chain of custody)
  • Cyber Kill Chain, MITRE ATT&CK Matrix, Diamond Model; Tactics, Techniques, and Procedures (TTP); Pyramid of Pain
• Explain the elements of cybersecurity incident response.
  • Policy, plan, and procedure elements; incident response lifecycle stages (NIST Special Publication 800-61 sections 2.3, 3.1-3.4)
  • Impact of compliance frameworks (GDPR, HIPAA, PCI-DSS, FERPA, and FISMA) on notification and reporting requirements
• Explain the importance of disaster recovery and business continuity planning.
  • Natural and human-caused disasters, features of disaster recovery plans (DRP) and business continuity plans (BCP), all types of data backups, hot and cold spares, disaster recovery controls (detective, preventive, and corrective)
• Assist users in restoring data after an incident.
  • Restore points, restoring from cloud storage