Curriculum

Chapter 2 – Risk Management

2.1 Module A: Risk Management Programs

2.2 Module B: Security audits

2.3 Module C: Conducting security assessments

2.4 Summary

Including Topics and Frameworks:

MITRE ATT&CK

WannaCry Ransomware

Colonial Pipeline Attack

Hands-on Labs

2.2.1. Gathering Site Information

2.2.2. Using the theHarvester Tool

2.3.1. Cracking a Linux Password Using John the Ripper

2.3.2. Footprinting a website

Chapter 3 – Organizational security

3.1 Module A: Social engineering

3.2 Module B: Security policies

3.3 Module C: User roles and training

3.4 Summary

Including Topics and Frameworks:

Mirai IoT Botnet

OWASP Top Ten

Cipher Block Modes of Operation

Hands-on Labs

3.1.2. Using Anti-phishing Tools

3.3.1. Using Social Engineering Techniques to Plan an Attack

Chapter 4 – Cryptography

4.1 Module A: Cryptography Concepts

4.2 Module B: Public key infrastructure

4.3 Summary

Including Topics and Frameworks:

NERC CIP

Identity and Access Management (IAM) Lifecycle

Enterprise Deployment Models

Hands-on Labs

4.1.1. Creating Asymmetric Key Pairs

4.1.2. Observing an MD5 Generated Hash Value

4.1.3. Performing Steganography Using OpenStego

4.1.4. Using Symmetric Encryption

4.1.5. Creating File Hashes

4.2.1. Examining PKI Certificates

4.2.2. Creating Certificates with OpenSSL

Chapter 5 – Network connectivity

5.1 Module A: Network attacks

5.2 Module B: Packet flow

5.3 Summary

Including Topics and Frameworks:

Security Control Types

Researching Skills

IPv4 vs IPv6

Hands-on Labs

5.1.4. Spoofing a MAC Address with SMAC

5.1.5. Cracking Passwords Using Rainbow Tables

5.1.6. Cracking Passwords

5.1.7. Capturing Credentials On-path

5.1.8 Launching a DoS Attack

5.2.1. Configuring a Network Firewall

5.2.2. Using Uncomplicated Firewall in Linux

Chapter 6 – Secure Network Configuration

6.1 Module A: Network security components

6.2 Module B: Secure network protocols

6.3 Module C: Hardening networks

6.4 Summary

Including Topics and Frameworks:

Network Segmentation vs Micro-segmentation

Active Directory & LDAP

System Lifecycle Management

Hands-on Labs

6.2.1. Securing a Wi-Fi Hotspot

6.2.2. Binding a Site Using IIS

6.2.3. Configuring a VPN

6.2.4. Requesting PKI Certificates

6.3.1. Scanning the Network

Chapter 7 – Authentication

7.1 Module A: Authentication factors

7.2 Module B: Authentication protocols

7.3 Summary

Including Topics and Frameworks:

PCI-DSS

VPN and its Types

CIS Benchmarks and Controls

Hands-on Labs

7.2.1. Examining Active Directory Objects

7.2.2. Examining Kerberos Settings

7.2.3. Installing a RADIUS Server

Chapter 8 – Access control

8.1 Module A: Access Control Principles

8.2 Module B: Account Management

8.3 Summary

Including Topics and Frameworks:

SolarWinds Attack

GDPR

Penetration Testing Lifecycle

Hands-on Labs

8.2.1. Creating Linux Users and Groups

8.2.2. Enforcing Password Policies

8.2.3. Delegating Control in Active Directory

8.2.4. Creating a Windows Domain Users

Chapter 9 – Enterprise Architecture

9.1 Module A: System vulnerabilities

9.2 Module B: System architecture

9.3 Summary

Including Topics and Frameworks:

Vulnerability Assessment Lifecycle

Vulnerability Assessment vs Penetration Testing

SDLC (Waterfall vs Agile vs DevOps)

Hands-on Labs

9.1.1. Examining Spyware

9.2.1. Detecting Virtualization

Projects (Week 9 – 12)

Red Team vs. Blue Team Project: Work in a group where one member attempts to attack a target system by exploiting vulnerabilities, while the other defends or investigates the attack as part of incident response. Tools such as Kali Linux, Virtual Machine, Caldera BAS, Comodo Dragon (EDR), and Splunk (SIEM).

Duration: 4 weeks.

Chapter 10 – Secure assets

10.1 Module A: Physical security and safety

10.2 Module B: Securing data

10.3 Summary

Including Topics and Frameworks:

ISO 27001 Framework

ISO 27002 Framework

Cyber Kill Chain

Hands-on Labs

10.1.1. Identifying Access Badge Areas

10.1.2. Implementing Physical Security

10.2.1. Using BitLocker in Windows 10

10.2.2. Encrypting Files with EFS

10.2.3. Assigning NTFS Permissions

Chapter 11 – Securing Specialized Systems

11.1 Module A: Securing Hosts

11.2 Module B: Mobile security

11.3 Summary

Including Topics and Frameworks:

HIPAA

Cyber Essentials

ARCO

Hands-on Labs

11.1.1. Creating a Security Template

11.1.2. Enforcing a Security Template

Chapter 12 – Secure applications

12.1 Module A: Application attacks

12.2 Module B: Securing Applications

12.3 Summary

Including Topics and Frameworks:

NIST Cybersecurity Framework

NIST 800-53

Incident Response Lifecycle

Hands-on Labs

12.1.1. Performing an XSS Attack in DVWA

12.1.2. Performing SQL Injection in DVWA

12.1.3. Exploiting an Overflow Vulnerability

12.1.4. Exploiting a TOCTOU Vulnerability

12.2.1. Examining Application Vulnerabilities

Chapter 13 – Disaster planning and recovery

13.1 Module A: Secure operations

13.2 Module B: Resilience and Recovery

13.3 Summary

Including Topics and Frameworks:

NIST Privacy Framework

HITRUST Common Security Framework

FEDRAMP

Hands-on Labs

         13.2.1. Scheduling a Server Backup

Projects (Week 13 – 16)

Final Project: Simulate an attack and digital forensic process. Identify via tools such as Nessus and Nmap, and exploit system vulnerabilities (e.g., using a backdoor or command-and-control methods via Metasploit), then conduct a thorough investigation using tools like Autopsy.

Duration: 4 Weeks.

Chapter 14 – Threat detection and response

14.1 Module A: Security monitoring

14.2 Module B: Incident Response Procedures

14.3 Summary

Including Topics and Frameworks:

FISMA/FIPPs

Risk Management Lifecycle

COBIT / COSO

Hands-on Labs

14.1.2. Viewing Linux Event Logs

14.1.3. Viewing Windows Event Logs

Chapter 15 – Oversight and Operations

Reviews and Test Questions:

Review Chapter 1: Threats, Attacks, and Vulnerabilities - Domain 1 Questions

Review Chapter 2: Technologies and Tools - Domain 2 Questions

Review Chapter 3: Architecture and Design - Domain 3 Questions

Review Chapter 4: Identity and Access Management - Domain 4 Questions

Chapter 16 – Information Security Management

Reviews and Test Questions:

Review Chapter 5: Risk Management - Domain 5 Questions

Review Chapter 6: Cryptography and PKI - Domain 6 Questions

Chapter 7: Practice Exam 1 – Practice Exam 1 Questions

Chapter 8: Practice Exam 2 – Practice Exam 2 Questions