UOP-CMGT245v11.AB1 - IS Security Concepts

• Social Engineering Fundamentals
• User Security Awareness Education
• Malicious Software (Malware)
• Password Attacks
• Physical Attacks
• Adversarial Artificial Intelligence
• Supply-Chain Attacks
• Cloud-based vs. On-premises Attacks
• Cryptographic Attacks
• Privilege Escalation
• Cross-Site Scripting (XSS) Attacks
• Injection Attacks
• Pointer/Object Dereference
• Directory Traversal
• Buffer Overflows
• Race Conditions
• Error Handling
• Improper Input Handling
• Replay Attacks
• Request Forgeries
• Application Programming Interface (API) Attacks
• Resource Exhaustion
• Memory Leaks
• Secure Socket Layer (SSL) Stripping
• Driver Manipulation
• Pass the Hash
• Wireless Attacks
• On-Path Attacks
• Layer 2 Attacks
• Domain Name System (DNS) Attacks
• Distributed Denial-of-Service (DDoS) Attacks
• Malicious Code or Script Execution Attacks
• Actors and Threats
• Attributes of Threat Actors
• Attack Vectors
• Threat Intelligence and Threat Intelligence Sources
• Research Sources
• Cloud-based vs. On-premises Vulnerabilities
• Zero-day Vulnerabilities
• Weak Configurations
• Third-party Risks
• Improper or Weak Patch Management
• Legacy Platforms
• The Impact of Cybersecurity Attacks and Breaches
• Threat Hunting
• Vulnerability Scans
• Logs and Security Information and Event Management (SIEM)
• Security Orchestration, Automation, and Response (SOAR)
• Penetration Testing
• Passive and Active Reconnaissance
• Exercise Types

14 LiveLab in this lesson — see the labs panel →

• Configuration Management
• Data Sovereignty and Data Protection
• Site Resiliency
• Deception and Disruption
• Cloud Models
• Cloud Service Providers
• Cloud Architecture Components
• Virtual Machine (VM) Sprawl Avoidance and VM Escape Protection
• Software Development Environments and Methodologies
• Application Provisioning and Deprovisioning
• Software Integrity Measurement
• Secure Coding Techniques
• Open Web Application Security Project (OWASP)
• Software Diversity
• Automation/Scripting
• Elasticity and Scalability
• Authentication Methods
• Biometrics
• Multifactor Authentication (MFA) Factors and Attributes
• Authentication, Authorization, and Accounting (AAA)
• Cloud vs. On-premises Requirements
• Redundancy
• Replication
• On-premises vs. Cloud
• Backup Types
• Non-persistence
• High Availability
• Restoration Order
• Diversity
• Embedded Systems
• Supervisory Control and Data Acquisition (SCADA)/Industrial Control Systems (ICS)
• Internet of Things (IoT)
• Specialized Systems
• Voice over IP (VoIP)
• Heating, Ventilation, and Air Conditioning (HVAC)
• Drones
• Multifunction Printers (MFP)
• Real-Time Operating Systems (RTOS)
• Surveillance Systems
• System on a Chip (SoC)
• Communication Considerations
• Embedded System Constraints
• Bollards/Barricades
• Access Control Vestibules
• Badges
• Alarms
• Signage
• Cameras
• Closed-Circuit Television (CCTV)
• Industrial Camouflage
• Personnel
• Locks
• USB Data Blockers
• Lighting
• Fencing
• Fire Suppression
• Sensors
• Drones
• Visitor Logs
• Faraday Cages
• Air Gap
• Screened Subnet (Previously Known as Demilitarized Zone [DMZ])
• Protected Cable Distribution
• Secure Areas
• Secure Data Destruction
• Digital Signatures
• Key Length
• Key Stretching
• Salting
• Hashing
• Key Exchange
• Elliptic-Curve Cryptography
• Perfect Forward Secrecy
• Quantum
• Post-Quantum
• Ephemeral
• Modes of Operation
• Blockchain
• Cipher Suites
• Symmetric vs. Asymmetric Encryption
• Lightweight Cryptography
• Steganography
• Homomorphic Encryption
• Common Use Cases
• Limitations

8 LiveLab in this lesson — see the labs panel →

• Protocols
• Use Cases
• Endpoint Protection
• Antimalware
• Next-Generation Firewall
• Host-based Intrusion Prevention System
• Host-based Intrusion Detection System
• Host-based Firewall
• Boot Integrity
• Database
• Application Security
• Hardening
• Self-Encrypting Drive/Full-Disk Encryption
• Hardware Root of Trust
• Trusted Platform Module
• Sandboxing
• Load Balancing
• Network Segmentation
• Virtual Private Network
• DNS
• Network Access Control
• Out-of-Band Management
• Port Security
• Network Appliances
• Access Control List
• Route Security
• Quality of Service
• Implications of IPv6
• Port Spanning/Port Mirroring
• Monitoring Services
• File Integrity Monitors
• Cryptographic Protocols
• Authentication Protocols
• Methods
• Installation Considerations

16 LiveLab in this lesson — see the labs panel →

• Connection Methods and Receivers
• Mobile Device Management
• Mobile Device Management Enforcement and Monitoring
• Mobile Devices
• Deployment Models
• Cloud Security Controls
• Solutions
• Cloud Native Controls vs. Third-Party Solutions
• Identity
• Account Types
• Account Policies
• Authentication Management
• Authentication/Authorization
• Access Control Schemes
• Public Key Infrastructure
• Types of Certificates
• Certificate Formats
• PKI Concepts

9 LiveLab in this lesson — see the labs panel →

• Network Reconnaissance and Discovery
• File Manipulation
• Shell and Script Environments
• Packet Capture and Replay
• Forensics
• Exploitation Frameworks
• Password Crackers
• Data Sanitization
• Incident Response Plans
• Incident Response Process
• Exercises
• Attack Frameworks
• Stakeholder Management
• Communication Plan
• Disaster Recovery Plan
• Business Continuity Plan
• Continuity of Operations Planning (COOP)
• Incident Response Team
• Retention Policies
• Vulnerability Scan Output
• SIEM Dashboards
• Log Files
• syslog/rsyslog/syslog-ng
• journalctl
• NXLog
• Bandwidth Monitors
• Metadata
• NetFlow/sFlow
• Protocol Analyzer Output
• Reconfigure Endpoint Security Solutions
• Configuration Changes
• Isolation
• Containment
• Segmentation
• SOAR
• Documentation/Evidence
• Acquisition
• On-premises vs. Cloud
• Integrity
• Preservation
• E-discovery
• Data Recovery
• Nonrepudiation
• Strategic Intelligence/Counterintelligence
• Control Category
• Control Types
• Regulations, Standards, and Legislation
• Key Frameworks
• Benchmarks and Secure Configuration Guides
• Personnel Policies
• Diversity of Training Techniques
• Third-Party Risk Management
• Data Concepts
• Credential Policies
• Organizational Policies
• Risk Types
• Risk Management Strategies
• Risk Analysis
• Disaster Analysis
• Business Impact Analysis
• Organizational Consequences of Privacy and Data Breaches
• Notifications of Breaches
• Data Types and Asset Classification
• PII
• PHI
• Privacy Enhancing Technologies
• Roles and Responsibilities
• Information Lifecycle
• Impact Assessment
• Terms of Agreement
• Privacy Notice

17 LiveLab in this lesson — see the labs panel →