Compare and contrast different types of social engineering attack techniques.
Examples: baiting, scareware, pretexting, phishing, spear-phishing, watering hole, whaling
Analyze potential indicators which can be used to determine the type of attack taking place.
Examples: adversarial artificial intelligence, automated learning, ransomware, remote access Trojan (RAT)
Analyze potential indicators associated with application and network attacks.
Examples: race conditions, error handling, buffer overflow, distributed denial of service (DDoS), domain name system (DNS), OSI Model Layer 2 Attacks
Differentiate among specific threat actors, threat vectors, and intelligence sources.
Evaluate concerns associated with types of security vulnerabilities within an enterprise work environment.
Examples: network vulnerabilities, operating systems vulnerabilities, human vulnerabilities
Operations and Incident Response
Investigate and explain the importance of implementing security concepts within an enterprise environment.
Examples: configuration management (diagrams, baseline configuration, standard naming conventions, IP schema), data protection and redundancy, secure sockets layer (SSL) and transport layer security (TLS) inspection, hashing, API considerations, site resiliency, honeypots, fake telemetry
Describe the purpose and scope of a cybersecurity business continuity plan.
Apply mitigation techniques or controls to secure an environment in a given security incident.
Examples: application approved/denied list, quarantine, firewall rules, mobile device management (MDM), data loss prevention (DLP), update or revoke certificates
Collect and present information on the historical meanings and uses of key concepts of digital forensics.
Examples: documentation and evidence, acquisition, on-premises versus cloud, integrity, data recovery, non-repudiation
Explain the importance of following every detail of an incident response plan, including communication, response coordination with relevant employees and involved parties, and factors contributing to data criticality.
Examples: communicating only with trusted parties, disclosing information based on requirements, preventing inadvertent release of information, following requirements for reporting incidents
Describe the activities that make up the detection and analysis phase of the incident response life cycle, including identification of indication sources, analysis of an intrusion event, documentation, and notification of the incident.
Examples: unusual outbound network traffic or geographical irregularities, which indicate a possible breach or compromise
Describe the activities that make up the post-incident activity phase of the incident response life cycle, including identification of lessons learned and evidence retention.
Examples: cyber incident planning and response (CIPR) action checklist
Utilize basic digital forensics techniques and tools to collect data for use as evidence in an investigation.
Examples: network traffic analyzers, endpoint disk and memory, mobile, cloud, virtualization, legal hold, hashing, data carving, data acquisition
Compare and contrast various kinds of controls by type and category as they relate to governance, risk, and compliance.
Examples: managerial, operational, technical, control type (preventive, detective, corrective, deterrent, compensating, physical)
Research and share information on current, applicable regulations, standards, or frameworks that impact organizational security posture.
Examples: General Data Protection Regulation (GDPR), Payment Card Industry Data Security Standard (PCI DSS), Center for Internet Security framework (CIS); the National Institute of Standards and Technology (NIST), Risk Management Framework (RMF) and Cybersecurity Framework (CSF); benchmarks and security configuration guides
Critique organizational and security policies regarding businesses, personnel, and data. ,
Examples: acceptable use policy, job rotation, mandatory vacation, least privilege, non-disclosure agreement, third-party vendors and risk management, service level agreement, memorandum of understanding, measurement systems analysis, end of life, credentialing policies, change management, asset management
Summarize risk management processes and concepts including risk types, management strategies, and analysis.
Examples: external, internal, legacy systems, acceptance, avoidance, transference, mitigation, risk matrix, heat map, risk control assessment, asset value, single-loss expectancy, annualized loss expectancy, annualized rate of occurrence
Describe the consequences of applying security protocols related to Internet privacy and sensitive data.
Examples: avoiding reputation damage, identity theft, IP theft, and fines; preventing privilege escalation, public disclosures, and data breaches
Organizational Security
Explain the importance of cyber threat intelligence and data security to organizations.
Examples: Gather and report on current information from the Department of Homeland Security, the FBI, or SANS Internet Storm Center and explain how applying the information benefits an organization.
Summarize threat hunting techniques used proactively by organizations to secure their networks.
Utilize threat intelligence to support organizational security in a given scenario, using frameworks, threat research, intelligence sharing, and threat modeling methodologies.
Examples: MITRE ATT&CK, Diamond Model, kill chain, indicator of compromise, Common Vulnerability Scoring System, total attack surface, attack vector, adversary capability
Perform vulnerability management activities and analyze the output from common vulnerability assessment tools.
Examples: active versus passive scanning, mapping, enumeration, criticality of assets, validation outcomes (true positive, false positive, true negative, false negative), baseline configuration, patching, hardening, scanning parameters, web application scanners, wireless and infrastructure vulnerability scanners
Investigate the threats and vulnerabilities associated with specialized technologies, including operating within a cloud-based environment.
Examples: mobile, Internet of Things, embedded, real-time operating system, System-on-Chip, field programmable gate array, physical access controls, building automation systems, drones and vehicles, supervisory control and data acquisition systems (SCADA), cloud deployment models; insecure application programming interfaces, improper key management, unprotected storage, insufficient logging and monitoring
Identify network vulnerabilities that threat actors use to exploit an organization’s security and implement control measures to avoid such attacks.
Examples: malware, unpatched security vulnerabilities, hidden backdoor programs, superuser or Admin Account privileges
Analyze real-time data and apply security solutions for infrastructure management in real-world scenarios.
Examples: cloud versus on-premises, asset management, segmentation, network architecture, change management, virtualization, containerization, identity and access management, honeypot, certificate management, monitoring and logging, active best practices defense, encryption
Research and detail the use of current cybersecurity frameworks, policies, procedures, and controls.
Examples: code of conduct, acceptable use policy, password policy, data ownership and retention, account management, continuous monitoring, work product retention, control types
Apply security concepts that mitigate organization-specific risk and explain their effectiveness.
Examples: business impact analysis, risk identification process, risk calculation, communication of risk factors, risk prioritization, systems assessment, documented compensating controls, training and exercises, supply chain assessment
Data Security
Compare and contrast hardware and software quality assurance practices and determine their effectiveness in a given scenario.
Examples: software development life cycle, DevSecOps, software assessment methods (user acceptance testing, stress test application, security regression testing, code review), secure coding best practices, static and dynamic analysis tools, hardware root of trust, trusted firmware updates
Analyze data as part of security monitoring activities.
Examples: heuristics, trend analysis, endpoint, network, log review, impact analysis, security information and event management (SIEM) review, query writing, e-mail analysis, Sender Policy Framework, digital signature, embedded links
Implement configuration changes to network hardware and software controls to improve and increase security.
Examples: antivirus software installation, firewalls, multi-factor authentication, administrative controls
Compare and contrast automation concepts and technologies.
Examples: workflow orchestration, scripting, application programming interface integration, automated signature creation, data enrichment, threat feed combination, machine learning and artificial intelligence, automation protocols and standards, continuous integration
Justify the importance of data privacy and protection in the context of privacy versus security, non-technical controls, and technical controls in a given scenario.
Examples: classification, ownership, retention, data types, retention standards, confidentiality, legal requirements, data sovereignty, data minimization, purpose limitation, non-disclosure agreement, encryption, data loss prevention, data masking, de-identification, tokenization, watermarking and digital rights management, geographic access requirements, access controls
