Cybersecurity Fundamentals Training Course

DOMAIN 1: CYBERSECURITY CONCEPTS

• 1.1 Understanding information assurance (IA) principles applied to managing risks associated with the use, processing, storage, and transmission of information or data.
• 1.2 Comprehension of security management practices.
• 1.3 Familiarity with risk management processes, including the steps and methods used to assess risk.
• 1.4 Awareness of the organisation’s enterprise information technology (IT) goals and objectives.
• 1.5 Knowledge of various operational threat environments, such as first-generation (script kiddies), second-generation (non-nation-state-sponsored), and third-generation (nation-state-sponsored) threats.
• 1.6 Understanding of information assurance (IA) principles and organisational requirements related to confidentiality, integrity, availability, authentication, and non-repudiation.
• 1.7 Familiarity with common adversary tactics, techniques, and procedures (TTPs) relevant to specific areas of responsibility, including historical country-specific TTPs and emerging capabilities.
• 1.8 Knowledge of different classes of attacks, including passive, active, insider, close-in, and distribution attacks.
• 1.9 Awareness of relevant laws, policies, procedures, and governance requirements.
• 1.10 Understanding of relevant laws, policies, procedures, or governance frameworks that impact critical infrastructure.

DOMAIN 2: CYBERSECURITY ARCHITECTURE PRINCIPLES

• 2.1 Understanding of network design processes, including security objectives, operational goals, and associated trade-offs.
• 2.2 Knowledge of security system design methods, tools, and techniques.
• 2.3 Familiarity with network access, identity, and access management, such as public key infrastructure (PKI).
• 2.4 Understanding of information technology (IT) security principles and methods, including firewalls, demilitarised zones, and encryption.
• 2.5 Knowledge of current industry methods for evaluating, implementing, and disseminating IT security assessment, monitoring, detection, and remediation tools, leveraging standards-based concepts and capabilities.
• 2.6 Understanding of network security architecture concepts, including topology, protocols, components, and principles, such as the application of defence in depth.
• 2.7 Familiarity with malware analysis concepts and methodologies.
• 2.8 Knowledge of intrusion detection methodologies and techniques for identifying host- and network-based intrusions using intrusion detection technologies.
• 2.9 Understanding of defence in depth principles and network security architecture.
• 2.10 Knowledge of encryption algorithms, such as Internet Protocol Security (IPSEC), Advanced Encryption Standard (AES), and Generic Routing Encapsulation (GRE).
• 2.11 Familiarity with cryptology.
• 2.12 Understanding of encryption methodologies.
• 2.13 Knowledge of traffic flow across networks, including Transmission Control Protocol and Internet Protocol (TCP/IP) and the Open Systems Interconnection model (OSI).
• 2.14 Understanding of network protocols, such as Transmission Control Protocol and Internet Protocol.

DOMAIN 3: SECURITY OF NETWORK, SYSTEM, APPLICATION AND DATA

• 3.1 Knowledge of computer network defence (CND) and vulnerability assessment tools, including open-source options, and their respective capabilities.
• 3.2 Familiarity with basic system administration, network, and operating system hardening techniques.
• 3.3 Understanding of risks associated with virtualisation.
• 3.4 Knowledge of penetration testing principles, tools, and techniques, such as Metasploit and Neosploit.
• 3.5 Understanding of network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.
• 3.6 Familiarity with remote access technology concepts.
• 3.7 Knowledge of systems administration concepts.
• 3.8 Proficiency in Unix command line operations.
• 3.9 Understanding of system and application security threats and vulnerabilities.
• 3.10 Knowledge of system lifecycle management principles, including software security and usability.
• 3.11 Awareness of local specialised system requirements for safety, performance, and reliability, particularly for critical infrastructure systems that may not use standard IT.
• 3.12 Knowledge of system and application security threats and vulnerabilities, including buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language (PL/SQL) and injections, race conditions, covert channels, replay, return-oriented attacks, and malicious code.
• 3.13 Understanding of the social dynamics of computer attackers in a global context.
• 3.14 Familiarity with secure configuration management techniques.
• 3.15 Knowledge of the capabilities and applications of network equipment, including hubs, routers, switches, bridges, servers, transmission media, and related hardware.
• 3.16 Understanding of the communication methods, principles, and concepts that support network infrastructure.
• 3.17 Knowledge of common networking protocols (e.g., TCP/IP) and services (e.g., web, mail, Domain Name System [DNS]) and their interactions in providing network communications.
• 3.18 Understanding of different types of network communication, such as Local Area Network (LAN), Wide Area Network (WAN), Metropolitan Area Network (MAN), Wireless Local Area Network (WLAN), and Wireless Wide Area Network (WWAN).
• 3.19 Familiarity with virtualisation technologies and the development and maintenance of virtual machines.
• 3.20 Knowledge of application vulnerabilities.
• 3.21 Understanding of information assurance (IA) principles and methods applicable to software development.
• 3.22 Knowledge of risk and threat assessment processes.

DOMAIN 4: INCIDENT RESPONSE

• 4.1 Understanding of incident categories, response actions, and response timelines.
• 4.2 Knowledge of disaster recovery and continuity of operations plans.
• 4.3 Familiarity with data backup strategies, types of backups (e.g., full, incremental), and recovery concepts and tools.
• 4.4 Knowledge of incident response and handling methodologies.
• 4.5 Understanding of security event correlation tools.
• 4.6 Awareness of the investigative implications of hardware, operating systems, and network technologies.
• 4.7 Knowledge of processes for seizing and preserving digital evidence, including chain of custody procedures.
• 4.8 Understanding of types of digital forensics data and how to identify them.
• 4.9 Familiarity with basic concepts and practices of processing digital forensic data.
• 4.10 Knowledge of anti-forensics tactics, techniques, and procedures (TTPS).
• 4.11 Understanding of common forensic tool configuration and support applications, such as VMware and Wireshark.
• 4.12 Knowledge of network traffic analysis methods.
• 4.13 Awareness of which system files (e.g., log files, registry files, configuration files) contain relevant information and where to locate them.

DOMAIN 5: SECURITY OF EVOLVING TECHNOLOGY

• 5.1 Knowledge of new and emerging information technology (IT) and information security technologies.
• 5.2 Understanding of emerging security issues, risks, and vulnerabilities.
• 5.3 Awareness of risks associated with mobile computing.
• 5.4 Knowledge of cloud concepts related to data and collaboration.
• 5.5 Understanding of the risks involved in migrating applications and infrastructure to the cloud.
• 5.6 Awareness of risks associated with outsourcing.
• 5.7 Knowledge of supply chain risk management processes and practices.