4Information security

• 4.1Security Fundamentals (CIA and Risk Management)

  Learn the three pillars of information security (confidentiality, integrity, availability, i.e. CIA) plus the complementary properties authenticity, accountability, non-repudiation, and reliability, and how information assets relate to threats and vulnerabilities. Also cover the risk management process (risk identification / risk analysis / risk evaluation / risk response) and the four categories of risk response (mitigation, retention, avoidance, transfer).

• 4.2Threats and Attack Techniques (Malware, Web Application Attacks, Social Engineering)

  Learn the types of malware (virus, worm, Trojan horse, ransomware, spyware), targeted attacks and phishing, web application attacks such as SQL injection, XSS, and CSRF, denial-of-service via DoS/DDoS attacks, man-in-the-middle attacks on communications, password attacks (brute-force, dictionary, and password-list attacks), social engineering that exploits human psychology, and supply chain attacks that go through business partners.

• 4.3Cryptography and Authentication (Public-Key Cryptography, PKI, Multi-Factor Authentication)

  Learn how symmetric-key cryptography and public-key cryptography work and when to use each, the hybrid cryptography that combines both, hash functions used to detect tampering, digital signatures that prove authorship, the PKI (public-key infrastructure) and certificate authorities (CAs) that guarantee a public key's validity, SSL/TLS that protects web communications, multi-factor authentication and biometric authentication that verify identity via multiple factors, and challenge-response authentication that prevents impersonation over a network.

• 4.4Countermeasures and Management (Firewalls, Zero Trust, ISMS)

  Learn about network-perimeter defenses — firewalls, IDS/IPS, WAF — and the DMZ that isolates externally facing servers, VPN for securely connecting remote sites, the zero trust approach that does not rely on perimeter defense, the organizational security management framework ISMS/ISO/IEC 27001, the structure of a security policy, access control (least privilege, separation of duties), log management, and the CSIRT/incident response process for handling incidents.