Level 1
1.0 Access control
1.1 Foundation of a secure network
1.2 Access Control methods
2.0 Authentication
2.1 Overview
2.2 Kerberos
2.3 CHAP
2.4 Certificates
2.5 Username/Password
2.6 Tokens
2.7 Multi-Factor
2.8 Mutual Authentication
2.9 Biometrics
2.10 Auditing
3.0 Protecting Your network
3.1 Non-essential services & protocols – disabling unnecessary systems/process/attacks
3.2 Attacks
3.3 Malicious Code
3.4 Social Engineering
4.0 Auditing
4.1 Logging & System Scanning
Level 2
1.0 Remote Access
1.1 802.1x
1.2 VPN
1.3 RADIUS
1.4 TACACS/+
1.5 L2TP/PPTP
1.6 SSH
1.7 IPSEC
1.8 Vulnerabilities
2.0 E-mail
2.1 S/MIME
2.2 PGP
2.3 Vulnerabilities
3.0 Web
3.1 SSL/TLS
3.2 HTTP/S
3.3 Instant Messaging
4.0 Directory Services
4.1 SSL/TLS
4.2 LDAP
5.0 File Transfer
5.1 S/FTP
5.2 Blind FTP/Anonymous
5.3 File Sharing
5.4 Vulnerabilities
6.0 Wireless
6.1 WTLS
6.2 802.11x
6.3 WEP/WAP
6.4 Vulnerabilities
Level 3
1.0 Devices
1.1 Firewalls
1.2 Routers
1.3 Switches
1.4 Wireless
1.5 Modems
1.6 RAS
1.7 Telecom/PBX
1.8 VPN
1.9 IDS
1.10 Network Monitoring/Diagnostic
1.11 Workstations
1.12 Servers
1.13 Mobile Devices
2.0 Media
2.1 Coax
2.2 UTP/STP
2.3 Fiber
2.4 Removable media
3.0 Security Topologies
3.1 Security Zones
3.2 VLANs
3.3 NAT
3.4 Tunneling
4.0 Intrusion Detection
4.1 Network based
4.2 Host based
4.3 Active Detection
4.4 Honey Pots
4.5 Incident Response
5.0 Security Baselines
5.1 OS/NOS Hardening (Concepts & Processes
5.2 Network Hardening
5.3 Application Hardening
Level 4
1.0 Algorithms
1.1 Hashing
1.2 Symmetric
1.3 Asymmetric
2.0 Concepts of Cryptography
2.1 Confidentiality
2.2 Integrity
2.3 Authentication
2.4 Non-Repudiation
2.5 Access Control
3.0 PKI
3.1 Distinguishing Certificates
3.2 Revocation
3.3 Trust Models
4.0 Standards & Protocols
4.1 Common Standards
5.0 Key Management/Certificate Lifecycle
5.1 Centralized vs. Decentralized
5.2 Storage
5.3 Escrow
5.4 Expiration
5.5 Revocation
5.6 Suspension
5.7 Recovery
5.8 Renewal
5.9 Destruction
5.10 Key Usage
Level 5
1.0 Physical Security
1.1 Access Control
1.2 Social Engineering
1.3 Environment
2.0 Disaster Recovery
2.1 Backups
2.2 Secure Recovery
2.3 Disaster Recovery Plan
3.0 Business Continuity
3.1 Utilities
3.2 High Availability/Fault Tolerance
3.3 Backups
4.0 Policy & Procedures
4.1 Security Policy
4.2 Incident Response Policy
5.0 Privilege Management
5.1 User/Group/Role Management
5.2 Single Sign-on
5.3 Centralized vs. Decentralized
5.4 Auditing (Privilege, Usage, Escalation)
5.5 MAC/DAC/RBAC
6.0 Forensics (Awareness, conceptual Knowledge & understanding – knowing your role)
6.1 Chain of Custody
6.2 Preservation of Evidence
6.3 Collection of Evidence
7.0 Risk Identification
7.1 Asset Identification
7.2 Risk Assessment
7.3 Threat Identification
7.4 Vulnerabilities
8.0 Education – training of end-users, executives & HR
8.1 Communication
8.2 User Awareness
8.3 Education
8.4 Online Resources
9.0 Documentation
9.1 Standards and Guidelines
9.2 Systems Architecture
9.3 Change Documentation
9.4 Logs and Inventories
9.5 Classification
9.6 Retention/Storage
9.7 Destruction
| 