Cisco CCST Cybersecurity

Most incidents begin with something common. This module sorts the main kinds of malware and ransomware, shows how phishing and other social engineering work on people, and covers password and denial-of-service attacks.

• Viruses, worms, trojans and ransomware
• Phishing, spear phishing and pretexting
• Password attacks and credential reuse
• Denial-of-service attacks
• Insider threats and physical access
• Recognizing the signs of each attack

You build A phishing spotter’s guide built from real message samples.

Access control decides who can do what. You learn authentication, authorization and accounting, why multi-factor authentication helps, how least privilege limits damage, and what makes a password policy work rather than annoy.

• Authentication, authorization and accounting
• Passwords, passphrases and password managers
• Multi-factor authentication methods
• Least privilege and separation of duties
• Account lifecycle: joiners, movers and leavers

You build An access policy for a small team, with roles and review steps.

Cryptography protects data at rest and in motion. You compare hashing with encryption, symmetric with asymmetric keys, then see how digital signatures and certificates let a browser trust a site it has never met.

• Hashing and integrity checks
• Symmetric and asymmetric encryption
• Digital signatures
• Certificates and certificate authorities
• How TLS protects a web connection
• Encrypting data at rest

You build A worked demonstration that hashes a file, signs it and verifies the result.

Protocols were built for trust, not defense. You look at the weaknesses in TCP/IP, how addressing choices such as private ranges and segmentation affect exposure, and how attackers sniff, spoof and scan.

• Weaknesses in IP, TCP and UDP
• Spoofing and man-in-the-middle attacks
• Scanning and reconnaissance
• How addressing and segmentation limit exposure
• Wireless and DNS as attack surfaces

You build A map of attack paths across a sample network diagram.

Put defenses in the right places. You learn what firewalls and access lists do, where a DMZ fits, how intrusion detection differs from intrusion prevention, and how VPNs and network access control keep outsiders and unknown devices out.

• Firewalls and stateful filtering
• Access control lists
• DMZ design and why it exists
• IDS and IPS: detecting against preventing
• VPNs for remote and site-to-site access
• Network access control for unknown devices

You build A defended network design with each control placed and justified.

Endpoints are where users and attackers meet. You learn the security features of common operating systems, use netstat, nslookup and tcpdump to see what a machine is doing, apply updates, read system logs and clean up an infection.

• Operating system security features
• Seeing connections with netstat
• Capturing traffic with tcpdump
• Patching and update policy
• Reading system logs for anomalies
• Checking a device against a security policy
• Removing malware and confirming it is gone

You build A hardened endpoint with a before-and-after check of its open connections.

You cannot fix everything, so you decide what matters. This module covers vulnerability scanning, CVE records and scoring, threat intelligence, how to rank risks, and the plans for disaster recovery and business continuity.

• Vulnerability scanning and what the results mean
• CVE records and severity scoring
• Sources and uses of threat intelligence
• Ranking risk by likelihood and impact
• Risk responses: accept, reduce, transfer, avoid
• Disaster recovery and business continuity plans

You build A ranked risk register for a small organization, with a response for each item.

When something goes wrong, order matters. You learn how SIEM and SOAR tools collect and act on events, how the kill chain and MITRE ATT&CK describe an attack, what NIST SP 800-61 asks of a response, and how evidence and compliance rules shape what you do.

• From log to alert: what a SIEM does
• Automating response with SOAR
• The kill chain and MITRE ATT&CK
• The incident response lifecycle in NIST SP 800-61
• When to escalate a security event
• Preserving evidence and digital forensics basics
• Compliance frameworks and their demands

You build An incident response checklist tested against a simulated phishing case.

Apply every earlier idea to one environment. You inventory what exists, rank its risks, check its endpoints and defenses, and write up findings and fixes in the order a manager can act on.

• Scoping the review and its assets
• Checking access, endpoints and network controls
• Scoring and ranking what you find
• Recommending fixes in a sensible order
• Reporting findings to a non-specialist

You build A short security review report for a real or simulated small network.