CompTIA Security+

Cryptography protects data in motion and at rest, and misuse of it is common. You learn symmetric and asymmetric methods, hashing, signatures and certificates, and how keys are kept safe and replaced.

• Symmetric and asymmetric encryption
• Hashing, salting and integrity checks
• Digital signatures and certificates
• Public key infrastructure and certificate authorities
• Key management, HSMs and TPMs
• Choosing encryption for data at rest, in transit and in use
• Steganography, tokenization and obfuscation

You build A certificate chain you create, inspect and revoke, with a note on how each part is trusted.

Defenses depend on knowing who attacks and why. You study the main kinds of threat actor, their motives and resources, and the routes they use to reach a target, from email to third parties.

• Nation-state, criminal, insider and hacktivist actors
• Motivations and levels of sophistication
• Message, network, image and file vectors
• Supply chain and third-party exposure
• Unsecured devices, ports and services
• Mapping an organization’s attack surface

You build An attack surface map for a small organization, with the likely actors for each exposure.

Most breaches start with a person or a program. You learn how phishing, pretexting and impersonation work, the main families of malware, and the signs that point to each.

• Phishing, smishing, vishing and business email compromise
• Pretexting, impersonation and physical tactics
• Ransomware, trojans, worms and rootkits
• Spyware, keyloggers and fileless malware
• Indicators of compromise
• Reducing risk through training and technical controls

You build A phishing analysis report for a real message, with indicators and recommended responses.

Attacks on software and credentials are routine. You learn injection, scripting and overflow flaws, denial of service, on-path and replay attacks, and the ways passwords are guessed and stolen.

• SQL injection and cross-site scripting
• Buffer overflows and race conditions
• Denial of service and amplification
• On-path, replay and downgrade attacks
• Brute force, spraying and credential stuffing
• Reading logs that reveal each attack

You build A lab write-up that runs three attacks against a test application and shows the log evidence for each.

A vulnerability matters only when it can be used. You examine weaknesses in operating systems, applications, hardware, cloud and mobile, and choose mitigations such as patching, segmentation and least privilege.

• Operating system and application vulnerabilities
• Hardware, firmware and virtualization weaknesses
• Cloud, mobile and supply chain weaknesses
• Misconfiguration and weak defaults
• Patching, segmentation and isolation
• Hardening and application allow lists

You build A mitigation plan that pairs each finding on a test system with a fix and a check.

Architecture decides how much a single mistake can cost. You compare cloud, on-premises and hybrid designs, place firewalls, IDS and VPNs, and segment networks so an intruder cannot move freely.

• Cloud, hybrid and on-premises models
• Virtualization, containers and serverless
• Network segmentation and screened subnets
• Firewalls, IDS, IPS and proxies
• VPNs and secure communications
• Infrastructure as code and software-defined networking
• Securing embedded and industrial systems

You build A segmented network design with firewall placement, explained zone by zone.

Data must stay secret and available. You classify data, apply protection by its state, and design backups, redundancy and recovery so the organization carries on through a failure or an attack.

• Data types, classification and ownership
• Data at rest, in transit and in use
• Masking, tokenization and data loss prevention
• High availability, clustering and load balancing
• Backups, snapshots and recovery sites
• Capacity planning and testing recovery

You build A data classification scheme and protection plan for one business, with a tested restore.

Secure systems are configured on purpose. You set baselines, harden endpoints, wireless and mobile devices, run vulnerability scans, read the results and drive findings through to remediation.

• Secure baselines and configuration standards
• Hardening endpoints, servers and network devices
• Wireless and mobile device security
• Vulnerability scanning and scoring
• Penetration testing and rules of engagement
• Remediation, exceptions and rescanning

You build A vulnerability report for a test network with prioritized, assigned remediation steps.

Most attacks use valid accounts. You manage identities through their whole life, apply access models and multi-factor authentication, and control privileged accounts more tightly than ordinary ones.

• Provisioning, deprovisioning and account reviews
• Single sign-on, federation and directory services
• Multi-factor authentication and biometrics
• Role-based, attribute-based and mandatory access
• Privileged access management
• Password policy that people can follow

You build An access model for a department, with roles, review cycle and privileged account rules.

Detection and response decide how much damage an attack does. You collect and correlate logs, tune alerts, and run an incident through preparation, containment, recovery and review, including evidence handling.

• Log sources and centralized collection
• SIEM correlation and alert tuning
• Endpoint, network and cloud monitoring
• The incident response process
• Digital forensics and chain of custody
• Playbooks, automation and escalation

You build An incident response plan and playbook for ransomware, walked through in a tabletop exercise.

Security serves the organization’s goals. You write policy and procedure, assess and treat risk with qualitative and quantitative methods, assess vendors, and support audits and awareness programs.

• Policies, standards, procedures and guidelines
• Risk identification, analysis and treatment
• Annualized loss expectancy and risk registers
• Third-party and vendor risk assessment
• Compliance, privacy and audits
• Security awareness and training programs

You build A risk register of ten risks, with ratings, owners and chosen treatments.

One engagement uses every domain. You review an organization’s architecture, accounts, data and processes, identify its weaknesses and present a prioritized improvement plan to its management.

• Scoping the review and gathering evidence
• Rating threats, vulnerabilities and risks
• Choosing controls that fit the budget
• Planning monitoring and response
• Presenting findings to non-technical leaders

You build A security assessment report with findings, risk ratings and a prioritized plan.