ISACA Certified Cybersecurity Specialist

You cannot protect what you do not understand. This module gives the working knowledge of operating systems, networks, web applications and the cloud that security decisions depend on.

• How operating systems manage users and files
• How networks move data
• How web applications work
• Cloud services in outline
• Logs and what they record
• Reading command line output

You build A diagram of a small organization’s systems and networks, with the main assets labelled.

Defenders need a clear view of how attacks proceed. You study phishing, malware, password and web attacks, and the basic techniques, such as patching, filtering and monitoring, that answer them.

• Phishing and social engineering
• Malware and ransomware
• Password and credential attacks
• Web application attacks in outline
• Network scanning and its defense
• Matching techniques to threats

You build A table that pairs ten common attacks with the techniques that prevent, detect or limit them.

Proving identity and protecting data are used everywhere. You learn how passwords, multi-factor sign-in and certificates work, and how hashing and encryption protect information.

• Passwords and password storage
• Multi-factor authentication
• Symmetric and asymmetric encryption
• Hashing and digital signatures
• Certificates and secure web connections
• Choosing the right technique for a task

You build A short lab that hashes passwords, encrypts a file and inspects a website certificate.

Security added at the end is weaker and costs more. You learn secure design principles, write security requirements, shrink attack surface and model threats before a system is built.

• Secure design principles
• Security requirements for a system
• Reducing attack surface
• Threat modeling with simple methods
• Trust boundaries and data flows
• Reviewing a design for weaknesses

You build A security requirements list and threat model for one small web application.

Many breaches come from small mistakes in code and settings. You learn secure coding habits, safe handling of secrets and dependencies, and how to configure and harden systems before they go live.

• Common coding weaknesses
• Input validation and output handling
• Secrets and dependency hygiene
• Secure configuration baselines
• Hardening a server or workstation
• Testing for security flaws

You build A hardening checklist and a review of one small program for common weaknesses.

Information needs protection that matches its value. You classify data, apply privacy by design, choose encryption and access rules, and plan backup and retention so protection holds as systems change.

• Data classification
• Privacy by design in outline
• Encryption of data at rest and in transit
• Access control models
• Backup and recovery design
• Retention and disposal

You build A data protection plan for one dataset, with classification, controls and backup.

Modern systems run on shared platforms. You learn the shared responsibility model, secure identity and storage settings in the cloud, and design network layouts that limit how far a problem can spread.

• Shared responsibility in cloud services
• Cloud identity and permissions
• Securing cloud storage and settings
• Network segmentation
• Firewalls and secure remote access
• Infrastructure defined as code and its checks

You build A secure design for a small cloud-hosted service, with identity, network and storage choices explained.

Prevention will sometimes fail, so you need to see it. You collect logs, set baselines, read alerts from detection tools and decide which events need action.

• Log sources and collection
• Baselines and unusual behavior
• Reading intrusion detection alerts
• Endpoint monitoring
• Triage of alerts
• Reducing false alarms

You build A set of alert rules for a small environment, each tested against a sample event.

Weaknesses must be found before others find them. You run scans, interpret results, rank findings, apply patches and learn what penetration testers do and why their findings matter.

• Vulnerability scanning in practice
• Reading severity scores and context
• Patching and mitigation
• Penetration testing in outline
• Reporting a finding clearly
• Verifying that a fix worked

You build A scan report for a lab system, with findings ranked and fixes verified.

When something goes wrong, calm method matters. You follow the incident lifecycle, triage and escalate, contain and recover, keep evidence intact and write down what happened.

• The incident response lifecycle
• Recognizing and escalating an incident
• Containment and recovery
• Preserving evidence
• Communicating during an incident
• Learning from what happened

You build A response checklist and incident report for a simulated phishing compromise.

One small system uses everything. You design it with security in mind, build and harden it, set up monitoring, test it and respond to a simulated incident.

• Setting requirements and drawing the design
• Building and hardening the system
• Adding logging and alerts
• Testing and fixing weaknesses
• Handling a simulated incident

You build A small system with design notes, hardening record, monitoring and an incident report.