ISC2 Certified in Cybersecurity

Security manages risk; it does not remove it. You learn to describe a risk, judge its likelihood and impact, and choose between accepting, avoiding, reducing and transferring it. The aim is a decision someone can defend.

• Likelihood, impact and risk appetite
• Qualitative and quantitative risk, side by side
• Treatment options: accept, avoid, reduce, transfer
• Residual risk and who signs for it
• Writing an entry in a risk register
• Reading a simple risk matrix

You build A risk register of five risks for a small office, with a treatment chosen for each.

Controls are how risk gets reduced. You sort them by type and by purpose, see why no single control is enough, and learn how least privilege and separation of duties limit harm. The module closes on the ethical duties of a security professional.

• Administrative, technical and physical controls
• Preventive, detective and corrective controls
• Defense in depth and layered design
• Least privilege and need to know
• Separation of duties and two-person rules
• The ISC2 code of ethics applied to hard cases

You build A controls table that pairs each risk in a register with a layered set of safeguards.

Security work runs under rules set by the organization and by law. You learn how policies, standards, procedures and guidelines relate, who writes and approves them, and how privacy and industry regulations shape what a team must do.

• Policy, standard, procedure and guideline compared
• Who owns what: governance roles and duties
• Laws and regulations that touch security and privacy
• Industry standards and frameworks in general terms
• Change management as a control
• Awareness training and acceptable use

You build An acceptable use policy for a small company, with the standard and procedure beneath it.

Most breaches involve someone who should not have had access. This module covers how identities are proven and how permissions follow from them, from passwords and multifactor authentication to role-based access, plus the physical doors that guard the machines.

• Identification, authentication, authorization, accounting
• Passwords, passphrases and why multifactor helps
• Single sign-on and directories in plain terms
• Discretionary, mandatory, role and attribute-based access
• Privileged accounts and how to watch them
• Physical access: badges, visitor logs and tailgating

You build An access matrix for a team of ten, with roles, privileges and a review schedule.

You cannot defend a network you cannot picture. Learn how data moves through layers, addresses and ports, then meet the common attacks and the devices and designs that stop them.

• The OSI and TCP/IP models side by side
• IP addresses, ports, DNS and DHCP
• Common protocols and the risks that come with them
• Denial of service, spoofing and on-path attacks
• Malware, phishing and social engineering
• Firewalls, IDS and IPS, and where each one sits
• Segmentation, VPNs and network access control

You build A labeled diagram of an office network showing where each defense sits.

Cloud changes who secures what. You learn the service and deployment models, what a provider handles and what stays with the customer, and the threats that appear when data and workloads leave the building.

• Infrastructure, platform and software as a service
• Public, private, hybrid and community deployment
• The shared responsibility model by service type
• Misconfiguration, weak identity and exposed storage
• Data location, residency and provider contracts
• Threats and defenses that are specific to cloud

You build A responsibility chart that splits security duties between a provider and a customer for three services.

When something goes wrong, the team that knows what normal looks like acts fastest. You learn what to log, how alerts are raised, and how an incident moves from detection through containment and recovery to review.

• What to log and why logs need protecting
• Alerts, thresholds and false positives
• The incident response lifecycle, preparation to lessons learned
• Roles in an incident: who decides, who acts, who tells
• Evidence handling and chain of custody basics
• Communicating during and after an incident

You build A one-page incident response plan with roles, steps and contact order.

Not every disruption is an attack, and security owns more than the attack. This module covers business impact, continuity and disaster recovery, backups, and the recovery targets that tell a team how fast and how much.

• Business impact analysis in plain steps
• Business continuity compared with disaster recovery
• Recovery time and recovery point objectives
• Backup types, storage and testing a restore
• Alternate sites and failover
• Testing and exercising a plan

You build A recovery plan for one critical system, with a backup schedule and recovery targets.

Bring every idea together on a single case. You find the assets, rate the risks, choose controls, check policy and access, and plan how the organization would detect and recover from a failure. The result is something you could hand to an owner.

• Scoping the organization and its assets
• Rating risk and choosing controls
• Checking policy, access and network design
• Cloud and third-party exposure
• Detection, response and recovery readiness
• Presenting findings to a non-technical owner

You build A short security review of a small organization, with findings and a plan of next steps.