ISC2 Systems Security Certified Practitioner

Every access decision starts with proving who is asking. You administer credentials and multifactor methods, and learn how Kerberos, SAML, OAuth and OpenID Connect carry identity between systems without sharing passwords.

• Authentication factors and their weaknesses
• Password policy, storage and reset handling
• Single sign-on and federation, step by step
• Kerberos tickets and what can go wrong
• SAML, OAuth and OpenID Connect compared
• Service accounts, tokens and machine identity

You build A federation setup for one application, with a diagram of each trust step.

Permissions drift unless someone owns them. This module covers the access models, how accounts are created, changed and removed, and the reviews that catch excess privilege before an attacker or an auditor does.

• Discretionary, mandatory, role and attribute-based models
• Joiner, mover, leaver: provisioning and deprovisioning
• Privileged access and just-in-time elevation
• Access reviews and recertification
• Segregation of duties in system administration
• Directory services and group design

You build A role model and review process for a 50-person department.

Risk work begins with knowing what you run and where it is weak. You scan, read the results with judgment, rate what you find, and drive fixes through patching and compensating controls.

• The risk management cycle for administrators
• Vulnerability scanning: credentialed and unauthenticated
• Reading CVE and CVSS data in context
• Patch prioritization and testing before release
• Penetration testing: what it shows and what it cannot
• Compensating controls when a patch is not possible

You build A scan report triaged into a remediation plan with owners and dates.

Controls fail quietly, and logs are where you notice. You learn to set baselines, collect from many sources, correlate events in a SIEM and separate real signals from noise, using threat intelligence as context.

• What to collect: host, network, application and cloud logs
• Baselines and what normal looks like
• Correlation and use cases in a SIEM
• Network and host intrusion detection
• Event, alert and incident: where each line sits
• Threat intelligence feeds and indicators of compromise

You build Five detection use cases, each with data source, logic and expected false positives.

A good response is rehearsed before the incident. You work the response lifecycle, preserve evidence so it holds up, and bring systems back using continuity and disaster recovery plans that were written in advance.

• Preparing: roles, tools and runbooks
• Detection, triage and containment decisions
• Eradication and recovery without reinfection
• Evidence preservation and chain of custody
• Business continuity and disaster recovery basics
• Backups, restores and recovery testing
• Post-incident review and what to change

You build A response runbook for ransomware on a file server, from first alert to restored service.

Cryptography protects data only when it is chosen and used correctly. You learn how symmetric and asymmetric methods, hashing and digital signatures differ, and which problems each one solves and fails to solve.

• Symmetric encryption: block and stream, modes of operation
• Asymmetric encryption and key exchange
• Hash functions, salting and integrity checks
• Digital signatures and non-repudiation
• Common attacks on cryptographic systems
• Choosing a method for a stated need

You build A decision table that matches five data-protection needs to the right cryptographic tool.

Keys are the real secret, and most failures are operational. You administer certificates and a public key infrastructure, configure transport and storage encryption, and manage keys through their life.

• Certificate authorities, chains and revocation
• TLS configuration and common mistakes
• Disk, file and database encryption
• Email and messaging protection
• Key generation, storage, rotation and destruction
• Hardware security modules and escrow

You build A certificate and key management plan for a small web estate.

Networks carry everything, so their defenses must be layered and observable. You secure addressing, routing and name services, place firewalls and detection sensibly, protect wireless links and remote access, and meet the attacks aimed at each.

• Segmentation, VLANs and screened subnets
• Firewall rule design and egress filtering
• Securing DNS, DHCP and routing
• Wireless protocols, enterprise login and rogue access points
• VPN types for remote and site-to-site access
• Network access control and device posture
• Defending against denial of service and on-path attacks

You build A segmented network design with firewall rules for a company with an office, guest wireless and remote staff.

Attackers go after the easiest endpoint, so every device needs a baseline. You harden hosts and servers, defend against malicious code, secure virtual and cloud workloads, manage mobile devices and apply basic application security.

• Secure baselines and configuration benchmarks
• Endpoint protection and malware defense
• Patch, application control and allow-listing
• Virtual machines, containers and cloud workloads
• Mobile device management and bring-your-own-device
• Web application risks an administrator can reduce
• Email and browser security

You build A hardening checklist and automated check for one server role.

Put administration, monitoring, response and protection into one working picture. You secure a small estate, watch it, break it on purpose, and recover it, documenting each decision the way a team would need to see it.

• Scoping the environment and its risks
• Applying access, network and endpoint controls
• Turning on logging and building alerts
• Simulating an incident and working the runbook
• Restoring from backup and verifying integrity
• Writing the handover report

You build A documented, monitored small environment with an incident exercise and a handover report.