Instructor

CCSE Slides with notes

Blue Team Mock Exam 2

Enumeration / Foot printing

Blockchain

Topics Covered What is Blockchain? The history of Bitcoin Bitcoin not equal Blockchain What Is a Blockchain Bitcoin Ecosystem Cutting the Middleman Building Consensus Many Different Cryptocurrencies ❖ How Does Blockchain Work Uses of Blockchain  

AI/ML

Topics Covered What is Artificial Intelligence? What is Machine Learning What is Deep Learning Natural Language Processing- NLP AI/ML Careers Skills Required Intro to Neural Networks Security Implications for Machine Learning Applications for Machine Learning Security Risks Supervised and Unsupervised Learning Tools of Al/ML  

Biometrics

Topics Covered Fingerprint Iris – iris recognition Facial Voice Vein Gait False Acceptance Rate (FAR) False Rejection Rate (FRR)  

Secure Application Development Management

Topics Covered Software Development Environment Development Test Staging Production Quality assurance (QA) Provisioning and deprovisioning Integrity measurement Secure coding techniques Normalization Stored procedures Obfuscation/camouflage Code reuse/dead code Server-side vs. client-side Execution and validation Memory management Use of third-party libraries Open Web Application Security Project (OWASP) Software diversity Compiler Binary Automation/scripting Automated courses of action Continuous monitoring    

Assessments and Audits

Topics Covered Audit Frameworks Assessments and Audits Security Audit vs Security Assessment Password Audit Compliance Audit Information System Audit Internal Audit External Audit Physical Security Audit Information Governance Audit Checklists for Audit Virtual vs. Physical  

Risk Management

Topics Covered Risk Management Threats Manmade, Internal, External Exploits Quantitative Risk Management Qualitative Risk Management Risk Register Supply Chain Management Stakeholder Management Risk Management Strategies Risk Avoidance Risk Mitigation  

OSINT

Topics Covered What is OSINT How is OSINT Used? Five Steps For Creating An OSINT Strategy OSINT Cycle Harvest web data OSINT Tools and Resources Collect data from the dark web  

Compliance

Topics Covered Security Governance Regulatory Compliance Compliance Strategic Plan Tactical Plan Operational Plan Change Control Management Security Standards, Baselines, Guidelines Supply Chain Management  

Cloud Security – Cyber Security

Topics Covered Cloud Model Cloud organization Cloud Components  

Data Protection

Topics Covered Data in Transit Data in Use Data Retention Data Remnants Destruction Backups -redundancy Purging Wiping  

Access Control

Topics Covered Access Control Models Permissions, Rights, Privileges Implicit Deny Access Control Matrix Constrained Interface Content Dependent Control (CDI) Context Dependent Control (UDI) POLP-Principle of Least Privilege Separation Duties Privilege  

IDM (PAM, IAM)

Topics Covered Controlling Access to Assets Comparing Identification and Authentication Implementing Identity Management Managing Identity and Access Provisioning Lifecycle Remote Access Security Management VPN with respect to IAM/PAM Information Systems Capabilities Cloud+  

Security Architecture

Topics Covered Implement and Manage Engineering Processes using Secure Design Principles Separation of Duties Principle of Least Privilege (POLP) Threat Modeling Methodologies Security Models Minimize Attack Surface Defense in Depth Understand Fundamentals of Security Models Select Controls Based on System Requirements Understand Capabilities of Information Systems Assess and Mitigate Security Vulnerabilities Client Based Systems -Network Essentials Server Based Systems Network Essentials Database Systems 3nf, 2nf, …

Network Design

Topics Covered Packet Capture and Replay Packet Sniffer Protocol Analyzers (packet analyzer) Wireshark Who should use Wireshark? Wireshark Demo ➤ Tcpdump Packet sniffer in the cloud Wireshark’s cousin- tshark Tcpreplay Common Networking Protocols DNS Tools-nslookup, dig DNS Record Types Querying multiple servers DNS Poisoning  

Git and Github

Topics Covered What is Github? Why is Github important for Linux How to Install Git and create a Github account How does git work? Basic Git commands Quick Example Of Git and GitHub Summary

Cybersecurity fundamentals – Network Essentials

Topics Covered is the Internet of Things? How loT relates to IOT, Cloud and Big Data loT devices Smart home, Smart cars Home appliances Medical Devices Drones Industrial Control Systems (ICS) SCADA Systems – RTUs, PLCs Wearables loT Protocols loT Tools OWASP IoT Top 10  

Kali Linux

Topics Covered What is Linux? Windows V/s Linux OS Components of Linux OS What is a Linux Distro? What is Kali Linux? Features of Kali Linux Choosing the version and Downloading of Kali Linux Installation of Kali Linux

Software as a Service

Topics Covered What is a SaaS Key Differences between SaaS and other models • Common Examples of SaaS SaaS Delivery Official CertCop SaaS Characteristics When to use SaaS SaaS Limitations and Concerns Summary

Platform as a Service

Topics Covered What is Platform as a Service What type of Services are offered What are the responsibilities of the Consumer vs. the Cloud Service Provider PaaS Description Examples of PaaS PaaS Delivery Advantages of PaaS When to use PaaS Summary

Infrastructure as a Service

Topics Covered What is the laaS laas Delivery laaS Advantages laas Characteristics When to use laas laaS Limitations and Concerns Examples of laaS

Application Security

Topics Covered Cloud-Secure Software Development Lifecycle (SDLC) ISO ISO/IEC 27034-1 Standards for Secure Application Identity and Access Management (IAM) Cloud Application Architecture Cloud Application Assurance and Validation

Cloud Cybersecurity

Topics Covered Why Cybersecurity CIA Triad NIST Cloud Computing Cloud Security Alliance Cloud Benefits Cloud Models Components of Cloud: Cloud Security Best Practices Firewalls Data in Transit Data at Rest Stateful vs. Stateless Firewalls Intrusion Detection Systems (IDS) Intrusion Prevention Systems (IPS) Next Gen Firewalls Unified Threat Monitoring Vulnerability Scanning Penetration Test in the Cloud Networking Engineering Amazon Web Services Security Azure Security Google Cloud …

Fedramp System Security Plan (SSP) Control

Topics Covered What documents are required for initial package submission Why the SSP is one of the essential documents in the Security Package How to properly prepare for writing a SSP and submitting a Security Package How the SSP has organized an its relation to other documents included in the Security Package How to develop clear, concise, consistent, and complete information within each section of …

Fedramp Continuous Monitoring Strategy

Topics Covered Roles and Responsibilities within the ConMon Process Expectation for monthly reports all the vulnerabilities within the Plan of Action and Milestones (POA&M) Impact of changes to the cloud service and how to properly address planned and unplanned changes What FedRAMP is looking for when a CSP delivers monthly authenticated scans Tips to Enable Successful and Effective ConMon strategies

Fedramp Security Assessment Plan

Topics Covered What is a Security Assessment Plan? Laws, Regulations, Standards, Guidance Applicable Standards to FedRAMP FedRAMP Conops replaced by SAF Authorities for SAF 3PAO Accreditation Standards 3PAO Obligations FedRAMP Security Test Case Workbook Penetration Testing Plan and Methodology 3PAO Supplied Deliverables Penetration Test Rules of Engagement

Fedramp Best Practices

Topics Covered FedRAMP process/flowchart Preparation/Authorization/Continuous Monitoring Selecting a FedRAMP 3PAO How to Become a 3PAO/Guidelines Security Testing SAP Template Security Test Procedure Workbooks SAR Template Running Scans Guidelines for CSPS Summary

FedRAMP

Topics Covered FedRAMP Disclaimer FedRAMP Introduction FedRAMP Requirements