EXIN Cyber & IT Security Foundation – CISEF

Curriculum

What you will learn

• Duration: 16 hours
• 10 modules
• Knowledge test per module
• Official PeopleCert aligned

• 00 Module 0 - Course introduction 8 lessons

  • About the course
  • About the instructor
  • About EXIN
  • About the certification
  • About the exam
  • Literature
  • Security study path
  • Cybersecurity: a matter of survival
• 01 Module 1 - Introduction to Cyber Security / Computer Systems 19 lessons

  • Objectives
  • Computer architecture and operating systems
  • Components of a computing system
  • The evolution of operating systems
  • How does an operating system work?
  • Main operating systems
  • Security in computer systems
  • Risks, Threats, and Vulnerabilities
  • Examples of computer system security measures
  • Examples of computer system security measures
  • Principles of the A-I-C triad in IT infrastructures
  • Integrity
  • Confidentiality
  • Security controls that ensure confidentiality
  • Availability
  • Availability metrics
  • IT security policy structure
  • Data Classification Standards
  • User – The Weakest Link in the Security of an IT Infrastructure!
• 02 Module 2 - Security in IT Infrastructures | The 7 Domains 37 lessons

  • Objectives
  • User Domain
  • How does the user domain work?
  • Responsibilities in the user domain
  • Relationship: risks, threats, vulnerabilities vs. mitigation strategies in the user domain
  • Workstation domain
  • How does the workstation domain work?
  • Responsibilities in the workstation domain
  • Relationship: risks, threats, vulnerabilities vs. Mitigation strategies in the workstation domain
  • LAN Domain
  • The physical components of the LAN domain
  • Logical elements of the LAN domain
  • How the LAN domain works
  • Responsibilities in the LAN domain
  • Relationship: risks, threats, vulnerabilities vs. mitigation strategies in the LAN domain
  • Lan-to-Wan Domain
  • Lan-to-Wan domain – examples of TCP and UDP ports
  • How does the Lan-to-Wan domain work?
  • Responsibilities in the Lan-to-Wan domain
  • Relationship: risks, threats, vulnerabilities vs. Mitigation strategies for the LAN-to-WAN domain
  • WAN Domain
  • How does the Wan domain work?
  • Responsibilities in the Wan domain
  • Relationship: risks, threats, vulnerabilities vs. WAN domain mitigation strategies
  • WAN domain – security issues with Internet providers
  • Security issues in the connectivity provided by the provider for the WAN domain
  • Remote access domain
  • How does the remote access domain work?
  • Responsibilities in the remote access domain
  • Security controls in the remote access domain
  • Relationship: risks, threats, vulnerabilities vs. Remote Access Domain Mitigation Strategies
  • System/application domain
  • How does the system/application domain work?
  • Responsibilities in the system/application domain
  • Data – the treasure stored in the System/Application Domain
  • Relationship: risks, threats, vulnerabilities vs. Mitigation strategies for the system/application domain
  • The importance of security controls
• 03 Module 3 - Applications and Databases / Security Issues and Countermeasures 25 lessons

  • Objectives
  • About Application Development
  • Types of applications
  • Types of system architectures
  • Systems development lifecycle methods
  • System Lifecycle (SLC)
  • Systems Development Life Cycle (SDLC)
  • Phases of Systems Development Life Cycles
  • A little more about equipment disposal
  • About system testing
  • Certification and accreditation
  • Certification
  • Accreditation
  • Waterfall Model
  • Traditional (waterfall) model vs. Agile methods
  • Security issues in the systems development lifecycle
  • Database
  • SQL language types
  • Database Management System (DBMS)
  • OWASP Top 10 Vulnerabilities
  • Top 10 countermeasures for OWASP vulnerabilities
  • Still on vulnerabilities…
  • SQL Injection
  • Examples of SQL Injection
  • Relevant aspects of security in the software development lifecycle
• 04 Module 4 - TCP/IP Networks 42 lessons

  • Objectives
  • The evolution of telecommunications
  • Protocol
  • TCP and IP
  • Other Types of Protocols – IPv4 and IPv6
  • Other Types of Protocols – HTTP
  • Other Types of Protocols – IPSec
  • Other Types of Protocols – SSH and SSL
  • Other Types of Protocols – TLS, DNS, VNC, and S/MIME
  • Other Types of Protocols – VOIP, SNMP, SMTP, and POP3
  • Other Types of Protocols – UDP, FTP, ARP, and Challenge and Response
  • Other Types of Protocols – ETHERNET
  • Addressing – IP
  • ICMP, Ping, and Traceroute
  • ICMP – Smurf Attack
  • Nodes
  • Hubs and Switches
  • Routers
  • Configuring a router
  • Node connection
  • Elements of the star topology
  • OSI Model
  • Layers of the OSI model and their functions
  • How protocols work in the layers
  • Network security risk categories
  • Risk category – network reconnaissance
  • Risk category – network sniffing
  • Risk category – network denial of service
  • Firewall – rules
  • Firewall
  • Firewall deployment techniques – Edge firewalls
  • Firewall deployment techniques – Filtered subnet (DMZ) firewalls
  • Firewall deployment techniques – Multilayer firewalls
  • VPN
  • VPN Technology
  • Network Access Control (NAC)
  • Wireless networks
  • Wireless networks – Wireless Access Points (WAP)
  • Wireless networks – the danger is in the air…
  • Wireless network security controls – wireless encryption
  • Beacon SSID
  • MAC Address Filtering
• 05 Module 5 - Cloud Computing 21 lessons

  • Objectives
  • Characteristics of cloud computing
  • Cloud deployment models – Private cloud
  • Cloud deployment model – Community cloud
  • Cloud deployment model – Public cloud
  • Hybrid cloud model
  • Cloud service models/types
  • SaaS (Software as a Service)
  • PaaS (Platform as a Service)
  • Usability and advantages of PaaS
  • IaaS (Infrastructure as a Service)
  • PaaS ≠ IaaS
  • SECaas (Security as a Service)
  • IDaaS (Identity as a Service)
  • Baas (Backup as a Service)
  • The risks of cloud computing – encryption
  • The risks of cloud computing – data storage and archiving and APIs
  • The risks of cloud computing – customer vs. Provider relationship and provider assurance
  • The risks of cloud computing – vendor lock-in
  • Managing risks
  • Risk = Threats vs. Vulnerabilities
• 06 Module 6 - Cryptography 35 lessons

  • Objectives
  • A bit of the history of Cryptography
  • Kerckhoffs Principle
  • Basic Concepts and Definitions in the Cryptographic Process
  • Basic concepts and definitions in the cryptographic process
  • Types of ciphers
  • Transposition ciphers
  • Substitution ciphers
  • Substitution ciphers – Vigenère Cipher and Vernam Cipher
  • Substitution ciphers – One-way function
  • Encryption methodologies – Symmetric cryptography vs. Asymmetric cryptography
  • Symmetric Encryption – Symmetric Confidentiality Process
  • Examples of symmetric cryptography
  • Asymmetric cryptography – Confidentiality
  • Asymmetric cryptography – Authenticity
  • Advantages and disadvantages of asymmetric cryptography
  • Examples of asymmetric cryptography
  • Cryptography in information security – Confidentiality
  • Cryptography in information security – Integrity
  • Cryptography in information security – Authentication
  • Cryptography in information security – Non-repudiation
  • Business and Security Requirements for Cryptography
  • Cryptanalysis
  • Cryptanalysis – Objectives and Tools
  • How do digital signatures provide authenticity and non-repudiation?
  • About non-repudiation
  • How hashing can provide the integrity of digital information
  • The main hash standards
  • Public Key Infrastructure (PKI)
  • Public Key Infrastructure (PKI) – processes
  • Digital certificates
  • Digital certificates – x.509v3 standard
  • SSL/TLS technologies and practical examples
  • IPsec technologies and practical examples
  • What can we conclude about cryptography in information security?
• 07 Module 7 - Identity and Access Management 17 lessons

  • Objectives
  • Identity and Access Management – Concept
  • Identification vs. Authentication
  • Identification vs. Authentication
  • Main Authentication technologies and two-factor authentication
  • Biometrics
  • Single Sign-On (SSO)
  • Advantages of SSO
  • Disadvantage of SSO
  • Password Management
  • Authorization in Access Management and Identity
  • Usability principles
  • Usability principles vs. Authorization
  • Access controls
  • Physical access controls
  • Logical Access Controls
  • OPENID CONNECT and OAUTH Specifications and Functionality
• 08 Module 8 - Exploiting Vulnerabilities 37 lessons

  • Objectives
  • Vulnerability – You need to know to mitigate
  • Malware
  • Examples of malware
  • Types of threats
  • Categories and types of attacks
  • Full Penetration – Trojan Horse
  • Full penetration – Backdoor and Spoofing
  • Full Penetration – Unicode Attack and Bypass Attack
  • Denial-of-service (DoS) attack
  • Not everything is an attack by...
  • Distributed Denial of Service (DDoS) attack
  • Theft or disclosure of information
  • Social engineering
  • Social engineering – Phishing
  • Social engineering – clues to identify phishing
  • Social engineering – Pharming
  • Other examples of attacks – Brute Force, Dictionary, and Repetition
  • Other examples of attacks – Masquerading, Espionage, and Smurf
  • Other examples of Hijacking attacks
  • White Hat Hacker = Ethical Hacker
  • Types of pentests – White Box (with full knowledge)
  • Types of pentests – Black Box (no knowledge)
  • Types of pentests – Grey Box (with limited knowledge)
  • Tools for pentests
  • Black Hat Hacker
  • (Black Hat Hacker) = “Cracker” Hacker
  • Grey Hat Hacker
  • Script Kiddies
  • Hacktivists
  • Tools used for cybercrime
  • Tools used for cybercrime – Vulnerability and port scanners
  • Tools used
  • For cybercrimes – Sniffers, wardialers, and keyloggers
  • How cybercriminals exploit vulnerabilities
  • Eight general preventive steps
  • Conclusion
• 09 Module 9 - Preparatory Practice Exams 9 lessons

  • CISEF Practice Exam 1: 40 Questions
  • CISEF Mock Exam 2: 40 Questions
  • CISEF Mock Exam 3: 40 Questions
  • CISEF Mock Exam 4: 40 Questions
  • CISEF Mock Exam 5: 40 Questions
  • CISEF Mock Exam 6: 40 Questions
  • CISEF Mock Exam 7: 40 Questions
  • CISEF Practice Exam 8: 40 Questions
  • CISEF 9 Practice Exam: 40 Questions