SECURITY
ADVANCE YOUR CAREER
Security Courses
CISSP
Close
CISSP
Course Number:
N/A
Five (5) days, classroom (can also be offered as a remote, video-based offering) training, focused on preparing attendees for taking and passing the CISSP exam. This class is based on the Official (ISC)2 CISSP Study Guide, 8th edition. It is taught by one of the authors of the book, James Michael Stewart. This class completely covers the topics listed on the official exam outline and serves as a solid preparation for the certification exam. The class will consist of lecture presentation of the materials while striving to answer all student questions about topics along the way. Students will need to read and review materials as well as take practice questions in the evenings and in the weeks following to round out their studies to be well suited for passing the CISSP certification exam.
Audience:
Course Duration:
5 Days
Prerequisites:
To qualify for the CISSP, you must have a minimum of five years of cumulative paid full-time work experience in two or more of the eight domains:
- Security and Risk Management
- Asset Security
- Security Engineering
- Communications and Network Security
- Identity and Access Management
- Security Assessment and Testing
- Security Operations
- Software Development Security
Course Objectives:
- Security and Risk Management
- Asset Security
- Security Engineering
- Communications and Network Security
- Identity and Access Management
- Security Assessment and Testing
- Security Operations
- Software Development Security
Course Outline:
- Security and Risk Management
- Confidentiality, Integrity and Availability
- Security Governance – Alignment of security function to strategy, goals, mission and objectives; organizational processes; security roles and responsibilities; due care and due diligence
- Compliance – Legislative and regulatory; privacy requirements compliance
- Legal and Regulatory Issues Pertaining to Information Security in Global Context – Computer crimes; licensing and intellectual property; import/export controls; trans-border data flow; privacy; data breaches
- Professional Ethics
- Documented Security Policy, Standards, Procedures and Guidelines
- Business Continuity Requirements
- Personnel Security Policies
- Risk Management Concepts
- Threat Modeling – Identifying; determining and diagramming potential attacks; reduction analysis; technologies and processes to remediate threats
- Security Risk Considerations Integrated into Acquisition Strategy and Practice – Hardware, software and services; third-party assessment and monitoring; minimum security requirements and service-level requirements
- Information Security Education, Training and Awareness
- Asset Security
- Classify Information and Supporting Assets
- Determine and Maintain Ownership
- Data Privacy
- Retention
- Data Security Controls
- Handling Requirements
- Security Engineering
- Engineering Processes Using Secure Design Principles
- Concepts of Security Models
- Controls and Countermeasures
- Security Capabilities of Information Systems
- Assess and Mitigate Vulnerabilities of Security Architectures, Designs and Solution Elements – Client-based; server-based; database security; large-scale parallel systems; distributed systems; cryptographic systems; industrial control systems
- Assess and Mitigate Vulnerabilities in Web-based Systems
- Assess and Mitigate Vulnerabilities in Mobile Systems
- Assess and Mitigate Vulnerabilities in in Embedded Devices and Cyber-Physical Systems
- Apply Cryptography – Lifecycle; types; PKI; key management practices; digital signatures; digital rights management; non-repudiation; integrity; methods of cryptanalytic attacks
- Secure Principles – Site and Facility Design
- Design and Implement Physical Security
- Communication and Network Security
- Secure Design Principles Applied to Network Architecture – OSI and TCP/IP models; IP networking; implications of multilayer protocols; converged protocols; software-defined networks; wireless networks; cryptography used to maintain communication security
- Secure Network Components – Operation of hardware; transmission media; network access control devices; endpoint security; content-distribution networks; physical devices
- Secure Communication Channels – Voice; multimedia collaboration; remotes access; data communications; virtualized networks
- Prevent or Mitigate Network Attacks
- Identity and Access Management
- Control Physical and Logical Access to Assets
- Manage Identification and Authentication of People and Devices
- Identity as a Service
- Third-Party identity Services
- Implement and Manage Authorization Mechanisms
- Prevent or Mitigate Access Controls Attacks
- Manage Identity and Access Provisioning Lifecycle
- Security Assessment and Testing
- Design and Validate Assessment and Test Strategies
- Conduct Security Control Testing
- Collect Security Process Data
- Analyze and Report Test Outputs
- Conduct or Facilitate Internal and Third Party Audits
- Security Operations
- Investigations – Evidence collection and handling; reporting and documenting; investigative techniques; digital forensics
- Requirements for Investigation Types – Operations; criminal; civil; regulatory; eDiscovery
- Logging and Monitoring Activities
- Sure Provisioning of Resources
- Foundational Security Operations Concepts
- Resource Protection Techniques
- Incident Management
- Operate and Maintain Preventative Measures
- Patch and Vulnerability Management
- Change Management Processes
- Recovery Stages – Backup storage strategies; recovery site strategies; multiple processing sites; system resilience, high availability, quality of service and fault tolerance
- Disaster Recovery Processes
- Test Disaster Recovery Plans
- Business Continuity Planning and Exercises
- Implement and Manage Physical Security
- Address Personal Safety Concerns
- Software Development Security
- Security in the Software Development Lifecycle
- Security Controls in Development Environments
- Assess Effectiveness of Software Security
- Assess Security Impact of Acquired Software
CompTIA Security
Close
CompTIA Security
Course Number:
N/A
This powerful five-day class is an intense, exam-focused approach to the Security+ certification. CompTIA Security+ is a globally recognized credential with certified professionals working in over 147 countries throughout the world. CompTIA Security+ meets the ISO 17024 standard and is approved by U.S. Department of Defense to fulfill Directive 8570.01-M requirements. It is also compliant with government regulations under the Federal Information Security Management Act (FISMA). The CompTIA Security+ certification covers network security, compliance and operation security, threats and vulnerabilities as well as application, data and host security. Additional material included in this class covers access control, identity management and cryptography.
Audience:
Course Duration:
5 days
Prerequisites:
There are no prerequisites required for this course.
Course Objectives:
- 20% — Network Security
- 18% — Compliance and Operational Security Prerequisites
- 20% — Threats and Vulnerabilities
- 15% — Application, Data and Host Security
- 15% — Access Control and Identity Management
- 12% — Cryptography
Course Outline:
- Measuring and Weighing Risk
- Risk Assessment
- Computing Risk Assessment
- Acting on Your Risk Assessment
- Risks Associated with Cloud Computing
- Risks Associated with Virtualization
- Developing Policies, Standards, and Guidelines
- Implementing Policies
- Understanding Control Types and False Positives/Negatives
- Risk Management Best Practices
- Disaster Recovery
- Monitoring and Diagnosing Networks
- Monitoring Networks
- Network Monitors
- Understanding Hardening
- Working with Service
- Patches
- User Account Control
- Filesystems
- Securing the Network
- Security Posture
- Continuous Security Monitoring
- Setting a Remediation Policy
- Reporting Security Issues
- Alarms
- Alerts
- Trends
- Detection Controls versus Prevention Controls
- Understanding Devices and Infrastructure
- Mastering TCP/IP
- OSI Relevance
- Working with the TCP/IP Suite
- IPv4 and IPv6
- Understanding Encapsulation
- Working with Protocols and Services
- Designing a Secure Network
- Demilitarized Zones
- Subnetting
- Virtual Local Area Networks
- Remote Access
- Network Address Translation
- Telephony
- Network Access Control
- Understanding the Various Network Infrastructure Devices
- Firewalls
- Routers
- Switches
- Load Balancers
- Proxies
- Web Security Gateway
- VPNs and VPN Concentrators
- Intrusion Detection Systems
- Understanding Intrusion Detection Systems
- IDS vs. IPS
- Working with a Network-Based IDS
- Working with a Host-Based IDS
- Working with NIPSs
- Protocol Analyzers
- Spam Filters
- UTM Security Appliances
- Access Control, Authentication, and Authorization
- Understanding Access Control Basics
- Identification vs. Authentication
- Authentication (Single Factor) and Authorization
- Multifactor Authentication
- Layered Security and Defense in Depth
- Network Access Control
- Tokens
- Federations
- Potential Authentication and Access Problems
- Authentication Issues to Consider
- Authentication Protocols
- Account Policy Enforcement
- Users with Multiple Accounts/Roles
- Generic Account Prohibition
- Group-based and User-assigned Privileges
- Understanding Remote Access Connectivity
- Using the Point-to-Point Protocol
- Working with Tunneling Protocols
- Working with RADIUS
- TACACS/TACACS+/XTACACS
- VLAN Management
- SAML
- Understanding Authentication Services
- LDAP
- Kerberos
- Single Sign-On Initiatives
- Understanding Access Control
- Mandatory Access Control
- Discretionary Access Control
- Role-Based Access Control
- Rule-Based Access Control
- Implementing Access Controlling Best Practices
- Least Privileges
- Separation of Duties
- Time of Day Restrictions
- User Access Review
- Smart Cards
- Access Control Lists
- Port Security
- Working with 802.1X
- Flood Guards and Loop Protection
- Preventing Network Bridging
- Log Analysis
- Trusted OS
- Secure Router Configuration
- Protecting Wireless Networks
- Working with Wireless Systems
- IEEE 802.11x Wireless Protocols
- WEP/WAP/WPA/WPA2
- Wireless Transport Layer Security
- Understanding Wireless Devices
- Wireless Access Points
- Extensible Authentication Protocol
- Lightweight Extensible Authentication Protocol
- Protected Extensible Authentication Protocol
- Wireless Vulnerabilities to Know
- Wireless Attack Analogy
- Securing the Cloud
- Working with Cloud Computing
- Software as a Service (SaaS)
- Platform as a Service (PaaS)
- Infrastructure as a Service (IaaS)
- Private Cloud
- Public Cloud
- Community Cloud
- Hybrid Cloud
- Working with Virtualization
- Snapshots
- Patch Compatibility
- Host Availability/Elasticity
- Security Control Testing
- Sandboxing
- Security and the Cloud
- Cloud Storage
- Host, Data and Application Security
- Application Hardening
- Databases and Technologies
- Fuzzing
- Secure Coding
- Application Configuration Baselining
- Operating System Patch Management
- Application Patch Management
- Host Security
- Permissions
- Access Control Lists
- Antimalware
- Host Software Baselining
- Hardening Web Servers
- Hardening Email Servers
- Hardening FTP Servers
- Hardening DNS Servers
- Hardening DHCP Services
- Protecting Data Through Fault Tolerance
- Backups
- RAID
- Clustering and Load Balancing
- Application Security
- Best Practices for Security
- Data Loss Prevention
- Hardware-Based Encryption Devices
- Cryptography
- An Overview of Cryptography
- Historical Cryptography
- Modern Cryptography
- Working with Symmetric Algorithms
- Working with Asymmetric Algorithms
- What Cryptography Should You Use?
- Hashing Algorithms
- Rainbow Tables and Salt
- Key Stretching
- Understanding Quantum Cryptography
- Cryptanalysis Methods
- Wi-Fi Encryption
- Using Cryptographic Systems
- Confidentiality and Strength
- Integrity
- Digital Signatures
- Authentication
- Nonrepudiation
- Key Features
- Understanding Cryptography Standards and Protocols
- The Origins of Encryption Standards 2
- Public-Key Infrastructure X.509/Public-Key Cryptography Standards
- 509
- SSL and TLS
- Certificate Management Protocols
- Secure Multipurpose Internet Mail Extensions
- Secure Electronic Transaction
- Secure Shell
- Pretty Good Privacy
- HTTP Secure
- Secure HTTP
- IP Security
- Tunneling Protocols
- Federal Information Processing Standard
- Using Public-Key Infrastructure
- Using a Certificate Authority
- Working with Registration Authorities and Local Registration Authorities
- Implementing Certificates
- Understanding Certificate Revocation
- Implementing Trust Models
- Hardware-Based Encryption Devices
- Malware, Vulnerabilities and Threats
- Understanding Malware
- Surviving Viruses
- Symptoms of a Virus Infection
- How Viruses Work
- Types of Viruses
- Managing Spam to Avoid Viruses
- Antivirus Software
- Understanding Various Types of Attacks
- Identifying Denial-of-Service and Distributed Denial-of-Service Attacks
- Spoofing Attacks
- Pharming Attacks
- Phishing, Spear Phishing, and Vishing
- Xmas Attack
- Man-in-the-Middle Attacks
- Replay Attacks
- Smurf Attacks
- Password Attacks
- Privilege Escalation
- Malicious Insider Threats
- Transitive Access
- Client-Side Attacks
- Typo Squatting and URL Hijacking
- Watering Hole Attack
- Identifying Types of Application Attacks
- Cross-Site Scripting and Forgery
- SQL Injection
- LDAP Injection
- XML Injection
- Directory Traversal/Command Injection
- Buffer Overflow
- Integer Overflow
- Zero-Day Exploits
- Cookies and Attachments
- Locally Shared Objects and Flash Cookies
- Malicious Add-Ons
- Session Hijacking
- Header Manipulation
- Arbitrary Code and Remote Code Execution
- Tools for Finding Threats
- Interpreting Assessment Results
- Tools to Know
- Risk Calculations and Assessment Types
- Social Engineering and Other Foes
- Understanding Social Engineering
- Types of Social Engineering Attacks
- What Motivates an Attack?
- The Principles Behind Social Engineering
- Social Engineering Attack Examples
- Understanding Physical Security
- Hardware Locks and Security
- Mantraps
- Video Surveillance
- Fencing
- Access List
- Proper Lighting
- Signs
- Guards
- Barricades
- Biometrics
- Protected Distribution
- Alarms
- Motion Detection
- Environmental Controls
- HVAC
- Fire Suppression
- EMI Shielding
- Hot and Cold Aisles
- Environmental Monitoring
- Temperature and Humidity Controls
- Control Types
- A Control Type Analogy
- Data Policies
- Destroying a Flash Drive
- Some Considerations
- Optical Discs
- Security Administration
- Third-Party Integration
- Transitioning
- Ongoing Operations
- Understanding Security Awareness and Training
- Communicating with Users to Raise Awareness
- Providing Education and Training
- Safety Topics
- Training Topics
- Classifying Information
- Public Information
- Private Information
- Information Access Controls
- Security Concepts
- Complying with Privacy and Security Regulations
- The Health Insurance Portability and Accountability Act
- The Gramm-Leach-Bliley Act
- The Computer Fraud and Abuse Act
- The Family Educational Rights and Privacy Act
- The Computer Security Act of 1987
- The Cyberspace Electronic Security Act
- The Patriot Act
- Familiarizing Yourself with International Efforts
- Mobile Devices
- BYOD Issues
- Alternative Methods to Mitigate Security Risks
- Disaster Recovery and Incident Response
- Issues Associated with Business Continuity
- Types of Storage Mechanisms
- Crafting a Disaster-Recovery Plan
- Incident Response Policies
- Understanding Incident Response
- Succession Planning
- Tabletop Exercises
- Reinforcing Vendor Support
- Service-Level Agreements
- Code Escrow Agreements
- Penetration Testing
- What Should You Test?
- Vulnerability Scanning