> For the complete documentation index, see [llms.txt](https://martian1337.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://martian1337.gitbook.io/notes/training-and-career/guides/cybersecurity-training-topics.md).

# Cybersecurity Training Topics

### 1. Threats, Attacks, and Vulnerabilities

* Types of Malware: Viruses, worms, trojans, ransomware, spyware, adware, rootkits, botnets, RAT, polymorphic malware, keyloggers, grayware.
* Types of Attacks: Social engineering attacks, Man-in-the-Middle, DDoS and DoS attacks, code injection attacks, replay attacks, rainbow table attacks, dictionary attacks, pass the hash, hijacking and related attacks, Advanced Persistent Threats (APTs).
* Physical security attacks: Tailgating, lock picking, fence jumping.
* Threat Actors: Insider threats, nation-states/APTs, organized crime, script kiddies, hacktivists, cyberterrorists, unintentional threats.
* Indicators of Compromise: Unusual network traffic, anomalies in privileged user account activity, sudden increase in database read volume, suspicious registry or system file changes.
* IoT and embedded device threats: Insecure configurations, weak authentication, firmware vulnerabilities.
* Advanced Threat Tactics: Living off the land attacks, fileless malware.
* Malware Analysis: Static and dynamic analysis techniques, behavior analysis.
* Insider Threats: Detection and mitigation strategies.
* Fileless Malware: Analysis and response techniques.
* Social Engineering: Pretexting, quid pro quo, tailgating, manipulation techniques.
* Supply Chain Attacks: Assessing and securing the software and hardware supply chain.
* Zero-day Vulnerabilities: Identifying and addressing undisclosed vulnerabilities.
* Incident Response: Incident handling and response, containment, eradication, recovery.
* Threat Hunting: Proactive identification of advanced threats.
* Mobile Device Security: Best practices for securing smartphones, tablets, and other mobile devices.
* Wireless Security: Securing wireless networks, preventing unauthorized access.
* Web Application Security: Secure coding practices, input validation, output encoding, session management.

### 2. Identity and Access Management

* Account Management: Least privilege, onboarding/offboarding processes, permission auditing, password complexity.
* Access Control Models: Role-Based Access Control (RBAC), Mandatory Access Control (MAC), Discretionary Access Control (DAC), Attribute-Based Access Control (ABAC).
* Identity Repositories: LDAP, SQL databases, Active Directory, federated identities.
* Biometric Authentication: Fingerprints, retina scanning, facial recognition.
* Multi-Factor Authentication (MFA): Different factors, implementation methods.
* Identity as a Service (IDaaS): Cloud-based identity management.
* Cloud Identity and Access Management: AWS IAM, Google IAM, Azure AD.
* Privileged Access Management (PAM): Managing and securing administrative access.
* Federation and Single Sign-On (SSO): OAuth, OpenID Connect, SAML.
* Privileged Account Management (PAM): Monitoring and controlling privileged accounts.
* Just-in-Time (JIT) and Just-Enough-Access (JEA): Provisioning temporary and limited access.
* Identity Governance and Administration (IGA): Managing digital identities, roles, entitlements.
* Biometric Technologies: Voice recognition, gait analysis, behavioral biometrics.
* Passwordless Authentication: Alternative authentication methods.
* Single Sign-On (SSO) Federation: Federated identity providers, SSO protocols.
* Privilege Escalation: Techniques used to gain elevated privileges.

### 3. Technologies and Tools

* Network Security: Firewalls, IDS/IPS, VPNs, network scanners, vulnerability scanners.
* Endpoint Security: Antivirus, anti-malware, host-based firewalls, host-based IDS/IPS.
* Security Information and Event Management (SIEM) Systems: Real-time monitoring, log collection, correlation.
* Secure Staging Deployment: Sandbox environments, secure baseline configurations.
* Cloud-Based Security Tools: Web Application Firewalls (WAFs), Cloud Access Security Brokers (CASBs), Cloud Security Posture Management (CSPM) tools.
* Security Orchestration, Automation, and Response (SOAR): Automating security operations and incident response.
* Endpoint Detection and Response (EDR): Real-time threat monitoring and response on endpoints.
* Firewalls: Next-generation firewalls (NGFWs), application-aware firewalls, web application firewalls (WAFs).
* Security in DevOps: Integrating security practices into DevOps workflows and pipelines.
* IoT Security: Securing Internet of Things (IoT) devices and networks.
* Secure Email Gateways (SEG): Protection against email-based threats such as phishing and malware.
* Cloud Workload Protection Platforms (CWPP): Securing cloud workloads and containers.
* DevSecOps: Integrating security practices into DevOps methodologies.
* Secure Remote Access: Virtual Private Networks (VPNs), remote desktop solutions, multi-factor authentication (MFA).
* Web Application Firewalls (WAFs): Protecting web applications from common attacks.
* Cloud Security: Securely deploying and managing applications and services in cloud environments.
* Intrusion Detection Systems/Intrusion Prevention Systems (IDS/IPS): Monitoring and preventing unauthorized access and attacks.
* Vulnerability Scanners: Identifying and assessing vulnerabilities in systems and applications.
* Security Information and Event Management (SIEM) Systems: Collecting and analyzing security event logs for threat detection and incident response.

### 4. Risk Management

* Vulnerability Management: Vulnerability scanning, patch management, remediation processes.
* Data Loss Prevention (DLP): Techniques to prevent data leakage, such as endpoint DLP, network DLP, email DLP.
* Vendor Risk Management: Assessing and managing risks associated with third-party vendors and suppliers.
* Risk Management Frameworks: ISO 27001/27002, NIST SP800-53, COBIT, ITIL.
* Incident Response procedures: Incident response planning, initial response, documentation, escalation, reporting, post-incident response.
* Business Impact Analysis (BIA): Assessing potential effects of disruptions to business functions.
* Disaster Recovery: Recovery Point Objective (RPO), Recovery Time Objective (RTO), recovery strategies.
* Continuous Monitoring: Ongoing tracking and evaluation of security controls.
* Business Continuity Management (BCM): Developing and testing plans to ensure business resilience.
* Privacy and Data Protection Laws: Understanding global regulations such as GDPR, CCPA, HIPAA.
* Threat Modeling: Identifying and evaluating potential threats and vulnerabilities in systems and applications.
* Quantitative and Qualitative Risk Assessment: Estimating and evaluating risks using numerical or descriptive methods.
* Risk Register and Risk Treatment Plan: Documenting identified risks and defining appropriate risk response strategies.
* Security Assessment and Authorization: Evaluating and authorizing systems to operate within acceptable risk levels.
* Privacy Impact Assessments (PIA): Assessing the privacy risks and impacts of systems and processes.
* Security Program Management: Developing and managing security programs, policies, and procedures.
* Security Governance: Roles and responsibilities, compliance with regulations and standards.

### 5. Architecture and Design

* Security Frameworks: CIS Controls, NIST Cybersecurity Framework, ISO/IEC 27001.
* Secure Network Design: Segmentation, network access control (NAC), zero-trust networks.
* Container Security: Securing container technologies like Docker and Kubernetes.
* Secure Mobile Device Deployment: Implementing mobile device management (MDM) solutions and enforcing device security policies.
* Software-Defined Networking (SDN) Security: Securing virtualized network environments and network function virtualization (NFV).
* Web Application Security: Secure coding practices, input validation, output encoding, session management, error handling.
* Cloud Security Architecture: Securely designing and deploying applications and services in cloud environments.
* Secure IoT Deployment: Implementing security measures for IoT devices, protocols, and communication channels.
* Microsegmentation: Implementing fine-grained network segmentation to isolate workloads and limit lateral movement.
* Identity and Access Provisioning: Implementing processes and technologies to ensure secure user access provisioning and deprovisioning.
* Security Architecture Diagrams: Creating visual representations of security architecture and controls.
* Security in Agile Development: Integrating security practices into Agile software development methodologies.
* Security in DevOps: Integrating security practices into DevOps workflows and pipelines.
* Security in Cloud Environments: Securely designing and configuring cloud environments and services.
* Secure Software Development: Secure coding practices, code reviews, and secure development lifecycle (SDLC) methodologies.
* Secure Data Storage and Transmission: Encryption, secure protocols, secure file storage, secure data transfer.

### 6. Cryptography and PKI

* Cryptographic Protocols: SSL/TLS, IPsec, SSH, HTTPS, LDAPS.
* Cipher Suites: RC4, AES, DES, 3DES, HMAC, RSA, SHA, understanding different types of attacks on encryption: Cryptographic attacks, Brute-force attacks, Birthday attacks, Rainbow table attacks, Dictionary attacks.
* Key Management: Key escrow, key stretching, public key infrastructure.
* PKI Components and their roles: CA (Certificate Authority), RA (Registration Authority), Certificate repository, CRL (Certificate Revocation List), OCSP (Online Certificate Status Protocol).
* Quantum Cryptography: Understanding quantum key distribution and post-quantum cryptography.
* Cryptocurrency: How blockchain and cryptographic principles apply to cryptocurrencies.
* Hardware Security Modules (HSM): Devices used to manage digital keys securely.
* Digital Signatures: Assuring integrity and non-repudiation of digital communications or files.
* Quantum Computing: Impact on encryption and how to prepare for a post-quantum world.
* Secure Hashing Algorithms: SHA-1, SHA-2, SHA-3, and their different uses.
* Digital Rights Management (DRM): Protecting intellectual property using encryption, licensing, and access control.
* Cryptocurrency: Understanding blockchain technology, cryptocurrency wallets, and transaction security.
* Secure Socket Layer (SSL) Decryption: Enabling security appliances to inspect encrypted traffic.

### 7. Governance, Risk, and Compliance

* Third-Party Risk Management: Assessing and managing risks associated with vendors, suppliers, and business partners.
* Incident Response Plan (IRP): Developing and testing a comprehensive plan to address security incidents effectively.
* Security Policies, Standards, and Procedures: Developing and implementing policies aligned with industry best practices and legal requirements.
* Security Metrics and KPIs: Defining and tracking key performance indicators to measure the effectiveness of security controls.
* Security Training and Awareness Programs: Educating employees on security best practices, policies, and emerging threats.
* Compliance Auditing: Internal audits, third-party audits, penetration testing.
* Laws and Regulations: Computer Fraud and Abuse Act (CFAA), EU Cybersecurity Act, California Consumer Privacy Act (CCPA).
* Ethical Hacking: White hat practices, penetration testing, vulnerability assessments.
* Compliance Requirements: Payment Card Industry Data Security Standard (PCI DSS), General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA), Sarbanes-Oxley Act (SOX), ISO 27001, NIST 800-53.
* Personnel Management: Hiring practices, background checks, employment agreements (NDA, Non-compete), termination processes, continuous education.
* Data Privacy and Protection: Personally Identifiable Information (PII), Protected Health Information (PHI), Payment Card Industry Data Security Standard (PCI DSS).
* Organizational Risk Management: Risk appetite/tolerance, risk avoidance, transference, acceptance, mitigation, deterrence.
* Information Classification: Public, sensitive, private, confidential.
* Privacy Impact Assessments (PIA): Assessing the privacy risks and impacts of systems and processes.
* Security Awareness Training: Implementing effective training programs for staff.
* Code of Ethics: Understanding and adhering to ethical guidelines and professional behavior in the field of cybersecurity.

### 8. Operations and Incident Response

* Forensics: Collecting, analyzing, and reporting on digital data in a legally admissible manner.
* Incident Handling: Preparation, identification, containment, eradication, recovery, and lessons learned.
* Business Continuity Planning (BCP): Ensuring critical business functions can continue during and after a disaster.
* Cybersecurity Frameworks: Understanding different frameworks like NIST Cybersecurity Framework, MITRE ATT\&CK.
* Threat Hunting: Proactive identification of threats in the environment.
* Purple Teaming: Combination of red teaming (attack simulation) and blue teaming (defense) for comprehensive security.
* Threat Intelligence Sharing: Collaborating with industry peers and information sharing communities to exchange threat intelligence.
* Incident Response Playbooks: Developing predefined response plans for different types of security incidents.
* Digital Forensics Tools and Techniques: Collecting and analyzing digital evidence for incident investigations.
* Business Impact Analysis (BIA): Assessing the potential impact of disruptions on critical business processes and systems.
* Disaster Recovery Planning (DRP): Developing and testing plans to recover IT infrastructure and systems after a disaster.
* Security Incident and Event Management (SIEM) Systems: Collecting and analyzing security event logs for threat detection and incident response.
* Incident Response Exercises and Tabletop Drills: Simulating real-world security incidents to test response capabilities.
* Incident Response Automation: Implementing tools and processes for automated incident detection, analysis, and response.
* Cloud Incident Response: Understanding unique challenges and best practices for incident response in cloud environments.
* Malware Analysis: Techniques and tools for analyzing and understanding the behavior of malicious software.
* Security Incident Reporting and Documentation: Maintaining accurate records of security incidents for regulatory compliance and legal purposes.