Certified Security Principles+

Begin the certified security principles plus course with a foundational introduction to i.t. security, outlining core definitions and the groundwork for six modules in one chapter.

Understand security as protection against danger, damage, loss, and crime, and learn how measurement, risk management, and defense in depth align with business needs.

This lecture explains how to build a security program by aligning with ISO 27002 and NIST SP 800-53, emphasizing security by design and default and risk management.

Explores the CIA triad: confidentiality, integrity, and availability, and how access controls, encryption, hashing, and backups protect data, with administrative, technical, operational, and physical controls.

Explore how governance, risk, and compliance unify policies, baselines, standards, and enforcement to protect the enterprise, align stakeholders, and drive value.

Explore the state of security today through a PwC information security survey, highlighting IoT risk, data integrity, insider threats, and cloud security concerns.

Explore risk management from a holistic viewpoint using a structured framework, with a six-section module that begins with an all-encompassing overview and a dedicated risk assessment section.

Navigate the risk management flow by valuing assets, identifying threats and vulnerabilities, deploying safeguards and controls, and assessing risk probability and impact within a holistic security framework.

Assess risks within the CSP plus framework by identifying assets, vulnerabilities, and threats; quantify risk levels, estimate potential losses, and propose mitigations in a structured risk register.

Examine threats, risk types, and vulnerabilities, including threat agents, social engineering, phishing, malware, botnets, and common flaws like default passwords and buffer overflows, plus mitigation strategies.

Mitigate attacks through policy-based and technical controls plus user training. Implement change management, least privilege, and audits to sustain secure operations.

Learn how vulnerability assessments and penetration testing use automated scans to identify, prioritize, and report security gaps, informed by logs, meantime to failure, and meantime to repair data.

Demonstrates discovering vulnerabilities with open Voss, configuring deep scans, and generating detailed reports. Showcases asset discovery, scan options, and common issues such as SSL vulnerabilities.

Explore using a vulnerability assessment and penetration testing tool to configure scan jobs, define targets, run heavy vulnerability scans with external credentials options, generate detailed reports, and analyze findings.

Explore the penetration testing process, simulate malicious attacks, and understand regulatory reporting benefits and methodologies such as information gathering, scanning, enumeration, and privilege escalation.

Monitor and re-evaluate risk, reporting compliance and weighing cost versus benefit to guide risk response. Choose among transfer, reduction, acceptance, or avoidance, noting accountability cannot be transferred.

Understand the basics of cryptography, focusing on foundational concepts needed for the exam. Note that detailed algorithm work isn't required, and recognize its relevance for managers as a starting point.

Explore cryptography's core: from plain text to cipher text via ciphers and algorithms, using symmetric and asymmetric keys, hash functions, and measures of authentication, privacy, integrity, and non repudiation.

Explain symmetric encryption with a shared secret key for encrypting and decrypting data between systems. Review block and stream ciphers, modes like ECB, CBC, and AES as the standard.

Explore asymmetric encryption basics, including public and private keys, confidentiality, authenticity, and non repudiation. See how RSA, El-Gamal, Diffie-Hellman, and elliptic curve crypto systems enable key exchange and digital signatures.

Explore hashing as a data fingerprinting method that accepts any data, yields a fixed digest, and verifies integrity without encryption, using md5, sha256, sha512, and sha3.

Explore how public key infrastructure (PKI) uses certificate authorities, registration authorities, and certificate revocation lists in conjunction with the online certificate status protocol to secure keys and trusted identities.

Compare link versus end-to-end encryption and explain how IPsec secures data at the network layer, with handshakes, security associations, and session keys, including secure email standards like S/MIME and PGP.

Explore identity and access management concepts by examining authentication techniques, implementing single sign-on, and noting basic monitoring considerations.

Master identity management basics by identifying subjects, authenticating with passwords, pins, biometrics, or tokens, and enforcing authorization, provisioning, and deprovisioning within a secure account lifecycle.

Explore authentication techniques, including biometric enrollment, error types, password security, one-time passwords, and public key infrastructure, with emphasis on practical trade-offs.

Discover how single sign-on enables one credential across multiple resources. Examine kerberos, domain accounts, directory services, and federated identity standards like SAML and OpenID Connect.

Explore access control monitoring through log collection, auditing, and policies and procedures; implement IDS/IPS, defense in depth, and risk-based responses, including MFA and honeypots.

Explore data security fundamentals across systems and devices, starting with data handling, then networking, hosts, applications, and mobile devices, and examine storage encryption options and basic data management.

Compare direct attached storage, network attached storage, and storage area networks, and explore RAID parity, iSCSI and Fibre Channel for high availability in virtual environments.

Explore encryption options for confidentiality, including self-encrypting drives, encrypting file system, smart cards, BitLocker with TPM, and hardware security modules, plus their data-at-rest protections.

Learn to classify data, assign owners, custodians, stewards, and privacy officers, and apply data lifecycle, permissions, and deduplication to protect data in transit, at rest, and in use.

Apply security to networking by leveraging your protocol and service baseline, discuss devices and design, and delve into a detailed wireless networking module, focusing on securing this domain.

Explore how the network stack coordinates data across the application to physical layers, emphasizing encapsulation, routing, and key protocols like IP, ICMP, ARP, DNS, FTP, and SMTP.

Explore core network and security devices, from repeaters to switches and routers, learn about VLANs, NAT, gateways, and bastion hosts for secure DMZ deployments.

Explore firewalls and types from packet filtering and access control lists to proxy and application layer firewalls, securing traffic and enforcing rules.

Apply fundamental network design concepts, including isolation, segmentation, and DMZ design, to build scalable, secure networks that route traffic through servers while minimizing direct inter-system access.

Learn wireless networking basics, 802.11 standards and security approaches from WEP to WPA3, including AES, SAE, and enterprise vs. personal modes.

Explore server and host security basics and OS hardening with a Windows 10 focus. Review physical security, virtualization, and cloud security topics as the chapter progresses.

Trace the evolution of Windows operating systems from XP to 10, including Windows Server 2019. Explore security features like UAC, BitLocker, Shadow Copy, File History, and System Restore.

Explore compatibility mode and virtualization for legacy apps. Navigate Windows admin tools and NTFS folders, then preview Mac OS and Linux OS with Unix core and Gatekeeper.

Explore Linux architecture, including the kernel, hardware platform, and architecture dependent code, how system calls connect the kernel to user space across diverse open source distributions.

Learn essential linux commands for deleting files and directories, managing permissions, using grep with pipes, killing processes by their process IDs, and editing with vim, nano, or ed.

Learn practical operating system hardening by configuring firewalls, managing inbound rules across private, public, and domain profiles, and applying patches on patch tuesday with central update strategies.

Assess physical security risks and implement countermeasures to protect facilities from intruders and disasters. Ensure access control, lighting, alarms, power stability, and fire detection to safeguard assets.

Explore practical application security for non-developers, focusing on defense in depth, vulnerability testing, input validation, patch management, and understanding the OWASP top 10 without coding.

Master application security principles by protecting data, ensuring function integrity, validating inputs, and securing APIs via rest or soap, guided by stride threat modeling and software assurance.

Explore the software development lifecycle with a focus on security, from requirements and threat modeling to secure design, coding, testing, and automated DevOps practices.

Explore the OWASP top 10 2017, covering injection, broken authentication, session management, data exposure, cross-site scripting, insecure deserialization, and XML external entities, with mitigation through input validation and logging.

Master web app hardening concepts, including threat analysis, secure coding, least privilege, input validation, cryptography, and memory management, with error handling and testing against cross site scripting and sql injection.

Explain patching, updates, and configuration management to ensure provisioning, deprovisioning, and availability. Highlight automated tools like Puppet and Chef, change management, continuous validation, audits, and immutable configurations to reduce risk.

Explore how mobile devices and IoT fit within security principles, identify key risks, and outline hardening strategies and corporate management of these devices.

Clarify mobile devices as handheld, LCD touch devices, and distinguish them from internet of things devices. Note IoT devices use IP connectivity and constrained, low-power designs, creating security risks.

Explore the growing risks from mobile and IoT devices, including rising malware, ransomware trends, insecure apps, and phishing, then map attacker steps from reconnaissance to maintaining presence.

Harden mobile and IoT devices by securing the device, apps, and data access through mobile device management, encryption, remote wipe, app whitelisting, user training, and continuous monitoring.

Explore corporate mobile deployment models such as corporate owned, CYOD, BYOD, and VDI, and map them to data ownership, policy enforcement, and minimum security baselines.