CISA - A complete course

Explore how enterprise information technology governance integrates with corporate governance to align objectives, manage risk, measure performance, and ensure security across outsourcing, compliance, and audits.

Develop a strategic information systems plan aligned with organizational goals and governance. Leverage business intelligence and data architecture from sources to warehouses to enable informed decisions and sustainable competitive advantage.

Explore data governance and management, prioritize ROI and risk in enterprise data initiatives, guided by governance frameworks and a steering committee, with policies, standards, and information security.

Define the purpose of risk management, assign responsibility, and integrate it across the organization; identify assets, threats, and vulnerabilities, then implement controls to reduce residual risk.

Analyze risk using qualitative and quantitative methods, balance subjective judgments with numeric measures, and apply maturity models like CMMI to enhance IT governance and compliance.

Learn sound financial management practices for IT through budgeting, chargeback, and funding, then navigate outsourcing with risk assessment, service levels, and third party audit considerations.

Govern outsourcing and cloud services by aligning governance with business objectives, defining roles and SLAs, managing risk, and monitoring performance with KPIs and audits.

Explore the system development lifecycle from planning to maintenance, using a Zomato-like case to illustrate feasibility, requirements, design, make or buy decisions, and post-implementation evaluation.

Evaluate in-house versus acquired software by weighing cost, security, and overemployment, then follow a formal SDLC with ISO 9001/27001, RFPs, customization, testing, and data migration.

Develop ERP configurations by enforcing change and configuration management, ensure data integrity during migrations, and document development with SDLC, data flow diagrams, and entity relationship diagrams.

Explore acceptance testing, production readiness, and post-implementation review within complex system deployments, covering implementation planning, data migration, security controls, and governance to ensure effective operational transition.

Examine how risk, cost, and documentation shape SDLC decisions, governance, and project management, highlighting the need for honest controls, board oversight, and disciplined planning.

Trace the shift from waterfall to agile approaches like extreme programming and dynamic system development, emphasizing flexible, incremental delivery through prototyping and customer feedback.

Explore how prototyping, evolutionary development, and traditional models like waterfall shape software design, with iterative evaluation, user feedback, risk management, change control, and cost considerations.

Explore rapid application development for government-scale systems using drag-and-drop tools and automated forms to design, test, and deliver high-quality mobile and web applications quickly.

Explore object oriented programming concepts such as inheritance, encapsulation, and polymorphism, and learn how classes and objects interact through abstraction to build modular, interoperable software.

Learn benchmarking as a continuous, systematic process to compare our processes with industry leaders, identify strengths and weaknesses, and drive improvements through milestone-driven planning and data collection and analysis.

Discover how business process reengineering and automation reshape operations—from stock market analysis to Coca-Cola’s ninety percent automation—using software and Microsoft Dynamics to cut costs and improve compliance.

Examine software engineering and business process reengineering, emphasizing rapid application development, automation, security, testing, and the integration of development and operations for scalable, cost-efficient systems.

Explore real-time, enterprise-wide software integration across diverse technologies, addressing modular design, change management, testing, and secure deployment to deliver coordinated, scalable applications.

Trace the evolution from fourth-generation computing to modern automation, highlighting object-oriented programming, databases, drag-and-drop interfaces, and the balance between technical procedures and user-friendly applications.

Explore the software development process from analysis to testing and documentation, aided by flowcharts and Visual Studio tools. Understand standards, cross-platform design, data security, and ROI considerations in modern applications.

Explore infrastructure development and acquisition for ICT, including cloud data centers, VPN and network security, and a structured vendor selection and proof of concept process.

Plan and execute hardware and software acquisitions by defining precise specifications, issuing requests for proposals, and applying evaluation criteria to select vendors, negotiate terms, and ensure robust support and security.

Explore how organizations evaluate software options from open source to cloud services, using cost-benefit analysis, procurement documentation, and vendor due diligence.

Identify and implement application and general controls to monitor transaction processing, ensure input validity, proper authorization, batch processing integrity, and thorough reconciliation.

Explore transaction processing controls, data validation, segregation of duties, and auditing to safeguard payment processing, authorization, verification, and integrity across financial systems.

Explore how controls, authorization, and data integrity safeguard financial and digital processes, from negotiable instruments and digital signatures to secure reporting, distribution, and cryptocurrency risk.

Examine application controls and testing methods to ensure confidentiality and integrity, conduct risk assessment, and evaluate cost-benefit analysis through documentation, design specifications, and penetration testing for secure systems.

Explore segregation of duties, authorization, and verification controls to prevent misuse. Use documented job descriptions, access control lists, and independent testing to support audits and secure system access.

Discover how decision support systems aggregate data to propose alternatives for structured and unstructured problems, from disaster recovery to stock forecasts and manufacturing.

Understand information system implementation in production, covering system and acceptance testing, testing plans, automated vs manual testing, and post-implementation review to ensure quality and requirements.

Explain how a test plan targets specific code portions, categorizes deficiencies, and sets severity for fixes before production. Compare bottom-up and top-down testing with drivers and documentation.

Master data integrity testing to ensure accuracy, completeness, and authorization, using cyclic checks, fault-tolerant online transaction processing, and relational and referential integrity under ACID.

Explore configuration and release management within ITIL, emphasizing controlled changes to hardware, software, and networks. Ensure reliability, availability, and security through regression testing and rollback planning.

Explore data migration and system migration from offline to online, detailing data conversion, mapping, ETL processes, and cloud deployment with risk, fallback, and testing to ensure data integrity.

Learn three changeover techniques—parallel, pilot, and phased—for migrating from an old system to a new ERP in live production, with total testing and a defined cutover.

Outline end-to-end system implementation from planning to testing, including change control, data migration, and phased production rollout, with emphasis on training, documentation, and a structured post-implementation support model.

Explore post-implementation review in ERP projects, analyzing Hershey and Nike cases to identify causes and costs of failures. Learn formal closure, independent audits, roi, and lessons for future improvements.

apply structured project management to software development, balancing user requirements with budget and schedule through initiation to closing while ensuring quality, security, and training.

Explore project management techniques and tools that align with corporate culture to balance budget, duration, and deliverables. Understand how projects, programs, and portfolios relate under the PMO.

The PMO acts as the project owner's permanent governance structure, ensuring staff support to optimize the project portfolio, realize benefits, and measure ROI through cost-benefit analysis and post-implementation review.

Assess how information systems are planned, acquired, developed, implemented, and disposed, and how auditors ensure governance, risk controls, and alignment with business objectives in software projects.

Initiate a project by drafting the project initiation document and charter, then secure approval through one-on-one meetings, kickoff sessions, and start workshops, while defining objectives and a work breakdown structure.

The lecture outlines software project planning and budgeting. It compares cost estimation methods, analog, bottom-up, parametric, and function point approaches like cocomo.

Frame a project’s business case with cost-benefit analysis and return on investment to justify or reject investments. Assess feasibility, alternatives, budget, and stakeholder needs to decide to proceed.

Explore how information systems blend hardware, software, networks, and people, comparing organization-centric and user-centric applications. Examine lifecycle models like waterfall and incremental development, emphasizing requirements, testing, and stakeholder collaboration.

Assess a retailer's high-level controls for point-of-sale, encryption, and data protection, highlighting PCI, GDPR, and California privacy gaps, and propose SDLC, database upgrades, and two-factor authentication improvements.

Explore self-assessment in domain three, focusing on data sanitization and parallel testing of new systems. Understand risk management, controls, audit trails, ERP selection, and waterfall development concepts.

Examine parameter tampering, cookie poisoning, and session handling flaws in web apps, and learn how input validation, data integrity during transmission, and auditing controls enhance security.

Explore auditing ERP migrations, focusing on data migration risks, post-implementation review, testing strategies, and governance controls to ensure payroll accuracy, data integrity, and project success.

Understand process ownership in system development, its impact on business needs and design costs, and how auditors engage early to align requirements with implemented solutions.

Analyze critical IT controls, from input-output validation and segregation of duties to offshore development risks, project management triangles, and testing strategies for secure software delivery.

Examine data integrity in legacy to ERP migration, audit roles, semantic and functional characteristics, testing strategies, production data use, and post-implementation review.

Learn how input controls prevent voucher data duplication during data entry by enforcing sequencing and range checks, ensuring accurate voucher records.

Explore hardware components from microprocessors to multicore CPUs, storage and I/O, and trace the evolution from supercomputers to personal computers, servers, and enterprise networks, with security and encryption considerations.

Explore radio frequency identification rfid technology across manufacturing and supply chains, from microchip identifiers to inventory tracking, while addressing privacy and security considerations.

Describe a maintenance program with acquisition planning, preventive maintenance, environmental controls, and asset management using RFID to protect assets, ensure uptime, and support audits.

Explore automation and job scheduling in production and ERP environments, from batch processing to real-time tasks, with priorities, dependencies, and backups. Ensure efficient, secure operations and auditable workflows.

Explore how human and machine interfaces enable data transfer across systems, including GUI and CLI, and learn security, encryption, authorization, auditing, and data integrity practices.

Assess how end-user computing enables rapid application development while exposing security and governance risks; emphasize independent testing, change control, authorization, authentication, and data protection.

Examine data governance and data quality, from planning and design to monitoring and retention, showing how garbage in, garbage out affects decision making in cloud and big data environments.

Explore access control for systems and operating system security, including system software selection, feasibility studies, cost considerations, change control, testing, and regression to safeguard data and IT resources.

Explore how hardware and software compose a computer system, from architecture and input-output to operating systems, memory management, and virtualization, with a focus on performance and security.

Explore how data communication software enables sender–receiver transmission across seven layers including physical, data link, network, transport, session, presentation, and application, and supports simplex, half duplex, and full duplex modes.

Explore how software licensing works, from ownership and licensing agreements to open source and free software, and learn how audits enforce compliance through asset management and centralized controls.

Explain source code management, from source and object code concepts to version control, access control, and escrow, and compare centralized versus distributed version control in the software lifecycle and audits.

Explore capacity management by planning, monitoring, and sizing computing and network resources to handle growth or reduction, while optimizing cost, performance, and reliability.

Learn four point problem management by comparing incident and problem management, performing root cause analysis with fishbone diagrams, and implementing proactive prevention, escalation, and documented resolution processes.

The help desk uses ticketing and a reference number to capture incidents, prioritize and escalate to specialists, and rapidly resolve problems through remote support and documented processes.

Explore how 24/7 network management uses tools like dashboards and incident management to optimize response time, availability, and help desk reporting using protocol analyzers such as Wireshark.

Explore day-to-day information system operation, including monitoring, backups, access controls, log management, and change control to ensure high-quality service and secure continuity.

Explore change management and change control procedures guiding offline to online transitions, centralized ERP upgrades, testing, deployment, and rollback plans to minimize risk and downtime.

Explore patch management as part of change and release management, including evaluating patches, testing in pilot implementations, deploying major, minor, and emergency releases, and planning rollbacks and contingency measures.

Define service level agreements as contracts between customers and providers that specify levels and response times. Link incident, problem, and change management with monitoring and benchmarking to improve service quality.

Analyze system exceptions, logs, and dashboards to diagnose performance issues and access control events. Assess service level agreements, outsourcing risks, and third-party accountability for reliable availability and security.

Defines and implements an enterprise architecture blueprint to align departments and service channels. Assesses availability and recovery options, and differentiates mission-critical from business-critical data to set service levels.

Learn how a database is a collection of files linked by keys, managed by a dbms to provide real-time, centralized data with reduced redundancy and secure access.

Explore enterprise and dbms architecture, defining metadata and its three types—conceptual, external, and internal schemas; map external views to internal storage with a data dictionary.

Explore relational databases, including one-to-one, one-to-many, and many-to-many relationships, and learn how tables, primary keys, and foreign keys enforce referential integrity, support joins, and enable normalization to reduce data redundancy.

Explore object-oriented database management concepts, including inheritance and encapsulation, compare object-oriented databases with relational systems, and examine big data, NoSQL, JSON and XML data interchange.

Examine database auditing and security across logical and physical schemas, with emphasis on access control, encryption, and audit trails. Understand backups, disaster recovery, and integrity measures to ensure data operations.

Explore how business continuity planning and disaster recovery planning build resiliency against disruptions, covering critical processes, impact analysis, downtime costs, backup storage, and recovery strategies.

Explore application resiliency, clustering types (active-active, active-passive), disaster recovery, and high availability strategies to protect services and minimize downtime.

Ensure telecommunications resilience by implementing a robust business continuity plan with fiber optic and copper backups, alternative routing, and redundant circuits to prevent downtime during disasters.

Explore backup schemes including full, incremental, and differential backups, and master rotation models like grandfather, father, son. Learn testing, offsite storage, and documentation for reliable disaster recovery.

Explains data backup storage, installation, and restoration, data retention policies, and the legal implications for enterprises. Describes raid storage concepts, data replication, and synchronous versus asynchronous disaster recovery.

Explains backup and restoration strategies, including offsite storage, cloud options, media rotation, and inventory management. Highlights security, environmental controls, retention policies, and disaster recovery through replication and snapshots.

Learn meteoritic backup procedures and how to set daily, weekly, or monthly backups aligned with recovery point and recovery time objectives, including offsite data, media, and documentation.

Activate contingency planning and backups to sustain business continuity after disasters. Identify key processes, assess risks, test recovery plans, and empower senior management with centralized, multi-location strategies.

Learn about business continuity planning and disaster recovery, including contingency backups, risk assessment, and plan activation to keep critical processes running during disruptions. Senior management bears responsibility for safeguarding assets.

Align IT planning with business strategy by assessing application criticality, mapping dependencies, and implementing testing, DRP/BCP, security controls, and resilient networks to protect data and operations.

Understand disaster recovery and business continuity planning, including DRP basics, disruption threats from natural and manmade disasters, cyber attacks, and pandemic scenarios, plus backup, restoration, and short-term, long-term contingency strategies.

Define and implement a cyclical business continuity planning lifecycle, covering policy scope, risk assessment, business impact analysis, strategy development, training, backups, and internal and public communications.

Coordinate preventive, detective, and corrective controls to detect incidents and recover quickly. Classify incidents, escalate appropriately, and sustain business continuity with backups and capacity monitoring.

Develop a comprehensive business continuity plan guided by business impact analysis, detailing incident management, evacuation, and recovery priorities. Assign clear roles and responsibilities for effective execution.

Learn to design and activate business continuity planning and disaster recovery strategies, including continuity of operations, crisis communication, and information system contingency plans for 30 days.

Explain disaster recovery testing from pre-test to post-mortem, including real-time simulations, backup-site validation, and quantitative metrics to improve business continuity.

Explore business continuity management through good practices, risk assessments, and testing to develop robust recovery plans that align with standards like NIST, HIPAA, and ISO 9001.

Develop and implement cost-effective disaster recovery planning to protect critical processes, ensure data availability, and meet recovery point and recovery time objectives across multiple locations.

Develop and select a recovery strategy by evaluating business process criticality, cost-benefit analysis, impact, and recovery time, using hot, warm, cold, hard, and mobile sites and reciprocal agreements.

Outline contractual provisions, roles, and access rules for disaster recovery, and require audits, testing, and insurance to ensure secure, rapid recovery across shared third-party arrangements.

Develop a disaster recovery plan through impact analysis and risk assessment, define activation criteria, recovery team roles, escalation procedures, and incident response to ensure swift post-disaster recovery.

Examine disaster recovery testing through a real case study, detailing third-party offsite data replication, ip failover, incident planning, risk assessment, and recovery planning alongside checklists and simulations.

Discover disaster recovery testing progression from tabletop exercises to full-scale simulations, with pre-test, post-mortem analysis, and careful documentation to improve recovery time, data integrity, and escalation protocol.

Explore how a 16-branch bank designs a branch automation project, balancing microwave radios, coaxial cable backups, encrypted traffic, wireless access for customers, and disaster recovery to protect confidential data.

Explore benchmarking to set industry standards for mission-critical systems, weigh high recovery costs, and apply change management and disaster recovery planning to minimize downtime.

Explore outsourcing risk, audits, and contract governance, covering service level agreements, right to audit, data security, physical security, disaster recovery planning, data backup, and business continuity planning.

Explore auditing of service level agreements, disaster recovery and business continuity, change management, incident handling, and data integrity controls in IT operations.

Explore the role of configuration and change management as the core of networking management, and examine how monitoring, topology, password policies, and disaster recovery relate to secure, reliable operations.

Explore disaster recovery planning for financial systems, balancing hardware, software, and physical security across primary and offsite sites. Learn about backup, RPO/RTO, testing, escrow, and change control.

Explore disaster recovery planning, business continuity, data classification, and impact analysis, alongside governance concepts through exam-style questions on process ownership, testing, outsourcing, and service level agreements.

Explore risk assessment, disaster recovery, and business continuity planning, including change management, testing, emergency response, data integrity, and continuity strategies for critical systems.

Explore disaster recovery and incident management, focusing on backup strategies, real-time snapshots, data confidentiality, and recovery time objectives to minimize data loss during incidents.

Examine patch management policy and risk-based decisions for timely critical patches, and explore emergency changes, incident response, and business continuity planning with RTO and RPO considerations.

Analyze data quality and integrity—from source data credibility and garbage in, garbage out—to extraction and transformation; assess change management, access controls, and logging for confidentiality and availability.

Learn how to design and implement security management and compliance programs, assess risk, protect sensitive information with access controls, and audit controls across people, processes, and technology.

Explore privacy principles and privacy policy requirements across departments. Learn to protect personally identifiable information, practice open disclosure, and ensure auditing for regulatory compliance.

Explore environmental exposure risks in IT facilities, define blackouts, brownouts, spikes, and surges, and show protective measures, redundancy, emi considerations, and disaster readiness.

Discover how to protect data, hardware, and people through physical access control, including locks, badges, biometrics, logging, CCTV, and visitor management.

Understand logical access controls and identity management, including authentication and authorization, to protect data and secure remote access, virtual private networks, proxies, and key network entry points.

Explore password-based authentication, identity and access management, and the roles of system administrators and guests, including password policies, encryption, hashing, expiry, lockouts, and two-factor tokens.

Explore how biometrics underpin identity and access management, covering physical and behavioral biometrics and the biometric lifecycle of access control.

Explore behavior oriented biometrics, including signature dynamics such as pressure, speed, and stroke, and voice recognition through speech dynamics, to securely authenticate users and manage lifecycle, privacy, and audit in enterprises.

Implement single sign-on to consolidate passwords across applications in a centralized authentication flow. Learn a two-step, SAML-based process that verifies identity before granting access.

Explore identity and access management, need-to-know principles, and how access control lists and matrices enforce least privilege. Examine centralized versus decentralized security and audit and remote access implications.

Learn how remote access relies on tcp/ip and packet switching, via isp, dsl, or dial-up, and why vpn with encryption and encapsulation protects data over public networks.

Audit logging and access control monitor system activity, protect audit trails, and ensure legal integrity with real-time analytics and SIEM.

Identify how data leakage occurs through careless handling and unapproved sharing, and show how DLP, classification, encryption, and centralized key management mitigate risk.

Auditors assess privacy principles, define which personally identifiable information to collect, ensure transparent policy and consent, and promote privacy by design across products, systems, and vendors.

Explore how wireless media networks connect devices from phones to smart TVs across campus and cities, and how storage networks and satellite links enable remote data sharing.

Explore network services and the network operating system, covering client-server interactions, network file systems, email distribution with authorization, and domain name to IP translation via DHCP for reliable networks.

Define cloud computing and its essential characteristics—on-demand access, broad network access, multi-tenancy, rapid elasticity—then compare service models, data ownership, security, audits, and SLAs across private, public, hybrid, and community clouds.

Examine patch release challenges in cloud environments, and apply identity and access management, service level agreements, exit strategies, and forensic auditing for data security.

Explore mobile computing policies and protections for enterprise data, including encryption, biometric authentication, MBM, secure containers, and BYOD management to prevent data loss and breaches.

Examine bring your own device policies, their productivity and cost benefits, and the security challenges—data protection, access control, device management, and wifi encryption like WPA—to prevent data leakage.

Explore the internet of things and machine-to-machine interactions across wearables, smart devices, healthcare, and supply chains, highlighting privacy and security risks.

Explore identity and access management as the core of computer security, covering authentication, authorization, physical and logical access controls, need-to-know, least privilege, and auditing to enforce policies and accountability.

Compare mandatory and discretionary access control, guided by top management policies and data sensitivity levels from top secret to unclassified.

Establish robust third-party access controls by conducting risk assessments, validating external parties through contracts and SLAs, and enforcing physical, logical, and network access with audits.

Detail identity and access management and layered access controls from network to application, covering authorization, authentication, privilege governance, logging, and password security policies.

Explore naming conventions for logical access control, standardizing user and admin accounts with examples. Link naming to access rules, accountability, and efficient security administration.

Explore federated identity management and how enterprises share a common user identity to access diverse services. See how identity providers and service providers establish trust for cross domain access.

Auditors assess logical access controls through reviews, interviews, and penetration testing, evaluate security features and risks, and report deficiencies to management.

Examine the evolving network and endpoint security landscape, highlighting perimeter controls, firewalls, and intrusion detection, and compare circuit switching with packet switching in telecom, ISDN and leased lines.

Explore enterprise network architecture, including client-server models, front-end and back-end systems, databases, intranets, and service-oriented architecture using SOA and SOAP as standards.

Explore the osi reference model and its seven layers—application, presentation, session, transport, network, data link, and physical—to see how data travels, is encapsulated, and verified with CRC.

Explore practical network architecture across LAN, WAN, and storage networks using copper and fiber media. Reveal how topology, MAC addresses, IP addresses, bridges, and repeaters govern data flow.

Explore collision domains and traffic flow across hub, bridge, switch, and ring topologies, and see how MAC addresses, VLANs, and layer two to layer seven switching optimize network performance.

Analyze the evolution of communication media from twisted pair to fiber optic and satellite, and compare simplex, half duplex, and full duplex transmission with digital versus analog signaling.

Analyze how physical and data link layer devices operate, from PSTN and ISDN signaling to point-to-point frame switching, multiplexing, and outerbridge devices connecting internal networks to external networks.

Explores point-to-point protocol basics, including LCP and NCP, IP networking, and the evolution from X.25 to frame relay; introduces VPN encryption and encapsulation with IPsec for secure remote access.

Learn how cookies, tiny text files stored by your browser, affect privacy and security, and how CGI differs from servlet in handling requests.

Learn how domain names resolve to IP addresses through DNS, how domain registration works, and how secure file transfer and remote login use encryption and passwords to protect data.

Compare tcp/ip with osi models, tracing data from application to the physical layer through segments, packets, and frames, while noting transport reliability and routing.

Examine cross-border data transmission, jurisdiction, and encryption rules, including data ownership and privacy, and master network administration, security, latency, throughput, and scalability for reliable data flows.

Explore how the World Wide Web uses domain names and uniform resource locators with IP-based addressing to locate resources, request them through a browser, and engage servers and CGI scripts.

Explore how organizations manage mixed lan and wan networks with fault, configuration, accounting, performance, and security tasks, using network management tools to monitor response time, downtime, and bandwidth.

Compare client-server, peer-to-peer, and multi-tier architectures, showing how processing shifts between clients and servers and how cloud computing enables scalable, distributed applications.

Explore on-demand computing in cloud environments, gaining pay-as-you-go access to storage, bandwidth, CPU, and RAM via private or public clouds while considering software as a service and confidentiality risks.

Explore network infrastructure security by implementing control through monitoring software, audit trails, and separation of duties; enforce encryption, device hardening, and IT governance for reliable operations.

Evaluate client-server architectures from two-tier to three-tier and how security depends on components. Identify risks like direct database access, proxy accounts, encrypted passwords, configuration access, and internet security controls.

Explains how organizations implement internal security controls within a framework guided by corporate policy. Covers firewall and intrusion detection, OS hardening, risk assessment, encryption, monitoring, and security awareness.

Learn how firewalls provide perimeter security against internal and external hackers. Compare hardware versus software firewalls and understand IP fragmentation defenses that rely on packet reassembly to block unauthorized traffic.

Explore application firewall concepts at the application layer and circuit level, including web application firewalls and proxies, to inspect content, block threats, and hide internal networks via NAT.

Learn how to manage network changes with formal approvals, change control procedures, and audit checks to prevent unauthorized configuration and ensure secure access.

Explore how stateful inspection firewalls track outbound and inbound traffic using ACLs and destination mappings to validate responses, offering greater efficiency than a proxy server while balancing security and complexity.

Explore firewall architectures including single-host and dual-homed configurations, bastion hosts, and the DMZ (screen subnet), showing how packet filtering and proxies limit access and protect internal networks.

Assess insider risks and false sense of security while covering firewall configuration, monitoring, and the trade-offs between hardware, software, and appliance firewalls for secure, scalable protection.

Identify shadow IT risks from cloud computing, third-party collaboration, and remote work; implement policy, awareness, and controls with IT and business unit collaboration, and continuous monitoring to manage security.

Classify data by sensitivity and criticality to determine access rights and protection levels across public, internal, confidential, private, and highly restricted data.

Explore fundamental data encryption concepts, including plaintext to ciphertext conversion, keys and decryption, and 128- and 256-bit strengths, with emphasis on data in transit and data at rest.

Discover how encryption relies on mathematical logic, keys, and algorithms; compare symmetric and asymmetric systems, analyze brute-force risks, and apply hash functions and digital signatures for integrity.

Explore how symmetric key cryptography uses the same key to encrypt and decrypt, with hash digests for integrity, DES and AES standards, and SSL relevance in e-commerce.

Explore asymmetric public key cryptography, encryption and decryption with public/private keys, digital signatures, hashing, and digital envelopes to secure communications.

Explore practical cryptography applications, combining symmetric and asymmetric encryption to secure data, keys, and communications; cover SSL/TLS, VPN, email encryption, digital certificates, and secure key exchange.

Learn how public key infrastructure secures communication with digital signatures, trusted third parties, certifying authorities, certificate issuance, certificate revocation lists, and registration authorities.

Explore VoIP, voice over IP over the internet, its packet-switched voice, cost benefits, and security risks, plus controls, backups, and firewall and border security measures to protect enterprise communications.

Explore computer-based PBX systems, including IP PBX and VoIP gateways, and identify security risks such as eavesdropping and fraud, plus practical controls like call tracking and access limits.

Explore email security issues in SMTP and POP3, covering phishing and spearfishing, server authentication, and the role of digital signatures and encryption.

Explore peer-to-peer vs client-server topologies, the security risks they introduce—data leakage, malware, downtime—and practical controls such as traffic blocks, antivirus, licensing, and encryption for enterprise networks and instant messaging.

Understand the risks and governance of social media for businesses, including corporate presence, employee use, brand protection, and policy, with techniques like awareness campaigns, content rights, and device management.

Explore virtualization concepts, including hypervisors, type one and type two, multiple operating systems on one physical server, and security risks and controls shaping efficient cloud deployments.

Explore how mobile devices access the internet through wireless LAN and 3G/4G/5G, enabling voip and browser content, while addressing security risks like interception and device theft.

Explore mobility risks from bring your own device and portable devices and implement security policy, encryption, authentication, and data protection with remote wipe and mobile device management.

Learn wireless networking basics, including wifi and bluetooth technologies, ad hoc and infrastructure topologies, and security practices from WEP to WPA3, PKI, and authentication.

Explore the internet of things (IoT) where physical objects such as smart devices communicate over networks, enabling machine-to-machine control and business advantages while addressing privacy, safety, and regulatory risks.

Master total security event management with a risk-based approach, integrating multi-layer defense and employee awareness programs to deter insider threats and social engineering while ensuring compliance.

Explore the fraud triangle—motivation, opportunity, and rationalization—and learn how internal controls and security measures limit opportunities to help auditors detect and prevent fraud.

Examine computer crime issues from fraud and data manipulation to remote access and intellectual property theft, and learn how organizations handle cyber threats, legal repercussions, and data security.

Understand denial of service and distributed denial of service attacks, botnets, phishing, social engineering, and malware like keyloggers and Trojans.

Examine common cyber threats including trojan horses, logic bombs, backdoors, man-in-the-middle attacks, masquerading, farming, salami, and social engineering, and discuss defense in depth and auditing.

Explore internet trends and security challenges of a globally connected network, risk assessment, common attacks (phishing, spoofing, DoS), and how auditors implement controls, firewalls, and intrusion detection.

Develop a malware implementation strategy to detect, prevent, and log incidents across networks and hosts using multi-layer defenses, antivirus on every workstation, real-time scanning, and up-to-date signatures.

Explore hardware and software malware controls, from BIOS protection and diskless workstations to signature-based and heuristic antivirus, plus CRC integrity checks, quarantine, and immunization strategies.

Learn how malware spreads through viruses, worms, and trojans. Apply prevention and detection methods, antivirus signatures, user training, and secure backups to protect open network environments.

Discover how auditors verify access controls, test password strength, and evaluate security procedures, from terminal inventory and log reviews to need-to-know access and incident reporting.

Explore remote access security, including VPN, password policies, encryption, and callback verification. Analyze case studies on securing home and remote office connections within enterprise networks.

Learn to prevent unauthorized access to data in clustered databases, secure initialization parameters, and preserve evidence integrity through robust access controls and chain-of-custody practices.

Explore how auditors assess privacy compliance by aligning organization policies, standards, and procedures with legal and regulatory requirements to ensure privacy protection across the enterprise.

Analyze auditing of access controls and data classification, alongside log integrity and incident response. Explore defense in depth, social engineering, encryption, steganography, and digital rights management.

Explore secure data disposal of magnetic tapes and disks. Learn PKI and digital certificates, intrusion detection components, and forensic preservation, with vpn, ipsec, and demilitarised zone security concepts.

Explore core security concepts in enterprise auditing and e-commerce, including digital signatures, hashing, public key infrastructure, authentication, incident response, access control, application layer protection, and recovery planning.

Explore SSL confidentiality through symmetric encryption, message integrity via hash and digital certificates, and authentication with website certificates, plus incident response, intrusion detection, and penetration testing types.

Assess access controls, logging, and least privilege to prevent unauthorized data modification in internal apps, while considering incident response, disaster recovery, cloud security, and Kerberos-based identity.

Explore how registration authorities verify certificate requests and how certifying authorities issue certificates within PKI. Assess security measures including honeypots, DMZs, intrusion detection, and digital signatures.

Analyze authentication threats like man-in-the-middle and keylogging, and show how two-factor and multi-factor authentication, digital signatures, and encryption protect emails and transmissions.

Contrast prevention with detection, explain containment and incident response, and survey phishing, social engineering, DMZ architecture, cloud security, and logs and evidence handling.

Explore beyond network firewalls with intrusion detection, DNS poisoning protection, and incident response, while strengthening authentication with password policies, challenge-response, replay protection, and biometric options.

Examine core network security and cryptography concepts, including firewalls, DMZ, encryption, public/private keys, digital signatures, and CRC for data integrity. Explore cloud security, change control, disaster recovery, and data disposal.