Master CREST Practitioner Security Analyst (CPSA) Training

Explore cybersecurity fundamentals, including confidentiality, integrity, and availability, and learn common threats and defenses like malware, phishing, ransomware, DDoS, social engineering, encryption, firewall, and patch management.

Explore the threat landscape and attack vectors: malware, social engineering, web and network exploits, insider and physical threats, zero-days, and apts, with defense in depth.

Identify common vulnerabilities in software, hardware, and configurations, and how attackers exploit them. Explore exploits such as sql injection, cross-site scripting, and csrf, and apply patch management.

Explore the fundamentals of networking protocols and how OSI layer roles, Ethernet, IP, TCP, UDP, HTTP, and HTTPS enable reliable, interoperable data transmission and data integrity.

Explore the OSI model and the TCP/IP stack as foundational frameworks for data transmission, detailing each layer from physical to application and their roles in troubleshooting networks.

Explore IPv4 addressing and subnetting, including 32-bit addresses, four octets, and the subnet mask. Learn CIDR notation, borrowing bits to create subnets, and practical uses for security and network management.

Explore open source intelligence (osint) techniques to gather and analyze data from websites, social media, public records, and news for cyber security threat assessment and competitive intelligence.

Explore passive and active reconnaissance in cyber security to understand information gathering, footprinting, port scanning, banner grabbing, and vulnerability scanning, with emphasis on legal and ethical authorization.

Explore vulnerability scanning in cyber security, using tools like Nessus, OpenVAS, Qualys, Rapid7, Retina to identify weaknesses in networks, systems, and applications, and learn scanning from target selection to reporting.

Explore effective reporting and documentation in cybersecurity to communicate findings, track vulnerabilities, and ensure audit trails for compliance.

Explore the OWASP top ten 2021 web vulnerabilities, including injection, broken authentication, broken access control, sensitive data exposure, xxe, and xss, and learn secure development practices to mitigate them.

Identify and test injection and cross-site scripting vulnerabilities in web apps using manual testing and tools like Burp Suite and OWASP ZAP; apply mitigations such as input validation and CSP.

Apply secure coding practices and remediation techniques to safeguard applications. Use input validation, output encoding, authentication and authorization, and proper error handling with least privilege during development.

Explore firewalls, IDS, and IPS, plus VPNs, network access control, DLP, network segmentation, and security zones to safeguard networks and support policy-driven, resilient operations.

Explore virtual private networks and secure remote access, including VPN types and security measures, to protect data in transit, enable remote work, and support scalable, compliant connections.

Secure network infrastructure by applying hardening best practices, reducing attack surface, and strengthening the organization's security posture with patch management, access controls, and segmentation.

Master the incident response lifecycle from preparation through lessons learned to minimize impact, contain, eradicate root causes, recover operations, and continuously improve security.

Identify and analyze security incidents by recognizing indicators of compromise, collecting event data, correlating findings, and prioritizing response with incident classification, severity, and digital forensics.

Implement containment, isolate affected systems, and restrict access to prevent spread; eradicate root causes with patches and malware removal; recover by validating, restoring data, monitoring, and documenting lessons learned.

Develop well defined security policies and procedures to guide risk management, compliance, awareness, access control, data protection, incident response, and enforcement.

Explore regulatory compliance and industry standards to protect data and strengthen security, covering GDPR, HIPAA, PCI DSS, Sarbanes-Oxley, ISO 27001, and NIST CSF.

Educate employees and stakeholders on security best practices to cultivate a vigilant culture and reduce human error. Implement a structured awareness program covering phishing, password security, and incident reporting.

Explore essential security tools used by analysts to monitor, analyze, and respond to threats, enabling real-time monitoring, threat detection, incident response, and forensics.

Engage in learning and professional development in cybersecurity to address the evolving threat landscape and technology advancements. Build a learning plan with goals, mentoring, and networking to advance your career.