Systems Security Certified Practitioner (SSCP) °ê»Ú»{¥iÃҮѽҵ{

Domain 1 Security Concepts and Practices

1.1 Comply with codes of ethics
1.1.1 (ISC)2 Code of Ethics
1.1.2 Organizational code of ethics
1.2 Understand security concepts
1.2.1 Confidentiality
1.2.2 Integrity
1.2.3 Availability
1.2.4 Accountability
1.2.5 Non-repudiation
1.2.6 Least privilege
1.2.7 Segregation of duties (SoD)
1.3 Identify and implement security controls
1.3.1 Technical controls (e.g., firewalls, intrusion detection systems (IDS), access control list (ACL))
1.3.2 Physical controls (e.g., mantraps, cameras, locks)
1.3.3 Administrative controls (e.g., security policies, standards, procedures, baselines)
1.3.4 Assessing compliance requirements
1.3.5 Periodic audit and review
1.4 Document and maintain functional security controls
1.4.1 Deterrent controls
1.4.2 Preventative controls
1.4.3 Detective controls
1.4.4 Corrective controls
1.4.5 Compensating controls
1.5 Support and implement asset management lifecycle (i.e., hardware, software, and data)
1.5.1 Process, planning, design, and initiation
1.5.2 Development /Acquisition (e.g., DevSecOps, testing)
1.5.3 Inventory and licensing (e.g., open source, closed-source )
1.5.4 Implementation/Assessment
1.5.5 Operation/Maintenance/End of Life (EOL)
1.5.6 Archival and retention requirements
1.5.7 Disposal and destruction
1.6 Support and/or implement change management lifecycle
1.6.1 Change management (e.g., roles, responsibilities, processes, communications, audit)
1.6.2 Security impact analysis
1.6.3 Configuration management (CM)
1.7 Support and/or implement security awareness and training (e.g., social engineering/phishing/tabletop exercises/awareness communications)
1.8 Collaborate with physical security operations (e.g., data center/facility assessment, badging and visitor management, personal device restrictions)

Domain 2 Access Controls

2.1 Implement and maintain authentication methods
2.1.1 Single/Multi-factor authentication (MFA)
2.1.2 Single sign-on (SSO) (e.g., Active Directory Federation Services (ADFS), OpenID Connect)
2.1.3 Device authentication (e.g., certificate, Media Access Control (MAC) address, Trusted Platform Module (TPM))
2.1.4 Federated access (e.g., Open Authorization 2 (OAuth2), Security Assertion Markup Language (SAML))
2.2 Understand and support internetwork trust architectures
2.2.1 Trust relationships (e.g., 1-way, 2-way, transitive, zero)
2.2.2 Internet, intranet, extranet, and demilitarized zone (DMZ)
2.2.3 Third-party connections (e.g., application programming interface (API), app extensions, middleware)
2.3 Support and/or implement the identity management lifecycle
2.3.1 Authorization
2.3.2 Proofing
2.3.3 Provisioning/De-provisioning
2.3.4 Monitoring, Reporting, and Maintenance (e.g., role changes, new security standards)
2.3.5 Entitlement (e.g., inherited rights, resources)
2.3.6 Identity and access management (IAM) systems
2.4 Understand and administer access controls
2.4.1 Mandatory
2.4.2 Discretionary
2.4.3 Role-based (e.g., subject-based, object-based, Privileged Access Management (PAM))
2.4.4 Rule-based
2.4.5 Attribute-based

Domain 3 Risk Identification, Monitoring, and Analysis

3.1 Understand risk management
3.1.1 Risk visibility and reporting (e.g., risk register, sharing threat intelligence, indicators of Compromise (IOC), Common Vulnerability Scoring System (CVSS), socialization, MITRE/ATT&CK model)
3.1.2 Risk management concepts (e.g., impact assessments, threat modeling, scope)
3.1.3 Risk management frameworks (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST))
3.1.4 Risk tolerance (e.g., appetite, risk quantification)
3.1.5 Risk treatment (e.g., accept, transfer, mitigate, avoid, ignore)
3.2 Understand legal and regulatory concerns (e.g., jurisdiction, limitations, privacy)
3.3 Perform security assessments and vulnerability management activities
3.3.1 Risk management frameworks implementation
3.3.2 Security testing
3.3.3 Risk review (e.g., internal, supplier, architecture)
3.3.4 Vulnerability management lifecycle (e.g., scanning, reporting, analysis, remediation)
3.4 Operate and monitor security platforms (e.g., continuous monitoring)
3.4.1 Source systems (e.g., applications, security appliances, network devices, hosts)
3.4.2 Events of interest (e.g., errors, omissions, anomalies, unauthorized changes, compliance violations, policy failures)
3.4.3 Log management (e.g., policy, integrity, preservation, architectures, configuration, aggregation, tuning)
3.4.4 Security information and event management (SIEM) (e.g., real-time monitoring, analysis, tracking, audit)
3.5 Analyze monitoring results
3.5.1 Security baselines and anomalies (e.g., correlation, noise reduction)
3.5.2 Visualizations, metrics, and trends (e.g., notifications, dashboards, timelines)
3.5.3 Event data analysis
3.5.4 Document and communicate findings (e.g., escalation)

Domain 4 Incident Response and Recovery

4.1 Understand and support incident response lifecycle (e.g., National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO))
4.1.1 Preparation (e.g., defining roles, training programs)
4.1.2 Detection, analysis, and escalation (e.g., incident communication, public relations)
4.1.3 Containment
4.1.4 Eradication
4.1.5 Recovery (e.g., incident documentation)
4.1.6 Post incident activities (e.g., lessons learned, new countermeasures, continuous improvement)
4.2 Understand and support forensic investigations
4.2.1 Legal (e.g., civil, criminal, administrative) and ethical principles
4.2.2 Evidence handling (e.g., first responder, triage, chain of custody, preservation of scene)
4.2.3 Reporting of analysis
4.2.4 Organization Security Policy Compliance
4.3 Understand and support business continuity plan (BCP) and disaster recovery plan (DRP) activities
4.3.1 Emergency response plans and procedures (e.g., information systems contingency, pandemic, natural disaster, crisis management)
4.3.2 Interim or alternate processing strategies
4.3.3 Restoration planning (e.g., Restore Time Objective (RTO), Restore Point Objectives (RPO), Maximum Tolerable Downtime (MTD))
4.3.4 Backup and redundancy implementation
4.3.5 Testing and drills (e.g., playbook, tabletop, disaster recovery exercises, scheduling)

Domain 5 Cryptography

5.1 Understand reasons and requirements for cryptography
5.1.1 Confidentiality
5.1.2 Integrity and authenticity
5.1.3 Data sensitivity (e.g., personally identifiable information (PII), intellectual property (IP), protected health information (PHI))
5.1.4 Regulatory and industry best practice (e.g., Payment Card Industry Data Security Standards (PCI-DSS), International Organization
for Standardization (ISO))
5.1.5 Cryptography entropy (e.g., quantum cryptography, quantum key distribution)
5.2 Apply cryptography concepts
5.2.1 Hashing
5.2.2 Salting
5.2.3 Symmetric/Asymmetric encryption/Elliptic curve cryptography (ECC)
5.2.4 Non-repudiation (e.g., digital signatures/certificates, Hash-based Message Authentication Code (HMAC), audit trails)
5.2.5 Strength of encryption algorithms and keys (e.g., Advanced Encryption Standards (AES), Rivest-Shamir-Adleman (RSA),
5.2.6 Cryptographic attacks and cryptanalysis
5.3 Understand and implement secure protocols
5.3.1 Services and protocols (e.g., Internet Protocol Security (IPsec), Transport Layer Security (TLS), Secure/Multipurpose Internet Mail Extensions (S/MIME), DomainKeys Identified Mail (DKIM))
5.3.2 Common use cases (e.g., credit card processing, file transfer, web client, virtual private network (VPN), transmission of PII data)
5.3.3 Limitations and vulnerabilities
5.4 Understand and support public key infrastructure (PKI) systems
5.4.1 Fundamental key management concepts (e.g., storage, rotation, composition, generation, destruction, exchange, revocation, escrow)
5.4.2 Web of Trust (WOT) (e.g., Pretty Good Privacy (PGP), GNU Privacy Guard (GPG), blockchain)

Domain 6 Network and Communications Security

6.1 Understand and apply fundamental concepts of networking
6.1.1 Open Systems Interconnection (OSI) and Transmission Control Protocol/Internet Protocol (TCP/IP) models
6.1.2 Network topologies
6.1.3 Network relationships (e.g., peer-to-peer (P2P), client server)
6.1.4 Transmission media types (e.g., wired, wireless)
6.1.5 Software-defined networking (SDN) (e.g., Software-Defined Wide Area Network (SD-WAN), network virtualization, automation)
6.1.6 Commonly used ports and protocols
6.2 Understand network attacks (e.g., distributed denial of service (DDoS), man-in-the-middle (MITM), Domain Name System (DNS) cache poisoning)
6.2.1 Countermeasures (e.g., content delivery networks (CDN), firewalls, network access controls, intrusion detection and prevention systems (IDPS))
6.3 Manage network access controls
6.3.1 Network access controls, standards, and protocols (e.g., Institute of Electrical and Electronics Engineers (IEEE) 802.1X, Remote
Authentication Dial-In User Service (RADIUS), Terminal Access Controller Access-Control System Plus (TACACS+))
6.3.2 Remote access operation and configuration (e.g., thin client, virtual private network (VPN), virtual desktop infrastructure)
6.4 Manage network security
6.4.1 Logical and physical placement of network devices (e.g., inline, passive, virtual)
6.4.2 Segmentation (e.g., physical/logical, data/control plane, virtual local area network (VLAN), access control list (ACL), firewall zones, micro-segmentation)
6.4.3 Secure device management
6.5 Operate and configure network-based security appliances and services
6.5.1 Firewalls and proxies (e.g., filtering methods, web application firewall (WAF), cloud access security broker (CASB))
6.5.2 Routers and switches
6.5.3 Intrusion detection systems (IDS) and intrusion prevention systems (IPS)
6.5.4 Network Access Control (NAC)
6.5.5 Data Loss Prevention (DLP)
6.5.6 Traffic-shaping devices (e.g., wide area network (WAN) optimization, load balancing)
6.5.7 Unified Threat Management (UTM)
6.6 Secure wireless communications
6.6.1 Technologies (e.g., cellular network, Wi-Fi, Bluetooth, Near-Field Communication (NFC))
6.6.2 Authentication and encryption protocols (e.g., Wi-Fi Protected Access (WPA), Extensible Authentication Protocol (EAP), Wi-Fi Protected Access 2 (WPA2), Wi-Fi Protected Access 3 (WPA3))
6.7 Secure and monitor Internet of Things (IoT) (e.g., configuration, network isolation, firmware updates, End of Life (EOL) management)

Domain 7 Systems and Application Security

7.1 Identify and analyze malicious code and activity
7.1.1 Malware (e.g., rootkits, spyware, scareware, ransomware, trojans, virus, worms, trapdoors, backdoors, fileless, app/code/operatin3 system (OS)/mobile code vulnerabilities)
7.1.2 Malware countermeasures (e.g., scanners, anti-malware, containment and remediation, software security)
7.1.3 Types of malicious activity (e.g., insider threat, data theft, distributed denial of service (DDoS), botnet, zero-day exploits, webbased attacks, advanced persistent threat (APT))
7.1.4 Malicious activity countermeasures (e.g., user awareness/training, system hardening, patching, isolation, data loss prevention (DLP))
7.1.5 Social engineering methods (e.g., SPAM email, phishing/smishing/vishing, impersonation, scarcity, whaling)
7.1.6 Behavior analytics (e.g., machine learning, Artificial Intelligence (AI), data analytics)
7.2 Implement and operate endpoint device security
7.2.1 Host-based intrusion prevention system (HIPS)
7.2.2 Host-based intrusion detection system (HIDS)
7.2.3 Host-based firewalls
7.2.4 Application whitelisting
7.2.5 Endpoint encryption (e.g., full disk encryption)
7.2.6 Trusted Platform Module (TPM) (e.g., hardware security module management)
7.2.7 Secure browsing (e.g., digital certificates)
7.2.8 Endpoint detection and response (EDR)
7.3 Administer and manage mobile devices
7.3.1 Provisioning techniques (e.g., corporate owned, personally enabled (COPE), Bring Your Own Device (BYOD), Mobile Device Management (MDM))
7.3.2 Containerization
7.3.3 Encryption
7.3.4 Mobile application management
7.4 Understand and configure cloud security
7.4.1 Deployment models (e.g., public, private, hybrid, community)
7.4.2 Service models (e.g., Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS))
7.4.3 Virtualization (e.g., hypervisor, Virtual Private Cloud (VPC))
7.4.4 Legal and regulatory concerns (e.g., privacy, surveillance, data ownership, jurisdiction, eDiscovery, shadow information technology (IT))
7.4.5 Data storage, processing, and transmission (e.g., archiving, backup, recovery, resilience)
7.4.6 Third-party/Outsourcing requirements (e.g., service-level agreement (SLA), data portability/privacy/destruction/auditing)
7.4.7 Shared responsibility model
7.5 Operate and maintain secure virtual environments
7.5.1 Hypervisor (i.e., Type 1 (e.g., bare metal), Type 2 (e.g., software))
7.5.2 Virtual appliances
7.5.3 Containers
7.5.4 Storage management (e.g., data domain)
7.5.5 Continuity and resilience
7.5.6 Threats, attacks, and countermeasures (e.g., brute-force attack, virtual machine escape, threat hunting)

1 Security Concepts and Practices
1.1 Comply with codes of ethics
1.1.1 (ISC)2 Code of Ethics
1.1.1.1 Overview
1.1.1.2 Canons of the (ISC)2 Code of Ethics
1.1.1.3 Importance
1.1.2 Organizational code of ethics
1.1.2.1 Overview
1.1.2.2 Key Elements
1.1.2.3 Implementation and Enforcement
1.1.2.4 Benefits
1.2 Understand security concepts
1.2.1 Confidentiality
1.2.1.1 Overview
1.2.1.2 Key Concepts
1.2.1.3 Perspectives on Confidentiality
1.2.1.4 Examples
1.2.1.5 Challenges and Mitigation Strategies
1.2.2 Integrity
1.2.2.1 Overview
1.2.2.2 Key Concepts
1.2.2.3 Perspectives on Integrity
1.2.2.4 Examples
1.2.2.5 Challenges and Mitigation Strategies
1.2.3 Availability
1.2.3.1.1 Overview
1.2.3.1.2 Key Concepts
1.2.3.1.3 Perspectives on Availability
1.2.3.1.4 Examples
1.2.3.1.5 Challenges and Mitigation Strategies
1.2.4 Accountability
1.2.4.1 Overview
1.2.4.2 Key Concepts
1.2.4.3 Perspectives on Accountability
1.2.4.4 Examples
1.2.4.5 Challenges and Mitigation Strategies
1.2.5 Non-repudiation
1.2.5.1 Overview
1.2.5.2 Importance of Non-repudiation
1.2.5.3 Methods to Achieve Non-repudiation
1.2.5.4 Perspectives on Non-repudiation
1.2.5.5 Examples and Case Studies
1.2.6 Least privilege / PoLP
1.2.6.1 Overview
1.2.6.2 Importance of Least Privilege
1.2.6.3 Implementing the Principle of Least Privilege
1.2.6.4 Examples and Case Studies
1.2.7 Segregation of duties (SoD)
1.2.7.1 Overview
1.2.7.2 Importance of Segregation of Duties
1.2.7.3 Implementing Segregation of Duties
1.2.7.4 Examples and Case Studies
1.3 Identify and implement security controls
1.3.1 Technical controls (e.g., firewalls, intrusion detection systems (IDS), access control list (ACL))
1.3.1.1 Overview
1.3.1.2 Firewalls
1.3.1.3 Intrusion Detection Systems (IDS)
1.3.1.4 Access Control Lists (ACLs)
1.3.1.5 Implementing Technical Security Controls
1.3.2 Physical controls (e.g., mantraps, cameras, locks)
1.3.2.1 Overview
1.3.2.2 Mantraps
1.3.2.3 Cameras (CCTV)
1.3.2.4 Locks
1.3.2.5 Implementing Physical Security Controls
1.3.3 Administrative controls (e.g., security policies, standards, procedures, baselines)
1.3.3.1 Overview
1.3.3.2 Security Policies
1.3.3.3 Standards
1.3.3.4 Procedures
1.3.3.5 Baselines
1.3.3.6 Implementing Administrative Security Controls
1.3.4 Assessing compliance requirements
1.3.4.1 Key Steps in Assessing Compliance Requirements
1.3.5 Periodic audit and review
1.3.5.1 Key Steps in Periodic Audit and Review
1.3.5.2 Examples of Audit and Review Practices in Different Industries
1.4 Document and maintain functional security controls
1.4.1 Deterrent controls
1.4.1.1 Key Aspects of Deterrent Controls
1.4.1.2 Examples of Deterrent Controls
1.4.2 Preventative controls
1.4.2.1 Key Aspects of Preventative Controls
1.4.2.2 Examples of Preventative Controls
1.4.3 Detective controls
1.4.3.1 Key Aspects of Detective Controls
1.4.3.2 Examples of Detective Controls
1.4.4 Corrective controls
1.4.4.1 Key Aspects of Corrective Controls
1.4.4.2 Examples of Corrective Controls
1.4.5 Compensating controls
1.4.5.1 Key Aspects of Compensating Controls
1.4.5.2 Examples of Compensating Controls
1.5 Support and implement asset management lifecycle (i.e., hardware, software, and data)
1.5.1 Process, planning, design, and initiation
1.5.1.1 Key Aspects
1.5.2 Development /Acquisition (e.g., DevSecOps, testing)
1.5.2.1 Key Aspects
1.5.3 Inventory and licensing (e.g., open source, closed-source)
1.5.3.1 Key Aspects
1.5.4 Implementation/Assessment
1.5.4.1 Key Aspects of Implementation
1.5.4.2 Key Aspects of Assessment
1.5.5 Operation/Maintenance/End of Life (EOL)
1.5.5.1 Key Aspects of Operation
1.5.5.2 Key Aspects of Maintenance
1.5.5.3 Key Aspects of End of Life (EOL)
1.5.6 Archival and retention requirements
1.5.6.1 Key Aspects of Archival
1.5.6.2 Key Aspects of Retention Requirements
1.5.7 Disposal and destruction
1.5.7.1 Key Aspects of Disposal
1.5.7.2 Key Aspects of Destruction
1.6 Support and/or implement change management lifecycle
1.6.1 Change management (e.g., roles, responsibilities, processes, communications, audit)
1.6.1.1 Key Aspects of Change Management
1.6.2 Security impact analysis
1.6.2.1 Key Aspects of Security Impact Analysis
1.6.3 Configuration management (CM)
1.6.3.1 Key Aspects of Configuration Management
1.7 Support and/or implement security awareness and training (e.g., social engineering/phishing/tabletop exercises/awareness communications)
1.7.1.1 Key Aspects of Security Awareness and Training
1.8 Collaborate with physical security operations (e.g., data center/facility assessment, badging and visitor management, personal device restrictions)
1.8.1.1 Key Aspects of Collaboration with Physical Security Operations
1.9 Miscellaneous Topics
1.9.1 SOC1, SOC2 and SOC3

2 Domain 2 Access Controls
2.1 Implement and maintain authentication methods
2.1.1 Single/Multi-factor authentication (MFA)
2.1.1.1 Overview
2.1.1.2 Key Aspects of Single-Factor Authentication (SFA)
2.1.1.3 Key Aspects of Multi-Factor Authentication (MFA)
2.1.2 Single sign-on (SSO) (e.g., Active Directory Federation Services (ADFS), OpenID Connect)
2.1.2.1 Overview
2.1.2.2 Key Aspects of Single Sign-On (SSO)
2.1.2.3 Implementing SSO: Active Directory Federation Services (ADFS)
2.1.2.4 Implementing SSO: OpenID Connect
2.1.2.5 SAML vs OIDC
2.1.3 Device authentication (e.g., certificate, Media Access Control (MAC) address, Trusted Platform Module (TPM))
2.1.3.1 Overview
2.1.3.2 Device Authentication Methods
2.1.3.2.1 Certificate-based Authentication
2.1.3.2.2 MAC Address-based Authentication
2.1.3.2.3 Trusted Platform Module (TPM)
2.1.4 Federated access (e.g., Open Authorization 2 (OAuth2), Security Assertion Markup Language (SAML))
2.1.4.1 Overview
2.1.4.2 Federated Access Methods
2.1.4.2.1 Open Authorization 2 (OAuth2)
2.1.4.3 Security Assertion Markup Language (SAML)
2.2 Understand and support internetwork trust architectures
2.2.1 Trust relationships (e.g., 1-way, 2-way, transitive, zero)
2.2.1.1 Overview
2.2.1.1.1 1-Way Trust
2.2.1.1.2 2-Way Trust
2.2.1.1.3 Transitive Trust
2.2.1.1.4 Zero Trust
2.2.2 Internet, intranet, extranet, and demilitarized zone (DMZ)
2.2.2.1 Internet
2.2.2.2 Intranet
2.2.2.3 Extranet
2.2.2.4 Demilitarized Zone (DMZ)
2.2.3 Third-party connections (e.g., application programming interface (API), app extensions, middleware)
2.2.3.1 Application Programming Interface (API)
2.2.3.2 App Extensions
2.2.3.3 Middleware
2.3 Support and/or implement the identity management lifecycle
2.3.1 Authorization
2.3.1.1 Access Control Models
2.3.1.2 Authorization Mechanisms
2.3.1.3 Techniques and Best Practices
2.3.1.4 Authorization in Different Environments
2.3.2 Proofing
2.3.2.1 Identity Proofing Processes
2.3.2.2 Methods of Identity Proofing
2.3.2.3 Identity Proofing in Different Contexts
2.3.2.4 Challenges and Considerations
2.3.3 Provisioning/De-provisioning
2.3.3.1 Provisioning Process
2.3.3.2 De-provisioning Process
2.3.4 Monitoring, Reporting, and Maintenance (e.g., role changes, new security standards)
2.3.4.1 Monitoring
2.3.4.2 Reporting
2.3.4.3 Maintenance
2.3.5 Entitlement (e.g., inherited rights, resources)
2.3.6 Identity and access management (IAM) systems
2.3.6.1 Key Components of IAM Systems
2.3.6.2 Biometric Authentication and Errors
2.4 Understand and administer access controls
2.4.1 Mandatory (MAC)
2.4.2 Discretionary (DAC)
2.4.3 Role-based (e.g., subject-based, object-based, Privileged Access Management (PAM))
2.4.3.1 Subject-based, object-based
2.4.3.2 Privileged Access Management (PAM)
2.4.3.3 Key Functions and Features
2.4.4 Rule-based
2.4.5 Attribute-based
2.4.6 Case Studies and Examples
2.5 Miscellaneous topics
2.5.1 Fire Suppression Systems
2.5.1.1 Wet Pipe
2.5.1.2 Dry Pipe
2.5.1.3 Deluge
2.5.1.4 Preaction
2.5.1.5 Water
2.5.1.6 Soda Acid
2.5.1.7 Carbon Dioxide (CO₂)
2.5.1.8 Halon
2.5.2 Access Cards
2.5.2.1 Smart Card
2.5.2.2 Proximity Card
2.5.2.3 Magnetic Stripe Card
2.5.3 Secure Facilities
2.5.3.1 SCIF (Sensitive Compartmented Information Facility)
2.5.4 Software Testing
2.5.4.1 Unit Testing
2.5.4.2 Acceptance Testing
2.5.4.3 Regression Testing
2.5.4.4 Vulnerability Testing
2.5.5 Security Concepts
2.5.5.1 Defense in Depth
2.5.5.2 Security through Obscurity
2.5.5.3 Privilege Creep
2.5.5.4 Two-Person Control
2.5.6 Authentication and Directory Services
2.5.6.1 Kerberos
2.5.6.2 RADIUS (Remote Authentication Dial-In User Service)
2.5.6.3 LDAP (Lightweight Directory Access Protocol)
2.5.6.4 SESAME (Secure European System for Applications in a Multi-vendor Environment)
2.5.7 Types of Tokens
2.5.7.1 Asynchronous Token
2.5.7.2 Smart Card Token
2.5.7.3 Synchronous Token
2.5.7.4 Static Token
2.5.8 Authentication Methods
2.5.8.1 Knowledge-Based Authentication (KBA)
2.5.8.2 Dynamic Knowledge-Based Authentication
2.5.9 Markup Languages and Protocols
2.5.9.1 HTML (HyperText Markup Language)
2.5.9.2 XACML (eXtensible Access Control Markup Language)
2.5.9.3 SPML (Service Provisioning Markup Language)
2.5.10 NIST Password Expiration Guidance

3 Risk Identification, Monitoring, and Analysis
3.1 Understand risk management
3.1.1 Risk visibility and reporting (e.g., risk register, sharing threat intelligence, indicators of Compromise (IOC), Common Vulnerability Scoring System (CVSS), socialization, MITRE/ATT&CK model)
3.1.1.1 Risk Visibility and Reporting
3.1.1.1.1 Risk Register
3.1.1.1.2 Sharing Threat Intelligence
3.1.1.1.3 Indicators of Compromise (IOC)
3.1.1.1.4 Common Vulnerability Scoring System (CVSS)
3.1.1.1.5 Socialization of Risk
3.1.1.1.6 MITRE/ATT&CK Model
3.1.2 Risk management concepts (e.g., impact assessments, threat modeling, scope)
3.1.2.1 Impact Assessments
3.1.2.2 Threat Modeling
3.1.2.3 Scope
3.1.3 Risk management frameworks (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST))
3.1.3.1 International Organization for Standardization (ISO)
3.1.3.2 National Institute of Standards and Technology (NIST)
3.1.4 Risk tolerance (e.g., appetite, risk quantification)
3.1.4.1 Risk Appetite
3.1.4.2 Risk Quantification
3.1.4.3 Practical Application: Risk Quantification in Decision-Making
3.1.5 Risk treatment (e.g., accept, transfer, mitigate, avoid, ignore)
3.1.5.1 Accept
3.1.5.2 Transfer
3.1.5.3 Mitigate
3.1.5.4 Avoid
3.1.5.5 Ignore
3.1.5.6 Integrating Risk Treatment Strategies
3.2 Understand legal and regulatory concerns (e.g., jurisdiction, limitations, privacy)
3.2.1 Jurisdiction
3.2.2 Limitations
3.2.3 Privacy
3.2.4 Examples and Case Studies
3.3 Perform security assessments and vulnerability management activities
3.3.1 Risk management frameworks implementation
3.3.1.1 Risk management frameworks
3.3.1.2 Implementing Risk Management Frameworks
3.3.2 Security testing
3.3.2.1 Overview
3.3.2.2 Types of Security Testing
3.3.2.2.1 CIS Benchmarks
3.3.3 Risk review (e.g., internal, supplier, architecture)
3.3.3.1 Overview
3.3.3.2 Types of Risk Reviews
3.3.3.3 Process of Conducting a Risk Review
3.3.4 Vulnerability management lifecycle (e.g., scanning, reporting, analysis, remediation)
3.3.4.1 Overview
3.3.4.2 Stages of the Vulnerability Management Lifecycle
3.4 Operate and monitor security platforms (e.g., continuous monitoring)
3.4.1 Source systems (e.g., applications, security appliances, network devices, hosts)
3.4.1.1 Applications
3.4.1.2 Security Appliances
3.4.1.3 Network Devices
3.4.1.4 Hosts
3.4.2 Events of interest (e.g., errors, omissions, anomalies, unauthorized changes, compliance violations, policy failures)
3.4.2.1 Errors
3.4.2.2 Omissions
3.4.2.3 Anomalies
3.4.2.4 Unauthorized Changes
3.4.2.5 Compliance Violations
3.4.2.6 Policy Failures
3.4.3 Log management (e.g., policy, integrity, preservation, architectures, configuration, aggregation, tuning)
3.4.3.1 Policy
3.4.3.2 2. Integrity
3.4.3.3 Preservation
3.4.3.4 Architectures
3.4.3.5 Configuration
3.4.3.6 Aggregation
3.4.3.7 Tuning
3.4.4 Security information and event management (SIEM) (e.g., real-time monitoring, analysis, tracking, audit)
3.4.4.1 Key Functions of SIEM
3.4.4.1.1 Real-Time Monitoring
3.4.4.1.2 Analysis
3.4.4.1.3 Tracking
3.4.4.1.4 Audit
3.5 Analyze monitoring results
3.5.1 Security baselines and anomalies (e.g., correlation, noise reduction)
3.5.1.1 Overview
3.5.1.2 Establishing Security Baselines
3.5.1.3 Detecting and Analyzing Anomalies
3.5.2 Visualizations, metrics, and trends (e.g., notifications, dashboards, timelines)
3.5.2.1 Visualizations
3.5.2.2 Metrics
3.5.2.3 Trends
3.5.3 Event data analysis
3.5.3.1 Key Components of Event Data Analysis
3.5.3.2 Techniques for Event Data Analysis
3.5.4 Document and communicate findings (e.g., escalation)
3.5.4.1 Documenting Findings
3.5.4.1.1 Type of Documentation
3.5.4.1.1.1 Incident Reports
3.5.4.1.1.2 Analysis Summaries
3.5.4.1.1.3 Logs and Records
3.5.4.1.1.4 Dashboards and Visualizations:
3.5.4.1.2 Best Practices for Documentation:
3.5.4.2 Communicating Findings
3.5.4.2.1 Methods of Communication
3.5.4.2.1.1 Email Reports
3.5.4.2.1.2 Meetings and Briefings
3.5.4.2.1.3 Dashboards
3.5.4.2.1.4 Alerts and Notifications:
3.5.4.2.1.5 Reports and Summaries:
3.5.4.2.2 Best Practices for Communication:
3.5.4.3 Escalation Procedures
3.6 Miscellaneous Topics
3.6.1 Syslog
3.6.2 NetFlow
3.6.3 NTP (Network Time Protocol)
3.6.4 Logsync
3.6.5 SNAP (Subnetwork Access Protocol)
3.6.6 Nmap (Network Mapper)
3.6.7 OpenVAS (Open Vulnerability Assessment System)
3.6.8 MBSA (Microsoft Baseline Security Analyzer)
3.6.9 Nessus
3.6.10 Fuzzing / Fuzzer
3.6.11 Reduction Analysis
3.6.12 Common Ports and Their Usage
3.6.13 Indicators of a Brute Force Attack
3.6.14 Indicators of a Dictionary Attack

4 Incident Response and Recovery
4.1 Understand and support incident response lifecycle (e.g., National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO))
4.1.1 Preparation (e.g., defining roles, training programs)
4.1.1.1 NIST
4.1.1.1.1 Defining Roles
4.1.1.1.2 Training Programs
4.1.1.2 ISO
4.1.1.2.1 Defining Roles
4.1.1.2.2 Training Programs
4.1.2 Detection, analysis, and escalation (e.g., incident communication, public relations)
4.1.2.1 NIST
4.1.2.1.1 Detection
4.1.2.1.2 Analysis
4.1.2.1.3 Escalation
4.1.2.2 ISO
4.1.2.2.1 Detection
4.1.2.2.2 Analysis
4.1.2.2.3 Escalation
4.1.3 Containment
4.1.3.1 NIST
4.1.3.2 ISO
4.1.4 Eradication
4.1.4.1 NIST
4.1.4.2 ISO
4.1.5 Recovery (e.g., incident documentation)
4.1.5.1 NIST
4.1.5.1.1 Recovery Steps
4.1.5.1.2 Incident Documentation
4.1.5.2 ISO
4.1.5.2.1 Recovery Steps
4.1.5.2.2 Incident Documentation
4.1.6 Post incident activities (e.g., lessons learned, new countermeasures, continuous improvement)
4.1.6.1 Lessons Learned
4.1.6.2 New Countermeasures
4.1.6.3 Continuous Improvement
4.2 Understand and support forensic investigations
4.2.1 Legal (e.g., civil, criminal, administrative) and ethical principles
4.2.1.1 Civil Law
4.2.1.2 Criminal Law
4.2.1.3 Administrative Law
4.2.1.4 Ethical Principles in Forensic Investigations
4.2.2 Evidence handling (e.g., first responder, triage, chain of custody, preservation of scene)
4.2.2.1 First Responder
4.2.2.2 Triage
4.2.2.3 Chain of Custody
4.2.2.4 Preservation of Scene
4.2.3 Reporting of analysis
4.2.4 Organization Security Policy Compliance
4.3 Understand and support business continuity plan (BCP) and disaster recovery plan (DRP) activities
4.3.1 Emergency response plans and procedures (e.g., information systems contingency, pandemic, natural disaster, crisis management)
4.3.1.1 Information Systems Contingency Plans
4.3.1.2 Pandemic Response Plans
4.3.1.3 Natural Disaster Response Plans
4.3.1.4 Crisis Management Plans
4.3.2 Interim or alternate processing strategies
4.3.2.1 Types of Interim or Alternate Processing Strategies
4.3.3 Restoration planning (e.g., Restore Time Objective (RTO), Restore Point Objectives (RPO), Maximum Tolerable Downtime (MTD))
4.3.3.1 Restore Time Objective (RTO)
4.3.3.2 Restore Point Objective (RPO)
4.3.3.3 Maximum Tolerable Downtime (MTD)
4.3.4 Backup and redundancy implementation
4.3.4.1 Types of Backup Strategies
4.3.4.2 Backup Implementation Strategies
4.3.5 Testing and drills (e.g., playbook, tabletop, disaster recovery exercises, scheduling)
4.3.5.1 Playbook Testing
4.3.5.2 Tabletop Exercises
4.3.5.3 Disaster Recovery Exercises

5 Cryptography
5.1 Understand reasons and requirements for cryptography
5.1.1 Confidentiality
5.1.1.1 Reasons for Implementing Cryptography for Confidentiality
5.1.2 Integrity and authenticity
5.1.2.1 Reasons for Implementing Cryptography for Integrity and Authenticity
5.1.3 Data sensitivity (e.g., personally identifiable information (PII), intellectual property (IP), protected health information (PHI))
5.1.3.1 Reasons for Implementing Cryptography for Data Sensitivity
5.1.4 Regulatory and industry best practice (e.g., Payment Card Industry Data Security Standards (PCI-DSS), International Organization for Standardization (ISO))
5.1.4.1 Payment Card Industry Data Security Standards (PCI-DSS)
5.1.4.2 International Organization for Standardization (ISO)
5.1.5 Cryptography entropy (e.g., quantum cryptography, quantum key distribution)
5.1.5.1 Quantum Cryptography and Its Role in Enhancing Entropy
5.2 Apply cryptography concepts
5.2.1 Hashing
5.2.1.1 Characteristics of Hash Functions
5.2.1.2 Common Hash Functions
5.2.1.3 Applications of Hashing
5.2.2 Salting
5.2.2.1 How Salting Works
5.2.2.2 Benefits of Salting
5.2.3 Symmetric/Asymmetric encryption/Elliptic curve cryptography (ECC)
5.2.3.1 Symmetric Encryption
5.2.3.2 Asymmetric Encryption
5.2.3.3 Elliptic Curve Cryptography (ECC)
5.2.4 Non-repudiation (e.g., digital signatures/certificates, Hash-based Message Authentication Code (HMAC), audit trails)
5.2.4.1 Digital Signatures
5.2.4.2 Digital Certificates
5.2.4.3 Hash-based Message Authentication Code (HMAC)
5.2.4.4 Audit Trails
5.2.5 Strength of encryption algorithms and keys (e.g., Advanced Encryption Standards (AES), Rivest-Shamir-Adleman (RSA), Cryptographic attacks and cryptanalysis
5.2.5.1 Advanced Encryption Standard (AES)
5.2.5.2 Rivest-Shamir-Adleman (RSA)
5.2.5.3 Cryptographic Attacks and Cryptanalysis
5.3 Understand and implement secure protocols
5.3.1 Services and protocols (e.g., Internet Protocol Security (IPsec), Transport Layer Security (TLS), Secure/Multipurpose Internet Mail Extensions (S/MIME), DomainKeys Identified Mail (DKIM))
5.3.1.1 Internet Protocol Security (IPsec)
5.3.1.2 Transport Layer Security (TLS)
5.3.1.3 Secure/Multipurpose Internet Mail Extensions (S/MIME)
5.3.1.4 DomainKeys Identified Mail (DKIM)
5.3.2 Common use cases (e.g., credit card processing, file transfer, web client, virtual private network (VPN), transmission of PII data)
5.3.2.1 Credit Card Processing
5.3.2.2 File Transfer
5.3.2.3 Web Client
5.3.2.4 Virtual Private Network (VPN)
5.3.2.5 Transmission of PII Data
5.3.3 Limitations and vulnerabilities
5.3.3.1 Limitations
5.3.3.2 Vulnerabilities
5.4 Understand and support public key infrastructure (PKI) systems
5.4.1 Fundamental key management concepts (e.g., storage, rotation, composition, generation, destruction, exchange, revocation, escrow)
5.4.1.1 Key Storage
5.4.1.2 Key Rotation
5.4.1.3 Key Composition
5.4.1.4 Key Generation
5.4.1.5 Key Destruction
5.4.1.6 Key Exchange
5.4.1.7 Key Revocation
5.4.1.8 Key Escrow
5.4.2 Web of Trust (WOT) (e.g., Pretty Good Privacy (PGP), GNU Privacy Guard (GPG), blockchain)
5.4.2.1 PKI vs WOT
5.4.2.2 Examples of Web of Trust Systems
5.4.2.2.1 Pretty Good Privacy (PGP)
5.4.2.2.2 GNU Privacy Guard (GPG)
5.4.2.2.3 Blockchain
5.5 Miscellaneous Topics
5.5.1 Kerckhoff's Principle
5.5.2 Heisenberg Principle

6 Network and Communications Security
6.1 Understand and apply fundamental concepts of networking
6.1.1 Open Systems Interconnection (OSI) and Transmission Control Protocol/Internet Protocol (TCP/IP) models
6.1.1.1 OSI Model
6.1.1.1.1 The Seven Layers
6.1.1.2 DARPA TCP/IP Model or TCP/IP Model
6.1.2 Network topologies
6.1.3 Network relationships (e.g., peer-to-peer (P2P), client server)
6.1.3.1 Peer-to-Peer (P2P) Networks
6.1.3.2 Client-Server Networks
6.1.4 Transmission media types (e.g., wired, wireless)
6.1.4.1 Wired Transmission Media
6.1.4.1.1 Types of Wired Media
6.1.4.1.1.1 Twisted Pair Cable
6.1.4.1.1.2 Fiber Optic Cable
6.1.5 Software-defined networking (SDN) (e.g., Software-Defined Wide Area Network (SD-WAN), network virtualization, automation)
6.1.5.1 Software-Defined Wide Area Network (SD-WAN)
6.1.5.2 Network Virtualization
6.1.6 Commonly used ports and protocols
6.2 Understand network attacks (e.g., distributed denial of service (DDoS), man-in-the-middle (MITM), Domain Name System (DNS) cache poisoning)
6.2.1 Countermeasures (e.g., content delivery networks (CDN), firewalls, network access controls, intrusion detection and prevention systems (IDPS))
6.2.1.1 Distributed Denial of Service (DDoS)
6.2.1.2 Man-in-the-Middle (MITM)
6.2.1.3 Domain Name System (DNS) Cache Poisoning
6.2.1.4 Content Delivery Networks (CDN)
6.2.1.5 Firewalls
6.2.1.6 Network Access Controls (NAC)
6.2.1.7 Intrusion Detection and Prevention Systems (IDPS)
6.3 Manage network access controls
6.3.1 Network access controls, standards, and protocols (e.g., Institute of Electrical and Electronics Engineers (IEEE) 802.1X, Remote Authentication Dial-In User Service (RADIUS), Terminal Access Controller Access-Control System Plus (TACACS+))
6.3.1.1 IEEE 802.1X
6.3.1.2 Remote Authentication Dial-In User Service (RADIUS)
6.3.1.3 Terminal Access Controller Access-Control System Plus (TACACS+)
6.3.2 Remote access operation and configuration (e.g., thin client, virtual private network (VPN), virtual desktop infrastructure)
6.3.2.1 Thin Client
6.3.2.2 Virtual Private Network (VPN)
6.4 Manage network security
6.4.1 Logical and physical placement of network devices (e.g., inline, passive, virtual)
6.4.1.1 Inline Devices
6.4.1.2 Passive Devices
6.4.1.3 Virtual Devices
6.4.2 Segmentation (e.g., physical/logical, data/control plane, virtual local area network (VLAN), access control list (ACL), firewall zones, micro-segmentation)
6.4.2.1 Physical Segmentation
6.4.2.2 Logical Segmentation
6.4.2.3 Control plane and Data plane
6.4.2.4 Virtual Local Area Network (VLAN)
6.4.2.5 Access Control List (ACL)
6.4.2.6 Firewall Zones
6.4.2.7 Micro-segmentation
6.4.3 Secure device management
6.5 Operate and configure network-based security appliances and services
6.5.1 Firewalls and proxies (e.g., filtering methods, web application firewall (WAF), cloud access security broker (CASB))
6.5.1.1 Filtering Methods
6.5.1.2 Web Application Firewall (WAF)
6.5.1.3 Proxies
6.5.1.4 Cloud Access Security Broker (CASB)
6.5.2 Routers and switches
6.5.2.1 Routers
6.5.2.2 Switches
6.5.3 Intrusion detection systems (IDS) and intrusion prevention systems (IPS)
6.5.4 Network Access Control (NAC)
6.5.5 Data Loss Prevention (DLP)
6.5.6 Traffic-shaping devices (e.g., wide area network (WAN) optimization, load balancing)
6.5.6.1 WAN Optimization
6.5.6.2 Load Balancing
6.5.7 Unified Threat Management (UTM)
6.6 Secure wireless communications
6.6.1 Technologies (e.g., cellular network, Wi-Fi, Bluetooth, Near-Field Communication (NFC))
6.6.1.1 Cellular Networks
6.6.1.2 Wi-Fi
6.6.1.3 Bluetooth
6.6.1.4 Near-Field Communication (NFC)
6.6.2 Authentication and encryption protocols (e.g., Wi-Fi Protected Access (WPA), Extensible Authentication Protocol (EAP), Wi-Fi Protected Access 2 (WPA2), Wi-Fi Protected Access 3 (WPA3))
6.6.2.1 Wi-Fi Protected Access (WPA)
6.6.2.2 Extensible Authentication Protocol (EAP)
6.6.2.3 Wi-Fi Protected Access 2 (WPA2)
6.6.2.4 Wi-Fi Protected Access 3 (WPA3)
6.7 Secure and monitor Internet of Things (IoT) (e.g., configuration, network isolation, firmware updates, End of Life (EOL) management)
6.8 Miscellaneous Topics
6.8.1 Metasploit
6.8.2 Key Vulnerabilities of WEP
6.8.3 Disabling SSID
6.8.4 Smurf
6.8.5 RFC 1918, Private IP Addresses, NAT, and Protecting Hosts from Public Exposure
6.8.6 TCP Three-Way Handshake
6.8.7 Ethernet cable standards
6.8.7.1 10BASE-T
6.8.7.2 100BASE-TX
6.8.7.3 1000BASE-T
6.8.7.4 10GBASE-T
6.8.7.5 2.5GBASE-T and 5GBASE-T
6.8.7.6 1000BASE-SX
6.8.7.7 1000BASE-LX
6.8.7.8 10GBASE-SR
6.8.7.9 10GBASE-LR
6.8.7.10 40GBASE-T
6.8.7.11 100GBASE-SR4

7 Systems and Application Security
7.1 Identify and analyze malicious code and activity
7.1.1 Malware (e.g., rootkits, spyware, scareware, ransomware, trojans, virus, worms, trapdoors, backdoors, fileless, app/code/operating system (OS)/mobile code vulnerabilities)
7.1.1.1 Rootkits
7.1.1.2 Spyware
7.1.1.3 Scareware
7.1.1.4 Ransomware
7.1.1.5 Trojans
7.1.1.6 Virus
7.1.1.7 Worms
7.1.1.8 Trapdoors (Backdoors)
7.1.1.9 Fileless Malware
7.1.1.10 App/code/operating system (OS)
7.1.1.11 Mobile Code Vulnerabilities
7.1.2 Malware countermeasures (e.g., scanners, anti-malware, containment and remediation, software security)
7.1.2.1 Scanners
7.1.2.2 Anti-Malware Solutions
7.1.2.3 Features and Capabilities
7.1.2.4 Containment and Remediation
7.1.2.4.1 Containment Strategies
7.1.2.4.2 Remediation Steps
7.1.2.5 Software Security
7.1.3 Types of malicious activity (e.g., insider threat, data theft, distributed denial of service (DDoS), botnet, zero-day exploits, web-based attacks, advanced persistent threat (APT))
7.1.3.1 Insider Threat
7.1.3.2 Data Theft
7.1.3.3 Distributed Denial of Service (DDoS)
7.1.3.4 Botnet
7.1.3.5 Zero-Day Exploits
7.1.3.6 Web-Based Attacks (SQL Injection, Cross-Site Scripting (XSS), CSRF (Cross-Site Request Forgery)
7.1.3.7 Advanced Persistent Threat (APT)
7.1.4 Malicious activity countermeasures (e.g., user awareness/training, system hardening, patching, isolation, data loss prevention (DLP))
7.1.4.1 User awareness/training
7.1.4.2 System hardening and patching
7.1.5 Social engineering methods (e.g., SPAM email, phishing/smishing/vishing, impersonation, scarcity, whaling)
7.1.5.1 SPAM Email
7.1.5.2 Phishing
7.1.5.3 Smishing
7.1.5.4 Vishing
7.1.5.5 Impersonation
7.1.5.6 Scarcity
7.1.5.7 Whaling
7.1.6 Behavior analytics (e.g., machine learning, Artificial Intelligence (AI), data analytics)
7.1.6.1 Machine Learning
7.1.6.2 Artificial Intelligence (AI)
7.1.6.3 Data Analytics
7.2 Implement and operate endpoint device security
7.2.1 Host-based intrusion prevention system (HIPS)
7.2.2 Host-based intrusion detection system (HIDS)
7.2.3 Host-based firewalls
7.2.4 Application whitelisting
7.2.5 Endpoint encryption (e.g., full disk encryption)
7.2.6 Trusted Platform Module (TPM) (e.g., hardware security module management)
7.2.7 Secure browsing (e.g., digital certificates)
7.2.8 Endpoint detection and response (EDR)
7.3 Administer and manage mobile devices
7.3.1 Provisioning techniques (e.g., corporate owned, personally enabled (COPE), Bring Your Own Device (BYOD), Mobile Device Management (MDM))
7.3.1.1 Corporate Owned, Personally Enabled (COPE)
7.3.1.2 Bring Your Own Device (BYOD)
7.3.1.3 Mobile Device Management (MDM)
7.3.2 Containerization
7.3.3 Encryption
7.3.4 Mobile application management
7.4 Understand and configure cloud security
7.4.1 Deployment models (e.g., public, private, hybrid, community)
7.4.1.1 Public Cloud
7.4.1.2 Private Cloud
7.4.1.3 Hybrid Cloud
7.4.2 Service models (e.g., Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS))
7.4.2.1 Infrastructure as a Service (IaaS)
7.4.2.2 Platform as a Service (PaaS)
7.4.2.3 Software as a Service (SaaS)
7.4.3 Virtualization (e.g., hypervisor, Virtual Private Cloud (VPC))
7.4.3.1 Hypervisor
7.4.3.2 Virtual Private Cloud (VPC)
7.4.4 Legal and regulatory concerns (e.g., privacy, surveillance, data ownership, jurisdiction, eDiscovery, shadow information technology (IT))
7.4.4.1 Privacy
7.4.4.2 Surveillance
7.4.4.3 Data Ownership
7.4.4.4 Jurisdiction
7.4.4.5 eDiscovery
7.4.4.6 Shadow Information Technology (IT)
7.4.5 Data storage, processing, and transmission (e.g., archiving, backup, recovery, resilience)
7.4.5.1 Archiving
7.4.5.2 Backup
7.4.5.3 Recovery
7.4.5.4 Resilience
7.4.6 Third-party/Outsourcing requirements (e.g., service-level agreement (SLA), data portability/privacy/destruction/auditing)
7.4.6.1 Service-level agreement (SLA)
7.4.6.2 Data Portability
7.4.6.3 Data Privacy
7.4.6.4 Data Destruction
7.4.7 Shared responsibility model
7.5 Operate and maintain secure virtual environments
7.5.1 Hypervisor (i.e., Type 1 (e.g., bare metal), Type 2 (e.g., software))
7.5.2 Virtual appliances
7.5.3 Containers
7.5.4 Storage management (e.g., data domain)
7.5.4.1 Data Domain
7.5.5 Continuity and resilience
7.5.5.1 Continuity
7.5.5.2 Resilience
7.5.6 Threats, attacks, and countermeasures (e.g., brute-force attack, virtual machine escape, threat hunting)
7.5.6.1 Brute-Force Attack
7.5.6.2 Virtual Machine Escape
7.5.6.3 Threat Hunting
7.6 Miscellaneous Topics
7.6.1 Reverse Engineering Tool
7.6.2 Static Analysis Sandbox
7.6.3 Dynamic Analysis Sandbox
7.6.4 Decompiler Sandbox
7.6.5 DNS Sinkhole
7.6.6 Hosts File
7.6.7 Reconnaissance
7.6.8 Community Cloud