DATA SECURITY SOFTWARE SECURITY COMPONENT SECURITY CONNECTION SECURITY SYSTEM SECURITY HUMAN SECURITY ORGANIZATIONAL SECURITY

GOVERNANCE 1. DATA SECURITY LAWS ETHICS

2. DATA PRIVACY 1. ETHICAL ISSUES IN SOFTWARE PERSONAL COMPLIANCE WITH SECURITY GOVERNANCE AND POLICY CYBER LAW
3. COMPLIANCE DEVELOPMENT CYBERSECURITY 1. ORGANIZATIONAL CONTEXT
2. SOCIAL ASPECTS OF SOFTWARE RULES/POLICY/ETHICAL NORMS 2. PRIVACY 1. GENERIC CATEGORIES OF CYBER LAW
DEVELOPMENT 1. SYSTEM MISUSE AND USER 3. LAWS, ETHICS, AND COMPLIANCE 2. GOVERNMENTAL REGULATIONS
3. LEGAL ASPECTS OF SOFTWARE MISBEHAVIOR  CATEGORIES OF CYBER LAW 3. PRIVACY REGULATIONS
DEVELOPMENT 2. ENFORCEMENT AND RULES OF 01. LAWS THAT REGULATE 4. LAWS THAT REGULATE INTELLECTUAL
4. VULNERABILITY DISCLOSURE BEHAVIOR CLASSIFIED OR SENSITIVE PROPERTY RIGHTS
5. WHAT, WHEN, AND WHY TO TEST 3. PROPER BEHAVIOR UNDER INFORMATION 5. CONTRACT AND TORT LAW
UNCERTAINTY 02. GOVERNMENT REGULATIONS 6. LAWS THAT REGULATE COMPUTER CRIME.
03. PRIVACY REGULATIONS 7. CONSTITUTIONAL FOUNDATIONS OF CYBER
AWARENESS AND UNDERSTANDING 04. LAWS THAT REGULATE LAW
– EDUCATION, AWARENESS, AND COMPUTER CRIME 8. INTELLECTUAL PROPERTY RELATED TO
TRAINING 4. SECURITY GOVERNANCE CYBERSECURITY
1. RISK PERCEPTION AND 5. EXECUTIVE- AND BOARD-LEVEL 9. PRIVACY LAWS
COMMUNICATION COMMUNICATION 10. DATA SECURITY LAW
2. CYBER HYGIENE 6. MANAGERIAL POLICY 11. COMPUTER HACKING LAWS
3. CYBERSECURITY USER 12. DIGITAL EVIDENCE
EDUCATION 13. DIGITAL CONTRACTS
4. CYBER VULNERABILITIES 14. MULTINATIONAL CONVENTIONS (ACCORDS)
AND THREAT AWARENESS 15. CROSS-BORDER PRIVACY AND DATA
PERSONNEL SECURITY SECURITY LAWS
SOCIAL AND BEHAVIORAL  REGULATION OF THE INTERNET:
1. SECURITY AWARENESS,
PRIVACY – HUMAN BEHAVIORAL FOUR PRIMARY MODES.
FACTORS TRAINING, AND EDUCATION 01. CONVENTIONAL REGULATION: LAW
1. SOCIAL THEORIES OF 2. SECURITY HIRING PRACTICES 02. TRADITIONAL REGULATION:
PRIVACY 3. SECURITY TERMINATION CONDUCT
2. SOCIAL MEDIA PRIVACY AND PRACTICES 03. SOCIAL NORMS AND CONVENTIONS
SECURITY 4. THIRD-PARTY SECURITY 04. MARKETS
5. SECURITY IN REVIEW
PROCESSES CYBER ETHICS
PERSONAL DATA PRIVACY AND 6. SPECIAL ISSUE IN PRIVACY OF 1. DEFINING ETHICS
SECURITY – PRIVACY OF EMPLOYEE PERSONAL 2. PROFESSIONAL ETHICS AND CODES OF
PERSONAL INFORMATION CONDUCT
INFORMATION
1. SENSITIVE PERSONAL DATA 3. ETHICS AND EQUITY/DIVERSITY
(SPD) 4. ETHICS AND LAW
2. PERSONAL TRACKING AND 5. SPECIAL AREAS OF ETHICS: ROBOTICS,
DIGITAL FOOTPRINT WAR, AND “ETHICAL” HACKING

USABLE SECURITY AND PRIVACY CYBER POLICY

– PERSONAL PRIVACY 1. INTERNATIONAL CYBER POLICY
ENABLEMENT AND ENFORCEMENT 2. U.S. FEDERAL CYBER POLICY
1. USABILITY AND USER 3. GLOBAL IMPACT
EXPERIENCE 4. CYBERSECURITY POLICY AND NATIONAL
2. HUMAN SECURITY FACTORS SECURITY
3. POLICY AWARENESS AND 5. NATIONAL ECONOMIC IMPLICATIONS OF
UNDERSTANDING CYBERSECURITY
4. PRIVACY POLICY 6. NEW ADJACENCIES TO DIPLOMACY
5. DESIGN GUIDANCE AND
IMPLICATIONS PRIVACY
1. DEFINING PRIVACY
2. PRIVACY RIGHTS
3. SAFEGUARDING PRIVACY
4. PRIVACY NORMS AND ATTITUDES
5. PRIVACY BREACHES
6. PRIVACY IN SOCIETIES
MANAGEMENT COMPONENT PROCUREMENT SYSTEM MANAGEMENT
1. SUPPLY CHAIN RISKS 1. POLICY MODELS RISK MANAGEMENT
2. SUPPLY CHAIN SECURITY 2. POLICY COMPOSITION 1. RISK IDENTIFICATION
3. SUPPLIER VETTING 3. USE OF AUTOMATION 2. RISK ASSESSMENT AND ANALYSIS
4. PATCHING AND THE 3. INSIDER THREATS
VULNERABILITY LIFE CYCLE 4. RISK MEASUREMENT AND
5. FIVE STAGES OF THE EVALUATION MODELS AND
SYSTEM PATCHING PROCESS METHODOLOGIES
01. DISCOVERY – A 5. RISK CONTROL
SECURITY
VULNERABILITY IS
IDENTIFIED
02. NOTIFICATION – SYSTEMS ADMINISTRATION
FINDER NOTIFIES THE 1. OPERATING SYSTEM
EFFECTED PARTIES ADMINISTRATION
03. INVESTIGATION –
2. DATABASE SYSTEM
EFFECTED PARTIES
CHARACTERIZE THE ADMINISTRATION
VULNERABILITY 3. NETWORK ADMINISTRATION
04. RESOLUTION – A 4. CLOUD ADMINISTRATION
PATCH IS CREATED TO 5. CYBER-PHYSICAL SYSTEM
ELIMINATE THE ADMINISTRATION
VULNERABILITY  ELEMENTS OF CYBER-
05. RELEASE – EFFECTED PHYSICAL SYSTEMS
PARTIES COORDINATE
ADMINISTRATION
AND RELEASE THE
REQUISITE PATCH. 01. SAFETY
6. OPERATION 02. CAPABILITY
7. GENERAL TYPES OF 03. ADAPTABILITY
CYBERATTACKS. 04. SCALABILITY
01. SPOOFING 05. RESILIENCY
02. SNOOPING 06. SECURITY
03. SUBVERSION 07. USABILITY
04. REPUDIATION
05. COVERT ACCESS
6. SYSTEM HARDENING
AND ABUSE 7. AVAILABILITY
06. PHYSICAL ABUSE
07. UNINTENTIONAL
ABUSE CYBERSECURITY PLANNING
08. COMMISSIONING 1. STRATEGIC PLANNING
AND 2. OPERATIONAL AND TACTICAL
DECOMMISSIONING MANAGEMENT
09. INSIDER THREAT
8. DOCUMENTATION
9. SYSTEMS AND PROCEDURES SECURITY PROGRAM MANAGEMENT
1. PROJECT MANAGEMENT
2. RESOURCE MANAGEMENT
3. SECURITY METRICS
 THE FUNDAMENTAL
ATTRIBUTES/ELEMENTS OF
SECURITY METRICS.
01. FACTUAL: IN THAT
THE VALUES ARE
 DIRECTLY
OBSERVABLE VERSUS
INFERRED
02. ADAPTABLE: IN
THAT THE MEASURES
APPROPRIATELY FIT
THE CIRCUMSTANCE
03. MEANINGFUL: IN
THAT THE OUTCOMES
ARE FULLY
UNDERSTANDABLE TO
ALL STAKEHOLDERS
4. QUALITY ASSURANCE AND
QUALITY CONTROL

SECURITY OPERATIONS
1. SECURITY CONVERGENCE
2. GLOBAL SECURITY OPERATIONS
CENTERS (GSOCS)

GOVERNANCE
INFORMATION STORAGE SECURITY
1. DISK AND FILE ENCRYPTION
2. DATA ERASURE
DATA AT CORE 3. DATA MASKING
REST/STORAGE 4. DATABASE SECURITY
SECURITY

RISK PROFILE ASSESSMENT

MANAGEMENT

DATA ANALYSIS GOVERNANCE

LEGAL ISSUES IN DIGITAL
FORENSICS
CORE DIGITAL FORENSICS DERIVATION OF SECURITY COMPONENT TESTING
INTRODUCTION REQUIREMENTS 1. PRINCIPLES OF UNIT SYSTEM RETIREMENT SOCIAL ENGINEERING ANALYTICAL TOOLS
DIGITAL FORENSICS TOOLS TESTING 1. DECOMMISSIONING 1. TYPES OF SOCIAL 1. PERFORMANCE MEASUREMENTS CYBERCRIME
DIGITAL FORENSICS INVESTIGATORY ANALYSIS AND TESTING 2. SECURITY TESTING 2. DISPOSAL ENGINEERING ATTACKS
1. STATIC AND DYNAMIC ANALYSIS (METRICS)
PROCESSES 3. STRESS TESTING 2. PSYCHOLOGY OF SOCIAL
MOBILE FORENSICS 2. UNIT TESTING 4. FUZZ TESTING 2. DATA ANALYTICS 1. CYBERCRIMINAL BEHAVIOR
SYSTEM TESTING ENGINEERING ATTACKS  GENERIC INCENTIVES THAT MIGHT
3. INTEGRATION TESTING 5. PENETRATION TESTS 3. MISLEADING USERS 3. SECURITY INTELLIGENCE
1. VALIDATING REQUIREMENTS LEAD A CRIMINAL TO ATTACK
4. SOFTWARE TESTING 2. VALIDATING COMPOSITION 4. DETECTION AND MITIGATION SYSTEMS:
OF COMPONENTS OF SOCIAL ENGINEERING 01. CURIOSITY OR RECREATIONAL
MAINTENANCE 3. UNIT VERSUS SYSTEM ATTACKS
1. CONFIGURING ATTACKS
TESTING BUSINESS CONTINUITY, DISASTER 02. BUSINESS OR FINANCIAL
2. PATCHING AND THE 4. FORMAL VERIFICATION OF RECOVERY, AND INCIDENT ATTACKS
VULNERABILITY LIFE CYCLE SYSTEMS
3. CHECKING ENVIRONMENT MANAGEMENT 03. GRUDGE ATTACKS
4. DEVOPS 1. INCIDENT RESPONSE 04. INTELLIGENCE ATTACKS
5. DECOMMISSIONING AND RETIRING 2. DISASTER RECOVERY 05. MILITARY OR TERRORIST
 GENERIC ELEMENTS OF A ATTACKS
DOCUMENTATION  MOTIVATION FACTORS FOR
DISASTER RECOVERY PLAN. CYBERCRIME
 1. INSTALLATION DOCUMENTS 01. DISASTER IMPACT 01. EGO: BEHAVIOR MOTIVATED
2. USER GUIDES AND MANUALS DESCRIPTION AND BY AN INFLATED SENSE OF
3. ASSURANCE DOCUMENTATION CLASSIFICATION PRIDE, OR INDIVIDUAL
4. SECURITY DOCUMENTATION SUPERIORITY TO OTHERS
02. RESPONSE
02. EXPOSURE: BEHAVIOR MEANT
DEPLOYMENT AND TO REVEAL INFORMATION
COMMUNICATION THAT THE OWNER DOES NOT
PROCESSES WANT TO BE REVEALED
03. ESCALATION AND 03. DEVIANCE: ABNORMAL
REASSESSMENT BEHAVIOR, NOT FITTING
PROCEDURES SOCIETY’S NORMS AND
3. BUSINESS CONTINUITY THEREFORE UNACCEPTABLE
04. MONETARY GAIN: BEHAVIOR
DESIGNED TO OBTAIN MONEY,
WHICH MOTIVATES TARGETED
CRIMES
05. EXTORTION: BEHAVIOR
INTENDED TO FORCE THE
VICTIM TO UNWILLINGLY DO
SOMETHING
06. SABOTAGE: BEHAVIOR
INTENDED TO DAMAGE OR
DESTROY THE CREDIBILITY
OF A RESOURCE
07. DISINFORMATION: BEHAVIOR
INTENDED TO ACHIEVE A
DISHONEST PURPOSE BY
SPREADING LIES
08. INFOWAR: BEHAVIORS
CONDUCTED TO ACHIEVE A
NATIONAL OR
ORGANIZATIONAL PURPOSE
 BEHAVIORAL PROFILES IN THE
CYBERCRIMINAL POPULATION.
01. SCRIPT KIDDIES
02. CYBER-PUNKS
03. OLD-TIMERS
04. CODE WARRIORS
05. CYBER THIEF
06. CYBER HUCKSTER
07. UNHAPPY INSIDER
08. EX-INSIDERS
09. CYBER-STALKERS
10. CONMAN
11. THE SOLDIER
12. WARFIGHTER
2. CYBERTERRORISM
3. CYBERCRIMINAL INVESTIGATION
4. ECONOMICS OF CYBERCRIME

MANAGEMENT
TRANSMISSION GOVERNANCE
SECUIRTY CORE SECURE COMMUNICATION PROTOCOLS IMPLEMENTATION NETWORK IMPLEMENTATIONS
1. TRANSMISSION CONTROL 1. VALIDATING INPUT AND CHECKING 1. IEEE 802/ISO NETWORKS
PROTOCOL/INTERNET ITS REPRESENTATION 2. IETF NETWORKS AND
PROTOCOL (TCP/IP) STACK 2. USING API’S CORRECTLY TCP/IP
2. APPLICATION AND TRANSPORT 3. USING SECURITY FEATURES 3. PRACTICAL INTEGRATION
LEVEL PROTOCOLS 4. CHECKING TIME AND STATE AND GLUE PROTOCOLS
 3. ATTACKS ON TLS-TRANSPORT RELATIONSHIPS 4. VULNERABILITIES AND
LAYER SECURITY 5. HANDLING EXCEPTIONS AND EXAMPLE EXPLOITS
4. INTERNET/NETWORK LAYER ERRORS PROPERLY
5. PRIVACY PRESERVING 6. PROGRAMMING ROBUSTLY: ROBUST NETWORK DEFENSE
PROTOCOLS DEFENSIVE PROGRAMMING 1. NETWORK HARDENING
6. DATA LINK LAYER CONCEPTS. 2. IMPLEMENTING FIREWALLS
7. ENCAPSULATING STRUCTURES AND AND VIRTUAL PRIVATE
MODULES NETWORKS (VPNS)
8. TAKING ENVIRONMENT INTO 3. DEFENSE IN DEPTH
ACCOUNT 4. HONEYPOTS AND HONEYNETS
5. NETWORK MONITORING
6. NETWORK TRAFFIC
ANALYSIS
7. MINIMIZING EXPOSURE
(ATTACK SURFACE AND
VECTORS)
8. NETWORK ACCESS CONTROL
(INTERNAL AND EXTERNAL)
9. PERIMETER
NETWORKS/PROXY SERVERS
10. NETWORK POLICY
DEVELOPMENT AND
ENFORCEMENT
11. NETWORK OPERATIONAL
PROCEDURES
12. NETWORK ATTACKS
13. THREAT HUNTING AND
MACHINE LEARNING

MANAGEMENT
GOVERNANCE
CRYPTOGRAPHY
1. INTRODUCTION: BASIC AND
ADVANCED CONCEPTS
2. MATHEMATICAL BACKGROUNDS
3. CIPHERS
CRYPTANALYSIS: CODE BREAKING
1. INTRODUCTION
DATA 2. CLASSICAL ATTACKS
TRANSMISSION CORE 3. SIDE-CHANNEL ATTACKS
SECUIRTY 4. ATTACKS AGAINST PRIVATE-KEY
CIPHERS
5. ATTACK AGAINST PUBLIC-KEY
CIPHERS
6. ALGORITHMS FOR SOLVING THE
DISCRETE LOG PROBLEM
7. ATTACKS ON RSA

MANAGEMENT
ACCESS GOVERNANCE
SECURITY CORE AUTHENTICATION: DATA
INTEGRITY/CORRECTNESS
1. CRYPTOGRAPHIC TECHNIQUES:
HASH FUNCTIONS
2. AUTHENTICATION FACTORS:
PASSWORDS, PINS
CRYPTOGRAPHIC TOKENS,
BIOMETRICS
 3. DATA INTEGRITY: CONCEPTS
AND IMPLEMENTATION
MODELS/MECHANISMS
4. WHAT YOU KNOW
AUTHENTICATION FACTORS:
PASSWORDS: SECRET CODES,
SECRET PINS
5. AUTHENTICATION STRENGTH
(STRENTHENING
AUTHENTICATION OF
PASSWORDS)
6. PASSWORD ATTACKS
7. PASSWORD STRORAGE
TECHNIQUES (STRENTHENING
STORAGE OF PASSWORDS)

MANAGEMENT
GOVERNANCE
CORE AUTHENTICATION AND FUNDAMENTAL DESIGN PRINCIPLES COMPONENT DESIGN PHYSICAL MEDIA
AUTHORIZATION: ACCESS CONTROL 1. LEAST PRIVILEGE 1. COMPONENT DESIGN 1. TRANSMISSION IN A SYSTEM THINKING
1. SECURE ARCHITECTURE DESIGN 2. FAIL-SAFE DEFAULTS SECURITY MEDIUM 1. WHAT IS A SYSTEM?
2. LOGICAL DATA ACCESS CONTROL 3. COMPLETE MEDIATION 2. PRINCIPLES OF SECURE 2. SHARED AND POINT-TO- 2. WHAT IS SYSTEMS
3. PHYSICAL DATA SECURITY 4. SEPARATION OF DUTIES COMPONENT DESIGN POINT MEDIA ENGINEERING?
4. DATA LEAK PREVENTION 5. MINIMIZE TRUST 3. COMPONENT 3. SHARING MODELS 3. SECURITY OF GENERAL-
6. ECONOMY OF MECHANISM IDENTIFICATION 4. COMMON TECHNOLOGIES PURPOSE SYSTEMS
7. MINIMIZE COMMON MECHANISM 4. ANTI-REVERSE 4. SECURITY OF SPECIAL-
8. LEAST ASTONISHMENT (SOMETIMES ENGINEERING TECHNIQUES PURPOSES SYSTEMS
REFERRED TO AS “PSYCHOLOGICAL 5. SIDE CHANNEL ATTACK 5. THREAT MODELS
ACCEPTABILITY”) MITIGATION PHYSICAL INTERFACES AND 6. REQUIREMENTS ANALYSIS
9. OPEN DESIGN 6. ANTI-TAMPER CONNECTORS 7. FUNDAMENTAL PRINCIPLES
10. LAYERING TECHNOLOGIES 1. HARDWARE  LEAST PRIVILEGE
11. MODULARITY CHARACTERISTICS AND  COMPLETE MEDIATION
12. COMPLETE LINKAGE MATERIALS  FAIL-SAFE DEFAULTS
13. DESIGN FOR ITERATION 2. CATEGORIES OF UTP CABLE  LEAST COMMON
3. STANDARDS MECHANISM
COMPONENT REVERSE 4. PIN ASSIGNMENTS FOR THE  SEPARATION OF
SPECIFICATION OF SECURITY ENGINEERING TIA/EIA 568A AND 568B PRIVILEGE:
REQUIREMENTS 1. DESIGN REVERSE STANDARDS.  PSYCHOLOGICAL
SOFTWARE DEVELOPMENT LIFE ENGINEERING 5. COMMON CONNECTORS ACCEPTABILITY AND
CYCLE/SECURITY DEVELOPMENT LIFE 2. HARDWARE REVERSE  RJ45 WORK FACTO
CYCLE ENGINEERING  RJ11  ECONOMY OF MECHANISM
PROGRAMMING LANGUAGES AND TYPE- 3. SOFTWARE REVERSE  F-TYPE AND ANALYZABILITY
SAFE LANGUAGES ENGINEERING  FIBER  DEFENSE IN DEPTH
 USB 8. DEVELOPMENT FOR TESTING
 BNC
 RS-232
 IEEE 1394 INTERFACE
SYSTEM ACCESS
HARDWARE ARCHITECTURE 1. AUTHENTICATION METHODS
1. STANDARD ARCHITECTURES 2. IDENTITY
2. HARDWARE INTERFACE
STANDARDS
3. ORGANIZATIONS SYSTEM CONTROL
RESPONSIBLE FOR
COMPUTER AND 1. ACCESS CONTROL
CONNECTIVITY STANDARDS 2. AUTHORIZATION MODELS
4. COMMON ARCHITECTURES 3. GENERIC AUTHORIZATION
5. EXAMPLES OF COMMERCIAL METHODS:
 MULTIPROCESSORS 01. POLICY-BASED ACCESS
CONTROL
DISTRIBUTED SYSTEMS 02. MANDATORY ACCESS
ARCHITECTURE CONTROL (MAC)
1. NETWORK ARCHITECTURES, 03. ROLE-BASED ACCESS
GENERAL CONCEPTS CONTROL (RBAC)
2. WORLD WIDE WEB 4. INTRUSION DETECTION
3. THE INTERNET 5. CYBERATTACKS AGAINST
4. PROTOCOLS AND LAYERING COMPUTER SYSTEMS
5. NETWORK LAYER 01. BACKDOORS
INTERACTION. 02. SPOOFING
6. HIGH PERFORMANCE 03. TAMPERING
COMPUTING 04. PRIVILEGE ESCALATION
(SUPERCOMPUTERS) 05. PHISHING
7. HYPERVISORS AND CLOUD 06. SOCIAL ENGINEERING
COMPUTING 6. DEFENSES
IMPLEMENTATIONS 7. AUDIT
8. VULNERABILITIES 8. MALWARE
9. VULNERABILITY MODELS
NETWORK ARCHITECTURE 10. PENETRATION TESTING
1. GENERAL CONCEPTS 11. VULNERABILITY MAPPING
2. NETWORK TOPOLOGIES. 12. FORENSICS
3. COMMON ARCHITECTURES 13. RECOVERY RESILIENCE
4. FORWARDING
5. ROUTING
6. SWITCHING/BRIDGING COMMON SYSTEM ARCHITECTURES
7. EMERGING TRENDS 1. VIRTUAL MACHINES
8. VIRTUALIZATION AND 2. INDUSTRIAL CONTROL
VIRTUAL HYPERVISOR SYSTEMS
ARCHITECTURE 3. INTERNET OF THINGS (IOT)
4. EMBEDDED SYSTEMS
NETWORK SERVICES 5. MOBILE SYSTEMS
6. AUTONOMOUS SYSTEMS
1. CONCEPT OF A SERVICE 7. GENERAL-PURPOSE SYSTEMS
2. SERVICE MODELS (CLIENT–
SERVER, PEER TO PEER)
3. SERVICE PROTOCOLS AND
CONCEPTS (IPC, APIS,
IDLS)
4. COMMON SERVICE
COMMUNICATION
ARCHITECTURES
5. SERVICE VIRTUALIZATION
6. VULNERABILITIES AND
EXAMPLE EXPLOITS

MANAGEMENT IDENTITY MANAGEMENT

1. IDENTIFICATION AND
AUTHENTICATION OF PEOPLE
AND DEVICES
2. PHYSICAL ASSET CONTROL
3. IDENTITY AS A SERVICE
(IDAAS)
4. THIRD-PARTY IDENTITY
SERVICES
5. ACCESS CONTROL ATTACKS
AND MITIGATION MEASURES
GOVERNANCE MANAGEMENT THREATS PROTOCOL