What must IT security professionals be aware of?
Regulations associated with their organization and the type of data collected
This includes both application-stored information and log files.
What is Sarbanes-Oxley abbreviated as?
SOX
Officially known as the Public Company Accounting Reform and Investor Protection Act of 2002.
What does Sarbanes-Oxley focus on?
The finances associated with an organization
What is HIPAA an abbreviation for?
Health Insurance Portability and Accountability Act
What does HIPAA ensure?
Protection of health care information
What are IT security professionals responsible for in terms of legal requirements?
Formal processes for reporting illegal activities
What is a legal hold?
Ensures data is available for future legal proceedings
True or False: Organizations must disclose security breaches within a mandated timeframe.
True
What is a challenge of cloud computing from a legal perspective?
Data may be stored anywhere in the world, subject to legal guidelines
What requirement might some countries have regarding data collected from their citizens?
Data must stay within that country’s borders
What might vary between different industries regarding IT security?
Security considerations and access requirements
How are power-generating technologies often secured?
Air-gapped from other parts of the network
What security measures are common in medical environments?
Extensive data encryption and protection technologies
What influences the security considerations of an organization?
The scope of the organization
Fill in the blank: A city or state government may collect records to help manage a _______.
city or county
What issues arise at the national level for data security?
Confidentiality and communication between states
What additional concerns do global companies face?
Different data protection and security laws in various countries
-
1.1 Security Control Types and Categories31
-
1.2 The CIA Triad: A Study Guide22
-
1.2 Digital Signatures: Ensuring Integrity and Origin - Study Guide25
-
1.2 AAA Framework and Authorization26
-
1.2 IT Security Gap Analysis: A Comprehensive Study23
-
1.2 Zero Trust Networks and Adaptive21
-
1.2 Physical Security Controls: Methods and Technologies26
-
1.2 IT Security Deception and Disruption: Honeypots, Honeyfiles, and Honeytokens18
-
1.3 Formal Change Control Processes: A Study Guide21
-
1.3 The Technician's Role in Change Control Implementation33
-
1.4 Cybersecurity Cryptography: Encryption and Public Key Infrastructure23
-
1.4 Data Encryption and Its Algorithms31
-
1.4 Secure Key Exchange Methods22
-
1.4 Cryptography's Guardians: TPM, HSM, and Secure Enclaves10
-
1.4 Obfuscation and Hidden Data Techniques21
-
1.4 Cryptographic Hashes and Digital Signatures25
-
1.4 Blockchain Essentials21
-
1.4 Digital Certificates18
-
2.1 Understanding Threat Actors18
-
2.2 Navigating Threat Vectors and Attack Paths26
-
2.2 The Art of Phishing: Recognizing and Avoiding Scams17
-
2.2 The Impersonation Playbook: Scams, Fraud, and Prevention18
-
2.2 Cybersecurity Fundamentals: Watering Hole Attacks and Layered Defense20
-
2.2 The Digital Deception Playbook24
-
2.3 Malware Memory Injection: Understanding the Threat20
-
2.3 Buffer Overflow Attacks23
-
2.3 Race Conditions and TOCTOU Attacks20
-
2.3 Secure Software Updates32
-
2.3 Operating System Patching15
-
2.3 Understanding Code and SQL Injection Attacks19
-
2.3 Code Injection Attack20
-
2.3 Understanding Cross-Site Scripting (XSS) Attacks27
-
2.3 IoT Firmware and Device Lifecycle Security17
-
2.3 Virtual Machine Security Vulnerabilities21
-
2.3 Cloud Security: Understanding Threats and Vulnerabilities31
-
2.3 Supply Chain Security and Third-Party Risk29
-
2.3 Cybersecurity Vulnerabilities and Countermeasures25
-
2.3 Mobile Device Security: Risks and Countermeasures17
-
2.3 Zero-Day Vulnerabilities and Attacks23
-
2.4 Understanding Malware26
-
2.4 Understanding Computer Viruses and Worms27
-
2.4 Digital Intruders: Spyware and Bloatware19
-
2.4 Cybersecurity Threats: Keyloggers, Logic Bombs, and Rootkits22
-
2.4 DNS Poisoning and URL Hijacking27
-
2.4 Wireless Network Attacks: Deauthentication and RF Jamming22
-
2.4 Denial of Service (DoS) and Distributed Denial of Service (DDoS) Attacks21
-
2.4 On-Path and Man-in-the-Middle Attacks21
-
2.4 Replay Attacks and Session Hijacking24
-
2.4 Malicious Code Attacks and Defenses17
-
2.4 Application Security Fundamentals20
-
2.4 Cryptography's Vulnerabilities28
-
2.4 Password Hashes and Brute Force Attacks24
-
2.4 Indicators of Compromise and Security Best50
-
2.5 Network Segmentation and Access17
-
2.5 Cybersecurity Mitigation Techniques and Best Practices29
-
2.5 System and Endpoint Hardening Fundamentals28
-
3.1 Cloud Infrastructure11
-
3.1 Network Isolation, Virtualization, and Cloud Infrastructure22
-
3.1 IT Security Considerations and Infrastructure Technologies24
-
3.1 IT Infrastructure and Operational Resilience16
-
3.2 Network Security Zones and Attack Surfaces23
-
3.2 Intrusion Prevention and Detection Systems21
-
3.2 Network Appliances:16
-
3.2 Port Security25
-
3.2 Network Firewall Concepts23
-
3.2 Secure Network Communication Technologies (VPN, SD-WAN, and SASE)20
-
3.3 Data Types and Classifications17
-
3.3 States of Data, Security, and Sovereignty19
-
3.3 Data Protection Methods and Security Techniques22
-
3.4 High Availability and Resilience Architectures18
-
3.4 Cryptography's Vulnerabilities: Birthday Attacks and SSL Stripping19
-
3.4 A Beginner's Guide to Keeping Systems Running: Understanding Disaster Recovery16
-
3.4 Backup Strategies and Recovery21
-
3.4 Data Center Power and Backup Systems16
-
4.1 Application Security Baselines and Deployment10
-
4.1 System and Device Hardening22
-
4.1 Wireless Site Surveys and Mobile Device Management21
-
4.1 Wireless Network Security Protocols and Authentication17
-
4.1 Application Security Development and Testing24
-
4.2 Asset Management26
-
4.3 Vulnerability Scanning15
-
4.3 Threat Intelligence17
-
4.3 Penetration Testing20
-
4.3 Analyzing Vulnerabilities19
-
4.3 Vulnerability Remediation17
-
4.4 Security Monitoring21
-
4.4 Security Tools37
-
4.5 Firewalls32
-
4.5 Web Filtering22
-
4.5 Operating System Security11
-
4.5 Secure Protocols14
-
4.5 Email Security18
-
4.5 Monitoring Data19
-
4.5 Endpoint Security27
-
4.6 Identity and Access Management29
-
4.6 Access Controls17
-
4.6 Multifactor Authentication17
-
4.6 Password Security18
-
4.7 Scripting and Automation27
-
4.8 Incident Response20
-
4.8 Incident Planning17
-
4.8 Digital Forensics17
-
4.9 Log Data31
-
5.1 Security Policies18
-
5.1 Security Standards20
-
5.1 Security Procedures24
-
5.1 Security Considerations17
-
5.1 Data Roles and Responsibilities10
-
5.2 Risk Management14
-
5.2 Risk Analysis20
-
5.2 Risk Management Strategies24
-
5.2 Business Impact Analysis12
-
5.3 Third-party Risk Assessment24
-
5.3 Agreement Types12
-
5.4 Compliance20
-
5.4 Privacy15
-
5.5 Audits and Assessments11
-
5.5 Penetration Tests18
-
5.6 Security Awareness19
-
5.6 User Training22
