Foundation of security principles (Confidentiality, Integrity, Availability), security governance and strategy, compliance with laws and regulations, risk management processes, business continuity (BCP) and disaster recovery (DR), personnel security, and professional ethics in information security

Protection of information assets – including data classification schemes, asset ownership responsibilities, data privacy considerations, data security controls (at rest and in transit), information lifecycle management, and data retention and destruction policies

Secure design principles for architecture and systems. Topics include security models (e.g. Bell-LaPadula, Biba), hardware, software, and network architecture vulnerabilities, cryptography and encryption solutions, physical security design, and evaluating the effectiveness of security controls in systems and architectures

Designing and protecting network infrastructure. Covers network architecture concepts, secure network components configuration, protocols security, implementing secure communication channels (VPNs, TLS encryption), network attack methods and mitigation (sniffing, DDoS, etc.), as well as wireless network security best practices

Managing identities and controlling access. Includes identification and authentication mechanisms (passwords, multi-factor, biometrics), authorization and access control models (role-based, discretionary, mandatory access control, etc.), identity provisioning and governance, federated identity services, single sign-on, and account monitoring and revocation

Techniques to evaluate an organization’s security posture. Focuses on developing assessment plans, performing vulnerability scans and penetration tests, conducting security audits and log reviews, software testing (e.g. code review, fuzzing), and reporting findings. Emphasis is on validating that security controls are effective and identifying gaps or weaknesses

Day-to-day security operations and incident management. Topics include implementing and managing security monitoring (SIEM, intrusion detection), incident response process and forensics, resource protection (data backups, redundancy), patch and change management, disaster recovery operations, business continuity procedures, and physical and environmental security to secure facilities and hardware

Ensuring that software is designed and developed with security in mind. Covers secure coding practices, integrating security into each phase of the software development life cycle (requirements, design, development, testing, deployment, maintenance), common software vulnerabilities (SQL injection, buffer overflows, etc.) and how to prevent them, application security testing tools (static/dynamic analysis), and evaluating third-party software security