Cybersecurity Learning Outcomes

Data Sample

Cybersecurity Learning Outcomes

Save time and increase accuracy with DegreeData custom service.

The following is an example of DegreeData’s work in parsing and aggregating data from multiple sources.

Using Cybersecurity as a sample, learning outcomes are presented on a program-by-program basis and cross-referenced to their accrediting association’s competences. The result is a data-rich publication ready for research, publication or further development.

Alfred State, College of Technology Outcome Outcome Outcome Outcome Outcome Outcome Outcome Outcome Outcome Outcome Outcome Outcome
Program: Cyber Security
Award: B Tech
Demonstrate troubleshooting strategies with a variety of security problems. Install and configure web, database, file, and application servers. Develop and implement effective security and disaster recovery systems and policies. Develop and maintain technical documentation and procedures for security management. Demonstrate effective research, planning, and security management of software updates and fixes. Apply accumulated knowledge and skills in an actual industry environment. Demonstrate effectiveness in the use of computer forensic tools, procedures, techniques, and hardware, as well as maintain physical evidence. Demonstrate effectiveness in configuring authentication schemes, such as NAT, content security and content vectoring, SYNDefender, and VPNs using industry standard firewalls. Demonstrate effectiveness in the use and scan of a network with heterogeneous operating systems and identify security vulnerabilities. Demonstrate knowledge of multiple areas within the liberal arts arena. Demonstrate knowledge in design and configuration of Windows security. Demonstrate effectiveness in tracking and monitoring attacks against Linux servers and how to prevent them
John's Hopkins Proficiency Proficiency Proficiency Outcome Outcome              
Division: Whiting School of Engineering
Program: Cyber Security
Award: MS
ensuring the confidentiality, availability and integrity of data, preserving and restoring systems developing risk management skills. Demonstrate proficiency in assessing enterprise security risk and formulating technical recommendations in the areas of both hardware and software. Demonstrate proficiency in four major areas of cryptology: Encryption, Hash Functions, Signature Schemes, and Authentication              
Drexel University Attain Attain Attain Attain Attain Attain Attain Attain Attain Source    
Division: College of Computing and Informatics
Program: Computing & Security
Award: BS
Affiliation/Accreditation: NSA/CAE
An ability to apply knowledge of computing and mathematics appropriate to the program’s student outcomes and to the discipline An ability to analyze a problem, and identify and define the computing requirements appropriate to its solution An ability to design, implement, and evaluate a computer-based system, process, component, or program to meet desired needs An ability to function effectively on teams to accomplish a common goal An understanding of professional, ethical, legal, security and social issues and responsibilities An ability to communicate effectively with a range of audiences An ability to analyze the local and global impact of computing on individuals, organizations, and society Recognition of the need for and an ability to engage in continuing professional development An ability to use current techniques, skills, and tools necessary for computing practice More information    
Monroe Community College                        
Program: CyberSecurity
Award: Certificate
Identify security risks to computing resources. Assess potential threats to computing resources. Develop effective countermeasures aimed at protecting data. Develop effective countermeasures aimed at protecting computer assets                
Millersville University Ability Ability Ability Ability Ability Ability Ability Ability Ability      
Division: Dept. of Computer Science
Program: Computer Science
Award: BS
Affiliation/Accreditation: ABET
Analyze a complex computing problem and to apply principles of computing and other relevant disciplines to identify solutions. Design, implement, and evaluate a computing-based solution to meet a given set of computing requirements in the context of the program’s discipline. Communicate effectively in a variety of professional contexts. Recognize professional responsibilities and make informed judgments in computing practice based on legal and ethical principles. Function effectively as a member or leader of a team engaged in activities appropriate to the program’s discipline. Apply computer science theory and software development fundamentals to produce computing-based solutions.       More Information    
Southeast Missouri State Ability Ability Ability Ability Ability Ability Ability          
Harrision College of Business & Computing
Program: Cybersecurity
Award: BS
Affiliation/Accreditation: ABET
An ability to analyze a problem, and to identify and define the computing requirements appropriate to its solution. An ability to design, implement and evaluate a computer-based solution to meet a given set of computing requirements in the context of the discipline. An ability to communicate effectively with a range of audiences about technical information. An ability to make informed judgements in computing practice based on legal and ethical principles. An ability to function effectively on teams to establish goals, plan tasks, meet deadlines, manage risk and produce deliverables. An ability to apply security principles and practices to the environment, hardware, software, and human aspects of a system. An ability to analyze and evaluate systems with respect to maintaining operations in the presence of risks and threats.          
NYU, Tandon School of Engineering Intention Intention Intention Intention                
Division: Tandon School of Engineering
Program: Computer Science
Award: MS
Affiliation/Accreditation: NCAE/Cyber Op.s
deeply technical interdisciplinary grounded in the computer science (CS), computer engineering (CE), and/or electrical engineering (EE) disciplines extensive opportunities for hands-on applications via labs/exercises.                
Syracuse University Outcome Outcome Outcome Outcome Outcome Outcome            
Program: Computer Science
Award: BS
Affiliation/Accreditation: ABET
Analyze a complex computing problem and apply principles of computing and other relevant disciplines to identify solutions. Design, implement, and evaluate a computing-based solution to meet a given set of computing requirements in the context of the program’s discipline. Communicate effectively in a variety of professional contexts. Recognize professional responsibilities and make informed judgments in computing practice based on legal and ethical principles. Function effectively as a member or leader of a team engaged in activities appropriate to the program’s discipline. Apply computer science theory and software development fundamentals to produce computing-based solutions.            
Syracuse University Core/ABET Course Core/ABET Course Core/ABET Course                  
Special Program: Semester in Cyber Security
Program: CyberSecurity
Award: BS
Affiliation/Accreditation: ABET/Veterans
and Military Affairs
CIS 400: Certified Security by Design CSE 484: Introduction to Computer and Network Security CIS 487: Access Control, Security, and Trust                  
Carnegie Mellon Skills Skills Skills Skills Skills Skills Skills Source        
Division: School of Computer Science
Program: Computer Science
Award: BS
Identify, use, design, develop and analyze appropriate abstractions and algorithms to solve problems while being able to prove the algorithm’s performance and correctness across a variety of metrics (e.g., time, space, parallel vs. sequential implementation, computability). Implement solutions to problems in domains such as artificial intelligence, graphics and sound, software engineering, and humancomputer interaction, by applying the fundamentals of those areas to create solutions to current problems while being exposed to research developments that will enable them to adapt as the technology changes. Reason about and implement programs in various programming languages and paradigms Describe, specify, and develop large-scale, open-ended software systems subject to constraints such as performance and/or resource issues Communicate technical material effectively to technical and nontechnical audiences Work both individually and in teams Recognize the social impact of computing and the attendant responsibility to consider the legal, moral and ethical implications of computing technologies. More Information
Concentration: Security and Privacy Understand how to reason about the adversary in computer systems. Be familiar with common security vulnerabilities, from buffer overflows and return oriented programming to cross-site scripting, and widely deployed defenses against these vulnerabilities. Be familiar with and understand how to apply the basic concepts in cryptography and secure system design and analysis.                  
NYU, City Tech Demonstrate Demonstrate Demonstrate Demonstrate Demonstrate Demonstrate Demonstrate Demonstrate Hands-on Hands-on Hands-on Hands-on
Program: Computer Systems,
Networking and Security
Award: B Tech
An ability to apply the knowledge, techniques, skills, and modern tools of the discipline to computer systems technology activities. An ability to apply a knowledge of mathematics, science, engineering, and technology to computer systems problems that require application of principles and practical knowledge. An ability to conduct standard tests and measurements, and to conduct, analyze, and interpret experiments. An ability to function effectively as a member of a technical team. An ability to apply written, oral, and graphical communication in both technical and non-technical environments; and an ability to identify and use appropriate technical literature. An understanding of the need for and an ability to engage in self-directed continuing professional development. An understanding of and a commitment to address professional and ethical responsibilities, including a respect for diversity. A commitment to quality, timeliness, and continuous improvement in professional practice Analyzing, designing, and implementing hardware and software computer systems. Applying project management techniques to computer systems. Demonstrating a deeper knowledge of at least one area of computing, such as software development, databases, information technology operations, networking and security, enabling the student to gain employment in the computing field. Understanding how management uses information systems to operate business enterprises

Please scroll to see additional competencies >>

Source: https://cybered.hosting.acm.org/wp/
Knowledge Area: Data Security
Basic cryptography concepts Describe the purpose of cryptography and list ways it is used in data communications. Describe the following terms: cipher, cryptanalysis, cryptographic algorithm, and cryptology, and describe the two basic methods (ciphers) for transforming plaintext in ciphertext. Explain how public key infrastructure supports digital signing and encryption and discuss the limitations/vulnerabilities. Discuss the dangers of inventing one’s own cryptographic methods. Describe which cryptographic protocols, tools and techniques are appropriate for a given situation.
End-to-end secure communications Explain the goals of end-to-end data security.        
Digital forensics Describe what a digital investigation is, the sources of digital evidence, and the limitations of forensics. Compare and contrast variety of forensics tools.      
Data integrity and authentication Explain the concepts of authentication, authorization, access control, and data integrity. Explain the various authentication techniques and their strengths and weaknesses. Explain the various possible attacks on passwords. Data erasure Describe the various techniques for data erasure.  
Knowledge Area: Software Security
Fundamental Design Principles; Least Privilege, Open Design, and Abstraction Discuss the implications of relying on open design or the secrecy of design for security. List the three principles of security. Describe why each principle is important to security. Identify the needed design principle.  
Security requirements and the roles they play in design Explain why security requirements are important. Identify common attack vectors. Describe the importance of writing secure and robust programs. Describe the concept of privacy including personally identifiable information.  
Implementation issues Explain why input validation and data sanitization are necessary. Explain the difference between pseudorandom numbers and random numbers. Differentiate between secure coding and patching and explain the advantage of using secure coding techniques. Describe a buffer overflow and why it is a potential security problem.  
Static, dynamic analysis Explain the difference between static and dynamic analysis. Discuss a problem that static analysis cannot reveal. Discuss a problem that dynamic analysis cannot reveal.    
Configuring, patching Discuss the need to update software to fix security vulnerabilities. Explain the need to test software after an update but before the patch is distributed. Explain the importance of correctly configuring software.    
Knowledge Area: Component Security
Vulnerabilities of system components Explain how the security of a system’s components might impact the security of the system. Describe ways in which the confidentiality of a component’s design may be compromised. Describe ways to learn information about component’s functionality with limited information about its design and implementation.    
Component lifecycle List the phases of a component’s lifecycle. Secure component design principles List component design artifacts which may require protection. Give examples of several secure component design principles and explain how each protects the security of components. Describe several techniques for protecting the design elements of an integrated circuit.  
Supply chain management List common points of vulnerability in a component’s supply chain. Describe security risks in a component supply chain. Describe ways to mitigate supply chain risks.    
Security testing Differentiate between unit and system testing. List several techniques for testing security properties of a component.      
Reverse engineering List reasons why someone would reverse engineer a component. Explain the difference between static and dynamic analysis in reverse engineering software. Describe a technique for reverse engineering the functionality of an integrated circuit.    
Knowledge Area: Connection Security
Systems, architecture, models, and standards Discuss the need for common models and architectures in order to describe systems. Describe a model of systems that consists of components and interfaces for connections. Explain why a component requires at least one interface. List several standards that define models consisting of systems of components and interfaces. Describe the components and interfaces of a networking standard provided.
Physical component interfaces Explain why a hardware device is always modeled a physical component. List several examples of physical component interfaces with their associated vulnerabilities. Describe an exploit for a vulnerability of a physical interface provided.    
Software component interfaces Explain why every physical interface has a corresponding software component to provide a corresponding software interface. Explain how software components are organized to represent logical layers in a standard model. Discuss how the Internet 5 layer model can be viewed as software components and interfaces that represent levels of services encapsulated by lower-level services. Discuss how TCP/IP as a service is represented by different interfaces in different software systems.  
Connection attacks Explain how connection attacks can be understood in terms of attacks on software component interfaces. Describe how a specified standard interface could expose vulnerabilities in a software component that implements the interface. Describe how an implementation could protect itself from a specified vulnerability in a specified standard interface.    
Transmission attacks Explain how transmission attacks are often implemented as attacks on components that provide the service of relaying information. Describe an attack on a specified node in a TCP/IP network given the description of a vulnerability. Explain why transmission attacks can often be viewed as connection attacks on network components (physical or software).    
Knowledge Area: System Security
Holistic approach Explain the concepts of trust and trustworthiness. Explain what is meant by confidentiality, integrity, and availability. Explain what a security policy is, and its role in protecting data and resources.    
Security policy Discuss the importance of a security policy. Explain why different sites have different security policies. Explain the relationship among a security group, system configuration, and procedures to maintain the security of the system.    
Authentication Explain three properties commonly used for authentication. Explain the importance of multifactor authentication. Explain the advantages of pass phrases over passwords.    
Access control Describe an access control list. Describe physical and logical access control, and compare and contrast them. Distinguish between authorization and authentication.    
Monitoring Discuss how intrusion detection systems contribute to security. Describe the limits of anti-malware software such as antivirus programs. Discuss uses of system monitoring.    
Recovery Explain what resilience is and identify an environment in which it is important. Discuss the basics of a disaster recovery plan. Explain why backups pose a potential security risk.    
Testing Describe what a penetration test is and why it is valuable. Discuss how to document a test that reveals a vulnerability. Discuss the importance of validating requirements.    
Documentation Discuss the importance of documenting proper installation and configuration of a system. Be able to write host and network intrusions documentation. Be able to explain the security implications of unclear or incomplete documentation of system operation.    
Identity Management Explain the difference between identification, authentication, and access authorization of people and devices. Discuss the importance of audit trails and logging in identification and authentication. Demonstrate the ability to implement the concept of least privilege and segregation of duties. Demonstrate the overall understanding of access control attacks and mitigation measures.  
Social Engineering Demonstrate overall understanding of the types of social engineering attacks, psychology of social engineering attacks, and misleading users. Demonstrate the ability to identify types of social engineering attacks. Demonstrate the ability to implement approaches for detection and mitigation of social engineering attacks.    
Awareness and understanding Discuss the importance of cyber hygiene, cybersecurity user education, as well as cyber vulnerabilities and threats awareness. Describe the major topics within Security Education, Training, and Awareness (SETA) programs. Discuss the importance of SETA as countermeasures. Discuss the importance of risk perception and communication in the context of mental models of cybersecurity and privacy.
Social behavioral privacy and security Compare and contrast various theories of privacy from social psychology and social science. Describe the concepts of privacy tradeoffs and risks in the social context, control and awareness of data consent, personal information monitoring, regulatory protections and concerns on maintaining social privacy. Discuss the importance of social media privacy and security.    
Personal data privacy and security Discuss the importance of protection of Sensitive Personal Data (SPD) and Personally Identifiable Information (PII). Discuss the importance of regulations governing the collection, use and distribution of SPD, and possibilities for inference of SPD. Describe the concepts of personal tracking and digital footprint, while understanding the invasiveness of such tools in the context of privacy.    
Knowledge Area: Organizational Security
Risk Management Describe risk management and its role in the organization. Describe risk management techniques to identify and prioritize risk factors for information assets and how risk is assessed. Discuss the strategy options used to treat risk and be prepared to select from them when given background information. Describe popular methodologies used in the industry to manage risk.  
Governance and policy Discuss the importance, benefits, and desired outcomes of cybersecurity governance and how such a program would be implemented. Describe information security policy and its role in a successful information security program. Describe the major types of information security policy and the major components of each. Explain what is necessary to develop, implement, and maintain effective policy and what consequences the organization may face if it does not do so.  
Laws, ethics, and compliance Differentiate between law and ethics. Describe why ethical codes of conduct are important to cybersecurity professionals and their organizations. Identify significant national and international laws that relate to cybersecurity. Explain how organizations achieve compliance with national and international laws and regulations, and specific industry standards.  
Strategy and planning Explain strategic organizational planning for cybersecurity and its relationship to organization-wide and IT strategic planning. Identify the key organizational stakeholders and their roles. Describe the principal components of cybersecurity system implementation planning.    
Knowledge Area: Societal Security
Cybercrime Discuss various motives for cybercrime behavior. Summarize terror activities in cyberspace geared toward generating societal fear and certainty. Describe methods for investigating both domestic and international crimes. Explain why preserving the chain of digital evidence is necessary in prosecuting cybercrimes.  
Cyber law Describe the constitutional foundations of cyber law. Describe international data security and computer hacking laws. Interpret intellectual property laws related to security. Summarize laws governing online privacy.  
Cyber ethics Distinguish among virtue ethics, utilitarian ethics and deontological ethics. Paraphrase professional ethics and codes of conduct from prominent professional societies, such as ACM, IEEE-CS, AIS and (ISC)2. Describe ways in which decision-making algorithms could overrepresent or under-represent majority and minority groups in society.    
Cyber policy Describe major international public policy positions and the impact they have on organizations and individuals. Summarize nation-specific cybersecurity public policy with respect to the protection of sensitive information and protection of critical infrastructure. Explain global impact of cybersecurity to culture including areas such as the economy, social issues, policy and laws.    
Privacy Describe the concept of privacy including the societal definition of what constitutes personally private information and the tradeoffs between individual privacy and security. Summarize the tradeoff between the rights to privacy by the individual versus the needs of society. Describe the common practices and technologies used to safeguard personal privacy.    

Please scroll to see additional competencies >>

Source: http://www.iad.gov/NIETP/CAERequirements.cfm
Foundational
CyberSecurity Foundations (CSF) Ability Ability Ability Ability Ability  
  Describe the fundamental concepts of the cybersecurity discipline and use to provide system security Describe potential system attacks and the actors that might perform them Describe cyber defense tools, methods and components and apply cyber defense methods to prepare a system to repel attacks Describe appropriate measures to be taken should a system compromise occur Properly use the Vocabulary associated with cybersecurity  
CyberSecurity Principles (CSP) Ability Ability Ability Ability Ability  
  Define the principles of cybersecurity Describe why each principle is important to security and how it enables the development of security mechanisms that can implement desired security policies Analyze common security failures and identify specific design principles that have been violated Given a specific scenario, identify the design principles involved or needed Understand the interaction between security and system usability and the importance for minimizing the effects of security mechanisms.  
IT Systems Components (ISC) Ability Ability Ability Ability Ability  
  Describe the hardware components of modern computing environments and their individual functions Describe the basic security implications of modern computing environments Understand the Federal, State and Local Cyber Defense partners/structures Properly use the Vocabulary associated with cybersecurity.    
Technical Core
Technical Core – Basic Cryptography (BCY) Ability Ability Ability Ability    
  Students will be able to identify the elements of a cryptographic system Students will be able to describe the differences between symmetric and asymmetric algorithms Students will be able to describe which cryptographic protocols, tools and techniques are appropriate for a given situation Students will be able to describe how crypto can be used, strengths and weaknesses, modes, and issues that have to be addressed in an implementation (e.g., key management), etc.    
Technical Core – Basic Networking (BNW Ability Ability Ability Ability Ability Ability
  Describe the fundamental concepts, technologies, components and issues related to communications and data networks Design a basic network architecture given a specific need and set of hosts/clients Track and identify the packets involved in a simple TCP connection (or a trace of such a connection) Use a network monitoring tools to observe the flow of packets (e.g., WireShark) Perform network mapping (enumeration and identification of network components) (e.g., Nmap) Describe common network vulnerabilities.
Technical Core – Basic Scripting and Programming (BSP) Ability Ability Ability Ability    
  Demonstrate their proficiency in the use of scripting languages to write simple scripts (e.g., to automate system administration tasks) Write simple linear and looping scripts Write simple and compound conditions within a programming language or similar environment (e.g., scripts, macros, SQL) Demonstrate proficiency in the use of a programming language to solve complex problems in a secure and robust manner.    
Technical Core – Network Defense (NDF) Ability Ability Ability Ability    
  Describe the key concepts in network defense (defense in depth, minimizing exposure, etc.) Explain how network defense tools (firewalls, IDS, etc.) are used to defend against attacks and mitigate vulnerabilities Analyze how security policies are implemented on systems to protect a network Evaluate how network operational procedures relate to network security.    
Technical Core – Operating Systems Concepts (OSC) Ability Ability Ability Ability    
  Describe the role and basic functions of an operating system, and how operating systems interact with hardware and software applications Identify and describe basic security issues of operating systems.        
Non-Technical Core
Non-Technical Core – Cyber Threats (CTH) Ability Ability Ability Ability    
  Identify the bad actors in cyberspace and compare and contrast their resources, capabilities/techniques, motivations and aversion to risk Describe different types of attacks and their characteristics.        
Non-Technical Core – Cybersecurity Planning and Management (CPM) Ability Ability Ability Ability    
  Examine the placement of security functions in a system and describe the strengths and weaknesses Develop contingency plans for various size organizations to include: business continuity, disaster recovery and incident response Develop system specific plans for: aThe protection of intellectual property bThe implementation of access controls cPatch and change management Outline and explain the roles of personnel in planning and managing security, including: aBoard of Directors bSenior Management cChief Information Security Officer (CISO) dIT Management (CIO, IT Director, etc) eFunctional Area Management fInformation Security personnel gEnd users    
Non-Technical Core – Policy, Legal, Ethics, and Compliance (PLE) Ability Ability Ability      
  List the applicable laws and policies related to cyber defense and describe the major components of each pertaining to the storage and transmission of data Describe their responsibilities related to the handling of data as it pertains to legal, ethical and/or agency auditing issues Describe how the type of legal dispute (civil, criminal, private) affects the evidence used to resolve it.      
Non-Technical Core – Security Program Management (SPM) Ability Ability Ability      
  Apply their knowledge to develop a security program, identifying goals, objectives and metrics Apply their knowledge to effectively manage a security program Assess the effectiveness of a security program      
Non-Technical Core – Security Risk Analysis (SRA) Ability Ability Ability Ability    
  Describe how risk relates to a system security policy Describe various risk analysis methodologies Evaluate and categorize risk a) with respect to technology; b) with respect to individuals, and c) in the enterprise, and recommend appropriate responses Select the optimal methodology based on needs, advantages and disadvantages.    

Please scroll to see additional competencies >>

Source: https://cybered.hosting.acm.org/wp/
Data Security
Basic cryptography Describe the purpose of cryptography and list ways it is used in data communications. Describe the following terms: cipher, cryptanalysis, cryptographic algorithm, and cryptology, and describe the two basic methods (ciphers) for transforming plaintext in ciphertext. Explain how public key infrastructure supports digital signing and encryption and Discuss the limitations/vulnerabilities. Discuss the dangers of inventing one’s own cryptographic methods. Describe which cryptographic protocols, tools and techniques are appropriate for a given situation.
End-to-end secure communications Explain the goals of end-to-end data security.          
Digital forensics Describe what a digital investigation is, the sources of digital evidence, and the limitations of forensics. Compare and contrast variety of forensics tools.        
Data integrity and authentication Explain the concepts of authentication, authorization, access control, and data integrity. Explain the various authentication techniques and their strengths and weaknesses. Explain the various possible attacks on passwords.      
Data erasure Describe the various techniques for data erasure          
Software Security
Fundamental Design Principles; Least Privilege, Open Design, and Abstraction Discuss the implications of relying on open design or the secrecy of design for security. List the three principles of security. Describe why each principle is important to security. Identify the needed design principle.    
Security requirements and the roles they play in design Explain why security requirements are important. Identify common attack vectors. Describe the importance of writing secure and robust programs. Describe the concept of privacy including personally identifiable information.    
Implementation issues Explain why input validation and data sanitization are necessary. Explain the difference between pseudorandom numbers and random numbers. Differentiate between secure coding and patching and Explain the advantage of using secure coding techniques. Describe a buffer overflow and why it is a potential security problem.    
Static, dynamic analysis Explain the difference between static and dynamic analysis. Discuss a problem that static analysis cannot reveal. Discuss a problem that dynamic analysis cannot reveal.      
Configuring, patching Discuss the need to update software to fix security vulnerabilities. Explain the need to test software after an update but before the patch is distributed. Explain the importance of correctly configuring software.      
Ethics Explain the concept that because you can do it, it doesn’t mean you should do it. Discuss the ethical issues in disclosing vulnerabilities. Discuss the ethics of thorough testing, especially corner cases. Identify the ethical effects and impacts of design decisions.    
Component Security
Vulnerabilities of system components Explain how the security of a system’s components might impact the security of the system. Describe ways in which the confidentiality of a component’s design may be compromised. Describe ways to learn information about component’s functionality with limited information about its design and implementation.      
Component lifecycle List the phases of a component’s lifecycle. Secure component design principles List component design artifacts which may require protection. Give examples of several secure component design principles and Explain how each protects the security of components. Describe several techniques for protecting the design elements of an integrated circuit.    
Supply chain management List common points of vulnerability in a component’s supply chain. Describe security risks in a component supply chain. Describe ways to mitigate supply chain risks.      
Security testing Differentiate between unit and system testing List several techniques for testing security properties of a component.        
Reverse engineering List reasons why someone would reverse engineer a component. Explain the difference between static and dynamic analysis in reverse engineering software. Describe a technique for reverse engineering the functionality of an integrated circuit.      
Connection Security
Systems, architecture, models, and standards Discuss the need for common models and architectures in order to Describe systems. Describe a model of systems that consists of components and interfaces for connections. Explain why a component requires at least one interface. List several standards that define models consisting of systems of components and interfaces. Describe the components and interfaces of a networking standard provided.  
Physical component interfaces Explain why a hardware device is always modeled a physical component. List several examples of physical component interfaces with their associated vulnerabilities. Describe an exploit for a vulnerability of a physical interface provided.      
Software component interfaces Explain why every physical interface has a corresponding software component to provide a corresponding software interface. Explain how software components are organized to represent logical layers in a standard model. Discuss how the Internet 5 layer model can be viewed as software components and interfaces that represent levels of services encapsulated by lower-level services. Discuss how TCP/IP as a service is represented by different interfaces in different software systems.    
Connection attacks Explain how connection attacks can be understood in terms of attacks on software component interfaces. Describe how a specified standard interface could expose vulnerabilities in a software component that implements the interface. Describe how an implementation could protect itself from a specified vulnerability in a specified standard interface.      
Transmission attacks Explain how transmission attacks are often implemented as attacks on components that provide the service of relaying information. Describe an attack on a specified node in a TCP/IP network given the description of a vulnerability. Explain why transmission attacks can often be viewed as connection attacks on network components (physical or software).      
System Security
Holistic approach Explain the concepts of trust and trustworthiness Explain what is meant by confidentiality, integrity, and availability Explain what a security policy is, and its role in protecting data and resources      
Security policy Discuss the importance of a security policy Explain why different sites have different security policies Explain the relationship among a security group, system configuration, and procedures to maintain the security of the system      
Authentication Explain three properties commonly used for authentication Explain the importance of multifactor authentication Explain the advantages of pass phrases over passwords      
Access control Describe an access control list Describe physical and logical access control, and compare and contrast them Distinguish between authorization and authentication      
Monitoring Discuss how intrusion detection systems contribute to security Describe the limits of anti-malware software such as antivirus programs Cybersecurity 2017 Version 1.0 Report CSEC2017 31 December 2017 52 Discuss uses of system monitoring    
Recovery Explain what resilience is and identify an environment in which it is important Discuss the basics of a disaster recovery plan Explain why backups pose a potential security risk      
Testing Describe what a penetration test is and why it is valuable Discuss how to document a test that reveals a vulnerability Discuss the importance of validating requirements      
Documentation Discuss the importance of documenting proper installation and configuration of a system Be able to write host and network intrusions documentation Be able to explain the security implications of unclear or incomplete documentation of system operation.      
Human Security
Identity Management Explain the difference between identification, authentication, and access authorization of people and devices Discuss the importance of audit trails and logging in identification and authentication Demonstrate the ability to implement the concept of least privilege and segregation of duties Demonstrate the overall understanding of access control attacks and mitigation measures    
Social Engineering Demonstrate overall understanding of the types of social engineering attacks, psychology of social engineering attacks, and misleading users Demonstrate the ability to identify types of social engineering attacks Demonstrate the ability to implement approaches for detection and mitigation of social engineering attacks      
Awareness and understanding Discuss the importance of cyber hygiene, cybersecurity user education, as well as cyber vulnerabilities and threats awareness Describe the major topics within Security Education, Training, and Awareness (SETA) programs Discuss the importance of SETA as countermeasures Discuss the importance of risk perception and communication in the context of mental models of cybersecurity and privacy    
Social behavioral privacy and security Compare and contrast various theories of privacy from social psychology and social science Describe the concepts of privacy tradeoffs and risks in the social context, control and awareness of data consent, personal information monitoring, regulatory protections and concerns on maintaining social privacy Discuss the importance of social media privacy and security      
Personal data privacy and security Discuss the importance of protection of Sensitive Personal Data (SPD) and Personally Identifiable Information (PII) Discuss the importance of regulations governing the collection, use and distribution of SPD, and possibilities for inference of SPD Describe the concepts of personal tracking and digital footprint, while understanding the invasiveness of such tools in the context of privacy.      
Organizational Security
Risk Management Describe risk management and its role in the organization. Describe risk management techniques to identify and prioritize risk factors for information assets and how risk is assessed. Discuss the strategy options used to treat risk and be prepared to select from them when given background information. Cybersecurity 2017 Version 1.0 Report CSEC2017 31 December 2017 70 Describe popular methodologies used in the industry to manage risk.    
Governance and policy Discuss the importance, benefits, and desired outcomes of cybersecurity governance and how such a program would be implemented. Describe information security policy and its role in a successful information security program. Describe the major types of information security policy and the major components of each. Explain what is necessary to develop, implement, and maintain effective policy and what consequences the organization may face if it does not do so.    
Laws, ethics, and compliance Differentiate between law and ethics. Describe why ethical codes of conduct are important to cybersecurity professionals and their organizations. Identify significant national and international laws that relate to cybersecurity. Explain how organizations achieve compliance with national and international laws and regulations, and specific industry standards.      
Strategy and planning Explain strategic organizational planning for cybersecurity and its relationship to organization-wide and IT strategic planning. Identify the key organizational stakeholders and their roles. Describe the principal components of cybersecurity system implementation planning      
Societal Security
Cybercrime Discuss various motives for cybercrime behavior. Summarize terror activities in cyberspace geared toward generating societal fear and certainty. Describe methods for investigating both domestic and international crimes. Explain why preserving the chain of digital evidence is necessary in prosecuting cybercrimes.      
Cyber law Describe the constitutional foundations of cyber law. Describe international data security and computer hacking laws. Interpret intellectual property laws related to security. Summarize laws governing online privacy.        
Cyber ethics Distinguish among virtue ethics, utilitarian ethics and deontological ethics. Paraphrase professional ethics and codes of conduct from prominent professional societies, such as ACM, IEEE-CS, AIS and (ISC)2 . Describe ways in which decision-making algorithms could overrepresent or under-represent majority and minority groups in society.      
Cyber policy Describe major international public policy positions and the impact they have on organizations and individuals. Summarize nation-specific cybersecurity public policy with respect to the protection of sensitive information and protection of critical infrastructure. Explain global impact of cybersecurity to culture including areas such as the economy, social issues, policy and laws.      
Privacy Describe the concept of privacy including the societal definition of what constitutes personally private information and the tradeoffs between individual privacy and security. Summarize the tradeoff between the rights to privacy by the individual versus the needs of society. Describe the common practices and technologies used to safeguard personal privacy