• You will learn how to demonstrate knowledge in account management, access control concepts, and attack methods that are used to defeat access control systems.
• You will learn how to demonstrate knowledge in privacy issues, data classification, data integrity, audit, policies, standards, guidelines, and procedures as well as the application of accepted industry practices.
• You will understand risk management including risk analysis and threats and vulnerabilities.
• You will learn what the basic concepts of cryptography are, including public and private key algorithms, key distribution and management, methods of attack as well as the principles of public key infrastructure.
• You will understand all of the concepts of malicious and mobile code, types of malicious code threats, how malicious code is introduced into the environment, as well as various protection and recovery methods.

Audience Profile:

The SSCP is geared toward individuals who may hold technical and engineering related information technology positions such as network security engineers, systems security analysts, security administrators as well as non-security specific technical positions that require an understanding of security concepts and of best security practices including system administrators, application programmers, database administrators and systems analysts.

Methodology:

This course will be delivered utilizing best practice methodologies for a constructive learning environment. In employing this framework, concepts will be shared with the class in a traditional format in order to expand their frame of reference, but learners will also share their individual experiences, in and from the workplace, based upon these concepts. The individual learners in the classroom have varied experiences, workplace tasks, and hands-on knowledge that will allow others to comprehend and increase their own understandings in order to grow, retain, and transfer this newly attained knowledge.

Core Material to be addressed based on the 7 Domains of the SSCP CBK:

1. Access Controls

Tasks within the access controls domain permit management to specify what users are permitted to do, which resources they are allowed to access, and what operations they are able to perform on a system.

At the end of this section learners will be able to:

• Implement Logical Access Controls In terms Of Subjects
• Implement Logical Access Controls In terms Of Objects
• Implement Authentication Mechanisms
• Apply Access Control Concepts
• Describe Basic Security Concepts Related To Cloud Computing and Virtualization

2. Security Operations and Administration

The security operations & administration domain entails the identification of an organizations information assets and the documentation required for the implementations of policies, standards, procedures and guidelines that ensure confidentiality, integrity and availability.

At the end of this section learners will be able to:

• Validate Security Controls
• Perform Data Classification
• Perform Change Management Duties
• Describe Endpoint Device Security
• Comply With Data Management Policies

3. Monitoring and Analysis

Within the monitoring and analysis domain, monitoring deals with activities that are accountable for collecting information, providing methods of identifying security events, assigning priority to these events, taking the appropriate actions to maintain the security of the system, and reporting the pertinent information to the appropriate individual, group, or process.

At the end of this section learners will be able to:

• Explain Effective Monitoring Of Systems
• Monitor Intrusion Detection/Prevention Systems
• Monitor Event Correlation Systems
• Analyze Monitoring Results

4. Risk, Response and Recovery

The risk, response and recovery domain covers multiple aspects of existing threats, and mitigating and developing plans to deal with those threats. Risk management is the identification, measurement and control of loss associated with adverse events. It includes overall security review, risk analysis, selection and evaluation of safeguards, cost benefit analysis, management decisions, safeguard implementation, and effectiveness review.

Business Continuity Planning (BCP) facilitates the rapid recovery of business operations to reduce the overall impact of the disaster, through ensuring continuity of the critical business functions. Disaster Recovery Planning includes procedures for emergency response, extended backup operations and post-disaster recovery when the computer installation suffers loss of computer resources and physical facilities.

At the end of this section learners will be able to:

• Explain The Risk Management Process
• Participate In Risk Assessment
• Perform Security Assessment Activities
• Explain And Support Business Continuity Planning And Disaster Recovery Planning

5. Cryptography

Cryptography domain deals with the protection of information by modifying the information to ensure its integrity, confidentiality authenticity and non-repudiation. Cryptanalysis deals with defeating the cryptosystem and violating the confidentiality or integrity of the protected data. The ability of any organization to protect its information from unauthorized access or modification is critical. The application of cryptography for the storage and transmission of information attempts to address these concerns.

At the end of this section learners will be able to:

• Explain How To Install And Maintain Cryptographic Systems
• Execute Certificate and Key Management
• Execute The Implementation Of Secure Protocols

6. Networks and Communication

The networks and communications domain encompasses the network structure, transmission methods, transport formats and security measures used to maintain the integrity, availability, authentication and confidentiality of the transmitted information over both private and public communication networks.

At the end of this section learners will be able to:

• Explain Firewalls and Proxies
• Describe and Manage Remote Access
• Describe and Address Network Security Concepts
• Design Secure Network Topologies

7. Malicious Code and Activity

The malicious code & activity domain addresses computer code that can be described as being harmful or destructive to the computing environment. This includes viruses, worms, logic bombs, the Trojan horse and other technical and non-technical attacks. The number and types of attacks using malicious code is increasing. The requirement for an individual or an organization to protect themselves from these attacks is extremely important.

At the end of this section learners will be able to:

• Identify Malicious Activity
• Implement Malicious Code Countermeasures