SSCP Cert Prep: 7 Systems and Application Security

Introduction

• Securing systems and applications
• What you need to know
• Study resources

1. Malware

• Comparing viruses, worms, and trojans
• Malware payloads
• Understanding backdoors and logic bombs
• Looking at advanced malware
• Understanding botnets
• Code signing

2. Understanding Attackers

• Cybersecurity adversaries
• Preventing insider threats
• Attack vectors
• Zero-days and the Advanced Persistent Threat

3. Social Engineering Attacks

• Social engineering
• Impersonation attacks
• Identity fraud and pretexting
• Watering hole attacks
• Physical social engineering

4. Web Application Attacks

• OWASP Top Ten
• Application security
• Preventing SQL injection
• Understanding cross-site scripting
• Request forgery
• Defending against directory traversal
• Overflow attacks
• Explaining cookies and attachments
• Session hijacking
• Code execution attacks

5. Host Security

• Operating system security
• Malware prevention
• Application management
• Host-based network security controls
• File integrity monitoring
• Data loss prevention
• Endpoint monitoring

6. Hardware Security

• Data encryption
• Hardware and firmware security
• Peripheral security

7. Mobile Device Security

• Mobile connection methods
• Mobile device security
• Mobile device management
• Mobile device tracking
• Mobile application management
• Mobile security enforcement
• Bring Your Own Device (BYOD)
• Mobile deployment models

8. Embedded Systems Security

• Industrial control systems
• Internet of Things
• Securing smart devices
• Secure networking for smart devices

9. Cloud Computing

• What is the cloud?
• Cloud activities and the Cloud Reference Architecture
• Cloud deployment models
• Cloud service categories
• Virtualization
• Cloud compute resources
• Cloud storage
• Containers

10. Cloud Issues

• Security and privacy concerns in the cloud
• Data sovereignty
• Operational concerns in the cloud

11. What's Next?

• Continuing your studies