Information Security Governance & Practice learning path: everything to study, topic by topic

Professional codes of ethics, organizational ethics, due care and due diligence, conflicts of interest, ethical dilemmas in security work, reporting obligations and the duty to protect society and the profession

Aligning security with business strategy, goals and mission, organizational roles and responsibilities, governance versus management, control frameworks (ISO/IEC 27001/27002, NIST CSF, COBIT), due care, decision making, oversight and accountability

The documentation hierarchy (policy, standard, baseline, procedure, guideline), how each is developed, approved, communicated, enforced and reviewed, and how exceptions are handled

Computer crime laws, intellectual property (copyright, patents, trademarks, trade secrets), licensing, privacy and data protection law (GDPR, LGPD, HIPAA, CCPA), cross-border data flows, import/export controls, contractual and industry standards (PCI DSS), breach notification and liability

Administrative, criminal, civil, regulatory and industry-standards investigations, burden and standard of proof, evidence types and admissibility, chain of custody, forensic soundness, eDiscovery and legal hold, and coordination with legal counsel and law enforcement

Candidate screening, employment agreements and NDAs, onboarding and role changes, termination and offboarding, vendor and contractor personnel, separation of duties in HR processes, privacy in the workplace, and compliance and sanctions

Entry-level foundations: the confidentiality, integrity and availability triad, authentication, authorization and accountability, non-repudiation, privacy, threats, vulnerabilities and risk vocabulary, risk treatment options, defense in depth, least privilege, and the types and functions of security controls (administrative, technical, physical; preventive, detective, corrective)

Security awareness and training programs, phishing, vishing, smishing, pretexting, baiting and tailgating, insider threat basics, reporting suspicious activity, password and device hygiene, remote work behavior, and measuring the effect of awareness (click rates, report rates, simulations)

Risk practice vocabulary: the NIST Risk Management Framework step order (prepare, categorize, select, implement, assess, authorize, monitor), DREAD scoring of threats (damage, reproducibility, exploitability, affected users, discoverability) versus STRIDE classification, the Delphi technique of anonymous iterative expert consensus for qualitative estimates, and supply chain risk management for hardware including provenance, counterfeit and tampered components, trusted suppliers and hardware bills of materials

People-protection and investigative-ethics issues: duress codes and silent alarms that let a coerced employee signal danger without alerting the attacker, safety of personnel as the first priority, high-risk travel controls (travel briefings, minimal-data clean devices, full-disk encryption, no sensitive data crossing borders, VPN, device seizure and surveillance risks, check-in procedures), and the legal difference between entrapment (inducing someone to commit a crime they were not predisposed to commit) and enticement (providing an opportunity to someone already inclined, as with honeypots)

Identifying and inventorying assets, classification schemes (government and commercial), labeling, ownership roles (owner, custodian, steward, user, processor, controller), handling, storage, transport and marking requirements, and data states

Lifecycle stages (create, store, use, share, archive, destroy), retention schedules and legal requirements, data remanence, sanitization (clear, purge, destroy), end-of-life and end-of-support assets, and selecting data security controls such as DLP, tokenization, masking and rights management

Technical controls that follow data: data loss prevention (DLP) at endpoint, network and cloud layers with content inspection, fingerprinting, regular expressions and labels, monitor versus block modes and false positives, and information or digital rights management (IRM/DRM) enforcing read, print, copy and expiry permissions that stay with the document after it leaves the organization

Business impact analysis, critical functions, MTD/MTPD, RTO, RPO and WRT, continuity plan scope and development, project initiation, stakeholder roles, plan approval, maintenance and training

Recovery site options (hot, warm, cold, cloud, reciprocal), backup strategies, replication and failover, recovery priorities, disaster recovery plan content, communications, test types (read-through, walk-through, simulation, parallel, full interruption), lessons learned and return to normal

Single points of failure, redundancy of power, network, storage and compute, high availability versus fault tolerance, failover and failback, load balancing, RAID levels, backups versus replication, clustering, availability metrics and how redundancy supports recovery objectives

Formal security models (Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash, Graham-Denning, state machine, noninterference, take-grant), access control matrix, reference monitor and TCB, and evaluation, certification and accreditation schemes (TCSEC, ITSEC, Common Criteria)

Hardware and firmware security (TPM, HSM, secure boot, enclaves), memory protection and process isolation, virtualization and containers, protection rings, emerging architectures (embedded, mobile, IoT, ICS, client-server, distributed), covert channels and side-channel and architectural vulnerabilities

Symmetric and asymmetric cryptography, hashing, digital signatures, hybrid schemes, PKI and certificate lifecycle, key management, algorithm selection, and attacks on cryptosystems (brute force, birthday, frequency analysis, known-plaintext, side-channel, downgrade, replay)

Site and facility design (CPTED, layered defense), perimeter and entry controls, secure areas and data centers, utilities, HVAC, fire detection and suppression, power, media and equipment protection, visitor management and personnel safety (duress, travel, workplace violence)

OSI and TCP/IP models, secure network design (segmentation, defense in depth, microsegmentation), secure protocols, IPsec and TLS, VPN and remote access, wireless, VoIP and collaboration, converged and software defined networking, and securing network components

Choosing secure protocols for transport, email, remote administration and file transfer (TLS, IPsec, SSH, S/MIME, SFTP), certificate lifecycle, cryptographic key generation, storage, rotation, escrow and destruction, hardware security modules, hashing, digital signatures and common implementation failures

TCP/IP and OSI essentials, addressing, ports and common services, DNS and DHCP, network attacks (spoofing, poisoning, man-in-the-middle, denial of service, VLAN hopping), segmentation and VLANs, 802.1X, NAC and network device hardening

Operating firewalls, proxies, IDS/IPS, VPN gateways and load balancers, rule base review, secure wireless (WPA2/WPA3, enterprise authentication, rogue access points), and inventory, isolation and monitoring of IoT and operational technology devices

Entry-level network security architecture: segmentation, VLANs, DMZ, defense in depth, zero trust principles, VPN and remote access, firewall placement, NAT, common ports and protocols, plus cloud basics (IaaS, PaaS, SaaS, public, private, hybrid and community deployment, shared responsibility, service level agreements, multi-tenancy)

How block ciphers are used safely and where they leak: modes of operation (ECB, CBC, CFB, OFB, CTR, GCM) with IV and nonce rules, authenticated encryption, the threat quantum computers pose to RSA, ECC and Diffie-Hellman through Shor's algorithm versus the reduced impact of Grover's algorithm on symmetric keys, NIST post-quantum standards (lattice-based ML-KEM and ML-DSA, hash-based SLH-DSA), crypto-agility and harvest-now-decrypt-later, and side-channel attacks (timing, power analysis, cache, acoustic, electromagnetic, fault injection) with their countermeasures

Securing the plumbing of the network: DNSSEC signatures and the chain of trust (RRSIG, DNSKEY, DS) versus DNS cache poisoning, BGP route hijacking and leaks and their defenses (RPKI route origin validation, ROAs, prefix filtering, MD5/TCP-AO sessions), IPv6 rogue router advertisements and RA Guard with SEND, SRTP and ZRTP protection of VoIP media and signaling (SIPS/TLS), and wireless intrusion prevention (WIPS) detecting rogue access points and evil twins

Design-level security reasoning: Saltzer-Schroeder principles such as complete mediation, least privilege, fail-safe defaults and economy of mechanism, covert storage and timing channels and how to reduce their bandwidth, database inference and aggregation attacks with controls (polyinstantiation, query restriction, noise and cell suppression, views), and applying security baselines with scoping and tailoring decisions documented against risk

Assessment, test and audit strategy (internal, external, third-party), control testing methods, vulnerability and penetration test scope, synthetic transactions, code review, collecting process data (KPIs, KRIs, backups, training), SOC 1/2/3 and attestation reports, analysis, reporting, remediation tracking and management review

Need-to-know and least privilege, separation of duties, job rotation, privileged account management, service level agreements, media management, hardware and software asset management, configuration and change control as operational disciplines, and managing operations on a continuing basis

Single-factor and multi-factor authentication, tokens and biometrics, single sign-on and federation (Kerberos, SAML, OAuth 2.0, OpenID Connect), device authentication, and trust relationships between networks and domains (one-way, two-way, transitive, extranet and third-party connections)

Provisioning, review and deprovisioning of identities, role and attribute based access control models (DAC, MAC, RBAC, ABAC), privileged and service accounts, access recertification, federated identity administration and the audit of entitlements

Operating and tuning security platforms (SIEM, IDS/IPS, DLP, file integrity monitoring, NAC, application allow-listing), log collection and time synchronization, baselines, alert triage, false positive and false negative tuning, vulnerability scan analysis, and reporting monitoring results

Types of malicious code (viruses, worms, ransomware, rootkits, fileless malware, botnets), indicators of compromise, static and dynamic analysis basics, sandboxing, endpoint hardening, anti-malware and endpoint detection and response (EDR), mobile device management and host-based controls

Securing hypervisors, virtual machines, containers and virtual networks, VM escape and sprawl, snapshots and images, shared responsibility in IaaS/PaaS/SaaS, cloud identity and storage configuration, data residency, and operating secure cloud services

Entry-level incident response: events versus incidents, the incident response lifecycle (preparation, detection and analysis, containment, eradication, recovery, lessons learned), the incident response team and roles, escalation and communication, evidence handling basics, how incident response relates to business continuity and disaster recovery, and the first-hour actions of a frontline analyst

Authentication system design details tested at manager level: biometric error rates (false acceptance FAR, false rejection FRR, crossover error rate CER) and how sensitivity tuning shifts them, TACACS+ (TCP 49, full-payload encryption, separate authentication, authorization and accounting) versus RADIUS (UDP, password-only encryption, combined authn/authz) for device administration versus network access, and Kerberos ticket mechanics with attacks such as pass-the-ticket, Kerberoasting, golden and silver tickets and the double reset of the krbtgt account

Planning and governing security testing: interface testing (APIs, UI, network and physical interfaces), misuse and abuse case testing from requirements, regression testing after a fix and test coverage metrics (statement, branch, requirement coverage), penetration test authorization, scope and rules of engagement (written permission, get-out-of-jail letter, testing windows, escalation paths, data handling), and audit finding management with root cause analysis, corrective action plans, owners and due dates, and verification of closure

Integrating security into waterfall, agile, DevOps and DevSecOps, security gates per phase, change and configuration management of code, development environment security, maturity models (CMMI, OWASP SAMM, BSIMM), API governance and software-defined security

Secure coding guidelines and standards, input validation, output encoding, error handling, code review, static, dynamic and interactive testing, fuzzing, software composition analysis, security of repositories and pipelines, and measuring the effectiveness of software security (defect density, risk analysis, auditing)

Security impact of commercial off-the-shelf, open-source, SaaS and outsourced code, vendor assessment, software bills of materials, licensing, source code escrow, acceptance testing, contractual security requirements and ongoing monitoring of components