Systems Security Certified Practitioner (SSCP) → <div class="sscp-iam-curriculum"> <h4 style="font-weight: 500; color: #333;">01. Authentication & Identity Methods</h4> <ul> <li>Types of Authentication: Something you know, have, are, or do</li> <li>Multi-Factor Authentication (MFA): Implementation and security benefits</li> <li>Single Sign-On (SSO): Streamlining user access across the enterprise</li> <li>Biometrics and Hardware Tokens: Advanced authentication mechanisms</li> </ul> <h4 style="font-weight: 500; color: #333;">02. Access Control Models & Privileges</h4> <ul> <li>Defining Access: Granting and Revoking permissions (Allow vs. Deny)</li> <li>Resource Permissions: Read, Write, and Execute (RWX) operations</li> <li>Role-Based Access Control (RBAC): Mapping permissions to job functions</li> <li>Rule-Based Access Control: Implementing dynamic, logic-driven access</li> </ul> <h4 style="font-weight: 500; color: #333;">03. Advanced Authorization Architectures</h4> <ul> <li>Mandatory Access Control (MAC): Sensitivity labels and Lattice-based security</li> <li>Discretionary Access Control (DAC): Owner-defined resource permissions</li> <li>Identity and Access Management (IAM) Systems: Centralizing user lifecycles</li> <li>Authorization: Ensuring correct privilege levels after successful authentication</li> </ul> <h4 style="font-weight: 500; color: #333;">04. Trust Relationships & Flow</h4> <ul> <li>Flow of Trust: Understanding how identity is verified across domains</li> <li>One-Way and Two-Way Trusts: Controlling directional resource access</li> <li>Transitive vs. Non-Transitive Trusts: Managing inheritance in complex forests</li> <li>Zero-Trust Architecture: The principle of “Never Trust, Always Verify”</li> </ul> <h4 style="font-weight: 500; color: #333;">05. Identity Management & Provisioning</h4> <ul> <li>User Provisioning: Creating accounts and assigning initial privileges</li> <li>Deprovisioning: Securely revoking access during offboarding or role changes</li> <li>Directory Services: Managing identity metadata and group memberships</li> <li>Privileged Access Management (PAM): Securing administrative credentials</li> </ul> </div>

<div class="sscp-curriculum"> <h4 style="font-weight: 500; color: #333;">01. Exam Overview & Professional Ethics</h4> <ul> <li>Exam Logistics: 3-hour duration, 125 questions</li> <li>Understanding the (ISC)² Code of Ethics</li> <li>Core Security Principles: Confidentiality, Integrity, and Availability (CIA)</li> </ul> <h4 style="font-weight: 500; color: #333;">02. Access Control & Security Basics</h4> <ul> <li>Implementing Least Privilege and Segregation of Duties</li> <li>Technical Controls: Password requirements and lockout policies</li> <li>Security Foundations: Authentication, Authorization, and Accounting</li> </ul> <h4 style="font-weight: 500; color: #333;">03. Physical & Administrative Security Controls</h4> <ul> <li>Physical Controls: Locks, Bollards, Fencing, Cameras, and Mantraps</li> <li>Identification Systems: Badges and biometric access</li> <li>Administrative Controls: Writing and enforcing Policies and Procedures</li> <li>Human Security: Effective Employee Training and awareness programs</li> </ul> <h4 style="font-weight: 500; color: #333;">04. Control Categories & Compliance</h4> <ul> <li>Types of Security Controls: Deterrent, Corrective, and Preventative</li> <li>Assessing Compliance: Periodic audits and policy reviews</li> <li>Regulatory Alignment: Mapping controls to legal and industry standards</li> </ul> <h4 style="font-weight: 500; color: #333;">05. Asset & Change Management</h4> <ul> <li>Asset Management: Full lifecycle inventory and data retention requirements</li> <li>Licensing Models: Managing software compliance and usage</li> <li>The Change Management Lifecycle: Request, Review, Approval, and Implementation</li> <li>Risk Mitigation: Managing updates and patches without service interruption</li> </ul> </div>

<div class="sscp-risk-curriculum"> <h4 style="font-weight: 500; color: #333;">01. Foundations of Risk Management</h4> <ul> <li>Core Definitions: Differentiating Risk, Risk Management, and Vulnerability</li> <li>Calculating Risk Levels: Probability x Loss formulas</li> <li>Asset Valuation: Determining the quantitative and qualitative value of assets</li> <li>Key Risk Indicators (KRI): Monitoring metrics that signal potential threats</li> </ul> <h4 style="font-weight: 500; color: #333;">02. Risk Response & Enterprise Frameworks</h4> <ul> <li>Strategic Responses: Avoidance, Transference, Acceptance, and Mitigation</li> <li>Enterprise Risk Management Frameworks (RMF): NIST 800-171, CMMC, and COBIT</li> <li>Vulnerability Management Planning: Tool selection and assessment strategies</li> </ul> <h4 style="font-weight: 500; color: #333;">03. Identifying Vulnerabilities & Security Testing</h4> <ul> <li>Scanning & Discovery: Utilizing Vulnerability Scanners and identifying Network flaws</li> <li>Security Assessment: Internal vs. External Penetration Testing</li> <li>Hardening Standards: Implementing Security Technical Implementation Guides (STIGs)</li> <li>Baseline Management: Establishing “Normal” to identify system anomalies</li> </ul> <h4 style="font-weight: 500; color: #333;">04. Incident Detection & Intrusion Analysis</h4> <ul> <li>Continuous Monitoring: Role of IDS/IPS in real-time threat detection</li> <li>Indicators of Intrusion: Identifying missing files, changed permissions, and system crashes</li> <li>Network Anomalies: Repeated login failures and unusual geographic activity</li> <li>Metrics and Data Analysis: Leveraging logs and event triggers for forensics</li> </ul> <h4 style="font-weight: 500; color: #333;">05. Remediation, Reporting & Legal Constraints</h4> <ul> <li>Remediation Lifecycle: Planning, making changes, and deploying countermeasures</li> <li>Post-Incident Activity: After-Action Reporting (AAR) and continuous improvement</li> <li>Compliance & Privacy: Understanding laws and regulations governing data security</li> <li>Legal Restraints: Navigating privacy laws during monitoring and investigations</li> </ul> </div>

Curriculum

01. Exam Overview & Professional Ethics

02. Access Control & Security Basics

03. Physical & Administrative Security Controls

04. Control Categories & Compliance

05. Asset & Change Management

01. Authentication & Identity Methods

02. Access Control Models & Privileges

03. Advanced Authorization Architectures

04. Trust Relationships & Flow

05. Identity Management & Provisioning

01. Foundations of Risk Management

02. Risk Response & Enterprise Frameworks

03. Identifying Vulnerabilities & Security Testing

04. Incident Detection & Intrusion Analysis

05. Remediation, Reporting & Legal Constraints

01. & 02. Response Planning & First Steps

03. Investigation & Recovery Operations

04. Post-Incident Activity & Training

05. Backup Strategies & Methodology

06. Business Continuity & Disaster Recovery

01. Compliance, Laws & Regulations

02. Cryptography Fundamentals

03. Public Key Infrastructure (PKI)

04. Data Integrity & Non-Repudiation

05. Security Protocols & Secure Communication

01. Network Components & Architecture

02. Protocols, Topologies & Routing

03. VPN Technologies & Remote Access

04. Firewall Technologies & Network Defense

05. Wireless & Mobile Communication Security

06. Systems & Application Hardening

07. Virtualization & Cloud Infrastructure