ISC2 Certified in Cybersecurity (CC)

A suite of protocols for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet in a data stream.

• Operates at the network layer (Layer 3) of the OSI model.
• Provides confidentiality, integrity, and authenticity.
• Commonly used to implement VPNs (Virtual Private Networks).

A type of Virtual Private Network that automatically establishes and maintains a secure connection to a corporate network whenever the device has internet connectivity, without requiring manual user initiation.

• Ensures continuous security and policy enforcement for remote devices.
• Enhances compliance and reduces security risks for mobile users.
• Can be configured to enforce full tunnel or split tunnel depending on policy.

A technology that creates a secure, encrypted connection over a less secure network, such as the internet, allowing remote users to access private network resources.

• Encrypts data between the client and the VPN server.
• Creates a 'tunnel' for secure communication.
• Allows remote users to appear as if they are physically on the corporate network.

A cybersecurity solution that continuously monitors and collects data from endpoint devices, enabling the detection, investigation, and response to advanced threats.

• Provides deep visibility into endpoint activities (processes, file changes, network connections).
• Uses behavioral analytics and machine learning to detect anomalies.
• Facilitates rapid incident response and threat hunting.

A core protocol of the Internet protocol suite that provides reliable, ordered, and error-checked delivery of a stream of bytes between applications running on hosts communicating over an IP network.

• Connection-oriented (three-way handshake).
• Guarantees delivery and order of packets.
• Performs error checking and retransmission.

A network security device that monitors network traffic for malicious activity and automatically takes actions to prevent detected threats in real-time.

• Actively blocks or drops malicious traffic.
• Operates inline with network traffic.
• Can use signature-based, anomaly-based, or policy-based detection.

Software that allows organizations to securely manage, monitor, and configure mobile devices, such as smartphones and tablets, used by employees.

• Enforces security policies (e.g., passcodes, encryption).
• Manages applications (installation, removal, updates).
• Enables remote actions (e.g., locate, lock, wipe).

The practice of dividing a computer network into multiple smaller network segments, each acting as its own small network.

• Reduces the attack surface by isolating critical assets.
• Limits lateral movement of attackers within the network.
• Improves network performance and security posture.

A security solution that centralizes the collection, storage, and analysis of security logs and events from across an organization's IT infrastructure to provide real-time threat detection and compliance reporting.

• Aggregates logs from various sources (servers, firewalls, applications).
• Correlates security events to identify patterns and potential incidents.
• Provides real-time monitoring and alerting.

Cryptographic protocols that provide secure communication over a computer network, primarily used for encrypting and authenticating data in transit between a client and a server.

• Encrypts data to ensure confidentiality.
• Provides authentication to verify identities.
• Protects data integrity during transmission.

Standardized port numbers used by various network protocols to identify specific services running on a server.

• Port 80: HTTP (Hypertext Transfer Protocol) for unencrypted web traffic.
• Port 443: HTTPS (Hypertext Transfer Protocol Secure) for encrypted web traffic.
• Firewalls use port numbers to filter traffic and enhance security.

A physical or logical subnetwork that separates an organization's local area network (LAN) from an untrusted network, usually the internet.

• Provides an additional layer of security for the internal network.
• Hosts public-facing servers (e.g., web, email, DNS).
• Typically located between two firewalls (a screened subnet DMZ).

A network device that combines the functions of a router, a switch, a wireless access point, and often a basic firewall to connect multiple devices to a local network and the internet.

• Connects local devices to the internet.
• Assigns IP addresses using DHCP.
• Provides Wi-Fi connectivity.

The latest security protocol for Wi-Fi networks, offering robust encryption and improved protection against common attacks compared to older standards.

• Uses 192-bit cryptographic strength in Enterprise mode.
• Provides 'Simultaneous Authentication of Equals' (SAE) for stronger password-based authentication.
• Offers enhanced privacy in open networks with 'Opportunistic Wireless Encryption' (OWE).

A logical grouping of network devices that allows them to communicate as if they were on the same physical LAN, regardless of their physical location.

• Segments a single physical switch into multiple virtual switches.
• Improves security by isolating traffic.
• Enhances network performance by reducing broadcast domains.

A network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.

• Acts as a barrier between a trusted internal network and untrusted external networks.
• Filters traffic based on IP addresses, port numbers, and protocols.
• Can be hardware, software, or cloud-based.

A network architecture that uses two firewalls to create a highly secure demilitarized zone (DMZ), completely isolating it from both the external network (internet) and the internal private network.

• Employs two firewalls for enhanced security.
• One firewall faces the internet, the other faces the internal network.
• DMZ hosts are placed between these two firewalls.

The process of examining firewall rulesets to identify potential vulnerabilities, misconfigurations, or unintended access permissions that could compromise network security.

• Rules are processed in order.
• The first matching rule is applied.
• Implicit 'deny all' is a common last rule.

HTTPS is the secure version of HTTP, using TLS (Transport Layer Security) to encrypt communication and verify the identity of the web server.

• HTTPS ensures confidentiality and integrity of web data.
• TLS provides encryption and authentication.
• Essential for protecting sensitive data exchanged over the web.

A security system that monitors network or system activities for malicious activity or policy violations and produces reports to a management station.

• Passively monitors traffic, does not block it.
• Detects anomalies, known attack signatures, or policy violations.
• Can be network-based (NIDS) or host-based (HIDS).

Security safeguards implemented through hardware, software, or firmware that enforce security policies.

• Automated and often invisible to the end-user.
• Examples include firewalls, intrusion detection systems, encryption, and access control lists.
• Works in conjunction with administrative and physical controls.

The practice of assigning a distinct and non-reusable identifier to each individual user accessing a system or network resource.

• Essential for accountability and non-repudiation.
• Facilitates auditing and incident response.
• Prevents shared accounts that obscure individual actions.

The amount and type of risk that an organization is willing to pursue or retain in order to achieve its objectives. It's a high-level statement set by senior management and influences strategic decisions.

• Set by senior management/board
• Strategic, high-level decision
• Guides risk management activities

An approach to systems engineering that incorporates privacy and data protection into the entire lifecycle of technology, from the initial design phase to deployment and beyond. It emphasizes proactive rather than reactive measures.

• Seven foundational principles
• Proactive, not reactive
• Privacy as the default setting