2.0 Architecture and Design

2.1 Explain the importance of security concepts in an enterprise environment.

Configuration management
Geographical considerations
--- Deception and disruption
--- Diagrams
Response and recovery
--- Honeypots
--- Baseline configurations
Secure Sockets Layer (SSL)/ Transport Layer Security (TLS) inspection
--- honeyfiles
--- Standard naming conventions
Hashing
--- Honeynets
--- Internet protocol (IP) schema
API considerations
--- Fake telemetry
Data sovereignty
Site resiliency
--- DNS sinkhole
Data protection
--- Hot site
--- Data loss prevention
--- Cold site
--- Masking
--- Warm site
--- Encryption
--- At rest
--- In transit
--- In processing
--- Tokenization
--- Rights management

2.2 Summarize virtualization and cloud computing concepts.

Cloud Models
Managed service provider (MSP)/ managed security service provider (MSSP)
Infrastructure as code
--- Infrastructure as a service (IaaS)
On-premises vs. off-premises
--- Software-defined networking (SDN)
--- Platform as a service (PaaS)
Fog computing
--- Software-defined visibility (SDV)
--- Software as a service
Edge computing
Serverless architecture
--- Anything as a service (XaaS)
Thin clients
Resource policies
--- Public
Containers
Transit gateway
--- Community
Microservices/API
Virtualization
--- Private
--- Sprawl avoidance
--- Hybrid
--- Virtual machine (VM)
Cloud service providers
--- VM escape protection

2.3 Summarize secure application development, deployment, and automation concepts.

Environment
--- Code reuse/dead code
Automation/scripting
--- Development
--- Server-side vs client side execution validation
--- Automated courses of action
--- Test
--- Memory management
--- Continuous monitoring
--- Staging
--- Use of third party libraries and software development kits (SDKs)
--- Continuous validation
--- Production
--- Data exposure
--- Continuous integration
--- Quality assurance (QA)
Open Web Application Security Project (OWASP)
--- Continuous delivery
Provisioning and deprovisioning
Software diversity
--- Continuous deployment
Integrity measurement
--- Compiler
Elasticty
Secure coding techniques
--- Binary
Scalability
--- Normalization
Version control
--- Stored procedures
--- Obfuscation/camouflage

2.4 Summarize authentication and authorization design concepts.

Authentication methods
Biometrics
Multifactor authentication (MFA) factors and attributes
--- Directory services
--- Fingerprint
--- Factors
--- Federation
--- Retina
     --- Something you know
--- Attestation
--- Iris
     --- Something you have
--- Technologies
--- Facial
     --- Something you are
     --- Time-based one-time password (TOTP)
--- Voice
--- Attributes
     --- HMAC-based one-time password (HOTP)
--- Vein
     --- Somewhere you are
     --- Short message service (SMS)
--- Gait analysis
     --- Something you can do
     --- Token key
--- Efficacy rates
     --- Something you exhibit
     --- Authentication applications
--- False acceptance
     --- Someone you know
     --- Push notifications
--- False rejection
Authentication, authorization, and accounting (AAA)
     --- Phone call
--- Crossover error rate
Cloud vs. on-premises requirements
--- Smart card authentication

2.5 Given a scenario, implement cybersecurty resilience.

Redundancy
Replication
--- Offsite storage
--- Disk
--- Storage area network
     --- Distance considerations
     --- Redundant array of inexpensive disks (RAID) levels
--- VM
Non-persistence
     --- Multipath
On-premises vs. cloud
--- Revert to know state
--- Network
Backup-types
--- Last known good configuration
     --- Load balancers
--- Full
--- Live boot media
     --- Network interface card (NIC) teaming
--- Incremental
High availability
--- Power
--- Snapshot
--- Scalability
     --- Uninterruptible power supply (UPS)
--- Differential
Restoration order
     --- Generator
--- Tape
Diversity
     --- Dual supply
--- Disk
--- Technologies
     --- Managed power distribution units (PDUs)
--- Copy
--- Vendors
--- Storage area network
--- Crypto
--- Cloud
--- Controls
--- Image
--- Online vs. Offline

2.6 Explain the security implications of embedded and specialized systems.

Embedded systems
Specialized
--- Subscriber identity module (SIM) cards
--- Raspberry Pi
--- Medical systems
--- Zigbee
--- Field-programmable gate array (FPGA)
--- Vehicles
Constraints
--- Arduino
--- Aircraft
--- Power
Supervisory control and data acquisition (SCADA)/industrial control system (ICS)
--- Smart meters
--- Compute
--- Facilities
Voice over IP (VoIP)
--- Network
--- Industrials
Heating, ventalation, air conditioning (HVAC)
--- Crypto
--- Manufacturing
Drones
--- Inability to patch
--- Energy
Multifunction printer (MFP)
--- Authentication
--- Logistics
Real-time operating system
--- Range
Internet of Things (IoT)
Surveillance systems
--- Cost
--- Sensors
System on a chip (SoC)
--- Implied trust
--- Smart devices
Communication considerations
--- Wearables
--- 5G
--- Facility automation
--- Narrow-band
--- Weak defaults
--- Baseband radio

2.7 Explain the importance of physical security controls.

Bollards/barricades
--- Electronic
Air gap
Access control vestibules
--- Physical
Screened subnet (previously known as demilitarized zone)
Badges
--- Cable locks
Protection cable distribution
Alarms
USB data blocker
Secure areas
Signage
Lighting
--- Vault
Cameras
Fencing
--- Safe
--- Motion recognition
Fire suppression
--- Hot aisle
--- Object detection
Sensors
--- Cold aisle
Closed circuit television (CCTV)
--- Motion detection
Secure data destruction
Industrial camouflage
--- Noise detection
--- Burning
Personnel
--- Proximity reader
--- Shredding
--- Guards
--- Moisture detection
--- Pulping
--- Robot sentries
--- Cards
--- Pulverizing
--- Reception
--- Temperature
--- Degaussing
--- Two-person integrity/control
Drones
--- Third-party solutions
Locks
Visitors logs
--- Biometrics
Faraday cages

2.8 Summarize the basics of cyptographic concepts.

Digital Signatures
Blockchain
--- Supporting integrety
Key length
--- Public ledgers
--- Supporting obfuscation
Key stretching
Cipher suites
--- Supporting authentication
Salting
--- Stream
--- Supporting non-repudiation
Hashing
--- Block
Limitations
Key exchange
Symmetric vs. asymmetric
--- Speed
Elliptical-curve cryptography
Lightweight cryptography
--- Size
Perfect forward secrecy
Steganography
--- Weak keys
Quantum
--- Audio
--- Time
--- Communications
--- Video
--- Longevity
--- Computing
--- Image
--- Predictability
Post-quantum
Homomorphic encryption
--- Reuse
Ephemeral
Common use cases
--- Entropy
Modes of operation
--- Low power devices
--- Computational overheads
--- Authenticated
--- Low latency
--- Resource vs. security constraints
--- Unauthenticated
--- High resiliency
--- Counter
--- Supporting confidentiality