LPI Wiki - User contributions [en]

Security Essentials Objectives V1.0

2019-05-28T14:25:12Z

Mmarco:

__FORCETOC__
==Introduction==

This certificate covers a basic knowledge of IT security. The focus is the digital self-defense of an individual user. This includes a general understanding of major threats against individual computing systems, networks, services and identity as well as approaches to prevent and mitigate them.

 

==Candidate Description==

===The Minimally Qualified Candidate===

The Candidate has a basic understanding of the major security threats of using computers, networks, connected devices and IT service on premise and in the cloud. The candidate understands common ways to prevent, mitigate and prevent attacks against their personal devices and data. Furthermore, the candidate is able to use encryption to secure data transferred through a network and stored on local storage media and in the cloud. The candidate is able to apply common security tools, protect private information and secure their identity. The candidate is able to take responsibility for securing their own devices and making use of IT services.

 

==Version Information==

These objectives are '''A DRAFT FOR''' version 1.0.0.

 

==Translations of Objectives==

The following translations of the objectives are available on this wiki:

* [[SecurityEssentials Objectives V1.0|English]]
* [[SecurityEssentials Objectives V1.0(PT-BR)|Brazilian Portuguese]]
* [[SecurityEssentials Objectives V1.0(ZH)|Chinese (Simplified)]]
* [[SecurityEssentials Objectives V1.0(ZH-TW)|Chinese (Traditional)]]
* [[SecurityEssentials Objectives V1.0(NL)|Dutch]]
* [[SecurityEssentials Objectives V1.0(FR)|French]]
* [[SecurityEssentials Objectives V1.0(DE)|German]]
* [[SecurityEssentials Objectives V1.0(IT)|Italian]]
* [[SecurityEssentials Objectives V1.0(JA)|Japanese]]
* [[SecurityEssentials Objectives V1.0(ES)|Spanish]]

 

==Objectives==

===''021 Security Concepts''===

====021.1 Goals, Roles and Actors (weight: 1)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 1
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the importance of IT security. This includes an understanding of essential security goals as well as understanding various actors and roles in the field of IT security.

|}

'''Key Knowledge Areas:'''

* Understand common security goals (confidentiality, integrity and availability, non repudiation)

* Understand common roles in security (hackers, crackers, black hat, white hat)

* Awareness of industrial espionage

'''Partial list of the used files, terms and utilities:'''

 

====021.2 Risk Assessment and Management (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should know how to find and interpret relevant security information. This includes understanding the risk of a vulnerability and determining the need, urgency and appropriateness for a reaction.

|}

'''Key Knowledge Areas:'''

* Know common sources for security information

* Understand security incident classification schema

* Understand the concepts of Common Vulnerabilities and Exposures (CVE)

'''Partial list of the used files, terms and utilities:'''

 

====021.3 Ethical Behaviour (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidates should understand the implications of their behavior when using digital infrastructure. This includes understanding the potential harm caused by using security tools. Furthermore, the candidate should understand common principles in copyright and privacy laws.

|}

'''Key Knowledge Areas:'''

* Understanding the implications of one’s actions on others

* Handling of personal and confidential information in a responsible way

* Awareness of legal implications

'''Partial list of the used files, terms and utilities:'''

 

===''022 Encryption''===

====022.1 Cryptography Public Key Infrastructure (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of symmetric and asymmetric encryption. Furthermore candidates should understand how digital certificates are used to associate cryptographic keys with individual persons and organizations.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles of symmetric, asymmetric and hybrid cryptography

* Understanding of the principle of Perfect Forward Secrecy

* Understanding of the principle of hash functions

* Awareness of most important cryptographic algorithms

* Understanding of the principle of digital certificates

* Understanding of how certificates are associated with a subject and an issuer

* Understanding of the role of Certificate Authorities

* Awareness of Let’s Encrypt

'''Partial list of the used files, terms and utilities:'''

 

====022.2 Web Encryption (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of HTTPS. This includes verifying the identity of existing websites and understanding common browser error messages.

|}

'''Key Knowledge Areas:'''

* Understanding of the major differences between plain text protocols and transport encryption

* Understanding of the principle of HTTPS

* Understanding of important fields in X.509 certificates for the use with HTTPS

* Determining whether or not a website is encrypted, including common browser messages

* Awareness of SSL Labs Server Test

'''Partial list of the used files, terms and utilities:'''

 

====022.3 Email Encryption (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of GPG for email encryption. This includes handling one’s own and foreign GPG keys and sending and receiving encrypted emails.

|}

'''Key Knowledge Areas:'''

* Understanding of the principle of GPG

* Understanding of the role of key servers

* Using GPG for Email encryption (using Enigmail and Thunderbird on Windows, Linux or OS X)

'''Partial list of the used files, terms and utilities:'''

 

====022.4 Data Storage Encryption (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principles of data, file and storage device be able to encrypt data stored on local storage devices and in the cloud.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles of data, file and storage device encryption

* Using VeraCrypt to store data in a container or an encrypted storage devices

* Using Cryptomator to encrypt files stored in the cloud

* Awareness of Bitlocker

'''Partial list of used files, terms and utilities:'''

 

===''023 Node, Device and Storage Security''===

====023.1 Hardware Security (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand security aspects of hardware. This includes understanding the various types of computer devices as well as their major components. Furthermore, the candidate should understand the security implications of various devices that interact with a computer.

|}

'''Key Knowledge Areas:'''

* Understanding of the functionality of major components of a computer

* Understanding of the functionality of tablets, smartphones, smart tvs, routers, printers smart home, alarm, and IoT devices (light bulbs, thermostats, TVs, …)

* Understanding of the security implications of physical access to a computer

* Understanding of security implications of USB devices

* Understanding of security implications of Bluetooth devices

* Understanding of security implications of RFID devices

'''Partial list of used files, terms and utilities:'''

 

====023.2 Application Security (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the security aspects of software. This includes managing software updates, protecting software from remote access and understanding how to security install software.

|}

'''Key Knowledge Areas:'''

* Understanding of updates for firmware, operating systems and applications

* Understanding of the concepts of local packet filters, endpoint firewalls and application layer firewalls

* Understanding of various sources for applications and ways to securely procure and install software

* Understanding of sources for mobile applications

'''Partial list of used files, terms and utilities:'''

 

====023.3 Malware (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of various types of malware. This includes understanding of how they are installed on a device, what effects they cause and how to protect against malware.

|}

'''Key Knowledge Areas:'''

* Understanding of various types of malware (virus, ransomware, trojan horses, adware, cryptominers)

* Understanding of various types of spying (file copy, keylogging, camera and microphone hijacking)

* Awareness of the risk of data and address books copies

* Understanding of the principle of rootkit and remote access

* Understanding of keyloggers

* Understanding of virus and malware scanners

'''Partial list of used files, terms and utilities:'''

 

====023.4 Data Availability (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should be able to ensure the availability of their data. This includes storing data in appropriate devices and services as well as creating backups.

|}

'''Key Knowledge Areas:'''

* Understanding of data access and sharing in the cloud

* Awareness of the dependence on internet connection and the synchronization of data between cloud services and local storage

* Creating and securely storing backups (full, differential, incremental backups, backup retention)

'''Partial list of used files, terms and utilities'''

 

===''024 Network and Service Security''===

====024.1 Local Network Access Security (weight: 4)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 4
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand how devices are connected to a local network and and which threats result from physical media access. Furthermore, candidates should be able to securely connect to a wireless network.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles behind IP networks and the internet

* Understanding of the principles behind IP addresses and ports

* Understanding of the principles behind routing and network providers

* Understanding of the various types of network media (wired and WiFi)

* Understanding of the implications of media / link layer access

* Understanding of the concept of Man in the Middle attacks

* Understanding of the risk of unencrypted / Public WiFi

* Understanding and using of WiFi security and encryption

'''Partial list of used files, terms and utilities:'''

 

====024.2 Internet Security (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of the Internet and routed networks. This includes understanding how connections to cloud services are established and understanding common threats against services on the Internet.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles of the internet

* Understanding of the principle of traffic interception

* Understanding of the principle of DoS and DDoS attacks

* Understanding of the principle of botnets

* Understanding of the principle of clouds

'''Partial list of the used files, terms and utilities:'''

 

====024.3 Network Encryption and Anonymity (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of virtual private networks. This includes using a VPN provider to encrypt transmitted data. Candidates should understand about the anonymity of the Internet and TOR.

|}

'''Key Knowledge Areas:'''

* Understanding of virtual private networks

* Understanding of the role of a VPN provider

* Understanding the concepts of gateway packet filters

* Awareness of TOR and the Darknet

* Awareness of crypto currencies and their anonymity aspects

'''Partial list of used files, terms and utilities:'''

 

===''025 Identity and Privacy''===

====025.1 Identity (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand various concepts on how to prove their identity when using services on the internet. This includes using a password manager and multi factor authentication as well as being aware of common threats against individual identities.

|}

'''Key Knowledge Areas:'''

* Understanding of the characteristics of secure password (length, special characters, change frequencies, complexity)

* Using a password manager (keepass2)

* Understanding of the differences between online and offline password managers

* Understanding of the risks of traditional password memorization compared to password managers

* Understanding of the principle of security questions and account recovery tools

* Understanding of the principle of multifactor factor authentication

* Understanding of Phishing

* Understanding of Social Engineering

* Understanding of the role of email accounts for IT security

* Monitoring own accounts for password leaks (Search engine alerts for own usernames, password leak checkers)

* Understanding of the security aspects of online banking and credit cards

'''Partial list of used files, terms and utilities:'''

 

====025.2 Information Confidentiality and Trustworthiness (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should be able to judge the trustworthiness and correctness of information on the internet. This includes understanding how search engines work and rank their results, knowing common criteria for recognizing fake news, spam messages and scam.

|}

'''Key Knowledge Areas:'''

* Understanding the principle of search engines and web index

* Awareness of web archives

* Recognition of fake news

* Distinguishing fake and real URLs

* Understanding the principles of email spam filters

* Understanding the principle of scamming and scareware

* Handling of received email attachments

* Sharing information securely and responsibly using email cloud shares and messaging services

'''Partial list of the used files, terms and utilities:'''

 

====025.3 Privacy Protection (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the importance of the confidentiality of personal information. This includes managing privacy settings in various services as well as being aware of common threats against personal information.

|}

'''Key Knowledge Areas:'''

* Understanding of the importance of personal information

* Understanding of the concepts of information gathering and profiling

* Understanding of the principle of identity theft

* Understanding of the principle of stalking

* Understanding of the principle of cybermobbing

* Understanding of the principle of doxxing

* Understanding of the principle of fake profiles

* Understanding of the principle of cookies and tracking

* Configuring profile privacy settings on social media platforms and online services

* Managing contacts and privacy settings on social networks

* Understanding of the risk of publishing personal information

* Understanding of the rights regarding information about own personal information (such as GDPR for companies based in Europe)

'''Partial list of the used files, terms and utilities:'''

Security Essentials Objectives V1.0

2019-05-28T14:22:47Z

Mmarco: /* Minimally Qualified Candidate */

Security Essentials Objectives V1.0

2019-05-28T14:22:00Z

Mmarco: /* Translations of Objectives */

__FORCETOC__
==Introduction==

This certificate covers a basic knowledge of IT security. The focus is the digital self-defense of an individual user. This includes a general understanding of major threats against individual computing systems, networks, services and identity as well as approaches to prevent and mitigate them.

 

==Candidate Description==

===Minimally Qualified Candidate===

The Candidate has a basic understanding of the major security threats of using computers, networks, connected devices and IT service on premise and in the cloud. The candidate understands common ways to prevent, mitigate and prevent attacks against their personal devices and data. Furthermore, the candidate is able to use encryption to secure data transferred through a network and stored on local storage media and in the cloud. The candidate is able to apply common security tools, protect private information and secure their identity. The candidate is able to take responsibility for securing their own devices and making use of IT services.

 

==Version Information==

These objectives are '''A DRAFT FOR''' version 1.0.0.

 

==Translations of Objectives==

The following translations of the objectives are available on this wiki:

* [[SecurityEssentials Objectives V1.0|English]]
* [[SecurityEssentials Objectives V1.0(PT-BR)|Brazilian Portuguese]]
* [[SecurityEssentials Objectives V1.0(ZH)|Chinese (Simplified)]]
* [[SecurityEssentials Objectives V1.0(ZH-TW)|Chinese (Traditional)]]
* [[SecurityEssentials Objectives V1.0(NL)|Dutch]]
* [[SecurityEssentials Objectives V1.0(FR)|French]]
* [[SecurityEssentials Objectives V1.0(DE)|German]]
* [[SecurityEssentials Objectives V1.0(IT)|Italian]]
* [[SecurityEssentials Objectives V1.0(JA)|Japanese]]
* [[SecurityEssentials Objectives V1.0(ES)|Spanish]]

 

==Objectives==

===''021 Security Concepts''===

====021.1 Goals, Roles and Actors (weight: 1)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 1
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the importance of IT security. This includes an understanding of essential security goals as well as understanding various actors and roles in the field of IT security.

|}

'''Key Knowledge Areas:'''

* Understand common security goals (confidentiality, integrity and availability, non repudiation)

* Understand common roles in security (hackers, crackers, black hat, white hat)

* Awareness of industrial espionage

'''Partial list of the used files, terms and utilities:'''

 

====021.2 Risk Assessment and Management (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should know how to find and interpret relevant security information. This includes understanding the risk of a vulnerability and determining the need, urgency and appropriateness for a reaction.

|}

'''Key Knowledge Areas:'''

* Know common sources for security information

* Understand security incident classification schema

* Understand the concepts of Common Vulnerabilities and Exposures (CVE)

'''Partial list of the used files, terms and utilities:'''

 

====021.3 Ethical Behaviour (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidates should understand the implications of their behavior when using digital infrastructure. This includes understanding the potential harm caused by using security tools. Furthermore, the candidate should understand common principles in copyright and privacy laws.

|}

'''Key Knowledge Areas:'''

* Understanding the implications of one’s actions on others

* Handling of personal and confidential information in a responsible way

* Awareness of legal implications

'''Partial list of the used files, terms and utilities:'''

 

===''022 Encryption''===

====022.1 Cryptography Public Key Infrastructure (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of symmetric and asymmetric encryption. Furthermore candidates should understand how digital certificates are used to associate cryptographic keys with individual persons and organizations.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles of symmetric, asymmetric and hybrid cryptography

* Understanding of the principle of Perfect Forward Secrecy

* Understanding of the principle of hash functions

* Awareness of most important cryptographic algorithms

* Understanding of the principle of digital certificates

* Understanding of how certificates are associated with a subject and an issuer

* Understanding of the role of Certificate Authorities

* Awareness of Let’s Encrypt

'''Partial list of the used files, terms and utilities:'''

 

====022.2 Web Encryption (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of HTTPS. This includes verifying the identity of existing websites and understanding common browser error messages.

|}

'''Key Knowledge Areas:'''

* Understanding of the major differences between plain text protocols and transport encryption

* Understanding of the principle of HTTPS

* Understanding of important fields in X.509 certificates for the use with HTTPS

* Determining whether or not a website is encrypted, including common browser messages

* Awareness of SSL Labs Server Test

'''Partial list of the used files, terms and utilities:'''

 

====022.3 Email Encryption (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of GPG for email encryption. This includes handling one’s own and foreign GPG keys and sending and receiving encrypted emails.

|}

'''Key Knowledge Areas:'''

* Understanding of the principle of GPG

* Understanding of the role of key servers

* Using GPG for Email encryption (using Enigmail and Thunderbird on Windows, Linux or OS X)

'''Partial list of the used files, terms and utilities:'''

 

====022.4 Data Storage Encryption (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principles of data, file and storage device be able to encrypt data stored on local storage devices and in the cloud.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles of data, file and storage device encryption

* Using VeraCrypt to store data in a container or an encrypted storage devices

* Using Cryptomator to encrypt files stored in the cloud

* Awareness of Bitlocker

'''Partial list of used files, terms and utilities:'''

 

===''023 Node, Device and Storage Security''===

====023.1 Hardware Security (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand security aspects of hardware. This includes understanding the various types of computer devices as well as their major components. Furthermore, the candidate should understand the security implications of various devices that interact with a computer.

|}

'''Key Knowledge Areas:'''

* Understanding of the functionality of major components of a computer

* Understanding of the functionality of tablets, smartphones, smart tvs, routers, printers smart home, alarm, and IoT devices (light bulbs, thermostats, TVs, …)

* Understanding of the security implications of physical access to a computer

* Understanding of security implications of USB devices

* Understanding of security implications of Bluetooth devices

* Understanding of security implications of RFID devices

'''Partial list of used files, terms and utilities:'''

 

====023.2 Application Security (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the security aspects of software. This includes managing software updates, protecting software from remote access and understanding how to security install software.

|}

'''Key Knowledge Areas:'''

* Understanding of updates for firmware, operating systems and applications

* Understanding of the concepts of local packet filters, endpoint firewalls and application layer firewalls

* Understanding of various sources for applications and ways to securely procure and install software

* Understanding of sources for mobile applications

'''Partial list of used files, terms and utilities:'''

 

====023.3 Malware (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of various types of malware. This includes understanding of how they are installed on a device, what effects they cause and how to protect against malware.

|}

'''Key Knowledge Areas:'''

* Understanding of various types of malware (virus, ransomware, trojan horses, adware, cryptominers)

* Understanding of various types of spying (file copy, keylogging, camera and microphone hijacking)

* Awareness of the risk of data and address books copies

* Understanding of the principle of rootkit and remote access

* Understanding of keyloggers

* Understanding of virus and malware scanners

'''Partial list of used files, terms and utilities:'''

 

====023.4 Data Availability (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should be able to ensure the availability of their data. This includes storing data in appropriate devices and services as well as creating backups.

|}

'''Key Knowledge Areas:'''

* Understanding of data access and sharing in the cloud

* Awareness of the dependence on internet connection and the synchronization of data between cloud services and local storage

* Creating and securely storing backups (full, differential, incremental backups, backup retention)

'''Partial list of used files, terms and utilities'''

 

===''024 Network and Service Security''===

====024.1 Local Network Access Security (weight: 4)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 4
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand how devices are connected to a local network and and which threats result from physical media access. Furthermore, candidates should be able to securely connect to a wireless network.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles behind IP networks and the internet

* Understanding of the principles behind IP addresses and ports

* Understanding of the principles behind routing and network providers

* Understanding of the various types of network media (wired and WiFi)

* Understanding of the implications of media / link layer access

* Understanding of the concept of Man in the Middle attacks

* Understanding of the risk of unencrypted / Public WiFi

* Understanding and using of WiFi security and encryption

'''Partial list of used files, terms and utilities:'''

 

====024.2 Internet Security (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of the Internet and routed networks. This includes understanding how connections to cloud services are established and understanding common threats against services on the Internet.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles of the internet

* Understanding of the principle of traffic interception

* Understanding of the principle of DoS and DDoS attacks

* Understanding of the principle of botnets

* Understanding of the principle of clouds

'''Partial list of the used files, terms and utilities:'''

 

====024.3 Network Encryption and Anonymity (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of virtual private networks. This includes using a VPN provider to encrypt transmitted data. Candidates should understand about the anonymity of the Internet and TOR.

|}

'''Key Knowledge Areas:'''

* Understanding of virtual private networks

* Understanding of the role of a VPN provider

* Understanding the concepts of gateway packet filters

* Awareness of TOR and the Darknet

* Awareness of crypto currencies and their anonymity aspects

'''Partial list of used files, terms and utilities:'''

 

===''025 Identity and Privacy''===

====025.1 Identity (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand various concepts on how to prove their identity when using services on the internet. This includes using a password manager and multi factor authentication as well as being aware of common threats against individual identities.

|}

'''Key Knowledge Areas:'''

* Understanding of the characteristics of secure password (length, special characters, change frequencies, complexity)

* Using a password manager (keepass2)

* Understanding of the differences between online and offline password managers

* Understanding of the risks of traditional password memorization compared to password managers

* Understanding of the principle of security questions and account recovery tools

* Understanding of the principle of multifactor factor authentication

* Understanding of Phishing

* Understanding of Social Engineering

* Understanding of the role of email accounts for IT security

* Monitoring own accounts for password leaks (Search engine alerts for own usernames, password leak checkers)

* Understanding of the security aspects of online banking and credit cards

'''Partial list of used files, terms and utilities:'''

 

====025.2 Information Confidentiality and Trustworthiness (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should be able to judge the trustworthiness and correctness of information on the internet. This includes understanding how search engines work and rank their results, knowing common criteria for recognizing fake news, spam messages and scam.

|}

'''Key Knowledge Areas:'''

* Understanding the principle of search engines and web index

* Awareness of web archives

* Recognition of fake news

* Distinguishing fake and real URLs

* Understanding the principles of email spam filters

* Understanding the principle of scamming and scareware

* Handling of received email attachments

* Sharing information securely and responsibly using email cloud shares and messaging services

'''Partial list of the used files, terms and utilities:'''

 

====025.3 Privacy Protection (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the importance of the confidentiality of personal information. This includes managing privacy settings in various services as well as being aware of common threats against personal information.

|}

'''Key Knowledge Areas:'''

* Understanding of the importance of personal information

* Understanding of the concepts of information gathering and profiling

* Understanding of the principle of identity theft

* Understanding of the principle of stalking

* Understanding of the principle of cybermobbing

* Understanding of the principle of doxxing

* Understanding of the principle of fake profiles

* Understanding of the principle of cookies and tracking

* Configuring profile privacy settings on social media platforms and online services

* Managing contacts and privacy settings on social networks

* Understanding of the risk of publishing personal information

* Understanding of the rights regarding information about own personal information (such as GDPR for companies based in Europe)

'''Partial list of the used files, terms and utilities:'''

Security Essentials Objectives V1.0

2019-05-28T14:20:14Z

Mmarco:

__FORCETOC__
==Introduction==

This certificate covers a basic knowledge of IT security. The focus is the digital self-defense of an individual user. This includes a general understanding of major threats against individual computing systems, networks, services and identity as well as approaches to prevent and mitigate them.

 

==Candidate Description==

===Minimally Qualified Candidate===

The Candidate has a basic understanding of the major security threats of using computers, networks, connected devices and IT service on premise and in the cloud. The candidate understands common ways to prevent, mitigate and prevent attacks against their personal devices and data. Furthermore, the candidate is able to use encryption to secure data transferred through a network and stored on local storage media and in the cloud. The candidate is able to apply common security tools, protect private information and secure their identity. The candidate is able to take responsibility for securing their own devices and making use of IT services.

 

==Version Information==

These objectives are '''A DRAFT FOR''' version 1.0.0.

 

==Translations of Objectives==

The following translations of the objectives are available on this wiki:

* [[LinuxEssentials Objectives V1.6|English]]
* [[LinuxEssentials Objectives V1.6(PT-BR)|Brazilian Portuguese]]
* [[LinuxEssentials Objectives V1.6(ZH)|Chinese (Simplified)]]
* [[LinuxEssentials Objectives V1.6(ZH-TW)|Chinese (Traditional)]]
* [[LinuxEssentials Objectives V1.6(NL)|Dutch]]
* [[LinuxEssentials Objectives V1.6(FR)|French]]
* [[LinuxEssentials Objectives V1.6(DE)|German]]
* [[LinuxEssentials Objectives V1.6(IT)|Italian]]
* [[LinuxEssentials Objectives V1.6(JA)|Japanese]]
* [[LinuxEssentials Objectives V1.6(ES)|Spanish]]

 

==Objectives==

===''021 Security Concepts''===

====021.1 Goals, Roles and Actors (weight: 1)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 1
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the importance of IT security. This includes an understanding of essential security goals as well as understanding various actors and roles in the field of IT security.

|}

'''Key Knowledge Areas:'''

* Understand common security goals (confidentiality, integrity and availability, non repudiation)

* Understand common roles in security (hackers, crackers, black hat, white hat)

* Awareness of industrial espionage

'''Partial list of the used files, terms and utilities:'''

 

====021.2 Risk Assessment and Management (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should know how to find and interpret relevant security information. This includes understanding the risk of a vulnerability and determining the need, urgency and appropriateness for a reaction.

|}

'''Key Knowledge Areas:'''

* Know common sources for security information

* Understand security incident classification schema

* Understand the concepts of Common Vulnerabilities and Exposures (CVE)

'''Partial list of the used files, terms and utilities:'''

 

====021.3 Ethical Behaviour (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidates should understand the implications of their behavior when using digital infrastructure. This includes understanding the potential harm caused by using security tools. Furthermore, the candidate should understand common principles in copyright and privacy laws.

|}

'''Key Knowledge Areas:'''

* Understanding the implications of one’s actions on others

* Handling of personal and confidential information in a responsible way

* Awareness of legal implications

'''Partial list of the used files, terms and utilities:'''

 

===''022 Encryption''===

====022.1 Cryptography Public Key Infrastructure (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of symmetric and asymmetric encryption. Furthermore candidates should understand how digital certificates are used to associate cryptographic keys with individual persons and organizations.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles of symmetric, asymmetric and hybrid cryptography

* Understanding of the principle of Perfect Forward Secrecy

* Understanding of the principle of hash functions

* Awareness of most important cryptographic algorithms

* Understanding of the principle of digital certificates

* Understanding of how certificates are associated with a subject and an issuer

* Understanding of the role of Certificate Authorities

* Awareness of Let’s Encrypt

'''Partial list of the used files, terms and utilities:'''

 

====022.2 Web Encryption (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of HTTPS. This includes verifying the identity of existing websites and understanding common browser error messages.

|}

'''Key Knowledge Areas:'''

* Understanding of the major differences between plain text protocols and transport encryption

* Understanding of the principle of HTTPS

* Understanding of important fields in X.509 certificates for the use with HTTPS

* Determining whether or not a website is encrypted, including common browser messages

* Awareness of SSL Labs Server Test

'''Partial list of the used files, terms and utilities:'''

 

====022.3 Email Encryption (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of GPG for email encryption. This includes handling one’s own and foreign GPG keys and sending and receiving encrypted emails.

|}

'''Key Knowledge Areas:'''

* Understanding of the principle of GPG

* Understanding of the role of key servers

* Using GPG for Email encryption (using Enigmail and Thunderbird on Windows, Linux or OS X)

'''Partial list of the used files, terms and utilities:'''

 

====022.4 Data Storage Encryption (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principles of data, file and storage device be able to encrypt data stored on local storage devices and in the cloud.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles of data, file and storage device encryption

* Using VeraCrypt to store data in a container or an encrypted storage devices

* Using Cryptomator to encrypt files stored in the cloud

* Awareness of Bitlocker

'''Partial list of used files, terms and utilities:'''

 

===''023 Node, Device and Storage Security''===

====023.1 Hardware Security (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand security aspects of hardware. This includes understanding the various types of computer devices as well as their major components. Furthermore, the candidate should understand the security implications of various devices that interact with a computer.

|}

'''Key Knowledge Areas:'''

* Understanding of the functionality of major components of a computer

* Understanding of the functionality of tablets, smartphones, smart tvs, routers, printers smart home, alarm, and IoT devices (light bulbs, thermostats, TVs, …)

* Understanding of the security implications of physical access to a computer

* Understanding of security implications of USB devices

* Understanding of security implications of Bluetooth devices

* Understanding of security implications of RFID devices

'''Partial list of used files, terms and utilities:'''

 

====023.2 Application Security (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the security aspects of software. This includes managing software updates, protecting software from remote access and understanding how to security install software.

|}

'''Key Knowledge Areas:'''

* Understanding of updates for firmware, operating systems and applications

* Understanding of the concepts of local packet filters, endpoint firewalls and application layer firewalls

* Understanding of various sources for applications and ways to securely procure and install software

* Understanding of sources for mobile applications

'''Partial list of used files, terms and utilities:'''

 

====023.3 Malware (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of various types of malware. This includes understanding of how they are installed on a device, what effects they cause and how to protect against malware.

|}

'''Key Knowledge Areas:'''

* Understanding of various types of malware (virus, ransomware, trojan horses, adware, cryptominers)

* Understanding of various types of spying (file copy, keylogging, camera and microphone hijacking)

* Awareness of the risk of data and address books copies

* Understanding of the principle of rootkit and remote access

* Understanding of keyloggers

* Understanding of virus and malware scanners

'''Partial list of used files, terms and utilities:'''

 

====023.4 Data Availability (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should be able to ensure the availability of their data. This includes storing data in appropriate devices and services as well as creating backups.

|}

'''Key Knowledge Areas:'''

* Understanding of data access and sharing in the cloud

* Awareness of the dependence on internet connection and the synchronization of data between cloud services and local storage

* Creating and securely storing backups (full, differential, incremental backups, backup retention)

'''Partial list of used files, terms and utilities'''

 

===''024 Network and Service Security''===

====024.1 Local Network Access Security (weight: 4)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 4
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand how devices are connected to a local network and and which threats result from physical media access. Furthermore, candidates should be able to securely connect to a wireless network.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles behind IP networks and the internet

* Understanding of the principles behind IP addresses and ports

* Understanding of the principles behind routing and network providers

* Understanding of the various types of network media (wired and WiFi)

* Understanding of the implications of media / link layer access

* Understanding of the concept of Man in the Middle attacks

* Understanding of the risk of unencrypted / Public WiFi

* Understanding and using of WiFi security and encryption

'''Partial list of used files, terms and utilities:'''

 

====024.2 Internet Security (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of the Internet and routed networks. This includes understanding how connections to cloud services are established and understanding common threats against services on the Internet.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles of the internet

* Understanding of the principle of traffic interception

* Understanding of the principle of DoS and DDoS attacks

* Understanding of the principle of botnets

* Understanding of the principle of clouds

'''Partial list of the used files, terms and utilities:'''

 

====024.3 Network Encryption and Anonymity (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of virtual private networks. This includes using a VPN provider to encrypt transmitted data. Candidates should understand about the anonymity of the Internet and TOR.

|}

'''Key Knowledge Areas:'''

* Understanding of virtual private networks

* Understanding of the role of a VPN provider

* Understanding the concepts of gateway packet filters

* Awareness of TOR and the Darknet

* Awareness of crypto currencies and their anonymity aspects

'''Partial list of used files, terms and utilities:'''

 

===''025 Identity and Privacy''===

====025.1 Identity (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand various concepts on how to prove their identity when using services on the internet. This includes using a password manager and multi factor authentication as well as being aware of common threats against individual identities.

|}

'''Key Knowledge Areas:'''

* Understanding of the characteristics of secure password (length, special characters, change frequencies, complexity)

* Using a password manager (keepass2)

* Understanding of the differences between online and offline password managers

* Understanding of the risks of traditional password memorization compared to password managers

* Understanding of the principle of security questions and account recovery tools

* Understanding of the principle of multifactor factor authentication

* Understanding of Phishing

* Understanding of Social Engineering

* Understanding of the role of email accounts for IT security

* Monitoring own accounts for password leaks (Search engine alerts for own usernames, password leak checkers)

* Understanding of the security aspects of online banking and credit cards

'''Partial list of used files, terms and utilities:'''

 

====025.2 Information Confidentiality and Trustworthiness (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should be able to judge the trustworthiness and correctness of information on the internet. This includes understanding how search engines work and rank their results, knowing common criteria for recognizing fake news, spam messages and scam.

|}

'''Key Knowledge Areas:'''

* Understanding the principle of search engines and web index

* Awareness of web archives

* Recognition of fake news

* Distinguishing fake and real URLs

* Understanding the principles of email spam filters

* Understanding the principle of scamming and scareware

* Handling of received email attachments

* Sharing information securely and responsibly using email cloud shares and messaging services

'''Partial list of the used files, terms and utilities:'''

 

====025.3 Privacy Protection (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the importance of the confidentiality of personal information. This includes managing privacy settings in various services as well as being aware of common threats against personal information.

|}

'''Key Knowledge Areas:'''

* Understanding of the importance of personal information

* Understanding of the concepts of information gathering and profiling

* Understanding of the principle of identity theft

* Understanding of the principle of stalking

* Understanding of the principle of cybermobbing

* Understanding of the principle of doxxing

* Understanding of the principle of fake profiles

* Understanding of the principle of cookies and tracking

* Configuring profile privacy settings on social media platforms and online services

* Managing contacts and privacy settings on social networks

* Understanding of the risk of publishing personal information

* Understanding of the rights regarding information about own personal information (such as GDPR for companies based in Europe)

'''Partial list of the used files, terms and utilities:'''

Security Essentials Objectives V1.0

2019-05-28T14:13:40Z

Mmarco: /* The Minimally Qualified Candidate */

__FORCETOC__
==Introduction==

This certificate covers a basic knowledge of IT security. The focus is the digital self-defense of an individual user. This includes a general understanding of major threats against individual computing systems, networks, services and identity as well as approaches to prevent and mitigate them.

 

==Candidate Description==

===Minimally Qualified Candidate===

The Candidate has a basic understanding of the major security threats of using computers, networks, connected devices and IT service on premise and in the cloud. The candidate understands common ways to prevent, mitigate and prevent attacks against their personal devices and data. Furthermore, the candidate is able to use encryption to secure data transferred through a network and stored on local storage media and in the cloud. The candidate is able to apply common security tools, protect private information and secure their identity. The candidate is able to take responsibility for securing their own devices and making use of IT services.

 

==Version Information==

These objectives are '''A DRAFT FOR''' version 1.0.0.

 

==Objectives==

===''021 Security Concepts''===

====021.1 Goals, Roles and Actors (weight: 1)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 1
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the importance of IT security. This includes an understanding of essential security goals as well as understanding various actors and roles in the field of IT security.

|}

'''Key Knowledge Areas:'''

* Understand common security goals (confidentiality, integrity and availability, non repudiation)

* Understand common roles in security (hackers, crackers, black hat, white hat)

* Awareness of industrial espionage

'''Partial list of the used files, terms and utilities:'''

 

====021.2 Risk Assessment and Management (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should know how to find and interpret relevant security information. This includes understanding the risk of a vulnerability and determining the need, urgency and appropriateness for a reaction.

|}

'''Key Knowledge Areas:'''

* Know common sources for security information

* Understand security incident classification schema

* Understand the concepts of Common Vulnerabilities and Exposures (CVE)

'''Partial list of the used files, terms and utilities:'''

 

====021.3 Ethical Behaviour (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidates should understand the implications of their behavior when using digital infrastructure. This includes understanding the potential harm caused by using security tools. Furthermore, the candidate should understand common principles in copyright and privacy laws.

|}

'''Key Knowledge Areas:'''

* Understanding the implications of one’s actions on others

* Handling of personal and confidential information in a responsible way

* Awareness of legal implications

'''Partial list of the used files, terms and utilities:'''

 

===''022 Encryption''===

====022.1 Cryptography Public Key Infrastructure (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of symmetric and asymmetric encryption. Furthermore candidates should understand how digital certificates are used to associate cryptographic keys with individual persons and organizations.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles of symmetric, asymmetric and hybrid cryptography

* Understanding of the principle of Perfect Forward Secrecy

* Understanding of the principle of hash functions

* Awareness of most important cryptographic algorithms

* Understanding of the principle of digital certificates

* Understanding of how certificates are associated with a subject and an issuer

* Understanding of the role of Certificate Authorities

* Awareness of Let’s Encrypt

'''Partial list of the used files, terms and utilities:'''

 

====022.2 Web Encryption (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of HTTPS. This includes verifying the identity of existing websites and understanding common browser error messages.

|}

'''Key Knowledge Areas:'''

* Understanding of the major differences between plain text protocols and transport encryption

* Understanding of the principle of HTTPS

* Understanding of important fields in X.509 certificates for the use with HTTPS

* Determining whether or not a website is encrypted, including common browser messages

* Awareness of SSL Labs Server Test

'''Partial list of the used files, terms and utilities:'''

 

====022.3 Email Encryption (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of GPG for email encryption. This includes handling one’s own and foreign GPG keys and sending and receiving encrypted emails.

|}

'''Key Knowledge Areas:'''

* Understanding of the principle of GPG

* Understanding of the role of key servers

* Using GPG for Email encryption (using Enigmail and Thunderbird on Windows, Linux or OS X)

'''Partial list of the used files, terms and utilities:'''

 

====022.4 Data Storage Encryption (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principles of data, file and storage device be able to encrypt data stored on local storage devices and in the cloud.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles of data, file and storage device encryption

* Using VeraCrypt to store data in a container or an encrypted storage devices

* Using Cryptomator to encrypt files stored in the cloud

* Awareness of Bitlocker

'''Partial list of used files, terms and utilities:'''

 

===''023 Node, Device and Storage Security''===

====023.1 Hardware Security (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand security aspects of hardware. This includes understanding the various types of computer devices as well as their major components. Furthermore, the candidate should understand the security implications of various devices that interact with a computer.

|}

'''Key Knowledge Areas:'''

* Understanding of the functionality of major components of a computer

* Understanding of the functionality of tablets, smartphones, smart tvs, routers, printers smart home, alarm, and IoT devices (light bulbs, thermostats, TVs, …)

* Understanding of the security implications of physical access to a computer

* Understanding of security implications of USB devices

* Understanding of security implications of Bluetooth devices

* Understanding of security implications of RFID devices

'''Partial list of used files, terms and utilities:'''

 

====023.2 Application Security (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the security aspects of software. This includes managing software updates, protecting software from remote access and understanding how to security install software.

|}

'''Key Knowledge Areas:'''

* Understanding of updates for firmware, operating systems and applications

* Understanding of the concepts of local packet filters, endpoint firewalls and application layer firewalls

* Understanding of various sources for applications and ways to securely procure and install software

* Understanding of sources for mobile applications

'''Partial list of used files, terms and utilities:'''

 

====023.3 Malware (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of various types of malware. This includes understanding of how they are installed on a device, what effects they cause and how to protect against malware.

|}

'''Key Knowledge Areas:'''

* Understanding of various types of malware (virus, ransomware, trojan horses, adware, cryptominers)

* Understanding of various types of spying (file copy, keylogging, camera and microphone hijacking)

* Awareness of the risk of data and address books copies

* Understanding of the principle of rootkit and remote access

* Understanding of keyloggers

* Understanding of virus and malware scanners

'''Partial list of used files, terms and utilities:'''

 

====023.4 Data Availability (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should be able to ensure the availability of their data. This includes storing data in appropriate devices and services as well as creating backups.

|}

'''Key Knowledge Areas:'''

* Understanding of data access and sharing in the cloud

* Awareness of the dependence on internet connection and the synchronization of data between cloud services and local storage

* Creating and securely storing backups (full, differential, incremental backups, backup retention)

'''Partial list of used files, terms and utilities'''

 

===''024 Network and Service Security''===

====024.1 Local Network Access Security (weight: 4)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 4
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand how devices are connected to a local network and and which threats result from physical media access. Furthermore, candidates should be able to securely connect to a wireless network.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles behind IP networks and the internet

* Understanding of the principles behind IP addresses and ports

* Understanding of the principles behind routing and network providers

* Understanding of the various types of network media (wired and WiFi)

* Understanding of the implications of media / link layer access

* Understanding of the concept of Man in the Middle attacks

* Understanding of the risk of unencrypted / Public WiFi

* Understanding and using of WiFi security and encryption

'''Partial list of used files, terms and utilities:'''

 

====024.2 Internet Security (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of the Internet and routed networks. This includes understanding how connections to cloud services are established and understanding common threats against services on the Internet.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles of the internet

* Understanding of the principle of traffic interception

* Understanding of the principle of DoS and DDoS attacks

* Understanding of the principle of botnets

* Understanding of the principle of clouds

'''Partial list of the used files, terms and utilities:'''

 

====024.3 Network Encryption and Anonymity (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of virtual private networks. This includes using a VPN provider to encrypt transmitted data. Candidates should understand about the anonymity of the Internet and TOR.

|}

'''Key Knowledge Areas:'''

* Understanding of virtual private networks

* Understanding of the role of a VPN provider

* Understanding the concepts of gateway packet filters

* Awareness of TOR and the Darknet

* Awareness of crypto currencies and their anonymity aspects

'''Partial list of used files, terms and utilities:'''

 

===''025 Identity and Privacy''===

====025.1 Identity (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand various concepts on how to prove their identity when using services on the internet. This includes using a password manager and multi factor authentication as well as being aware of common threats against individual identities.

|}

'''Key Knowledge Areas:'''

* Understanding of the characteristics of secure password (length, special characters, change frequencies, complexity)

* Using a password manager (keepass2)

* Understanding of the differences between online and offline password managers

* Understanding of the risks of traditional password memorization compared to password managers

* Understanding of the principle of security questions and account recovery tools

* Understanding of the principle of multifactor factor authentication

* Understanding of Phishing

* Understanding of Social Engineering

* Understanding of the role of email accounts for IT security

* Monitoring own accounts for password leaks (Search engine alerts for own usernames, password leak checkers)

* Understanding of the security aspects of online banking and credit cards

'''Partial list of used files, terms and utilities:'''

 

====025.2 Information Confidentiality and Trustworthiness (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should be able to judge the trustworthiness and correctness of information on the internet. This includes understanding how search engines work and rank their results, knowing common criteria for recognizing fake news, spam messages and scam.

|}

'''Key Knowledge Areas:'''

* Understanding the principle of search engines and web index

* Awareness of web archives

* Recognition of fake news

* Distinguishing fake and real URLs

* Understanding the principles of email spam filters

* Understanding the principle of scamming and scareware

* Handling of received email attachments

* Sharing information securely and responsibly using email cloud shares and messaging services

'''Partial list of the used files, terms and utilities:'''

 

====025.3 Privacy Protection (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the importance of the confidentiality of personal information. This includes managing privacy settings in various services as well as being aware of common threats against personal information.

|}

'''Key Knowledge Areas:'''

* Understanding of the importance of personal information

* Understanding of the concepts of information gathering and profiling

* Understanding of the principle of identity theft

* Understanding of the principle of stalking

* Understanding of the principle of cybermobbing

* Understanding of the principle of doxxing

* Understanding of the principle of fake profiles

* Understanding of the principle of cookies and tracking

* Configuring profile privacy settings on social media platforms and online services

* Managing contacts and privacy settings on social networks

* Understanding of the risk of publishing personal information

* Understanding of the rights regarding information about own personal information (such as GDPR for companies based in Europe)

'''Partial list of the used files, terms and utilities:'''

Security Essentials Objectives V1.0

2019-05-28T13:32:31Z

Mmarco: Created page with "__FORCETOC__ ==Introduction== This certificate covers a basic knowledge of IT security. The focus is the digital self-defense of an individual user. This includes a general u..."

__FORCETOC__
==Introduction==

This certificate covers a basic knowledge of IT security. The focus is the digital self-defense of an individual user. This includes a general understanding of major threats against individual computing systems, networks, services and identity as well as approaches to prevent and mitigate them.

 

==Candidate Description==

===The Minimally Qualified Candidate===

The Candidate has a basic understanding of the major security threats of using computers, networks, connected devices and IT service on premise and in the cloud. The candidate understands common ways to prevent, mitigate and prevent attacks against their personal devices and data. Furthermore, the candidate is able to use encryption to secure data transferred through a network and stored on local storage media and in the cloud. The candidate is able to apply common security tools, protect private information and secure their identity. The candidate is able to take responsibility for securing their own devices and making use of IT services.

 

==Version Information==

These objectives are '''A DRAFT FOR''' version 1.0.0.

 

==Objectives==

===''021 Security Concepts''===

====021.1 Goals, Roles and Actors (weight: 1)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 1
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the importance of IT security. This includes an understanding of essential security goals as well as understanding various actors and roles in the field of IT security.

|}

'''Key Knowledge Areas:'''

* Understand common security goals (confidentiality, integrity and availability, non repudiation)

* Understand common roles in security (hackers, crackers, black hat, white hat)

* Awareness of industrial espionage

'''Partial list of the used files, terms and utilities:'''

 

====021.2 Risk Assessment and Management (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should know how to find and interpret relevant security information. This includes understanding the risk of a vulnerability and determining the need, urgency and appropriateness for a reaction.

|}

'''Key Knowledge Areas:'''

* Know common sources for security information

* Understand security incident classification schema

* Understand the concepts of Common Vulnerabilities and Exposures (CVE)

'''Partial list of the used files, terms and utilities:'''

 

====021.3 Ethical Behaviour (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidates should understand the implications of their behavior when using digital infrastructure. This includes understanding the potential harm caused by using security tools. Furthermore, the candidate should understand common principles in copyright and privacy laws.

|}

'''Key Knowledge Areas:'''

* Understanding the implications of one’s actions on others

* Handling of personal and confidential information in a responsible way

* Awareness of legal implications

'''Partial list of the used files, terms and utilities:'''

 

===''022 Encryption''===

====022.1 Cryptography Public Key Infrastructure (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of symmetric and asymmetric encryption. Furthermore candidates should understand how digital certificates are used to associate cryptographic keys with individual persons and organizations.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles of symmetric, asymmetric and hybrid cryptography

* Understanding of the principle of Perfect Forward Secrecy

* Understanding of the principle of hash functions

* Awareness of most important cryptographic algorithms

* Understanding of the principle of digital certificates

* Understanding of how certificates are associated with a subject and an issuer

* Understanding of the role of Certificate Authorities

* Awareness of Let’s Encrypt

'''Partial list of the used files, terms and utilities:'''

 

====022.2 Web Encryption (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of HTTPS. This includes verifying the identity of existing websites and understanding common browser error messages.

|}

'''Key Knowledge Areas:'''

* Understanding of the major differences between plain text protocols and transport encryption

* Understanding of the principle of HTTPS

* Understanding of important fields in X.509 certificates for the use with HTTPS

* Determining whether or not a website is encrypted, including common browser messages

* Awareness of SSL Labs Server Test

'''Partial list of the used files, terms and utilities:'''

 

====022.3 Email Encryption (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of GPG for email encryption. This includes handling one’s own and foreign GPG keys and sending and receiving encrypted emails.

|}

'''Key Knowledge Areas:'''

* Understanding of the principle of GPG

* Understanding of the role of key servers

* Using GPG for Email encryption (using Enigmail and Thunderbird on Windows, Linux or OS X)

'''Partial list of the used files, terms and utilities:'''

 

====022.4 Data Storage Encryption (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principles of data, file and storage device be able to encrypt data stored on local storage devices and in the cloud.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles of data, file and storage device encryption

* Using VeraCrypt to store data in a container or an encrypted storage devices

* Using Cryptomator to encrypt files stored in the cloud

* Awareness of Bitlocker

'''Partial list of used files, terms and utilities:'''

 

===''023 Node, Device and Storage Security''===

====023.1 Hardware Security (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand security aspects of hardware. This includes understanding the various types of computer devices as well as their major components. Furthermore, the candidate should understand the security implications of various devices that interact with a computer.

|}

'''Key Knowledge Areas:'''

* Understanding of the functionality of major components of a computer

* Understanding of the functionality of tablets, smartphones, smart tvs, routers, printers smart home, alarm, and IoT devices (light bulbs, thermostats, TVs, …)

* Understanding of the security implications of physical access to a computer

* Understanding of security implications of USB devices

* Understanding of security implications of Bluetooth devices

* Understanding of security implications of RFID devices

'''Partial list of used files, terms and utilities:'''

 

====023.2 Application Security (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the security aspects of software. This includes managing software updates, protecting software from remote access and understanding how to security install software.

|}

'''Key Knowledge Areas:'''

* Understanding of updates for firmware, operating systems and applications

* Understanding of the concepts of local packet filters, endpoint firewalls and application layer firewalls

* Understanding of various sources for applications and ways to securely procure and install software

* Understanding of sources for mobile applications

'''Partial list of used files, terms and utilities:'''

 

====023.3 Malware (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of various types of malware. This includes understanding of how they are installed on a device, what effects they cause and how to protect against malware.

|}

'''Key Knowledge Areas:'''

* Understanding of various types of malware (virus, ransomware, trojan horses, adware, cryptominers)

* Understanding of various types of spying (file copy, keylogging, camera and microphone hijacking)

* Awareness of the risk of data and address books copies

* Understanding of the principle of rootkit and remote access

* Understanding of keyloggers

* Understanding of virus and malware scanners

'''Partial list of used files, terms and utilities:'''

 

====023.4 Data Availability (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should be able to ensure the availability of their data. This includes storing data in appropriate devices and services as well as creating backups.

|}

'''Key Knowledge Areas:'''

* Understanding of data access and sharing in the cloud

* Awareness of the dependence on internet connection and the synchronization of data between cloud services and local storage

* Creating and securely storing backups (full, differential, incremental backups, backup retention)

'''Partial list of used files, terms and utilities'''

 

===''024 Network and Service Security''===

====024.1 Local Network Access Security (weight: 4)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 4
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand how devices are connected to a local network and and which threats result from physical media access. Furthermore, candidates should be able to securely connect to a wireless network.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles behind IP networks and the internet

* Understanding of the principles behind IP addresses and ports

* Understanding of the principles behind routing and network providers

* Understanding of the various types of network media (wired and WiFi)

* Understanding of the implications of media / link layer access

* Understanding of the concept of Man in the Middle attacks

* Understanding of the risk of unencrypted / Public WiFi

* Understanding and using of WiFi security and encryption

'''Partial list of used files, terms and utilities:'''

 

====024.2 Internet Security (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of the Internet and routed networks. This includes understanding how connections to cloud services are established and understanding common threats against services on the Internet.

|}

'''Key Knowledge Areas:'''

* Understanding of the principles of the internet

* Understanding of the principle of traffic interception

* Understanding of the principle of DoS and DDoS attacks

* Understanding of the principle of botnets

* Understanding of the principle of clouds

'''Partial list of the used files, terms and utilities:'''

 

====024.3 Network Encryption and Anonymity (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the principle of virtual private networks. This includes using a VPN provider to encrypt transmitted data. Candidates should understand about the anonymity of the Internet and TOR.

|}

'''Key Knowledge Areas:'''

* Understanding of virtual private networks

* Understanding of the role of a VPN provider

* Understanding the concepts of gateway packet filters

* Awareness of TOR and the Darknet

* Awareness of crypto currencies and their anonymity aspects

'''Partial list of used files, terms and utilities:'''

 

===''025 Identity and Privacy''===

====025.1 Identity (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand various concepts on how to prove their identity when using services on the internet. This includes using a password manager and multi factor authentication as well as being aware of common threats against individual identities.

|}

'''Key Knowledge Areas:'''

* Understanding of the characteristics of secure password (length, special characters, change frequencies, complexity)

* Using a password manager (keepass2)

* Understanding of the differences between online and offline password managers

* Understanding of the risks of traditional password memorization compared to password managers

* Understanding of the principle of security questions and account recovery tools

* Understanding of the principle of multifactor factor authentication

* Understanding of Phishing

* Understanding of Social Engineering

* Understanding of the role of email accounts for IT security

* Monitoring own accounts for password leaks (Search engine alerts for own usernames, password leak checkers)

* Understanding of the security aspects of online banking and credit cards

'''Partial list of used files, terms and utilities:'''

 

====025.2 Information Confidentiality and Trustworthiness (weight: 2)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should be able to judge the trustworthiness and correctness of information on the internet. This includes understanding how search engines work and rank their results, knowing common criteria for recognizing fake news, spam messages and scam.

|}

'''Key Knowledge Areas:'''

* Understanding the principle of search engines and web index

* Awareness of web archives

* Recognition of fake news

* Distinguishing fake and real URLs

* Understanding the principles of email spam filters

* Understanding the principle of scamming and scareware

* Handling of received email attachments

* Sharing information securely and responsibly using email cloud shares and messaging services

'''Partial list of the used files, terms and utilities:'''

 

====025.3 Privacy Protection (weight: 3)====

{|
| style="background:#dadada" |

'''Weight'''

| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" |

'''Description'''

| style="background:#eaeaea" |

The candidate should understand the importance of the confidentiality of personal information. This includes managing privacy settings in various services as well as being aware of common threats against personal information.

|}

'''Key Knowledge Areas:'''

* Understanding of the importance of personal information

* Understanding of the concepts of information gathering and profiling

* Understanding of the principle of identity theft

* Understanding of the principle of stalking

* Understanding of the principle of cybermobbing

* Understanding of the principle of doxxing

* Understanding of the principle of fake profiles

* Understanding of the principle of cookies and tracking

* Configuring profile privacy settings on social media platforms and online services

* Managing contacts and privacy settings on social networks

* Understanding of the risk of publishing personal information

* Understanding of the rights regarding information about own personal information (such as GDPR for companies based in Europe)

'''Partial list of the used files, terms and utilities:'''