b.理论储备

Roadmap for Learning Cyber Security

Cybersecurity Domains

Security Architecture
- Cryptography
- Secure System Build
  - Baseline Configuration
- Secure Application Development
- Network Design
- Data Protection
- Cloud Security
  - Federated Identity
  - CASB
- Access Control
  - Identify Management
    - Privileged Access Management
    - Identify & Access Management
  - Security Engineering
Frameworks and Standard
- NIST
- ISO/IEC
- COBIT
- SANS/CSC
Security Operation
- Vulnerability Management
- Protection
- Data Leakage
- Detection
- Prevention
- Recovery
  - DR
  - BCP
- SIEM
- SOC
- Incident Response
- Active Defense
Physical Security
User Education
- Training (new skills)
- Awareness (reinforcement)
Career Development
- Conferences
- Certification
- Training
- Peer Group
- Self-study
Threat Intelligence
- External
- Internal
- Contextual
- Intel. Sharing
- IOCs
Risk Assessment
- Source Code Scan
  - Blackbox
  - Whitebox
- Vulnerability Scan
- Assets Inventory
- 3rd Party Risk
  - 4th Party Risk
- Data-Centric Risk
  - Data-Flow Map
- Penetration Test
  - Blue Team
    - Social Engineering
    - Infrastructure
  - Red Team
    - Social Engineering
    - Infrastructure
    - Application
Governance
- Aduit
- Executive Management Involvement
  - Reports and Scorecards
    - KPIs/KPIs
  - Risk informed
- Company's Written Supervisory Procedures (WSP)
  - Policy
  - Procedure
  - Standard
  - Guideline
- Laws and Regulations
  - Industry Specific
  - Federal
  - State