Security Operations for Security+

Computing Resource Security

This Security+ topic covers secure baseline lifecycle: establish, deploy, and maintain approved configuration states; Hardening targets: mobile devices, workstations, switches, routers, cloud infrastructure, servers, ICS/SCADA, embedded systems, RTOS...

Asset Management Security

This Security+ topic covers acquisition and procurement process decisions that affect hardware, software, and data security; Assignment and accounting controls, including ownership and classification; Monitoring and asset tracking, including inventor...

Vulnerability Management

This Security+ topic covers identification methods: vulnerability scan, application security testing, static analysis, dynamic analysis, package monitoring, threat feeds, OSINT, proprietary or third-party feeds, information-sharing organizations, dar...

Security Monitoring and Alerting

This Security+ topic covers monitoring computing resources: systems, applications, and infrastructure; Monitoring activities: log aggregation, alerting, scanning, reporting, archiving, alert response and remediation validation, quarantine, and alert...

Enterprise Security Capabilities

This Security+ topic covers operational modification of enterprise security capabilities when a scenario gives a risk, exposure, or business change and asks what capability should be adjusted; Firewall capability changes: rules, access lists, ports/p...

Identity and Access Management

This Security+ topic covers operational implementation and maintenance of identity and access management controls; Identity lifecycle operations: identity proofing, provisioning, permission assignments, attestation, account recertification, and de-pr...

Automation and Orchestration

This Security+ topic covers secure operations automation and orchestration use cases: user provisioning, resource provisioning, guard rails, security groups, ticket creation, escalation, enabling/disabling services and access, continuous integration...

Incident Response Activities

This Security+ topic covers incident response process activities: preparation, detection, analysis, containment, eradication, recovery, and lessons learned; Incident response readiness activities: training, tabletop exercise, and simulation; Follow-o...

Investigation Data Sources

This Security+ topic covers choosing the data source that best supports an investigation based on the question being asked and the evidence needed; Log data sources: firewall logs, application logs, endpoint logs, OS-specific security logs, IPS/IDS l...