This comprehensive course is tailored for aspiring and current Security Control Assessors, emphasizing security auditing, management, and risk assessment frameworks. Participants will develop expertise in conducting vulnerability scans across systems and networks, assessing software security, and performing secure code reviews.

Throughout the program, participants will delve into the fundamentals of vulnerability scanning, learning to identify and assess vulnerabilities across Windows and Linux systems, within network architectures, and embedded in software development pipelines. The course emphasizes hands-on experience, allowing learners to apply these concepts in real-world scenarios. They will not only detect vulnerabilities but also propose and implement strategic recommendations to mitigate these risks, thereby enhancing the security posture of their organizations.

A significant portion of the course is dedicated to the assessment of software programs. Participants will be introduced to the techniques of secure code review and the practice of fuzzing to understand and improve the behavior of applications under test conditions. These critical skills are paramount for those aiming to ensure the integrity, confidentiality, and availability of software systems.

Upon completion, learners will be proficient in:

• Apply fundamental security auditing principles for effective risk mitigation.
• Develop comprehensive checklists to audit hardware, software, and business operations.
• Master risk assessment techniques and actively manage emerging security concerns.
• Utilize industry-standard security baselines to set organizational security standards.
• Employ security testing techniques using tools like Nmap, SonarQube, and OWASP ZAP.
• Provide recommendations to enhance organizational security measures across on-premises and cloud environments.

MCSI is one of the most respected and trusted names in cyber security education and training. Our certifications teach critical skills, knowledge and abilities needed to advance a career in cyber security. Our courses are comprehensive and up-to-date, and our instructors are experienced professionals who are dedicated to helping students learn. MCSI provides the real-world skills and knowledge you need to protect any organization from cyber threats.

• Lab Setup and Configuration

  Lab setup and configuration are crucial for MSCA to provide hands-on experience in applying security controls and methodologies. This practical training allows participants to simulate real-world scenarios, reinforcing their understanding of security principles and enhancing their ability to conduct effective security control assessments.

  OpenVAS

  OpenVAS is a vital tool for MSCA, enabling comprehensive vulnerability scanning and assessment across various systems and networks.

  VirtualBox

  VirtualBox is essential for setting up and configuring virtual lab environments, providing a sandboxed platform for testing security controls and configurations.

  Chef - AWS

  Chef integrated with AWS facilitates automated configuration management and deployment of security controls in cloud environments, a critical aspect of modern security assessments.

  Puppet - AWS

  Puppet in conjunction with AWS supports secure configuration management and orchestration, enabling efficient management of security controls across cloud infrastructures.

• Auditing and Risk Management

  Auditing and risk management are crucial for security control assessors as they enable the identification, evaluation, and mitigation of organizational risks. By conducting thorough audits and risk assessments, assessors can provide actionable insights and recommendations to enhance security postures and ensure compliance with industry standards and regulations.

  This proactive approach helps organizations maintain robust security measures and effectively manage potential threats and vulnerabilities.

  Gap Analysis

  Crucial for identifying security gaps and discrepancies between current practices and desired standards, guiding prioritization of improvement efforts for security control assessors.

  Security Baselines

  Establish foundational security configurations and standards to assess deviations, ensuring consistent and effective security practices are maintained.

  Bypassing Controls

  Understanding control weaknesses and potential bypasses is essential for identifying vulnerabilities and strengthening security measures as part of security control assessments.

  Audit Charter Document

  Defines the scope and objectives of audits, ensuring structured and comprehensive assessments that align with security control assessment goals.

  Engagement Letter

  Establishes clear terms and expectations for audit engagements, providing transparency and alignment between stakeholders in security control assessments.

  Privacy Audit Checklist

  Ensures compliance with privacy regulations and identifies risks associated with personal data handling, which is critical for security control assessors assessing privacy controls.

  Hardware & Software Acquisition Audit Checklists

  Assesses newly acquired assets for security vulnerabilities, ensuring that security controls are applied to prevent risks in the infrastructure.

  Logical Access Review Checklist

  Evaluates access controls and permissions to prevent unauthorized access, a key aspect of security control assessments.

  System Testing Review

  Validates system security through comprehensive testing, identifying vulnerabilities and areas for improvement in security control assessments.

  Risk Governance

  Establishes policies and processes for effective risk management, ensuring that security control assessors can align security practices with organizational goals.

  Gap Assessment Workbooks

  Organizes findings from gap analyses, aiding in prioritizing remediation efforts and tracking progress for security control assessors.

  IT Security Standard Documents

  Establishes consistent security standards for data protection and access control, guiding security control assessors in maintaining and enforcing security practices across the organization.

• Vulnerability Assessment and Exploitation

  Vulnerability assessment and exploitation are critical for security control assessors to identify weaknesses and potential entry points in systems, networks, and applications, enabling informed risk management and mitigation strategies.

  Understanding vulnerabilities and their exploitation helps assessors gauge the effectiveness of existing controls and prioritize remediation efforts to enhance overall security posture.

  Nmap

  Nmap is a critical tool for network scanning and identifying potential vulnerabilities within networked systems, aiding in comprehensive assessments for security control assessors.

  Utilizing Nmap to identify and exploit vulnerabilities

  Utilizing Nmap not only helps in identifying vulnerabilities but also aids in understanding system weaknesses and potential attack vectors, crucial for security control assessors in assessing risk.

  Writing PowerShell scripts to identify Windows vulnerabilities

  Writing PowerShell scripts enables automated detection and assessment of vulnerabilities in Windows environments, streamlining assessment processes for security control assessors.

  Identifying and exploiting numerous Linux vulnerabilities (such as Privilege escalation, etc.)

  Identifying and exploiting Linux vulnerabilities provides essential hands-on experience in assessing Linux systems, including privilege escalation, which is vital for comprehensive security assessments by security control assessors.

• Security Testing and Configuration Management

  Security Testing and Configuration Management are crucial for security control assessors as they enable comprehensive assessments of system vulnerabilities and ensure adherence to secure configuration standards.

  By conducting rigorous security testing and effectively managing configurations, assessors can identify, mitigate, and prevent potential security risks within organizational infrastructures.

  Perform Security Testing in Jenkins CI/CD Pipelines

  Integrating security testing into CI/CD pipelines created using Jenkins is crucial for security control assessors to automate and validate security measures throughout the development lifecycle, ensuring early detection and mitigation of vulnerabilities.

  DefectDojo for Security Testing in CI/CD Pipelines

  DefectDojo facilitates security testing within CI/CD pipelines, enabling assessors to manage findings and track remediation efforts efficiently, ensuring continuous security improvement in software development processes.

  OWASP ZAP for Security Testing in CI/CD Pipelines

  OWASP ZAP provides security testing capabilities in CI/CD pipelines, allowing assessors to identify and address security vulnerabilities early in the development cycle, enhancing the overall security posture of applications.

  Integrating Threat Mapper

  Integrating Threat Mapper is valuable for security control assessors to visualize and analyze threat models, aiding in the identification of potential security risks and the formulation of effective security strategies.

  Writing Sensible Playbooks for Different Circumstances

  Developing sensible playbooks is essential for security control assessors using automation tools like Ansible, enabling consistent and secure configuration management across diverse environments, thereby reducing security risks.

  Utilizing Chef for AWS Configuration Management

  Utilizing Chef for AWS configuration management allows security control assessors to enforce consistent and secure configurations, ensuring compliance with organizational security policies and standards in cloud environments.

  Utilizing Puppet to Configure AWS Firewall

  Leveraging Puppet for AWS firewall configuration enables security control assessors to manage and enforce firewall rules efficiently, enhancing network security and mitigating potential threats in AWS environments.

• Browzer Fuzzing

  Browser fuzzing is important for security control assessors because it allows them to identify and exploit vulnerabilities in web browsers, which are common entry points for attackers. By simulating unexpected or malformed inputs, fuzzing helps assessors uncover potential security weaknesses and ensure the robustness of browser security measures.

  Writing Scripts to Automate Browser Fuzzing

  Writing scripts to automate browser fuzzing is crucial for security control assessors, enabling efficient and systematic testing of web browsers for vulnerabilities. Automation allows assessors to scale their efforts and identify potential security weaknesses more effectively.

  Browser Fuzzing with the HTML Engine

  Browser fuzzing using the HTML engine is significant for security control assessors, as it helps simulate unexpected input scenarios and detect vulnerabilities specific to HTML rendering. This approach is essential for ensuring robust security measures in web browsers.

  Browser Fuzzing Using the JavaScript Engine

  Browser fuzzing using the JavaScript engine is important for security control assessors to assess the security of JavaScript execution within web browsers. This method enables assessors to uncover potential vulnerabilities related to JavaScript handling and execution.

This course teaches the specific Knowledge, Skills, Abilities, and Tasks (KSATs) aligned with the DoD Cyber Workforce Framework (DCWF) as outlined in DoD 8140. By focusing on these critical competencies, the course ensures that you develop the essential capabilities required for various cybersecurity roles within the Department of Defense. This alignment not only guarantees that the training is relevant and comprehensive but also that it prepares you to meet the specific operational needs and standards of the DoD cyber workforce.

• knowledge

  ID	Description
  19	Knowledge of cyber defense and vulnerability assessment tools, including open source tools, and their capabilities.
  22	Knowledge of computer networking concepts and protocols, and network security methodologies.
  40	Knowledge of organization’s evaluation and validation requirements.
  55	Knowledge of cybersecurity principles used to manage risks related to the use, processing, storage, and transmission of information or data.
  58	Knowledge of known vulnerabilities from alerts, advisories, errata, and bulletins.
  63	Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
  70	Knowledge of information technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, encryption).
  77	Knowledge of current industry methods for evaluating, implementing, and disseminating information technology (IT) security assessment, monitoring, detection, and remediation tools and procedures utilizing standards-based concepts and capabilities.
  105	Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).
  108	Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).
  1072	Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).
  1158	Knowledge of cybersecurity principles.
  1159	Knowledge of cyber threats and vulnerabilities.
  6900	Knowledge of specific operational impacts of cybersecurity lapses.
  6935	Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).
  6938	Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.
  27	Knowledge of cryptography and cryptographic key management concepts.
  38	Knowledge of organization’s enterprise information security architecture system.
  43A	Knowledge of embedded systems.
  53A	Knowledge of security risk assessments and authorization per Risk Management Framework processes.
  69A	Knowledge of risk management processes and requirements per the Risk Management Framework (RMF).
  88	Knowledge of new and emerging information technology (IT) and cybersecurity technologies.
  88A	Knowledge of current and emerging cyber technologies.
  95B	Knowledge of penetration testing principles, tools, and techniques, including specialized tools for non-traditional systems and networks (e.g., control systems).
  121	Knowledge of structured analysis principles and methods.
  128	Knowledge of systems diagnostic tools and fault identification techniques.
  143	Knowledge of the organization’s enterprise information technology (IT) goals and objectives.
  942	Knowledge of the organization’s core business/mission processes.
  1034A	Knowledge of Personally Identifiable Information (PII) data security standards.
  1034B	Knowledge of Payment Card Industry (PCI) data security standards.
  1034C	Knowledge of Personal Health Information (PHI) data security standards.
  1036	Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed.
  1037	Knowledge of information technology (IT) supply chain security and risk management policies, requirements, and procedures.
  1038B	Knowledge of local specialized system requirements (e.g., critical infrastructure/control systems that may not use standard information technology [IT]) for safety, performance, and reliability).
  1131	Knowledge of security architecture concepts and enterprise architecture reference models (e.g., Zackman, Federal Enterprise Architecture [FEA]).
  1141A	Knowledge of an organization’s information classification program and procedures for information compromise.
  1142	Knowledge of security models (e.g., Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model).

• skills

  ID	Description
  183	Skill in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomes.
  197	Skill in discerning the protection needs (i.e., security controls) of information systems and networks.
  3B	Skill in conducting vulnerability scans and recognizing vulnerabilities in information systems and networks.
  156	Skill in applying confidentiality, integrity, and availability principles.
  203	Skill in identifying measures or indicators of system performance and the actions needed to improve or correct performance, relative to the goals of the system.
  1039	Skill in evaluating the trustworthiness of the supplier and/or product.

• tasks

  ID	Description
  537	Develop methods to monitor and measure risk, compliance, and assurance efforts.
  548	Develop specifications to ensure risk, compliance, and assurance efforts conform with security, resilience, and dependability requirements at the software application, system, and network environment level.
  566	Draft statements of preliminary or residual security risks for system operation.
  691	Maintain information systems assurance and accreditation materials.
  710	Monitor and evaluate a system’s compliance with information technology (IT) security, resilience, and dependability requirements.
  417	Apply coding and testing standards, apply security testing tools including “‘fuzzing” static-analysis code scanning tools, and conduct code reviews.
  457	Conduct Privacy Impact Assessments (PIA) of the application’s security design for the appropriate security controls, which protect the confidentiality and integrity of Personally Identifiable Information (PII).
  772	Perform validation steps, comparing actual results with expected results and analyze the differences to identify impact and risks.
  775	Plan and conduct security authorization reviews and assurance case development for initial installation of systems and networks.
  798	Provide an accurate technical evaluation of the software application, system, or network, documenting the security posture, capabilities, and vulnerabilities against relevant cybersecurity compliances.
  827	Recommend new or revised security, resilience, and dependability measures based on the results of reviews.
  836B	Review and approve security and privacy assessment plans.
  836	Review authorization and assurance documents to confirm that the level of risk is within acceptable limits for each software application, system, and network.
  878	Verify that application software/network/system security postures are implemented as stated, document deviations, and recommend required actions to correct those deviations.
  879	Verify that the software application/network/system accreditation and assurance documentation is current.
  936	Develop security compliance processes and/or audits for external services (e.g., cloud service providers, data centers).
  1146	Develop and Implement cybersecurity independent audit processes for application software/networks/systems and oversee ongoing independent audits to ensure that operational and Research and Design (R&D) processes and procedures are in compliance with organizational and mandatory cybersecurity requirements and accurately followed by Systems Administrators and other cybersecurity staff when performing their day-to-day activities.