[فارسی]

01 مقدمه
01-01 درآمد SSCP خود را

02 امتحان SSCP
02-01 امتحان SSCP
02-02 آیا SSCP برای شما مناسب است؟
02-03 شغل در امنیت اطلاعات
02-04 مقدار صدور گواهینامه
02-05 منابع مطالعه

03 در آزمون SSCP
03-01 ثبت نام برای امتحان
03-02 محیط امتحان
03-03 انواع سوال
03-04 گذراندن آزمون SSCP

04 آماده شدن برای امتحان
04-01 نکات امتحان
04-02 برآورده کردن نیاز تجربه
04-03 الزامات مداوم آموزش

05 دامنه 1: مفاهیم و شیوه های امنیتی
05-01 نمای کلی از دامنه مفاهیم و شیوه های امنیتی

06 مفاهیم امنیتی
06-01 اهداف امنیت اطلاعات
06-02 محرمانه بودن
06-03 یکپارچگی
06-04 در دسترس بودن
06-05 پاسخگویی
06-06 نیاز به دانستن و کمترین امتیاز دارد
06-07 تفکیک وظایف (SOD)
06-08 انطباق حریم خصوصی
06-09 حریم خصوصی کارکنان
06-10 اخلاق

07 امنیت منابع
07-01 مدیریت دارایی فیزیکی
07-02 مجوز نرم افزار
07-03 مدیریت تغییر و پیکربندی

08 امنیت داده
08-01 درک امنیت داده ها
خط مشی امنیت داده 08-02
08-03 نقش های امنیتی داده
08-04 محدود کردن جمع آوری داده ها
08-05 چرخه حیات داده

09 استانداردهای امنیتی
09-01 توسعه خطوط امنیتی
09-02 استانداردهای صنعت اهرم
09-03 سفارشی سازی استانداردهای امنیتی

10 کنترل امنیتی
10-01 انتخاب و اجرای کنترل امنیت
10-02 چارچوب کنترل و ریسک
10-03 چارچوب سیاست امنیتی
10-04 Devops و devsecops

11 ارزیابی کنترل های امنیتی
11-01 داده های فرآیند امنیتی را جمع آوری کنید
11-02 بررسی مدیریت
11-03 معیارهای امنیتی
11-04 ممیزی و ارزیابی
11-05 مدیریت کنترل

12 آگاهی و آموزش
12-01 آگاهی و آموزش امنیتی
12-02 آموزش انطباق
12-03 عادت کاربر
12-04 مهندسی اجتماعی
12-05 اندازه گیری انطباق و وضعیت امنیتی

13 امنیت جسمی
13-01 طراحی سایت و تسهیلات
13-02 مرکز داده کنترل محیط زیست
13-03 مرکز داده حفاظت از محیط زیست
13-04 کنترل دسترسی فیزیکی
13-05 مدیریت بازدید کننده

14 دامنه 2: کنترل دسترسی
14-01 نمای کلی از دامنه کنترل دسترسی

15 مدیریت هویت و دسترسی
15-01 کنترل دسترسی
15-02 شناسایی ، احراز هویت و مجوز

16 شناسایی
16-01 نام کاربری و کارتهای دسترسی
بیومتریک 16-02
ثبت نام و اثبات هویت 16-03

17 احراز هویت
17-01 فاکتورهای احراز هویت
تأیید هویت چند عاملی 17-02
17-03 چیزی که دارید
17-04 پروتکل احراز هویت رمز عبور
17-05 SSO و فدراسیون
17-06 معماری اعتماد به نفس اینترنت
17-07 اتصالات شخص ثالث
معماری شبکه 17-08 صفر
17-09 SAML
17-10 OAUTH و OPENID CONNECT
تأیید اعتبار 17-11

18 چرخه مدیریت هویت
18-01 مدیریت حساب و امتیاز را درک کنید
18-02 سیاست های حساب
18-03 خط مشی رمز عبور
18-04 مدیریت نقش ها
18-05 نظارت ، گزارش و نگهداری
18-06 تهیه و محرومیت

19 مجوز
19-01 مجوز را درک کنید
19-02 کنترل دسترسی اجباری
19-03 کنترل دسترسی اختیاری
19-04 لیست کنترل دسترسی
19-05 مفاهیم مجوز پیشرفته

20 دامنه 3: شناسایی ریسک ، نظارت و تجزیه و تحلیل
20-01 نمای کلی از حوزه شناسایی ، نظارت و تجزیه و تحلیل ریسک

21 مدیریت ریسک
21-01 ارزیابی ریسک
21-02 ارزیابی ریسک کمی
21-03 مدیریت ریسک
21-04 مدیریت ریسک مداوم
چارچوب های مدیریت ریسک 21-05
21-06 دید و گزارش ریسک

22 مدل سازی تهدید
22-01 هوش تهدید
22-02 مدیریت شاخص های تهدید
22-03 اشتراک اطلاعاتی
22-04 شناسایی تهدیدات
22-05 خودکار تهدید تهدید
22-06 شکار تهدید
22-07 میتر

[ENGLISH]

01 Introduction
01-01 Earning your SSCP

02 The SSCP Exam
02-01 The SSCP exam
02-02 Is the SSCP right for you?
02-03 Careers in information security
02-04 Value of certification
02-05 Study resources

03 Inside the SSCP Exam
03-01 Registering for the exam
03-02 Exam environment
03-03 Question types
03-04 Passing the SSCP exam

04 Preparing for the Exam
04-01 Exam tips
04-02 Meeting the experience requirement
04-03 Continuing education requirements

05 Domain 1: Security Concepts and Practices
05-01 Overview of the Security Concepts and Practices Domain

06 Security Concepts
06-01 The goals of information security
06-02 Confidentiality
06-03 Integrity
06-04 Availability
06-05 Accountability
06-06 Need to know and least privilege
06-07 Segregation of duties (SoD)
06-08 Privacy compliance
06-09 Employee privacy
06-10 Ethics

07 Resource Security
07-01 Physical asset management
07-02 Software licensing
07-03 Change and configuration management

08 Data Security
08-01 Understanding data security
08-02 Data security policies
08-03 Data security roles
08-04 Limiting data collection
08-05 The data lifecycle

09 Security Standards
09-01 Developing security baselines
09-02 Leveraging industry standards
09-03 Customizing security standards

10 Security Controls
10-01 Security control selection and implementation
10-02 Control and risk frameworks
10-03 Security policy framework
10-04 DevOps and DevSecOps

11 Assessing Security Controls
11-01 Collect security process data
11-02 Management review
11-03 Security metrics
11-04 Audits and assessments
11-05 Control management

12 Awareness and Training
12-01 Security awareness and training
12-02 Compliance training
12-03 User habits
12-04 Social engineering
12-05 Measuring compliance and security posture

13 Physical Security
13-01 Site and facility design
13-02 Data center environmental controls
13-03 Data center environmental protection
13-04 Physical access control
13-05 Visitor management

14 Domain 2: Access Controls
14-01 Overview of the Access Controls Domain

15 Identity and Access Management
15-01 Access controls
15-02 Identification, authentication, and authorization

16 Identification
16-01 Usernames and access cards
16-02 Biometrics
16-03 Registration and identity proofing

17 Authentication
17-01 Authentication factors
17-02 Multifactor authentication
17-03 Something you have
17-04 Password authentication protocols
17-05 SSO and federation
17-06 Internetwork trust architectures
17-07 Third-party connections
17-08 Zero-trust network architectures
17-09 SAML
17-10 OAuth and OpenID Connect
17-11 Device authentication

18 Identity Management Lifecycle
18-01 Understand account and privilege management
18-02 Account policies
18-03 Password policies
18-04 Manage roles
18-05 Monitoring, reporting, and maintenance
18-06 Provisioning and deprovisioning

19 Authorization
19-01 Understand authorization
19-02 Mandatory access controls
19-03 Discretionary access controls
19-04 Access control lists
19-05 Advanced authorization concepts

20 Domain 3: Risk Identification, Monitoring, and Analysis
20-01 Overview of the Risk Identification, Monitoring, and Analysis Domain

21 Risk Management
21-01 Risk assessment
21-02 Quantitative risk assessment
21-03 Risk management
21-04 Ongoing risk management
21-05 Risk management frameworks
21-06 Risk visibility and reporting

22 Threat Modeling
22-01 Threat intelligence
22-02 Managing threat indicators
22-03 Intelligence sharing
22-04 Identifying threats
22-05 Automating threat intelligence
22-06 Threat hunting
22-07 MITRE ATT&CK

23 Understanding Vulnerability Types
23-01 Vulnerability impacts
23-02 Supply chain vulnerabilities
23-03 Configuration vulnerabilities
23-04 Architectural vulnerabilities

24 Vulnerability Scanning
24-01 What is vulnerability management?
24-02 Identifying scan targets
24-03 Scan configuration
24-04 Scan perspective
24-05 SCAP
24-06 CVSS
24-07 Interpreting CVSS scores
24-08 Analyzing scan reports
24-09 Correlating scan results

25 Legal and Regulatory Concerns
25-01 Legal and compliance risks
25-02 Legal definitions
25-03 Data privacy
25-04 Data breaches

26 Security Monitoring
26-01 Monitoring log files
26-02 Security information and event management
26-03 Continuous security monitoring
26-04 Visualization and reporting
26-05 Compliance monitoring
26-06 Legal and ethical issues in monitoring

27 Domain 4: Incident Response and Recovery
27-01 Overview of the Incident Response and Recovery Domain

28 Incident Management
28-01 Build an incident response program
28-02 Creating an incident response team
28-03 Incident communications plan
28-04 Incident detection
28-05 Escalation and notification
28-06 Mitigation
28-07 Containment techniques
28-08 Incident eradication and recovery
28-09 Validation
28-10 Post-incident activities
28-11 Incident response exercises

29 Investigations and Forensics
29-01 Conducting investigations
29-02 Evidence types
29-03 Introduction to forensics
29-04 System and file forensics
29-05 Network forensics
29-06 Software forensics
29-07 Mobile device forensics
29-08 Embedded device forensics
29-09 Chain of custody
29-10 Reporting and documenting incidents
29-11 Electronic discovery (ediscovery)

30 Business Continuity
30-01 Business continuity planning
30-02 Business continuity controls
30-03 High availability and fault tolerance

31 Disaster Recovery
31-01 Disaster recovery planning
31-02 Backups
31-03 Restoring backups
31-04 Disaster recovery sites
31-05 Testing BC/DR plans
31-06 After action reports

32 Emergency Response
32-01 Building an emergency response plan

33 Domain 5: Cryptography
33-01 Overview of the Cryptography Domain

34 Encryption
34-01 Understanding encryption
34-02 Symmetric and asymmetric cryptography
34-03 Goals of cryptography
34-04 Codes and ciphers
34-05 Choosing encryption algorithms
34-06 The perfect encryption algorithm
34-07 The cryptographic lifecycle

35 Symmetric Cryptography
35-01 Data encryption standard
35-02 3DES
35-03 AES, Blowfish, and Twofish
35-04 RC4
35-05 Steganography

36 Asymmetric Cryptography
36-01 Rivest-Shamir-Adleman (RSA)
36-02 PGP and GnuPG
36-03 Elliptic curve and quantum cryptography

37 Key Management
37-01 Cryptographic key security
37-02 Key exchange
37-03 Diffie-Hellman
37-04 Key escrow
37-05 Key stretching

38 Public Key Infrastructure
38-01 Trust models
38-02 PKI and digital certificates
38-03 Hash functions
38-04 Digital signatures
38-05 Create a digital certificate
38-06 Revoke a digital certificate
38-07 Certificate stapling
38-08 Certificate authorities
38-09 Certificate subjects
38-10 Certificate types
38-11 Certificate formats

39 Transport Encryption
39-01 TLS and SSL
39-02 IPSec
39-03 Securing common protocols
39-04 DKIM
39-05 Tor and perfect forward secrecy
39-06 Blockchain

40 Cryptanalytic Attacks
40-01 Brute-force attacks
40-02 Knowledge-based attacks
40-03 Limitations of encryption algorithms

41 Domain 6: Network and Communications Security
41-01 Overview of the Network and Communications Security Domain

42 TCP/IP Networking
42-01 Introducing TCP/IP
42-02 IP addressing and DHCP
42-03 Domain Name System (DNS)
42-04 Network ports
42-05 ICMP
42-06 Network topologies
42-07 Network relationships

43 Network Security Devices
43-01 Routers, switches, and bridges
43-02 Firewalls
43-03 Proxy servers
43-04 Load balancers
43-05 VPNs and VPN concentrators
43-06 Network intrusion detection and prevention
43-07 Protocol analyzers
43-08 Content distribution networks
43-09 Traffic shaping and WAN optimization
43-10 Unified threat management

44 Secure Network Design
44-01 Public and private addressing
44-02 Subnetting
44-03 Security zones
44-04 VLANs and network segmentation
44-05 Security device placement
44-06 Software-defined networking (SDN)
44-07 Transmission media

45 Network Security Technologies
45-01 Restricting network access
45-02 Network access control
45-03 RADIUS and TACACS
45-04 Firewall rule management
45-05 Router configuration security
45-06 Switch configuration security
45-07 Maintaining network availability
45-08 Network monitoring
45-09 SNMP
45-10 Isolating sensitive systems

46 Remote Network Access
46-01 Remote network access
46-02 Desktop and application virtualization

47 Wireless Networking
47-01 Understanding wireless networking
47-02 Wireless encryption
47-03 Wireless authentication
47-04 Wireless signal propagation
47-05 Wireless networking equipment

48 Network Attacks
48-01 Denial of service attacks
48-02 Eavesdropping attacks
48-03 DNS attacks
48-04 Layer 2 attacks
48-05 Network address spoofing
48-06 Wireless attacks
48-07 Propagation attacks
48-08 Preventing rogues and evil twins
48-09 Disassociation attacks
48-10 Understanding Bluetooth and NFC attacks

49 Domain 7: Systems and Application Security
49-01 Overview of the Systems and Application Security Domain

50 Malware
50-01 Comparing viruses, worms, and trojans
50-02 Malware payloads
50-03 Understanding backdoors and logic bombs
50-04 Looking at advanced malware
50-05 Understanding botnets
50-06 Code signing

51 Understanding Attackers
51-01 Cybersecurity adversaries
51-02 Preventing insider threats
51-03 Attack vectors
51-04 Zero-days and the Advanced Persistent Threat

52 Social Engineering Attacks
52-01 Social engineering
52-02 Impersonation attacks
52-03 Identity fraud and pretexting
52-04 Watering hole attacks
52-05 Physical social engineering

53 Web Application Attacks
53-01 OWASP Top Ten
53-02 Application security
53-03 Preventing SQL injection
53-04 Understanding cross-site scripting
53-05 Request forgery
53-06 Defending against directory traversal
53-07 Overflow attacks
53-08 Explaining cookies and attachments
53-09 Session hijacking
53-10 Code execution attacks

54 Host Security
54-01 Operating system security
54-02 Malware prevention
54-03 Application management
54-04 Host-based network security controls
54-05 File integrity monitoring
54-06 Data loss prevention
54-07 Endpoint monitoring

55 Hardware Security
55-01 Hardware encryption
55-02 Hardware and firmware security
55-03 Peripheral security

56 Mobile Device Security
56-01 Mobile connection methods
56-02 Mobile device security
56-03 Mobile device management
56-04 Mobile device tracking
56-05 Mobile application management
56-06 Mobile security enforcement
56-07 Bring Your Own Device (BYOD)
56-08 Mobile deployment models

57 Embedded Systems Security
57-01 Industrial control systems
57-02 Internet of Things
57-03 Securing smart devices
57-04 Secure networking for smart devices

58 Cloud Computing
58-01 What is the cloud?
58-02 Cloud activities and the Cloud Reference Architecture
58-03 Cloud deployment models
58-04 Cloud service categories
58-05 Virtualization
58-06 Cloud compute resources
58-07 Cloud storage
58-08 Containers

59 Cloud Issues
59-01 Security and privacy concerns in the cloud
59-02 Data sovereignty
59-03 Cloud access security brokers
59-04 Operational concerns in the cloud

60 Conclusion
60-01 Preparing for the exam