3.1 Describe operating system security concepts — Windows, macOS, Linux security features; Windows Defender; host-based firewalls; CLI and PowerShell; file and directory permissions; privilege escalation

▸ What Are Operating System Security Features

▸ How Windows Defender Keeps Your Computer Safe

▸ Understanding Host-Based Firewalls

▸ File and Directory Permissions: Keeping Your Data Safe

▸ What Is Privilege Escalation and Why It Matters

3.2 Demonstrate familiarity with appropriate endpoint tools that gather security assessment information — Using netstat to gather endpoint security data; using nslookup for DNS security assessment; using tcpdump for packet capture and analysis

▸ Introduction to Endpoint Security Tools

▸ What is Netstat and How Does it Improve Security

▸ How to Use Nslookup for DNS Security Checks

▸ Understanding Tcpdump for Network Packet Analysis

▸ Comparing Netstat, Nslookup, and Tcpdump for Security

3.3 Verify that endpoint systems meet security policies and standards — Hardware inventory; software inventory; program deployment; data backups; regulatory compliance (PCI DSS, HIPAA, GDPR); BYOD device management and encryption

▸ What Are Endpoint Security Policies and Standards?

▸ What is Endpoint Security and Why Does it Matter?

▸ How to Keep Track of Your Hardware and Software Inventory

▸ Understanding the Basics of Program Deployment

▸ Why Data Backups are Essential for Security

▸ A Beginner's Guide to Regulatory Compliance: PCI DSS, HIPAA, GDPR

3.4 Implement software and hardware updates — Windows Update and application update processes; device drivers and firmware updates; patch management strategies and best practices

▸ What Are Software and Hardware Updates in Cybersecurity?

▸ What Are Windows and Application Updates?

▸ Understanding Device Drivers and Firmware Updates

▸ Simple Patch Management Strategies for Beginners

▸ How to Automatically Update Your Software and Devices

▸ Why Regular Updates Are Essential for Cybersecurity

3.5 Interpret system logs — Using Event Viewer to interpret Windows logs; audit logs and system and application logs; syslog and centralized log management; identification of anomalies in log data

▸ What is Event Viewer and How Does it Work

▸ Understanding Audit Logs and Their Importance

▸ How to Use Syslog for Centralized Log Management

▸ Identifying Anomalies in Log Data Made Simple

3.6 Demonstrate familiarity with malware removal — Scanning systems for malware; reviewing and interpreting scan logs; malware remediation steps and best practices

▸ What is Malware and How Does it Affect Your Computer?

▸ How to Scan Your Computer for Malware: A Beginner's Guide

▸ Understanding Malware Scan Logs: What Do They Mean?

▸ Malware Removal Steps: How to Clean Your Computer Safely

▸ Best Practices for Preventing Malware: Stay Safe Online

Vulnerability Assessment and Risk Management

4.1 Explain vulnerability management

▸ What Are Security Vulnerabilities and Why They Matter

▸ How to Identify and Mitigate Security Vulnerabilities

▸ Common Types of Security Vulnerabilities Explained

▸ Comparing Different Vulnerability Types and Their Threat Levels

4.2 Use threat intelligence techniques to identify potential network vulnerabilities

▸ What Are Threat Vectors in Cybersecurity?

▸ What Are Indicators of Malicious Activity?

▸ Threat Vectors vs Attack Surfaces: Key Differences

▸ How to Analyze Network Traffic for Malicious Activity

▸ Common Attack Surfaces in Network Security

▸ Common Signs of Malware and How to Respond

▸ Comparing Host-Based and Network-Based Indicators

▸ How to Identify and Mitigate Threat Vectors

4.3 Explain risk management

▸ What is Risk Management in Cybersecurity?

▸ Why Risk Management Matters in Everyday Life

▸ How to Identify and Assess Cyber Risks

▸ Real-World Analogies for Understanding Risk Management

4.4 Explain the importance of disaster recovery and business continuity planning — Natural and human-caused disasters; features of DRP and BCP; backup strategies; disaster recovery controls (detective, preventive, corrective)

▸ What is Disaster Recovery Planning and Why is it Important?

▸ Understanding Business Continuity Planning for Beginners

▸ Backup Strategies Explained: How to Keep Your Data Safe

▸ Detective, Preventive, and Corrective Controls: What Are They?

Incident Handling

5.1 Monitor security events and know when escalation is required — Role of SIEM and SOAR in security operations; monitoring network data to identify security incidents; packet captures and log file analysis; identifying suspicious events and escalation criteria

Coming soon

5.2 Explain digital forensics and attack attribution processes

▸ What Are Indicators of Malicious Activity?

▸ How to Analyze Network Traffic for Malicious Activity

▸ Common Signs of Malware and How to Respond

▸ Comparing Host-Based and Network-Based Indicators

5.3 Explain the impact of compliance frameworks on incident handling — GDPR compliance requirements and incident reporting; HIPAA compliance and breach notification; PCI-DSS, FERPA, and FISMA frameworks; reporting and notification requirements

Coming soon

5.4 Describe the elements of cybersecurity incident response — Policy, plan, and procedure elements; NIST SP 800-61 lifecycle stages: preparation, detection and analysis, containment, eradication, recovery, and post-incident activity

Coming soon

Browse All CCST Cybersecurity Articles

Last updated 8 September 2026