ECF Cybersecurity (Core) study plan
ECF Cybersecurity (Core) · Give each week a clear focus.
8 weeks · About 7 hours per week
Security Fundamentals and Risk Management
Define confidentiality, integrity, and availability and classify ten real incidents or controls by the element each one protects
Distinguish threats, vulnerabilities, and risks, then write one sentence per term showing how they differ in a given scenario
Build a qualitative 5x5 likelihood-by-impact risk matrix and plot eight sample risks onto it
Explain the four risk treatment options (avoid, mitigate, transfer, accept) and assign one to each plotted risk with a one-line justification
Describe how a business impact analysis feeds recovery time and recovery point objectives for two critical systems
Your checkpoint
A one-page risk register with at least eight risks, each scored on the 5x5 matrix, assigned a treatment option, and mapped to a CIA element
Security Fundamentals and Risk Management & Governance, Compliance and Privacy
Compare control categories (preventive, detective, corrective, compensating) and tag every entry in your risk register with a category and control type (technical, administrative, physical)
Summarize the purpose of common frameworks and standards such as ISO 27001, NIST CSF, and SOC 2 without claiming any certification
Map five of your risk-register entries to NIST CSF functions (Identify, Protect, Detect, Respond, Recover)
Draft a data classification scheme with three tiers and write handling rules for each tier
Explain how privacy principles such as data minimization and purpose limitation constrain collection of personal data
Your checkpoint
A control mapping table linking each of your eight risks to a control category, a control type, and a NIST CSF function, plus a three-tier data classification policy of 300 words
Network Security
Diagram the OSI and TCP/IP layers and place six common attacks at the layer where each one operates
Explain how TCP handshakes, ports, and stateful inspection enable segmentation and firewall rule design
Describe how TLS establishes a session and identify where interception and downgrade attacks target it
Compare network segmentation approaches (VLANs, subnets, zero-trust microsegmentation) and recommend one for a flat small-office network
Explain the function of IDS versus IPS and where each is deployed relative to a firewall
Your checkpoint
A labeled network diagram of a small office with segmented zones, firewall placement, IDS/IPS placement, and at least six attacks annotated at their OSI layer
Network Security & Threat Intelligence and Vulnerability Management
Describe how vulnerability scanning differs from penetration testing and when each is appropriate
Interpret a sample CVSS vector string and explain what each metric group contributes to the base score
Explain how CVE identifiers, CWE weakness categories, and CISA KEV listings differ in purpose
Outline a vulnerability management lifecycle from asset inventory through remediation and verification
Prioritize five hypothetical findings using severity, exploitability, asset criticality, and known exploitation status
Your checkpoint
A vulnerability triage worksheet ranking five sample findings with CVSS base scores, exploitability notes, and a remediation deadline for each
Identity and Access Management
Compare authentication factors (knowledge, possession, inherence) and classify eight real authentication methods by factor
Explain how multi-factor authentication resists credential theft and identify two common MFA bypass techniques
Describe the difference between authentication and authorization and where each fits in an access-control decision
Compare role-based, attribute-based, and discretionary access control and select one for a given organizational scenario with justification
Explain least privilege, separation of duties, and privileged access management in operational terms
Your checkpoint
An access-control design for a fictional 50-person company covering authentication methods, MFA enrollment, an RBAC role matrix with at least five roles, and a privileged-access procedure
Endpoint and System Security & Cryptography and Data Protection
Describe endpoint hardening baselines including patch cadence, application allowlisting, and disabling unneeded services
Explain how EDR differs from traditional antivirus in detection and response capability
Distinguish symmetric from asymmetric encryption and identify an appropriate use case for each
Explain how hashing supports integrity verification and why salting matters for password storage
Describe how key management, rotation, and storage protect cryptographic material, and explain why encryption at rest and in transit are both required
Your checkpoint
A two-part document: an endpoint hardening checklist with at least ten concrete settings, and a data-protection matrix mapping four data types to encryption method, key management approach, and hashing or integrity control
Security Operations and Incident Response
Distinguish events, alerts, and incidents and classify ten sample observations accordingly
Order the incident response lifecycle phases and state the objective and key output of each
Explain the purpose of an incident response plan, playbook, and communication tree, and identify who declares an incident
Describe containment strategies (isolation, account disablement, blocklisting) and the tradeoff between speed and evidence preservation
Outline evidence handling steps that preserve integrity, including chain of custody and hashing of collected artifacts
Your checkpoint
An incident response playbook for one scenario (for example, ransomware on a file server) covering detection, triage, containment, eradication, recovery, and a post-incident review template
Security Operations and Incident Response & Threat Intelligence and Vulnerability Management & Governance, Compliance and Privacy
Explain the difference between tactical, operational, and strategic threat intelligence and match each to a consumer
Describe indicators of compromise and explain why context and timeliness affect their value
Summarize how log collection, centralization, and retention support detection and investigation
Explain how legal, regulatory, and contractual obligations shape incident notification timelines and evidence retention
Integrate prior weeks by tracing one simulated attack from initial access through detection, response, and lessons learned
Your checkpoint
An end-to-end attack-and-response walkthrough of 800 words that cites at least one threat-intelligence source type, one log source, one control from each earlier domain, and the notification obligations triggered
Milestones
Week 2: Risk register complete with eight scored risks, each mapped to a control category and NIST CSF function, and the data classification policy drafted
Week 4: Score at least 80 percent on a 30-question self-made quiz covering domains 1, 2, and 8, and correctly interpret three CVSS vectors without reference
Week 6: Access-control design and endpoint/cryptography deliverables complete, with a self-explanation of MFA bypass and salting written from memory
Week 8: Incident response playbook and end-to-end walkthrough finished, and a full 100-question timed practice set reviewed with every missed item re-taught in writing