ICYB study plan
ICYB · Give each week a clear focus.
8 weeks · About 7 hours per week
Cybersecurity Fundamentals and Threat Landscape
Define the CIA triad, non-repudiation, and defense-in-depth, and give one concrete failure example for each
Classify at least 12 threat actor types and attack motivations (insider, organized crime, nation-state, hacktivist, script kiddie) by capability and typical target
Map the kill chain and MITRE ATT&CK tactics to a written walkthrough of a ransomware intrusion from initial access to impact
Explain common malware families (ransomware, trojan, rootkit, worm, fileless) and the control that best detects each
Your checkpoint
A one-page threat landscape cheat sheet covering actor types, kill-chain stages, and malware categories, self-quizzed to 90% recall
Cybersecurity Fundamentals and Threat Landscape & Network Security and Perimeter Defense
Describe the OSI and TCP/IP layers and name the attacks that target each layer
Compare network-based threats: spoofing, ARP poisoning, MITM, DNS cache poisoning, DDoS, and VLAN hopping
Configure and explain the role of firewalls, IDS/IPS, and proxy placement in a segmented network
Distinguish stateful inspection, application-layer filtering, and zero-trust microsegmentation
Your checkpoint
A labeled network diagram with at least six security devices placed, each annotated with the threat it mitigates
Network Security and Perimeter Defense
Explain how IPsec, TLS, and VPN tunnels differ and where each is deployed
Compare WPA2/WPA3, 802.1X, and NAC for wired and wireless access control
Identify common misconfigurations in VPN, wireless, and remote-access setups and the compensating controls
Trace a packet through a DMZ from internet client to internal service, naming each control it crosses
Your checkpoint
A 10-question self-written quiz on perimeter controls with an answer key and a short rationale for each answer
Identity, Access, and Authentication & Endpoint and System Security
Differentiate authentication, authorization, and accounting, and place MFA, SSO, and federation (SAML, OIDC) in a login flow
Compare password, certificate, biometric, and token factors and state the weakness of each
Explain least privilege, RBAC vs ABAC, and privileged access management for admin accounts
Describe endpoint hardening baselines, patch management, EDR, and application allowlisting
Your checkpoint
A written identity and endpoint control matrix mapping each control to the attack it stops, reviewed against the week's notes
Data Protection, Privacy, and Cryptography & Endpoint and System Security
Distinguish symmetric, asymmetric, and hashing algorithms and match each to a use case (bulk encryption, key exchange, integrity, signatures)
Explain PKI: certificate lifecycle, chain of trust, CRL vs OCSP, and common certificate failures
Apply data classification, retention, and privacy principles (data minimization, purpose limitation) to a sample dataset
Select appropriate controls for data at rest, in transit, and in use, including tokenization and DLP
Your checkpoint
A cryptographic decision table covering at least eight scenarios with the recommended primitive, key size class, and rationale
Security Operations, Monitoring, and Incident Response
Describe log sources (endpoint, network, identity, cloud) and what each reveals during an investigation
Explain SIEM correlation, alert triage, and the difference between an event, an alert, and an incident
Walk through the incident response lifecycle and assign actions to each phase for a phishing-led breach
Outline forensic preservation steps: chain of custody, volatile data order, and evidence integrity
Your checkpoint
An incident response runbook for a suspected credential compromise, with detection, containment, eradication, and recovery steps
Risk Management, Governance, and Compliance & Secure Architecture, Development, and Cloud
Distinguish qualitative and quantitative risk assessment and compute a simple risk score from likelihood and impact
Compare risk treatment options (mitigate, transfer, avoid, accept) and match each to a scenario
Identify the purpose of common frameworks and regulations (ISO 27001, NIST CSF, GDPR, PCI DSS) without conflating them
Explain secure SDLC practices, threat modeling, and shared responsibility in cloud models (IaaS, PaaS, SaaS)
Your checkpoint
A risk register with five realistic entries, each with owner, score, treatment, and residual risk
Cybersecurity Fundamentals and Threat Landscape & Security Operations, Monitoring, and Incident Response & Risk Management, Governance, and Compliance
Re-test weak domains using missed practice questions and log every error with its root cause
Complete two timed mixed-domain practice sets and review all misses
Summarize each domain's key controls on a single review sheet from memory, then correct gaps
Confirm exam-day logistics and build a timing strategy for the question format
Your checkpoint
A final review sheet plus an error log showing at least 85% accuracy on the last mixed practice set
Milestones
Week 2: Explain the kill chain and place six network defenses on a diagram without notes
Week 4: Score at least 80% on a self-made 20-question quiz covering domains 1-4
Week 6: Walk through a full incident from alert to recovery, naming the control and evidence at each phase
Week 8: Achieve at least 85% on a timed mixed-domain practice set and clear the error log