ICSP CS study plan

Define each of the core risk terms (asset, threat, vulnerability, likelihood, impact, risk appetite, residual risk) in your own words and map how they chain together in a single risk scenario.

Classify a set of 15 controls as administrative, technical, or physical, and as preventive, detective, or corrective, then justify three placements that were ambiguous.

Compare qualitative, semi-quantitative, and quantitative risk analysis and state one decision context where each is the defensible choice.

Compute single loss expectancy, annualized loss expectancy, and annualized rate of occurrence for two sample asset scenarios and interpret which one warrants mitigation first.

List the main security governance artifacts (policy, standard, procedure, guideline, baselines) and explain who approves each and why the hierarchy matters.

Distinguish business continuity, disaster recovery, and incident response planning, and place recovery point objective and recovery time objective correctly within them.

Sequence the steps of a business impact analysis and identify which outputs feed the continuity strategy versus the risk register.

Evaluate third-party and supply-chain risk by writing the due-diligence questions you would ask a SaaS vendor holding regulated data.

Summarize the purpose and scope differences of common frameworks and legal drivers (ISO 27001-style ISMS, NIST risk management guidance, GDPR-style privacy obligations, SOX-style financial controls) without conflating them.

Explain how security metrics and key risk indicators get reported to executive leadership and the board, and what makes a metric decision-useful rather than vanity.

Compare discretionary, mandatory, role-based, and attribute-based access control on flexibility, administrative overhead, and best-fit scenarios.

Walk through each phase of the identity lifecycle (provisioning, review, transfer, deprovisioning) and name the control that catches failures at each phase.

Differentiate authentication factors by category and explain why multi-factor authentication resists phishing, replay, and credential stuffing differently.

Explain federation, single sign-on, SAML assertions, and OAuth-style delegated authorization, and state which problem each actually solves.

Identify access control attack patterns (privilege escalation, credential stuffing, session hijacking, Kerberos ticket abuse) and the detective control that would surface each.

Map symmetric and asymmetric algorithms to the security services they provide and state explicitly which ones provide confidentiality versus integrity versus key exchange.

Explain hashing, salting, key stretching, and message authentication codes, and describe why a plain hash fails as a password store.

Describe public key infrastructure end to end: certificate signing request, certificate authority validation, chain of trust, revocation via CRL and OCSP, and pinning trade-offs.

Distinguish encryption in transit, at rest, and in use, and select appropriate controls for each state in a cloud data flow.

Identify cryptographic failure modes including weak modes, reused nonces, insufficient key length, and poor random number generation, and describe how each is detected in review.

Place the OSI and TCP/IP layer models side by side and attribute at least two attacks and two countermeasures to each layer.

Explain network segmentation, virtual LANs, and microsegmentation, and justify where a demilitarized zone still earns its place.

Compare stateful inspection, application-layer firewalls, and intrusion prevention systems on what they can and cannot see.

Describe the security architecture of TLS, IPsec, and a site-to-site VPN, noting where each terminates and what it does not protect.

Evaluate secure design principles (least privilege, defense in depth, fail-safe defaults, separation of duties, least common mechanism) against a reference architecture you sketch yourself.

Distinguish trusted computing base, security perimeter, and reference monitor, and explain how each shapes evaluation of a system.

Compare virtualization, container, and serverless isolation models and identify the shared-responsibility split for each.

Differentiate vulnerability scanning, penetration testing, and red teaming by objective, scope, authorization, and reporting audience.

Design a test plan that covers network, application, and social engineering assessment types with sampling rationale and rules of engagement.

Explain coverage metrics and false positive/negative trade-offs, and state how you would validate that a scanner finding is real before escalation.

Sequence the incident response lifecycle and write the first three actions for a confirmed ransomware detonation on a file server.

Distinguish log sources (endpoint, network, identity, application) and state what each detects that the others miss.

Explain change management and configuration baselines, and describe how an unapproved change becomes a security incident.

Compare backup types and strategies, and state how to test restore integrity rather than assuming it.

Describe disaster recovery site types and the trade-offs in cost, readiness, and data loss between them.

Map secure development lifecycle activities (threat modeling, secure coding standards, code review, security testing in CI, release gating) to the phase where each belongs.

Explain the most common injection and broken-access-control classes at the code level and name the specific defensive pattern for each.

Classify data by sensitivity and map each class to handling, retention, and destruction requirements.

Describe data remanence and select the appropriate sanitization method for magnetic disk, solid-state storage, and cloud-hosted volumes.

Consolidate weak areas from prior weeks into a targeted review list and confirm each gap is closed by a practice question set or written explain-back.