AP® Cybersecurity Course Outline

Red flags in emails, texts, calls and social posts.

Authority, urgency, scarcity and other pressure tactics.

Lost money, stolen accounts and exposed personal data.

Unexpected logins, lockouts and security alerts.

Reused, guessable and leaked passwords.

Passphrases, password managers and MFA.

Script kiddies, hacktivists, insiders, criminal groups and cyberterrorists.

Evil twins, on-path attacks and rogue hotspots.

HTTPS, VPNs and safer connection habits.

Deepfakes, voice clones and AI-written phishing.

Verification habits and safeguards that still work.

Protecting networks, applications and data.

Spotting threats sooner, with a human checking the output.

Phishing, pretexting, impersonation and more.

Motives, resources and skill levels.

From reconnaissance to evading detection.

Assets, threats, vulnerabilities, likelihood and severity.

Avoid, transfer, mitigate or accept.

Physical, technical and managerial; preventive, detective and corrective.

Why layered security protects an organization best.

Tailgating, piggybacking, theft and tampering.

Exploiting doors, devices and unsecured areas.

Risk ratings and the risk register.

Policies, visitor procedures and training.

Locks, badges, vestibules, guards and barriers.

Cameras, sensors, alarms and access logs.

Coverage, blind spots and false alarms.

Reading badge and door logs for evidence.

On-path, ARP and DNS poisoning, MAC flooding, DoS and DDoS.

Stealing, disrupting or destroying communication.

Rating and recording network vulnerabilities.

Policies, agreements and audits.

Encryption, authentication and router settings.

Subnets, VLANs and screened subnets (DMZs).

Containing attacks and limiting access.

Stateless, stateful and next-generation.

Rule order, first match and implicit deny.

Perimeter, internal and screened-subnet placement.

Writing and fixing rules to control traffic.

IDS, IPS and SIEM.

Finding anomalies and responding faster.

Signature-based vs. anomaly-based detection.

Speed, accuracy and false positives.

Indicators in firewall, IDS and network logs.

Servers, personal, mobile and embedded/IoT devices.

Viruses, worms, trojans, ransomware, rootkits, fileless malware and more.

Unpatched software, open ports and weak authentication.

Rating risk by how critical a device is.

Hash properties and why passwords are salted.

Spraying, credential stuffing, brute force and rainbow tables.

Knowledge, possession, biometric and location factors.

Complexity, length, age, history and lockout.

Acceptable use, password and software installation policies.

Signature scanning, quarantine and its limits.

Closing known vulnerabilities on time.

Allow and deny rules on the device itself.

Host-, file- and behavior-based IoCs.

Performance, cost and criticality.

Speed, attack phase and false positives.

Failed-login patterns and what logs can't show.

Unencrypted files, excess privileges and weak access controls.

SQL injection, XSS, buffer overflows and directory traversal.

Rating risk by data sensitivity.

At rest, in transit and in use; regulated data types.

Approved algorithms, keys and assessment rules.

RBAC, rule-based, DAC, MAC and least privilege.

Read, write and execute for owner, group and others.

Keys, keyspace, symmetric vs. asymmetric, block vs. stream.

How AES protects stored data.

Key pairs and encrypting for a recipient.

Keyspace, brute force and the speed trade-off.

RSA, ECC and the tools that apply them.

Building security in from the start.

Stopping injection, XSS and traversal attacks.

Activity monitoring, decoy files and hash checks.

Cost, sensitivity and regulatory needs.

Speed, real-time vs. after the fact, and blind spots.

Generating and comparing file digests.

Signs of injection, XSS, overflows and traversal.