Certified Cybersecurity Operations Analyst (CCOA) Training

Domain 1: Technology Essentials

• Identify the key components of both computer and cloud networking.
• Understand how databases, virtualization, and containerization are leveraged.
• Become familiar with command line interfaces.
• Identify the purpose, benefits, and use of APIs.
• Understand the principles and concepts of DevOps, SecDevOps, and the CI/CD pipeline.
• Fundamentally understand programming and scripting.

Domain 2: Cybersecurity Principles 

• Understand cybersecurity governance and alignment with business drivers.
• Define cybersecurity strategy based on enterprise objectives.
• Establish effective cross-organizational communication for cybersecurity.
• Define roles and responsibilities for cybersecurity initiatives.
• Develop metrics for evaluating cybersecurity program performance.
• Inform stakeholders about investment needs for asset protection.
• Implement repeatable processes for cybersecurity risk management.
• Recognize internal and external compliance requirements.
• Document risk associated with enterprise operations.

Domain 3: Adversarial Tactics, Techniques, and Procedures

• Understand common adversarial tactics, techniques, and procedures (TTPs).
• Develop critical and creative thinking skills for threat detection and response.
• Differentiate between dashboard events and attacker mindset insights.
• Tune baseline detections for malicious and anomalous behaviors.
• Implement time-optimized reactive detection capabilities.
• Engage in proactive threat-hunting activities.
• Explore the threat landscape, including attack vectors and threat actors.
• Identify motivations behind cyberattacks.
• Utilize threat intelligence sources effectively.
• Recognize various attack types and cyberattack stages.
• Analyze exploit techniques used by threat actors.
• Understand the significance of security testing in cybersecurity.

Domain 4: Incident Detection and Response

• Understand the inevitability of cybersecurity incidents and the importance of incident preparedness.
• Recognize the significance of incident detection and response in mitigating the impact of cybersecurity events.
• Appreciate the role of proactive planning, practice, and process refinement in effective incident response.
• Identify the components and techniques involved in incident detection, from data analytics to security logs and alerts.
• Learn to develop detection use cases and recognize indicators of compromise for early threat identification.
• Explore the various security monitoring tools and technologies essential for effective incident detection.
• Master the fundamentals of incident response, including containment strategies and handling procedures.
• Gain proficiency in forensic analysis, malware analysis, network traffic analysis, packet analysis, and threat analysis for comprehensive incident response.
• Explore the various security monitoring tools and technologies essential for effective incident detection.
• Master the fundamentals of incident response, including containment strategies and handling procedures.
• Gain proficiency in forensic analysis, malware analysis, network traffic analysis, packet analysis, and threat analysis for comprehensive incident response.

Domain 5: Securing Assets

• Understand the importance of designing countermeasures to protect digital assets.
• Recognize the iterative nature of securing systems and their ecosystems.
• Appreciate the holistic approach to securing assets, considering technical aspects and organizational products, services, and critical business processes.
• Differentiate between the security needs of various industries based on the unique values assigned to digital assets and risk tolerance levels.
• Gain insight into how an organization’s business goals and risk assessments influence the selection of security controls.
• Develop foundational knowledge of contingency planning to ensure business continuity during security incidents.
• Explore different control techniques applicable to securing digital assets.
• Understand the principles and practices of identity and access management to ensure proper authorization and authentication.
• Become familiar with industry best practices, guidance, frameworks, and standards relevant to asset security.
• Master the processes of vulnerability assessment, identification, remediation, and tracking to effectively manage vulnerabilities and mitigate risk.