Ethical hackers perform security vulnerability assessments and penetration tests in accordance with industry-accepted methods and protocols. They analyse systems for potential vulnerabilities that may result from improper system configuration, hardware or software flaws, or operational weaknesses.
No competences in this bucket.
Paths or methods that threat actors use to exploit vulnerabilities in information networks or systems from a concrete organisation and impact its availability, integrity and confidentiality. Attack vectors may include social engineering tactics such as phishing mails or pretexting, technical exploits as SQL injection as well as buffer overflow attacks.
Computer-based control systems that monitor mechanical and electrical equipment in a building such as HVAC, security and lighting systems.
The process of examining and recovering digital data from sources for legal evidence and crime investigation.
Methods, technologies and techniques used to defend (detect, monitor and recover) against cyber attacks. These cyber attacks include several attack vectors such as malware, denial of service (DoS) attacks and phishing. Intrusion prevention systems (IPS), firewall, antivirus, intrusion detection systems (IDS), cybersecurity training, backup, Information Security Management System (ISM), multi-factor authentication and employ awareness, are some examples of the methods used.
The methods and best practices that protect ICT systems, networks, computers, devices, services, processes and people against unauthorised access, modification and/or denial of service of assets.
The set of actions that are carried out to detect vulnerabilities within a computerised system in order to improve security within an organisation. They aim to identify and address data breaches and threats in a network.
The system, network, hardware and software applications and components, as well as devices and processes that are used in order to develop, test, deliver, monitor, control or support ICT services.
The security risk factors, such as hardware and software components, devices, interfaces and policies in ICT networks, risk assessment techniques that can be applied to assess the severity and the consequences of security threats and contingency plans for each security risk factor.
Best practices and guidelines established for securing information and communication technology (ICT) systems and data. Standards as is the case of ISO 27000 series, provide a framework for implementing effective security controls, including access control, risk assessment and incident management, as well as to provide compliance of anorganisation.
The principles of integrating ICT components and products from a number of sources to create an operational ICT system, techniques which ensure interoperability and interfaces between components and the system.
The plan defined by a company which sets the information security objectives and measures to mitigate risks, define control objectives, establish metrics and benchmarks while complying with legal, internal and contractual requirements.
The features, restrictions, architectures and other characteristics of operating systems such Linux, Windows, MacOS, etc.
The specialised ICT tools which test security weaknesses of the system for potentially unauthorised access to system information such as Metasploit, Burp suite and Webinspect.
The deviations of what is standard and exceptional events during software system performance, identification of incidents that can alter the flow and the process of system execution.
The specialised software to execute or control tests and compare predicted testing outputs with actual testing results such as Selenium, QTP and LoadRunner
The attacks, vectors, emergent threats on websites, web applications and web services, the rankings of their severity identified by dedicated communities such as OWASP.
The techniques and principles of software development, such as analysis, algorithms, coding, testing and compiling of programming paradigms (e.g. object oriented programming, functional programming) and of programming languages.
The philosophical study that deals with solving questions of human morality; it defines and systemises concepts such as right, wrong, and crime.
The international regulations related to the development and use of ICT products.
Interdisciplinary field of study that focuses on the realisation of secure systems and the technology to protect individuals or information from malice, errors, or unauthorized access. It involves defining security protection requirements, processes, and methods to ensure the resilience of systems and data.
No competences in this bucket.
Examine and review systematically computer source code to identify errors in any stage of development and to improve the overall software quality.
Create and test software exploits in a controlled environment to uncover and check system bugs or vulnerabilities.
Organise and execute audits in order to evaluate ICT systems, compliance of components of systems, information processing systems and information security. Identify and collect potential critical issues and recommend solutions based on required standards and solutions.
Perform simulated social engineering attacks to identify vulnerabilities in an organization's security posture. Social engineering tests may involve phishing emails, pretexting, or other forms of manipulation used by attackers to obtain sensitive information or unauthorized access to systems.
Perform tests to ensure that a software product will perform flawlessly under the specified customer requirements and identify software defects (bugs) and malfunctions, using specialised software tools and testing techniques.
Apply methods and techniques to identify potential security threats, security breaches and risk factors using ICT tools for surveying ICT systems, analysing risks, vulnerabilities and threats and evaluating contingency plans.
Analyse the system and network architecture, hardware and software components and data in order to identify weaknesses and vulnerability to intrusions or attacks. Execute diagnostic operations on cyber infrastructure including research, identification, interpretation and categorization of vulnerabilities, associated attacks and malicious code (e.g. malware forensics and malicious network activity). Compare indicators or observables with requirements and review logs to identify evidence of past intrusions.
Develop and implement procedures for identifying, assessing, treating and mitigating ICT risks, such as hacks or data leaks, according to the company's risk strategy, procedures and policies. Analyse and manage security risks and incidents. Recommend measures to improve digital security strategy.
Analyse the critical assets of a company and identify weaknesses and vulnerabilities that lead to intrusion or attack. Apply security detection techniques. Understand cyber attack techniques and implement effective countermeasures.
Measure system reliability and performance before, during and after component integration and during system operation and maintenance. Select and use performance monitoring tools and techniques, such as special software.
Execute types of security testing, such as network penetration testing, wireless testing, code reviews, wireless and/or firewall assessments in accordance with industry-accepted methods and protocols to identify and analyse potential vulnerabilities.
Utilise specialised ICT tools to create computer code that is interpreted by the corresponding run-time environments in order to extend applications and automate common computer operations. Use programming languages which support this method such as Unix Shell scripts, JavaScript, Python and Ruby.
Identify the strengths and weaknesses of various abstract, rational concepts, such as issues, opinions, and approaches related to a specific problematic situation in order to formulate solutions and alternative methods of tackling the situation.
Study the external and internal environment of an organisation by identifying its strengths and weaknesses in order to provide a base for company strategies and further planning.
Facilitate communication between organisations and interested third parties such as suppliers, distributors, shareholders and other stakeholders in order to inform them of the organisation and its objectives.
Use a variety of processes that result in mutually negotiated agreements, shared understandings and consensus building. Build partnerships within the work context.
No competences in this bucket.
No competences in this bucket.
No competences in this bucket.
No competences in this bucket.
The computer program Aircrack is a cracking program which recovers 802.11 WEP and WPA-PSK keys by making several network attacks such as FMS, KoreK and PTW attacks.
The software BackBox is a Linux distribution which tests security weaknesses of the system for potentially unauthorised access to system information by information gathering, forensic, wireless and VoIP analysis, exploitation and reverse engineering.
The BlackArch Linux distribution is a penetration testing tool which tests security weaknesses of the system for potentially unauthorised access to system information.
The software tool Cain and Abel is a password recovery tool which tests the Microsoft Operating System for security weaknesses and potentially unauthorised access to system information. The tool decodes, decrypts and uncovers passwords by means such as brute-force and cryptanalysis attacks, network sniffing and protocols analysis.
The hybrid model consists of principles and fundamentals of service-oriented modelling for business and software systems that allow the design and specification of service-oriented business systems within a variety of architectural styles, such as enterprise architecture.
The conversion of electronic data into a format which is readable only by authorized parties which use key encryption techniques, such as Public Key Infrastructure (PKI) and Secure Socket Layer (SSL).
The set of legislative rules that safeguards information technology, ICT networks and computer systems and legal consequences which result from their misuse. Regulated measures include firewalls, intrusion detection, anti-virus software and encryption.
The mechanisms and regulations which allow for selective access control and guarantee that only authorised parties (people, processes, systems and devices) have access to data, the way to comply with confidential information and the risks of non-compliance.
The principles, regulations, norms and programs that shape the evolution and use of internet, such as internet domain names management, registries and registrars, according to ICANN/IANA regulations and recommendations, IP addresses and names, name servers, DNS, TLDs and aspects of IDNs and DNSSEC.
The general principles, categories, requirements, limitations and vulnerabilities of smart connected devices (most of them with intended internet connectivity).
The tool John the Ripper is a password recovery tool which tests security weaknesses of the systems for potentially unauthorised access to system information. The key features of this tool are the strength-checking code and password hash code.
The Kali Linux tool is a penetration testing tool which tests security weaknesses of the systems for potentially unauthorised access to system information by information gathering, vulnerability analysis and wireless and passwords attacks.
The levels of testing in the software development process, such as unit testing, integration testing, system testing and acceptance testing.
The platform Maltego is a forensic application that uses data mining to deliver on overview of organisations' environment, testing security weaknesses of the system for potentially unauthorised access and demonstrates the complexity of infrastructure failures.
The framework Metasploit is a penetration testing tool which tests security weaknesses of the system for potentially unauthorised access to system information. The tool is based on the concept of 'exploit' which implies executing code on the target machine this way taking advantage of the bugs and vulnerabilities of the target machine.
The computer program Nessus is a specialised ICT tool which tests security weaknesses of the system for potentially unauthorised access to system information, developed by the software company Tenable Network Security.
The computer program Nexpose is a specialised ICT tool which tests security weaknesses of the system for potentially unauthorised access to system information, developed by the software company Rapid7.
The open source model consists of principles and fundamentals of service-oriented modelling for business and software systems that allow the design and specification of service-oriented business systems within a variety of architectural styles, such as enterprise architecture.
The strategies, methods and techniques that increase the organisation's capacity to protect and sustain the services and operations that fulfil the organisational mission and create lasting values by effectively addressing the combined issues of security, preparedness, risk and disaster recovery.
The outsourcing model consists of principles and fundamentals of service-oriented modelling for business and software systems that allow the design and specification of service-oriented business systems within a variety of architectural styles, such as enterprise architecture.
The integrated testing tool OWASP Zed Attack Proxy (ZAP) is a specialised tool which tests web applications security weaknesses, replying on an automated scanner and a REST API.
The operating system Parrot Security is a Linux distribution which performs penetration cloud testing, analysing security weaknesses for potentially unauthorised access.
The proxy tools which act as an intermediary for requests from users searching for resources e.g. files and web pages from other servers such as Burp, WebScarab, Charles or Fiddler.
The linux environment Samurai Web Testing Framework is a specialised penetration testing tool which tests security weaknesses of websites for potentially unauthorised access.
The principles and fundamentals of service-oriented modelling for business and software systems that allow the design and specification of service-oriented business systems within a variety of architectural styles, such as enterprise architecture and application architecture.
The computer program WhiteHat Sentinel is a specialised ICT tool which tests security weaknesses of the system for potentially unauthorised access to system information, developed by the software company WhiteHat Security.
The Wireshark tool is a penetration testing tool which evaluates security weaknesses, analysing network protocols through deep protocol inspection, live capture, display filters, offline analysis, VoIP analysis, protocol decryption.
No competences in this bucket.
No competences in this bucket.
Design and execute a written set of rules and policies that have the aim of securing an organisation concerning constraints on behaviour between stakeholders, protective mechanical constraints and data-access constraints.
Download, install and update a network security system designed to prevent unauthorized access to a private network.
Implement statements, assertions or rules that specify the appropriate use and protection of the ICT assets and systems from an organisation. These ICT security policies cover topics such as data classification, password management, access control and incident response.
Diagnose and eliminate hardware faults via repair or replacement. Take preventive measures, review performance, update software, review accessibility.
Create and manage cloud data retention. Identify and implement data protection, encryption, and capacity planning needs.
Guide application and fulfilment of relevant industry standards, best practices and legal requirements for information security.
Design, develop and deliver educational activities (such as lectures and cyber ranges) to cover needs and/or raise awareness on cybersecurity.
Manage and plan various resources, such as human resources, budget, deadline, results, and quality necessary for a specific project, and monitor the project's progress in order to achieve a specific goal within a set time and budget.
Carry out actions to remove computer viruses or other types of malware from a computer.
Identify potential component malfunctions. Monitor, document and communicate about incidents. Deploy appropriate resources with minimal outage and deploy appropriate diagnostic tools.