GIAC Security Essentials (GSEC) Exam Guide

1. Defense in depth: understand what defense in depth is, identify the key areas of security, and demonstrate the different strategies for implementing effective security within an organization
2. Access control & password management: understand the fundamental theory of access control and the role of passwords in access control management
3. Security frameworks and CIS controls: understand the purpose, implementation, and background of the CIS Critical Controls, NIST Cybersecurity Framework, and the MITRE ATT&CK knowledge base

Example scenario: A small firm relies on one perimeter firewall. Which extra layers would you add first, and which CIS Controls would you use to justify them?

1. Defensible network architecture: demonstrate how to architect a network to be monitored and controlled to resist intrusion
2. Networking & protocols: understand the properties and functions of network protocols and network protocol stacks
3. Network security devices: understand the function and uses of network security devices, such as firewalls, NIDS, and NIPS
4. Wireless network security: understand the configuration and risks of wireless networks and how to secure them

Example scenario: A capture shows many connection attempts that never complete the TCP handshake. What would you check to tell a scan from a network fault?

1. Web communication security: understand web application security and common vulnerabilities including cookies, SSL, and access control
2. Virtualization, cloud security, and AI essentials: understand the concepts of virtualization, cloud architectures, and AI fundamentals
3. Endpoint security: understand the function and uses of endpoint security devices, such as endpoint firewalls, HIDS, and HIPS
4. Container and MacOS security: understand how to secure containers and the security features provided in MacOS

Example scenario: A developer stores a session token in a cookie without the Secure flag. What risk does that create on public Wi-Fi?

1. Incident handling & response: understand the concepts and processes associated with incident handling
2. Log management & SIEM: understand logging importance, configuration, and SIEM assisted analysis
3. Data loss prevention and mobile device security: understand the risks and impacts of data loss, how to prevent it, and the security considerations of mobile devices
4. Vulnerability scanning and penetration testing: understand the concepts and relationship behind reconnaissance, resource protection, risks, threats, and vulnerabilities including the creation of network maps and penetration testing techniques

Example scenario: A SIEM alert shows a service account logging in to many hosts in a few minutes. What would you collect before containing it?

1. Malicious code & exploit mitigation: understand important attack methods and basic defensive strategies to mitigate malicious software threats and exploitations
2. Cryptography: understand the concepts of cryptography, including the major types of cryptosystems, the mathematical concepts that contribute to cryptography, and commonly used symmetric, asymmetric, and hashing cryptosystems
3. Cryptography application: understand the use, functionality, and operation of VPNs, GPG, and PKI

Example scenario: A partner needs to confirm a file came from you and was not changed. Which cryptographic tools would you combine?

1. Linux fundamentals: understand the Linux operating system structure, vulnerabilities, and permissions
2. Linux security and hardening: understand how to gain visibility into a Linux system to be able to secure, audit, and harden the system

Example scenario: A web server's upload directory is world-writable. Which permissions would you change, and how would you check for misuse?

1. Windows security infrastructure: identify the differences between types of Windows OSes and how Windows manages groups and accounts, locally and with Active Directory and Group Policy
2. Windows access controls: understand how permissions are applied in the Windows NT File System, Shared Folders, Printers, Registry Keys, and Active Directory, and how Privileges are applied
3. Enforcing Windows security policy: understand the features of Group Policy and working with INF security templates

Example scenario: A user can read a shared folder they should not see. Where would you check share and NTFS permissions?

1. Windows as a service: understand how to manage updates for a network of Windows hosts
2. Windows automation, auditing, and forensics: understand the techniques and technologies used to audit Windows hosts and simple PowerShell scripting
3. Windows services and Microsoft cloud: understand how to take basic measures in securing Windows network services such as IPsec, IIS, and Remote Desktop Services and Microsoft Azure security features

Example scenario: You need a list of local administrators on 200 servers. How would you collect it with PowerShell?