Security Awareness & Training Resource Center

Boost the effectiveness of your security awareness program or earn your next certification with free tools from our resource center. Check back frequently — new resources are added every week!

Featured content

Download — HRM (Forrester) Ebook, guide & report

Deconstructing Human-Element Breaches | Infosec HRM

Human risk management isn’t just rebranded SA&T — it’s a profound change of mindset, strategy, process and technology that approaches human-related breaches in a new way. 

Read More about Download — HRM (Forrester)

Our resources

Article

5 ways to identify a spear phishing email

Spear phishing is a targeted form of email attack used to steal sensitive information through enticement, impersonation, or access-control bypassing techniqu
Read More
Article

IoT firmware analysis -- Firmwalker

IoT is the next big technology that will change the way we communicate and exchange data. Every day thousands of IoT devices are coming into the market. Most
Read More
Article

Importance of IP Fragmentation in Penetration Testing

Introduction Penetration testing is an extremely important testing aspect when we consider the optimum level of security for any system pertaining to crucial
Read More
Article

Android penetration tools walkthrough series: QARK

In this article, we are going to learn how to use the Quick Android Review Kit. QARK one of the most efficient Android static analysis tool developed by two
Read More
Article

10 most common phishing attacks

Phishing is one of the most common ways for scammers to steal information. Through social engineering or deception, fraudsters attempt to trick people into h
Read More
Article

Closing the Gender Gap: Women in Cybersecurity

March 8 was International Women's Day. A lot of folks will say, “why do we need a special day for women? Women have equality now - don’t they?” To an extent,
Read More
Article

CGEIT Domain 5: Resource Optimization [DECOMMISSIONED ARTICLE]

NOTE: This article is based on an old version of the CGEIT exam, and should not be consulted for information on the current exam. Please consult the article
Read More
Article

DoD 8570 IAM certification – Level I

What is the DoD IAM Level 1? The Department of Defense (DoD) directive 8570 provides guidance on how the DoD workforce manages and executes Information Assu
Read More
Article

The IAPP CIPP/US certification: The leading U.S. privacy credential

Privacy issues have become increasingly important for organizations in recent years. While events such as Edward Snowden’s NSA revelations in 2013 began a co
Read More
Article

NIST CyberSecurity Framework

Introduction The National Institute for Standards and Technology (NIST) is a U.S.-based organization that was tasked by the U.S. government with creating an
Read More
Article

DoD IASAE Overview

What is the DoD IASAE? The U.S. Department of Defense (DoD) IASAE covers the requirements for the Information Assurance architecture and engineering areas (
Read More
Article

CGEIT Domain 4: Risk Optimization

Introduction Risk optimization falls under the fourth domain of the ISACA’s Certified in the Governance of Enterprise IT (CGEIT) exam and constitutes 24% of
Read More
Article

Memory forensics and analysis using volatility

Volatility is one of the best open source software programs for analyzing RAM in 32 bit/64 bit systems. It supports analysis for Linux, Windows, Mac, and And
Read More
Article

Top 5 email retention policy best practices

Email retention policies are no longer just about conserving space on your Exchange server. Today you must take into account how your email retention control
Read More
Article

The Rowhammer: the Evolution of a Dangerous Attack

The Rowhammer Attack Back in 2015, security researchers at Google's Project Zero team demonstrated how to hijack an Intel-compatible PCs running Linux by exp
Read More
Article

Privilege escalation on linux with live examples

One of the most important phase during penetration testing or vulnerability assessment is privilege escalation. During that step, hackers and security resear
Read More
Article

DoD 8570 IAM certification and requirements

The U.S. Department of Defense (DoD) directive 8570, which is titled “Information Assurance Workforce Improvement Program,” outlines the expectations for tra
Read More
Article

Learning curve: Security awareness in education

In education the goal is twofold, to bestow knowledge and protect the well-being of the student body.  Unfortunately, as reports of data compromise in educat
Read More
Article

What is an XXE attack?

XXE (XML External Entity attack) is now increasingly being found and reported in major web applications such as Facebook, PayPal, etc. For instance, a quick
Read More
Article

Top six SIEM use cases

With rising trends and forms of attacks, most organizations today deploy a Security Incident and Event Management (SIEM) solution as a proactive measure for
Read More
Article

CERT-Certified Computer Security Incident Handler (CSIH)

Note: The CERT-CSIH certification is being retired on April 30, 2021. Browse current IT and security certifications. "The SEI will be retiring this CSIH cer
Read More
Article

Insider Threat: How to Protect Your Business from Your Own Employees

It's trite to write that the company's data and customer base are the main assets of any business in the 21st century. However, the attitude to these assets
Read More
Article

Threat Hunting – Zyklon Trojan

This is a lab that is conducted in a test bed. The resources were downloaded from malware.trafficanalysis.net. The samples provided came from a case study of
Read More
Article

Top 10 solutions to protect against DDoS attacks and increase security

According to statistics, 33% of businesses fall victim to DDoS attacks. It is almost impossible to predict such attacks. Some of them can be powerful and rea
Read More