ISC2 Certified in Cybersecurity Certification Study Notes
(Optimized to be applicable to Comptia Security+)
Domain 1: Security Principles
Security Principles and Key Concepts
CIA Triad:
●
●
●
●
●
●
●
●
●
●
Confidentiality
Definition: Restricts data access solely to authorized users, protecting against improper
disclosure.
Importance: Essential when dealing with sensitive information like Personally Identifiable
Information and Protected Health Information.
Challenges:
○ Balancing user access with protection measures.
○ Risks when users access systems from compromised devices.
Implementation:
○ Authentication:
■ Single-Factor Authentication: Relies on one factor, such as a password.
■ Multi-Factor Authentication: Combines multiple factors, like tokens and
biometrics.
○ Data Sensitivity: Assigning sensitivity levels to information based on potential harm if
disclosed.
○ Non-Repudiation: Ensures actions cannot be denied after execution, often using digital
signatures.
Integrity
Definition: Ensures that data remains accurate, consistent, and unaltered by unauthorized
modifications.
Types:
○ Data Integrity: Protects data within systems from unauthorized changes or corruption.
○ System Integrity: Maintains system functionality and configuration according to an
expected baseline.
Implementation:
○ Baseline Security Standards: Establish minimum security configurations for systems.
○ Separation of Privilege: Users should not have overlapping permissions that could lead
to excessive privilege.
Availability
Definition: Guarantees access to data and systems when needed.
Importance: Critical systems have higher availability requirements.
Implementation:
○ Redundancy: Multiple systems or components to prevent single points of failure.
○ Load Balancing: Distributes workloads to prevent system overloads.
○
Disaster Recovery Plans: Strategies to restore systems after disruptions.
Adequate Security
●
●
Definition: Measures aligned with risk levels, ensuring protection proportionate to the
sensitivity of the information.
Applications:
○ Incorporates user access limits and robust policies.
○ Prevents vulnerabilities and minimizes significant risks to organizational operations.
Security in Depth and Defense-in-Depth
●
●
●
Concept: Layered security approach where multiple defenses are implemented.
Security in Depth:
○ Emphasizes not only layering defenses but ensuring they interact effectively.
○ Example: A firewall working in conjunction with intrusion prevention systems and access
controls.
Security Through Diversity:
○ Uses varied security technologies, vendors, and approaches.
○ Prevents single points of failure and reduces susceptibility to attacks targeting specific
system weaknesses.
○ Example: Using firewalls from different vendors.
Behavioral Analysis
●
●
Definition: Techniques involving AI and machine learning to detect patterns in user behavior or
system activity.
Applications:
○ Detecting anomalies in Security Operations Centers and SIEMs.
○ Helps detect insider threats and advanced persistent threats.
Ethics in Security
●
●
●
Importance: Ethical considerations include privacy concerns and responsible conduct.
ISC² Code of Ethics Canons:
○ Protect society, the common good, necessary public trust and confidence, and the
infrastructure.
○ Act honorably, honestly, justly, responsibly, and legally.
○ Provide diligent and competent service to principals.
○ Advance and protect the profession.
Applications:
○ Refusing to accept or share unauthorized materials.
○ Ethical hacking and authorized penetration testing.
Data Sensitivity and Asset Management
●
Data Sensitivity:
○ Assigning sensitivity levels to information based on potential harm if improperly
disclosed or modified.
○ Sensitive data requires legal and regulatory safeguarding (e.g., healthcare data governed
by HIPAA).
●
Asset Management:
○ Definition: Inventorying and safeguarding assets based on their value and criticality.
○ Types of Assets:
■ Tangible: Hardware, physical devices.
■ Intangible: Intellectual property, data.
○ Significance: Focuses security resources on high-value items essential for organizational
operations.
Authentication and Access Control
Authentication
●
●
●
Function: Validates user identity before granting system access.
Methods:
○ Single-Factor Authentication: Uses one authentication factor, like a password.
○ Multi-Factor Authentication: Combines multiple factors (something you know, have, or
are).
Considerations:
○ Based on data sensitivity.
○ Incorporates robust policies to prevent unauthorized access.
Authorization
●
●
●
Role: Defines permissions for authenticated users.
Principle of Least Privilege: Users are granted the minimum access necessary to perform their
duties.
Approach:
○ Role-Based Access Control: Access based on user roles within the organization.
○ Attribute-Based Access Control:
■ Grants access based on attributes like department, location, time.
■ Example: Employees accessing customer data may be restricted by location and
time.
Access Control Concepts
●
●
●
Access Review and Recertification:
○ Ensures access rights align with current job roles.
○ Recertification: Periodic re-approval of access rights by managers or data owners.
Just-in-Time Access:
○ Provides access only for the time necessary to perform a task.
○ Minimizes potential risks by automatically removing access once the task is complete.
Separation of Privilege:
○ Users should not have overlapping permissions that could lead to excessive privilege.
○ Example: A finance manager can view financial data but cannot approve transactions.
Baseline Security Standards
●
Purpose: Establish minimum security requirements for systems.
●
Content:
○ Baseline configurations apply to devices, applications, and networks.
○ Ensures a uniform protection level across the organization.
Risk Management
Risk Components and Definitions
●
●
●
●
●
Asset: Anything requiring protection, including data, infrastructure, or systems.
Vulnerability: Gaps or weaknesses within systems or processes that might be exploited.
Threat: Any entity or event aiming to exploit vulnerabilities.
Likelihood of Occurrence: Estimates the probability of a threat exploiting a vulnerability.
Impact: Measures the severity of adverse effects from unauthorized access, modification, or
destruction.
Risk Identification and Assessment
●
●
Risk Identification:
○ Continuous process identifying risks.
○ Estimating potential disruptions.
Risk Assessment:
○ In-depth analysis determining risks' likelihood and impact.
○ Prioritization based on the organization's mission, assets, and reputation.
Risk Treatment Strategies
●
●
●
●
Risk Avoidance: Eliminates risk by ceasing associated activities.
Risk Acceptance: Acknowledges risk without action due to low impact or likelihood.
Risk Mitigation: Minimizes risk through protective measures, such as policies and security
controls.
Risk Transference: Shifts risk to another party (e.g., insurance policies).
Risk Prioritization
●
●
●
Qualitative Analysis: Subjective assessment based on descriptors.
Quantitative Analysis: Numerical assignment based on statistical probabilities.
Risk Matrix:
○ Visual tool prioritizing risks by their likelihood and impact.
○ Guides decision-making for effective risk response.
Security Controls
Types of Security Controls
●
●
●
Physical Controls
Definition: Tangible mechanisms providing physical access security.
Examples:
○ Locks
○ Badge readers
○ Building design features like mantraps
Technical Controls
Definition: System-based controls implemented through hardware and software.
●
●
●
Examples:
○ Firewalls
○ Intrusion Detection Systems (IDS)
○ Encryption
Administrative Controls
Definition: Policies, procedures, and processes ensuring compliance with security standards.
Examples:
○ User access policies
○ Manager approvals for access
○ Dual personnel requirements for high-risk actions
Control Types by Function
●
●
●
●
Deterrent Controls:
○ Discourage unauthorized actions.
○ Example: Warning signs.
Preventive Controls:
○ Block incidents from occurring.
○ Examples: Access controls, firewalls.
Detective Controls:
○ Monitor systems to identify malicious activities.
○ Examples: Intrusion detection systems.
Corrective Controls:
○ Address incidents after detection.
○ Restore functionality.
Governance and Compliance
Governance Terms
●
●
●
Policies:
○ High-level governance documents guiding organizational compliance with laws and
regulations.
Standards:
○ Frameworks aiding policy implementation to meet regulations.
Procedures:
○ Step-by-step task instructions supporting policy compliance.
○ Ensure tasks are completed consistently.
Governance Framework
●
●
Policy Development:
○ Established by management to ensure industry compliance.
Standards and Frameworks:
○ Provide structure and best practices.
○ Examples:
■ ISO: International standards, including information security.
■ NIST: U.S. standards for IT and cybersecurity.
●
■ IEEE: Telecommunications and computer engineering standards.
Procedures:
○ Specific instructions ensuring organizational goals and regulatory compliance are met.
Privacy and Regulations
●
Privacy:
○ Individual control over personal information distribution.
○ Regulations:
■ GDPR: Protects individuals' data across borders.
■ Requires compliance regardless of the organization’s location.
■ HIPAA: Ensures protection of sensitive patient health data.
■ Establishes standards for authorized data access.
ISC² Code of Ethics
●
●
●
Professional Conduct Requirements:
○ All information security professionals certified by ISC² must adhere to the Code of
Ethics.
Canons:
○ Protect society, the common good, necessary public trust and confidence, and the
infrastructure.
○ Act honorably, honestly, justly, responsibly, and legally.
○ Provide diligent and competent service to principals.
○ Advance and protect the profession.
Application:
○ Ethical scenarios like refusing to accept unauthorized materials align with ISC²’s
standards.
Incident Response and Management
Key Incident Terminology
●
●
●
●
●
●
Breach:
○ Loss of control over sensitive information.
○ Unauthorized access, disclosure, or acquisition of PII.
Event:
○ Any observable occurrence on a network or system.
○ Examples: Login attempts, data transfers.
Exploit:
○ Attack method designed to take advantage of a system’s known vulnerabilities.
Incident:
○ Event that threatens the CIA of data or systems.
○ Requires an immediate response.
Intrusion:
○ Unauthorized access or attempted access to a system or resource.
Threat:
○ Circumstances or events with the potential to negatively impact operations.
●
●
○ Often by exploiting vulnerabilities.
Vulnerability:
○ Weakness in an information system or controls, exploitable by threats.
Zero Day:
○ Previously unknown vulnerability with no current defense or patch.
Goal of Incident Response
●
●
Preparation:
○ Organizations must prepare for adverse events disrupting business functions.
Incident Management:
○ Structured processes help manage and mitigate incidents effectively.
○ Reduces impact through an Incident Response Plan.
Incident Response Process
1. Preparation:
○ Develop policies approved by management.
○ Identify critical data and single points of failure.
○ Ensure staff training on incident handling.
○ Implement an Incident Response Team.
2. Detection and Analysis:
○ Monitor and analyze possible attack vectors.
○ Use known data and threat intelligence.
○ Standardize incident documentation.
3. Containment:
○ Contain incidents quickly to prevent further damage.
○ Choose strategies based on the scope and nature of the incident.
4. Eradication and Recovery:
○ Remove threats from affected systems.
○ Ensure evidence is gathered.
○ Recover systems back to normal operations.
5. Post-Incident Activity:
○ Review lessons learned.
○ Document improvements for future responses.
Incident Response Team Roles
●
●
Security Operations Center:
○ Centralized team monitoring and responding to incidents.
○ Cyber Incident Response Team:
■ Specialized team trained in handling cyber incidents.
Core Team Members:
○ Senior management representatives.
○ Information security professionals.
○ Legal representatives.
○ Public affairs/communications representatives.
○
System/network engineers.
Post-Incident Remediation
●
●
Actions:
○ Ensure vulnerabilities are patched.
○ Processes are updated.
Involves:
○ Revisiting network and application configurations.
○ Reinforcing employee training.
○ Strengthening policies that might have been exploited.
Crisis Management
●
●
●
Definition:
○ Planning for events that threaten the organization's reputation or operations.
Focus:
○ Executive and PR responses.
○ Media interactions.
○ Stakeholder communication during incidents.
Integration:
○ Works with Business Continuity and Disaster Recovery but focuses on communication
strategies.
Tabletop Exercises and Red-Teaming
●
●
Tabletop Exercises:
○ Scenario-based exercises to evaluate response plans.
○ Participants role-play through scenarios to identify gaps.
Red-Teaming:
○ Simulates a real-world adversary.
○ Actively targets systems to uncover weaknesses.
○ Often conducted by internal or third-party teams.
Network Security
Network Function Virtualization
●
●
●
Definition:
○ Virtualizing network functions that traditionally required hardware.
Benefits:
○ Enables scalable, flexible network configurations.
Application:
○ Used in Software-Defined Networking to simplify network management.
○ Isolates security services across virtual networks.
Zero Trust Architecture
●
●
Concept:
○ Assumes no inherent trust within a network.
Principles:
●
○ Continuously verify identity and device integrity for access.
○ Uses techniques like microsegmentation and context-based access.
Benefits:
○ Limits lateral movement within networks.
○ Enhances overall security posture.
SSL/TLS Offloading
●
●
●
Definition:
○ Offloading encryption/decryption from application servers to dedicated hardware or
cloud-based termination points.
Benefits:
○ Optimizes server performance.
○ Secures web traffic without compromising speed.
Considerations:
○ Must be managed to prevent misconfiguration.
Network Access Control
●
●
●
Function:
○ Enforces policies before devices are allowed on a network.
Processes:
○ Scans for security compliance (e.g., patch levels, antivirus).
Applications:
○ Prevents compromised or out-of-date devices from connecting.
○ Essential in Bring Your Own Device environments.
Darknet Monitoring
●
●
●
Definition:
○ Monitoring dark web forums and marketplaces for signs of organizational data or threat
actor activities.
Managed By:
○ Threat intelligence teams.
Purpose:
○ Detect stolen credentials or upcoming attack campaigns early.
Security Operations
Security Orchestration, Automation, and Response
●
●
●
Definition:
○ Platforms that automate repetitive security tasks.
Functions:
○ Integrate data from multiple tools.
○ Provide workflow management for incident response.
Benefits:
○ Reduced response times.
○ Minimized human error.
○
Improved consistency in handling incidents.
User and Entity Behavior Analytics
●
●
●
Function:
○ Analyzes user and system behaviors to detect anomalies.
Advantages:
○ Detects deviations from normal patterns.
○ Aids in insider threat detection.
Example:
○ Alerting on unusual access times or data transfer amounts.
Threat Hunting
●
●
●
Definition:
○ Proactively searching for hidden threats.
Approach:
○ Uses hypothesis-based investigation.
Skills Required:
○ Interpreting network data and logs.
○ Identifying unusual patterns potentially missed by automated tools.
Vulnerability Management Life Cycle
1. Discovery:
○ Identifying assets and potential vulnerabilities via scans and inventories.
2. Assessment:
○ Prioritizing based on risk, exploitability, and potential impact.
3. Remediation:
○ Applying patches, configuration changes, or mitigations.
4. Verification:
○ Re-scanning or testing to confirm vulnerabilities are resolved.
Phishing Simulation and Training
●
●
●
Purpose:
○ Test security awareness and educate on recognizing phishing tactics.
Process:
○ Simulated phishing emails are sent to employees.
Analysis:
○ Results are analyzed to identify training needs.
○ Improves awareness and reduces susceptibility to phishing attacks.
Patch Management Strategies
●
●
Automated Patching:
○ Automatic deployment of patches.
○ Suitable for general systems.
Staggered Rollout:
○ Deploy patches to a subset of systems first.
○ Expand if no issues are detected.
●
Criticality-Based Patching:
○ Focuses on high-priority assets or critical vulnerabilities.
Additional Concepts
Artificial Intelligence in Security
●
●
●
Application:
○ AI algorithms simulate human decision-making to enhance security.
Usage:
○ Supports anomaly detection.
○ Facilitates behavioral analysis.
○ Enables predictive threat modeling.
Benefits:
○ Identifies potential security threats early.
○ Enhances the efficiency of security operations.
Domain 2: Incident Response, Business Continuity and Disaster
Recovery Concepts
Incident Response
Definition
●
Incident Response (IR): The process of managing and addressing security incidents to minimize
impact on an organization.
Key Incident Terminology
●
●
●
●
●
●
●
●
Breach: Loss of control over sensitive information, resulting in unauthorized access, disclosure,
or acquisition of Personally Identifiable Information.
Event: Any observable occurrence on a network or system (e.g., login attempts, data transfers).
Exploit: An attack method designed to take advantage of a system's known vulnerabilities.
Incident: An event that threatens the Confidentiality, Integrity, or Availability of data or systems,
requiring immediate response.
Intrusion: Unauthorized access or attempted access to a system or resource.
Threat: Circumstances or events with the potential to negatively impact operations by exploiting
vulnerabilities.
Vulnerability: Weakness in an information system, security procedures, or controls, exploitable
by threats.
Zero Day: A previously unknown vulnerability with no current defense or patch, making it
especially dangerous.
Goal of Incident Response
●
Preparation: Organizations must prepare for adverse events that could disrupt business
functions.
●
Incident Management: Structured processes help manage and mitigate incidents effectively,
reducing impact. This includes having an Incident Response Plan (IRP) documenting steps to
detect, respond, and limit malicious cyber attacks.
Incident Response Process
1. Preparation:
○ Establish response capabilities, such as tools and trained personnel.
○ Develop policies approved by management.
○ Identify critical data and single points of failure.
○ Ensure staff training on incident handling.
○ Implement an Incident Response Team.
2. Detection and Analysis:
○ Monitor and analyze possible attack vectors using known data and threat intelligence.
○ Identify and assess incidents to confirm scope.
○ Standardize incident documentation.
3. Containment:
○ Isolate affected systems to prevent further damage.
○ Contain incidents quickly, choosing strategies based on the scope and nature of the
incident.
4. Eradication:
○ Remove threats from the environment.
○ Ensure evidence is gathered for potential legal actions.
5. Recovery:
○ Restore systems to normal operation.
○ Recover systems back to normal functionality.
6. Lessons Learned:
○ Conduct post-incident review to improve future responses.
○ Document improvements for future incidents.
Incident Response Team Roles
●
●
●
Security Operations Center: Centralized team monitoring and responding to incidents.
Computer Incident Response Team: Specialized team trained in handling cyber incidents.
Core Team Members:
○ Senior Management Representatives: Provide authority and decision-making support.
○ Information Security Professionals: Lead technical response efforts.
○ Legal Representatives: Advise on legal implications and compliance.
○ Public Affairs/Communications Representatives: Manage external and internal
communications.
○ System/Network Engineers: Provide technical expertise on systems and networks.
Business Continuity
Purpose of Business Continuity
●
●
Goal: Ensures that critical business functions continue during and after disruptions.
Emphasis: Sustainability and resilience of operations.
●
Business Continuity Planning: Develops proactive recovery processes and procedures to
maintain essential services.
Key Components of a Business Continuity Plan
1. Business Continuity Team:
○ Identifies key personnel, including primary contacts and backup members.
○ Defines roles and responsibilities.
2. Response Procedures and Checklists:
○ Define immediate actions to take when a disruption occurs.
○ Provide step-by-step guidance for various scenarios.
3. Notification Systems:
○ Outline communication methods, such as call trees, to alert personnel.
○ Ensure timely dissemination of information to all stakeholders.
4. Management Guidance:
○ Assigns specific authority roles for managers to enact the BCP.
○ Provides decision-making frameworks during a crisis.
5. Supply Chain Contact Information:
○ Maintains contact details for suppliers, partners, and critical vendors.
○ Ensures continuity of external dependencies.
Business Impact Analysis
●
●
●
Purpose:
○ Assesses critical functions and potential impacts of disruptions.
○ Evaluates an information system's needs, functions, and interdependencies.
Outputs:
○ Defines Recovery Time Objectives: Maximum allowable downtime for systems before
operations are severely impacted.
○ Defines Recovery Point Objectives: Acceptable data loss levels, dictating the frequency
of data backups.
Frequency of Testing:
○ The BCP should be tested routinely and whenever significant changes in the business
environment occur to validate readiness.
Disaster Recovery
Definition and Objective of Disaster Recovery
●
●
Disaster Recovery: Focuses on restoring IT systems and critical services after an incident or
disruption.
Objective: Resume normal functions and restore technology and IT infrastructure to full
functionality as quickly as possible.
Distinction from Business Continuity
●
Business Continuity:
○ Focuses on maintaining critical operations during and after a disruption.
●
○ Emphasizes continuous operation and resilience.
Disaster Recovery:
○ Concentrates on restoring technology and IT infrastructure post-disruption.
○ Involves technical recovery steps and processes.
Disaster Recovery Plan
Components of a Disaster Recovery Plan
1. Executive Summary:
○ Provides a high-level overview of the DRP for executives and stakeholders.
○ Highlights the plan's objectives and key elements.
2. Department-Specific Plans:
○ Custom plans addressing individual department needs and priorities.
○ Aligns recovery efforts with business functions.
3. Technical Guides:
○ Instructions for IT personnel to activate backup systems and recovery procedures.
○ Includes detailed technical steps and configurations.
4. Comprehensive Checklists:
○ Critical Team Member Checklists: Ensures each team member knows their
responsibilities during recovery.
○ IT and Technical Guides: Assist personnel in activating alternative sites and systems.
○ Public Relations Checklists: Guides communication with stakeholders, media, and the
public.
Testing
● Regular DR Exercises:
○ Conduct routine tests to confirm the functionality and reliability of recovery strategies.
○ Includes simulations, tabletop exercises, and full-scale drills.
Types of Recovery Sites
1. Hot Site:
○ Fully operational offsite data center ready for immediate use.
○ Equipped with real-time data replication.
○ Allows for rapid recovery with minimal downtime.
2. Warm Site:
○ Partially equipped site with essential equipment and infrastructure.
○ Requires some setup and data restoration before full operation.
○ Balances cost and recovery time.
3. Cold Site:
○ Basic infrastructure without immediate functionality.
○ Requires complete setup, configuration, and data restoration upon activation.
○ Most cost-effective but with longer recovery times.
Common Backup Types
1. Full Backups:
○ Complete data copies of all systems and data.
○ Provides the most comprehensive restore option.
○ Requires significant storage space and time.
2. Incremental Backups:
○ Captures changes since the last backup (full or incremental).
○ Requires the entire backup chain (full backup plus all incremental backups) for a full
restore.
○ More efficient in storage and time compared to full backups.
3. Differential Backups:
○ Backs up all data changed since the last full backup.
○ Simplifies the restoration process compared to incremental backups.
○ Requires more storage than incremental backups but less than full backups.
Key Disaster Recovery Metrics
●
●
Recovery Time Objective:
○ Maximum allowable downtime for a system before operations are severely impacted.
○ Guides the selection of recovery strategies and technologies.
Recovery Point Objective:
○ Acceptable amount of data loss measured in time.
○ Determines the frequency of data backups to minimize lost information during recovery.
Integration of Incident Response, Business Continuity, and
Disaster Recovery
●
●
●
Holistic Approach:
○ Incident Response, Business Continuity, and Disaster Recovery are interconnected
disciplines that collectively ensure organizational resilience.
○ Effective planning and execution across these areas minimize the impact of disruptions
and facilitate rapid recovery.
Coordination Between Teams:
○ Incident Response Teams focus on immediate threats and mitigation.
○ Business Continuity Teams ensure that critical operations continue despite disruptions.
○ Disaster Recovery Teams work on restoring IT systems and data.
Communication and Documentation:
○ Clear communication channels among teams and stakeholders are crucial.
○ Thorough documentation of plans, procedures, and lessons learned enhances
preparedness and response effectiveness.
Domain 3: Access Control Concepts
Module 1: Understanding Access Control Concepts
1. Fundamentals of Access Control
Access Control: Determines who can access resources within an organization. Controls
define permissions and enforce rules that limit users to authorized areas and
information.
○ Security Control: Access control is a key security measure that upholds Confidentiality,
Integrity, and Availability (CIA) by regulating user actions and protecting assets.
○ Key Components of Access Control:
■ Subjects: Individuals, processes, or devices requesting access.
■ Objects: Resources that subjects access, such as files, databases, and
applications.
■ Rules: Policies determining the access level, including factors such as timebased access or role-specific permissions.
2. Common Access Control Models
○ Discretionary Access Control:
■ Allows data owners to set access permissions on resources they own.
■ Users with access can share files or grant permissions to others, creating
flexibility but risking excessive privilege propagation.
○ Mandatory Access Control:
■ The system strictly enforces access based on organizational security policies,
independent of user preferences.
■ Typically used in high-security environments where data classification levels and
clearance levels govern access.
○ Role-Based Access Control (RBAC):
■ Permissions are assigned based on job roles within an organization, simplifying
permission management.
■ Allows organizations to standardize access according to roles, reducing
redundancy and enforcing least privilege.
○ Attribute-Based Access Control (ABAC):
■ Access is based on attributes, such as user role, location, or time of day, creating
a flexible and dynamic access control policy.
■ Useful for complex environments where decisions are made based on
contextual information.
3. Principle of Least Privilege
○ Objective: Limits users to the minimum access necessary to complete their tasks,
reducing the potential attack surface.
○ Example: Only specific individuals working in financial roles can access payment data,
while even fewer can make modifications. Least privilege enhances confidentiality,
integrity, and availability by restricting access to only essential personnel.
4. Privileged Access Management
○ Privileged Accounts: Users with elevated permissions allowing them to perform
administrative functions.
■ Systems Administrators: Responsible for systems, application deployment, and
performance.
○
Security Analysts: Require broad access to monitor and secure infrastructure.
Help Desk/IT Support Staff: Often need permissions for troubleshooting but
should be limited to necessary systems.
○ Security Measures for Privileged Accounts:
■ Enhanced logging and monitoring of actions.
■ Stricter authentication, often requiring MFA.
■ Regular audits and reviews of access logs to detect anomalies.
5. Segregation of Duties
○ Definition: Prevents any one individual from controlling all aspects of a critical process,
reducing fraud risks and enforcing accountability.
○ Dual Control: Also called Two-Person Integrity, requires two authorized individuals to
complete critical tasks. This setup prevents unauthorized or malicious activities by a
single actor.
■
■
Module 2: Understanding Physical Access Controls
1. Physical Security Controls
○ Purpose: Restrict access to physical locations, protecting assets and ensuring only
authorized individuals enter secure areas.
○ Examples of Physical Security Controls:
■ Locks and Fences: Basic barriers preventing unauthorized entry.
■ Mantraps and Turnstiles: Control access by allowing only one person to enter at
a time, reducing tailgating risks.
■ Security Guards: Provide human monitoring and can act in emergencies.
○ Environmental Design: Crime Prevention through Environmental Design uses building
layout and lighting to deter unauthorized access and make monitoring easier.
2. Badge Systems and Entry Control
○ Badge Access Systems: Require users to scan or swipe badges to gain entry.
■ Types of Badges:
■ Barcode: Simple but often not secure.
■ Magnetic Stripe: Used for medium security, but susceptible to wear.
■ Proximity: Allows contactless scanning, often integrated with higher
security environments.
■ Smart Cards: Embedded with microchips, providing enhanced security.
○ Controls for Entry and Exit:
■ Turnstiles and Mantraps: Prevent unauthorized access by controlling entry to a
single person at a time.
■ Geofencing: Enforces access controls based on physical location, useful in
environments with mobile or flexible workspaces.
3. Biometrics for Authentication
○ Definition: Uses unique biological traits for identification and authentication, ensuring
that only the intended person gains access.
Types of Biometric Systems:
■ Physiological: Measures fingerprints, iris scans, retinal patterns, and vein
patterns.
■ Behavioral: Measures voiceprints, signature patterns, and typing rhythms.
○ Process:
■ Enrollment: Registers the biometric pattern for later comparison.
■ Verification: Compares the presented biometric with the stored pattern for
identity validation.
○ Challenges: While biometrics are highly accurate, they can be expensive and may raise
privacy concerns.
4. Monitoring and Logging Physical Access
○ Surveillance Systems: Security cameras and alarms monitor entry points and restricted
areas, providing real-time oversight.
○ Access Logs: Record entry and exit data, assisting in security audits, incident
investigations, and compliance reporting.
○
Module 3: Understanding Logical Access Controls
1. Logical Access Controls
○ Purpose: Electronic methods that limit system access, often integrating with physical
controls to protect both digital and physical assets.
○ Types of Logical Access Controls:
■ Passwords: Basic form of access control, but often vulnerable to compromise.
■ Tokens and Badges: Provide additional security through physical objects that
users possess.
■ Biometrics: Ensures the user’s unique physical characteristics match the stored
pattern.
2. Logical Access Control Policies
○ Single-Factor Authentication: Uses one method, such as a password.
○ Multi-Factor Authentication: Combines factors, like something known (password) and
something possessed (token), greatly enhancing security.
3. Common Access Control Mechanisms
○ Discretionary Access Control in the Workplace:
■ Grants flexibility, allowing file owners to determine permissions, but risks
excessive access due to discretionary sharing.
○ Mandatory Access Control:
■ Enforced by system-wide policies, often applied in government or military
settings.
○ Role-Based Access Control:
Assigns permissions based on organizational roles, which simplifies access
management and minimizes administrative overhead.
■ Monitoring RBAC Permissions: Regular audits ensure permissions remain
aligned with current job functions, especially when roles or responsibilities
change.
4. Defense-in-Depth for Logical Access
○ Layered Defense Strategy: Incorporates multiple access control types (e.g., physical,
technical) to create a comprehensive security framework.
○ Example:
■ Physical Lock on Server Room: Prevents unauthorized physical access.
■ Network-Based Access Rules: Blocks remote access to servers unless approved.
■ Administrative Policies: Assign access only to roles that require it, implementing
the Principle of Least Privilege.
5. Authorization and Access Verification
○ Authorization: Determines access rights based on user roles, attributes, or credentials,
ensuring users can access only necessary resources.
○ Verification Methods:
■ Knowledge-Based (e.g., passwords): Validates identity based on information
only the user knows.
■ Token-Based (e.g., smart cards): Requires something the user has.
■ Biometric (e.g., fingerprint): Validates identity through unique user traits.
6. Segregation of Duties and Roles
○ Purpose: Ensures that sensitive processes are divided across multiple users, reducing
the risk of insider threats and fraud.
○ Examples:
■ Finance Department: One employee initiates a transaction, while another
approves it.
■ IT Security: A developer creates code, but a separate team tests it, preventing
unilateral control over code deployment.
■
Domain 4: Network Security
Module 1: Key Network Security Concepts and Terminology
1. Fundamental Network Components
○ Firewall: A security device that monitors and filters incoming and outgoing network
traffic based on security policies. Firewalls can be network-based or host-based:
■ Network-Based Firewalls: Positioned at the network perimeter to protect
against unauthorized access.
■ Host-Based Firewalls: Installed on individual systems, providing an additional
layer of security by controlling traffic at the endpoint level.
Access Control Lists (ACLs): Rules on network devices that permit or deny traffic based
on criteria such as IP addresses, ports, and protocols. ACLs enforce security by
restricting access based on the organization’s policies.
○ Virtual Private Network (VPN): Creates a secure, encrypted connection over a public
network, such as the internet. VPNs ensure data confidentiality and integrity, commonly
used for remote access and site-to-site communications.
2. Core Protocols in Network Security
○ Transmission Control Protocol/Internet Protocol (TCP/IP): The foundation of Internet
communication, defining how data packets are sent, received, and acknowledged
between devices.
○ Internet Protocol Security (IPSec): A suite of protocols securing IP communications by
encrypting and authenticating packets. IPSec operates in:
■ Tunnel Mode: Encrypts the entire IP packet, often used in VPNs.
■ Transport Mode: Encrypts only the data portion, used in host-to-host
communications.
○ Domain Name System Security Extensions (DNSSEC): Adds a layer of security to DNS,
ensuring that responses to DNS queries are authentic and unaltered, thus preventing
DNS spoofing.
○ Secure Sockets Layer/Transport Layer Security (SSL/TLS): Protocols that secure data
transmission over the internet, often used to protect HTTPS traffic by encrypting data
between web servers and browsers.
3. Security Threats and Attack Types
○ Denial-of-Service (DoS): An attack that disrupts service by overwhelming a system with
requests, causing slowdowns or crashes.
○ Distributed Denial-of-Service (DDoS): Similar to DoS but involves multiple systems
attacking a single target simultaneously, amplifying the disruption.
○ Man-in-the-Middle Attack: An interception attack where an attacker secretly relays and
possibly alters communication between two parties, compromising data integrity and
confidentiality.
○ Fragment Attack: Sends fragmented packets to disrupt a system's ability to reassemble
them, often leading to system crashes.
○ Spoofing: The act of falsifying an IP address or identity to gain unauthorized access,
commonly seen in phishing attacks.
○
Module 2: Network Architecture and Segmentation
1. Network Segmentation
○ Purpose: Divides a network into isolated zones to reduce attack surfaces and limit
lateral movement within the network. By restricting access between segments, security
breaches in one segment are contained, minimizing exposure to other areas.
○ Types of Segmentation:
■ Physical Segregation: Complete isolation by using separate physical devices.
Virtual LANs (VLANs): Logical segmentation within the same physical network,
allowing devices to be grouped by function, department, or security level.
■ Air Gaps: Complete isolation from other networks by physically separating
devices and systems, often used in high-security environments.
2. Network Zones and Topologies
○ Demilitarized Zone (DMZ): A network zone that houses internet-facing services, such as
web servers, isolated from the internal network to add a security layer.
○ Intranet: A private network accessible only by an organization’s internal members,
designed for secure, internal communications.
○ Extranet: Extends the internal network to external partners, providing controlled access
to internal resources for suppliers or clients.
○ Guest Network: A segregated network that provides internet access for visitors without
exposing the internal network resources.
3. Secure Tunneling and VPNs
○ Site-to-Site VPN: Connects entire networks from different locations over the internet
securely.
○ Remote Access VPN: Allows individual users to connect securely to an organization’s
internal network from remote locations.
■
Module 3: Network Security Devices and Technologies
1. Intrusion Detection and Prevention Systems (IDPS)
○ Intrusion Detection System (IDS): Monitors network traffic for suspicious activity and
alerts security teams, operating in a passive manner without blocking traffic.
○ Intrusion Prevention System (IPS): Detects and actively blocks identified threats,
operating inline to prevent malicious traffic from reaching its destination.
○ Detection Methods:
■ Signature-Based Detection: Compares traffic against known attack patterns,
effective for identifying established threats.
■ Anomaly-Based Detection: Identifies deviations from normal behavior, useful
for spotting new or evolving threats.
2. Proxy Servers
○ Forward Proxy: Manages outgoing traffic from users to the internet, adding anonymity
and filtering capabilities.
○ Reverse Proxy: Manages incoming traffic from the internet to internal servers, providing
load balancing, caching, and additional security.
3. Load Balancers
○ Purpose: Distributes network or application traffic across multiple servers, improving
reliability, reducing downtime, and increasing capacity.
○ Load Balancing Methods:
■ Round-Robin: Distributes requests evenly among servers.
Affinity-Based: Keeps sessions on the same server for each user, beneficial for
applications needing session persistence.
■ Active-Active Configuration: All load balancers are actively handling traffic,
maximizing resource usage.
■ Active-Passive Configuration: Only one load balancer is active, while the other
remains on standby, ensuring backup availability in case of failure.
4. Network Security Monitoring Tools
○ SIEM (Security Information and Event Management): Aggregates and analyzes log data
from multiple network sources, correlating events to identify security incidents and
anomalies.
○ Network Scanners and Protocol Analyzers:
■ Nmap: Maps network devices, open ports, and services, assisting in vulnerability
detection.
■ Zenmap: A graphical interface for Nmap, useful for visualizing network layouts
and potential weak points.
■ Protocol Analyzer: Captures and analyzes packets to identify network issues and
malicious traffic.
■
Module 4: Secure Network Protocols
1. Secure Communication Protocols
○ HTTPS (Hypertext Transfer Protocol Secure): Encrypts HTTP traffic using TLS, securing
data between web servers and browsers.
○ DNSSEC (Domain Name System Security Extensions): Provides authentication for DNS
responses, reducing DNS-based attacks.
○ SSH (Secure Shell): Encrypts remote command-line sessions, providing secure
management access over untrusted networks.
○ SRTP (Secure Real-Time Transport Protocol): Protects voice and video communications
from eavesdropping.
○ FTPS and SFTP: Encrypted file transfer protocols for secure data exchange, enhancing
FTP security by preventing unauthorized data access.
○ NTPsec: A secure version of Network Time Protocol, ensuring reliable time
synchronization for accurate event logging and analysis.
2. Authentication Protocols
○ IEEE 801X: A standard used in wired and wireless networks, enforcing port-based access
control, commonly integrated with RADIUS servers.
○ EAP (Extensible Authentication Protocol): An authentication framework with various
implementations, including:
■ PEAP (Protected EAP): Encapsulates EAP within a TLS tunnel, requiring
certificates on the server.
■ EAP-TLS: Uses PKI, requiring certificates on both server and clients, providing
high security for sensitive networks.
Module 5: Zero Trust and Network Security Models
1. Zero Trust Model
○ Definition: A security framework assuming no inherent trust within the network,
requiring continuous verification and restricted access.
○ Core Principles:
■ Verify Every User: Requires multi-factor authentication and strict identity
verification.
■ Microsegmentation: Breaks the network into smaller zones, controlling access
at a granular level to prevent lateral movement by attackers.
■ Least Privilege Access: Enforces the minimum permissions necessary for each
user, limiting potential damage from compromised accounts.
2. Network Monitoring and Security Practices
○ Continuous Monitoring: Provides real-time insights into network traffic patterns,
identifying anomalies that could indicate an attack.
○ Log Analysis and SIEM: Correlates events across the network, helping identify patterns
of malicious activity. SIEM also assists in regulatory compliance by providing detailed
records of network activities.
○ Threat Intelligence Feeds: Integrates external intelligence to anticipate and respond to
evolving threats, adapting network defenses proactively.
Domain 5: Security Operations
Module 1: Security Operations Overview
1. Purpose of Security Operations
○ Detection: Security operations rely heavily on proactive detection to identify suspicious
activities or anomalies that may indicate a potential threat. Detection methods include
real-time monitoring, automated alerts, and behavioral analysis.
○ Response: Response measures encompass containment, eradication, and remediation
actions. This includes isolating affected systems, removing malware, and restoring
services.
○ Prevention: Security operations use preventive measures such as firewalls, intrusion
prevention systems, and access control policies to block threats.
○ Recovery: Involves restoring affected systems to a stable and secure state. Effective
recovery reduces downtime, maintains operational continuity, and includes thorough
post-incident analysis.
2. Security Governance and Frameworks
○
○
○
Security Policies: High-level rules that guide organizational security practices, such as
acceptable use policies (AUPs) for employee behavior and data protection policies for
sensitive data.
Standards and Procedures: Specific guidelines and step-by-step instructions that ensure
security controls are consistently applied and adhered to.
Frameworks: Commonly used frameworks include:
■ NIST (National Institute of Standards and Technology): Provides
comprehensive cybersecurity guidelines through its NIST Cybersecurity
Framework (CSF) and NIST 800-53.
■ CIS (Center for Internet Security): Offers practical security controls for
establishing a baseline and improving an organization’s security posture.
Module 2: Core Security Control Types
1. Security Control Types in Detail
○ Deterrent Controls: Discourage attackers by making it clear that countermeasures are in
place, such as alarm systems, visible security cameras, and warning banners.
○ Preventive Controls: Designed to stop unauthorized actions or access, such as using
MFA, which combines two or more authentication factors (something you know,
something you have, something you are).
○ Detective Controls: These controls help identify potential threats or events in real-time.
Examples include security cameras for physical environments and IDS for network
traffic.
○ Corrective Controls: Take action to fix issues after detection, like restoring compromised
systems from a backup or deploying patches after a vulnerability is identified.
○ Technical Controls: Implemented through technology, including antivirus software,
intrusion detection systems, encryption, and network segmentation.
○ Administrative Controls: Include security awareness training, incident response
procedures, and policies that establish protocols for employee behavior and response.
2. Defense-in-Depth Strategy (Expanded)
○ Layered Approach: Implements multiple independent security measures to protect
assets, considering both internal and external threats.
○ Example Layers:
■ Physical Security: Restricts access to hardware with controls like locks and
surveillance.
■ Network Security: Utilizes firewalls and VPNs to secure data flow.
■ Endpoint Security: Protects individual devices with antivirus software and
access restrictions.
■ Application Security: Enforces security measures on applications, such as input
validation and secure coding practices.
Module 3: Operational Security Practices
1. Patch Management Process
○ Automated Patch Deployment: Many organizations use centralized patch management
tools that automate the process, ensuring patches are applied uniformly across the
organization.
○ Patch Rollback: If a patch causes issues, rollback capabilities allow administrators to
revert systems to their previous state, maintaining operational stability.
○ Vulnerability Management: Works in tandem with patch management by continuously
identifying vulnerabilities in software, categorizing them by severity, and addressing
them through patches or alternative measures.
2. System Hardening Techniques
○ Configuration Management: Standardizes configurations across systems to reduce
vulnerabilities, such as disabling unnecessary ports, restricting administrative privileges,
and enforcing password policies.
○ Application Whitelisting: Only allows approved applications to run, minimizing the risk
of malware or untrusted software execution.
○ Baseline Configurations: Establish minimum security configurations that all systems
must meet, providing a consistent level of security.
3. Data Loss Prevention
○ Endpoint DLP: Monitors and controls data transfers on end-user devices, such as
laptops, to prevent unauthorized data sharing via USB drives or personal emails.
○ Network DLP: Monitors and controls data transfers across the network, intercepting
unauthorized file transfers or emails containing sensitive information.
○ Cloud DLP: Protects data stored and accessed in cloud environments by monitoring and
managing permissions, restricting data sharing, and applying encryption.
4. Logging and Monitoring
○ Types of Logs:
■ System Logs: Record OS-level events, such as logins, user activities, and system
errors.
■ Application Logs: Track activities within applications, such as failed login
attempts or data access.
■ Security Logs: Contain records of security events detected by IDS, antivirus, and
firewalls.
○ Log Retention: Security operations often set log retention policies to ensure logs are
available for historical analysis, forensics, and compliance audits.
5. Network and Egress Monitoring
○ Network Security Monitoring: Collects, analyzes, and interprets network traffic data to
detect intrusions and ensure secure communication.
○ Behavioral Analytics: Uses machine learning to recognize normal traffic patterns and
identify anomalies, like unusual login times or large data transfers.
○ Data Exfiltration Prevention: Egress monitoring tools detect and block unauthorized
data transfers, preventing data breaches.
Module 4: Forensics and Incident Response Readiness
1. Forensic Readiness in Security Operations
○ Data Acquisition Procedures: Proper forensic data collection requires imaging drives,
capturing volatile data from memory, and storing data in a secure, tamper-evident
manner.
○ Legal and Regulatory Considerations: Adheres to chain of custody requirements,
documentation standards, and jurisdictional laws to ensure evidence is admissible and
compliant.
○ Digital Evidence Preservation: Uses write-blockers to prevent changes to evidence
during acquisition and analysis, preserving data integrity.
2. Incident Response Lifecycle
○ Preparation: Involves training response teams, acquiring tools, and conducting
simulated exercises to build readiness.
○ Detection and Analysis: Comprises techniques like SIEM monitoring, anomaly detection,
and event correlation to confirm incidents.
○ Containment: Quick, often temporary measures to prevent an incident from escalating,
such as disconnecting infected machines or blocking malicious IP addresses.
○ Eradication and Recovery: Eradication removes the root cause of the incident, while
recovery ensures affected systems return to normal operations, often with additional
monitoring.
○ Post-Incident Review: Comprehensive analysis to determine what happened, assess the
response, and implement improvements. Post-incident reports are key for enhancing
future incident responses.
3. Order of Volatility
○ Most Volatile to Least Volatile Data:
■ CPU Registers and Cache: Capture the state of CPU instructions and recent
activity.
■ RAM and Network Connections: Volatile data, including open connections and
temporary data, that can be lost with power-off.
■ Disk Storage: More stable data, such as system files, logs, and user documents.
○ Forensic Imaging: Creates a full disk copy, often necessary to capture all potential
evidence without altering the original device.
Digital Forensics
Digital Forensics is the practice of collecting, preserving, analyzing, and presenting digital evidence in a
manner that is legally admissible. It is used to investigate cyber incidents, criminal activities, and
policy breaches within organizations.
Key Phases in Digital Forensics
1.Identification:
●
●
Purpose: Locate potential digital evidence sources.
Actions:
○ Identify devices, networks, and storage media.
○ Determine relevant data like files, logs, emails, and metadata.
2. Preservation:
●
●
Goal: Protect evidence integrity.
Process:
○ Create forensic images (bit-by-bit copies).
○ Use write blockers to prevent data alteration.
○ Document the chain of custody for accountability.
3. Collection:
●
●
Purpose: Systematically gather data without compromising integrity.
Techniques:
○ Use imaging tools for exact copies.
○ Collect volatile data (e.g., RAM) first.
○ Gather non-volatile data (e.g., hard drives).
4. Analysis:
●
●
Objective: Uncover meaningful evidence.
Methods:
○ File Recovery: Restore deleted or hidden files.
○ Timeline Analysis: Reconstruct events using timestamps and logs.
○ Log Analysis: Review for unauthorized access or activities.
○ Network Forensics: Examine network traffic for malicious behavior.
5. Documentation:
●
●
Goal: Ensure transparency and reproducibility.
Inclusions:
○ Detailed notes and observations.
○ Screenshots, timestamps, and logs.
○ Record of tools and methods used.
6. Presentation:
●
●
Purpose: Summarize findings for legal proceedings.
Components:
○ Summary of Findings: Clear overview of evidence and conclusions.
○ Methodology: Explanation of procedures and tools.
○ Timeline: Chronological reconstruction of events.
○ Supporting Evidence: Exhibits like logs and screenshots.
Important Concepts in Digital Forensics
1. Chain of Custody:
● Definition: Documentation tracking evidence handling from collection to storage.
● Importance: Ensures evidence is untampered and legally admissible.
2. Order of Volatility:
● Principle: Capture the most volatile data first (e.g., RAM) before it is lost.
3. Hashing:
● Role: Use algorithms (MD5, SHA-1, SHA-256) to create unique digital fingerprints.
● Purpose: Verify data integrity; any alteration changes the hash value.
4. System Imaging:
● Definition: Creating a bit-for-bit copy of a storage device.
● Purpose: Preserve original data for analysis without risk of alteration.
5. Data Acquisition:
● Process: Collecting evidence from devices or networks.
● Methods:
○ Live Acquisition: Captures data from a running system (volatile data).
○ Static Acquisition: Collects data from powered-off devices (non-volatile data).
6. Metadata Analysis:
● Description: Examining file metadata to understand creation, modification, and access
details.
● Use Case: Reveals user actions and potential tampering.
Common Digital Forensics Tools
1. Imaging Tools:
● EnCase: Industry-standard for creating and analyzing forensic images.
● FTK Imager: Free tool for disk imaging and file preview.
● dd: Command-line utility for bit-level copying on Unix systems.
2. Hashing Tools:
● HashCalc, MD5deep, SHA256sum: Calculate hash values for data verification.
3. File Recovery and Analysis Tools:
● Autopsy: Open-source tool for analyzing digital evidence.
● Recuva, PhotoRec: Recover deleted files from various storage media.
4. Network Forensics Tools:
● Wireshark: Captures and analyzes network packets.
● tcpdump: Command-line network traffic analyzer.
● NetworkMiner: Extracts metadata from captured traffic.
5. Log Analysis Tools:
● Splunk: Aggregates and searches log data.
● ELK Stack: Open-source suite for log management (Elasticsearch, Logstash, Kibana).
● Event Log Explorer: Analyzes Windows Event Logs.
6. Mobile Device Forensics Tools:
● Cellebrite, Oxygen Forensic Suite, Magnet AXIOM: Extract and analyze data from
mobile devices.
Types of Digital Forensics
1. Computer Forensics:
● Focus: Investigating computer systems, hard drives, files, and applications.
● Use Case: Analyzing data breaches and unauthorized access.
2. Network Forensics:
● Scope: Monitoring and analyzing network traffic.
● Key Elements:
○ Analyzing logs and captured packets.
○ Reconstructing network attacks.
3. Mobile Device Forensics:
● Purpose: Extracting data from smartphones and tablets.
● Challenges: Diverse OS platforms and encryption.
4. Memory Forensics:
● Objective: Analyzing data in RAM.
● Importance: Investigating malware operating solely in memory.
5. Malware Forensics:
● Goal: Understanding malicious software’s origin and impact.
● Techniques:
○ Reverse engineering code.
○ Identifying indicators of compromise.
Challenges in Digital Forensics
1. Data Encryption and Obfuscation:
● Problem: Encrypted data hinders access.
● Solution: Use decryption tools or legal password recovery methods.
2. Data Volume:
● Challenge: Large amounts of data complicate analysis.
● Solution: Automate filtering to focus on relevant evidence.
3. Cloud Forensics:
● Complexity: Data spread across multiple locations.
● Solution: Collaborate with cloud providers; use remote tools.
4. Anti-Forensics Techniques:
● Methods: Data wiping, encryption, metadata manipulation.
● Countermeasures: Advanced recovery tools to detect remnants.
5. Legal and Compliance Issues:
● Considerations: Adherence to privacy laws and regulations.
● Best Practice: Document actions; ensure compliance with legal requirements.
Reporting and Testimony in Digital Forensics
1. Forensic Reporting:
● Purpose: Summarize findings clearly and objectively.
● Contents:
○ Executive summary.
○ Detailed timeline.
○ Methodology and evidence.
2. Expert Testimony:
● Context: Presenting findings in legal settings.
● Preparation:
○ Explain methods in understandable terms.
○ Demonstrate evidence integrity.
○ Be ready for cross-examination on reliability.
Module 5: Data Sanitization and Secure Disposal
1. Data Sanitization Standards
○ Overwriting and Deletion: Common for non-critical data; overwrites the original data to
prevent recovery.
○ Degaussing: Effective for magnetic storage, destroying magnetic fields, but ineffective
for solid-state drives (SSDs).
○ Physical Destruction: Suitable for high-security data, involving methods like crushing,
shredding, or incinerating storage media to ensure data is irrecoverable.
2. Data Retention Policies
○ Compliance Requirements: Regulatory requirements, such as GDPR or HIPAA, mandate
specific retention periods for certain types of data.
○ Record Management: Categorizes data based on value and sensitivity, determining
retention times and disposal procedures.
Module 6: Business Continuity and High Availability
1. Business Continuity Planning (BCP)
○ Components of a BCP:
■ Crisis Management Team (CMT): A designated group responsible for overseeing
business continuity efforts during a crisis.
■ Communication Plans: Ensures stakeholders are informed of incidents and
ongoing recovery efforts.
○ Business Impact Analysis (BIA): Identifies and prioritizes critical business functions,
setting the foundation for continuity planning by establishing RTOs and RPOs.
2. High Availability and Redundancy
○ RAID Configurations:
■ RAID 1: Disk mirroring for redundancy.
■ RAID 5: Stripes data and parity across disks, allowing recovery if one disk fails.
■ RAID 6: Similar to RAID 5 but provides two parity blocks for added resilience.
○ Failover and Load Balancing: Balancing workloads across servers and enabling rapid
failover if one server goes down. Geographic redundancy ensures that data and services
are backed up in different locations.
3. Disaster Recovery Testing
○ Testing Types:
■ Walkthroughs: Team members review their roles and the plan steps to verify
completeness.
■ Parallel Testing: Simultaneously runs recovery operations alongside normal
operations without taking down production systems.
■ Full-Scale Drills: Simulates an actual disaster by activating the entire recovery
plan, verifying the full process’s effectiveness.
4. Recovery Sites
○ Hot Site: Fully operational and ready-to-use, suitable for organizations requiring
immediate recovery.
○ Warm Site: Partially configured, requiring some setup upon activation.
○ Cold Site: Basic infrastructure only, requiring significant time and setup to become
functional.
5. Continuity of Operations Testing
○ Regular continuity testing confirms that employees understand their roles, systems
function as expected, and communication channels remain intact.
○ Tabletop Exercises: Simulated scenarios allow teams to discuss response steps, identify
gaps, and refine the plan.
○ Functional Testing: Validates that recovery strategies work in practice, identifying
potential bottlenecks or resource needs in the recovery process.
Lecture Recap:
Security Principles
The CIA Triad
1. Confidentiality: Protecting information from unauthorized access.
○ Encryption: Transforming data into unreadable formats using cryptographic keys.
○ Access Control: Limiting access based on roles (e.g., Role-Based Access Control).
○ Data Masking: Concealing specific data elements to protect sensitive information.
2. Integrity: Ensuring data accuracy and trustworthiness.
○ Hashing: Creating unique hash values; changes in data alter the hash, indicating
tampering.
○ Checksums: Verifying data integrity during transmission and storage.
○ Digital Signatures: Using hashing and encryption for non-repudiation and
authentication.
3. Availability: Ensuring reliable access to information and systems.
○ Redundancy: Implementing backup components (e.g., RAID, failover clustering).
○ Fault Tolerance: Enabling systems to continue operating despite failures.
○ Backups and Recovery: Regularly backing up data to restore after incidents.
Supporting Security Principles
●
●
●
●
●
Least Privilege: Granting users only the access necessary for their duties.
Separation of Duties: Dividing tasks among multiple people to prevent fraud.
Defense in Depth: Implementing multiple layers of security controls.
Risk Management: Identifying, assessing, and mitigating risks.
○ Risk Assessments: Evaluating vulnerabilities, threats, and impacts.
○ Threat Modeling: Analyzing potential threats and attack scenarios.
Compliance and Standards: Adhering to regulations (e.g., GDPR, HIPAA) and frameworks (e.g.,
NIST, ISO 27001).
Security Awareness and Training
●
●
User Education: Training users to recognize and prevent security threats like phishing.
Regular Security Audits: Ensuring compliance and identifying security gaps.
Business Continuity and Disaster Recovery
Business Continuity (BC)
●
Business Continuity Plan (BCP): Strategies to maintain operations during disruptions.
○ Critical Business Functions: Identifying essential systems and processes.
○ Business Impact Analysis (BIA): Assessing effects of potential disruptions.
○ Recovery Objectives:
■ Recovery Time Objective (RTO): Maximum acceptable downtime.
■ Recovery Point Objective (RPO): Maximum acceptable data loss.
○ Continuity Testing: Regular exercises to validate the BCP.
Disaster Recovery (DR)
●
Disaster Recovery Plan (DRP): Steps to restore IT systems and data after a disaster.
○ Components: Communication plans, contact lists, recovery procedures.
○ Backup Strategies: Full, incremental, and differential backups stored securely.
○ Recovery Sites:
■ Hot Site: Fully equipped and operational immediately.
■ Warm Site: Partially equipped, requires some setup.
■ Cold Site: Basic infrastructure, significant setup needed.
○ DR Testing: Testing the DRP through simulations and drills.
Incident Response
Incident Response Plan (IRP)
●
●
Objective: Minimize the impact of security incidents.
Incident Response Lifecycle:
1. Preparation: Establish policies, tools, and train personnel.
2. Identification: Detect and validate incidents.
3. Containment: Isolate affected systems to prevent spread.
4. Eradication: Remove the cause of the incident.
5. Recovery: Restore systems to normal operations.
6. Lessons Learned: Analyze the incident to improve future responses.
Forensic Readiness
●
●
Order of Volatility: Prioritize evidence collection from most to least volatile (e.g., RAM before
hard drives).
Evidence Handling:
○ Chain of Custody: Documenting who handled evidence.
○
Data Acquisition: Using tools to capture data without altering it.
Access Control Concepts
Access Control Models
1.
2.
3.
4.
Discretionary Access Control (DAC): Owners set access permissions.
Mandatory Access Control (MAC): Access based on security labels and classifications.
Role-Based Access Control (RBAC): Access determined by job roles.
Attribute-Based Access Control (ABAC): Access based on attributes (e.g., user, resource,
environment).
Access Control Mechanisms
●
●
●
●
Authentication: Verifying user identity (passwords, biometrics).
Authorization: Granting permissions based on policies.
Audit Logs: Recording access and actions for accountability.
Segregation of Duties: Dividing responsibilities to reduce fraud risk.
Best Practices
●
●
●
Principle of Least Privilege: Minimizing user access rights.
Multi-Factor Authentication (MFA): Using multiple authentication factors.
Regular Access Reviews: Auditing permissions to ensure they align with roles.
Network Security
Network Security Components
●
●
●
●
Firewalls: Filtering network traffic based on rules.
○ Types: Stateful, stateless, application-based.
VPNs: Securing remote connections through encryption.
Proxy Servers: Acting as intermediaries between clients and servers.
○ Forward Proxy: For client requests.
○ Reverse Proxy: For server resources.
Load Balancers: Distributing traffic to optimize resource use.
Network Security Protocols
●
●
●
●
●
HTTPS: Securing web traffic with SSL/TLS encryption.
DNSSEC: Adding authentication to DNS responses.
IPSec: Securing IP communications with encryption and authentication.
TLS: Encrypting data for applications like email and VoIP.
Zero Trust Models: Verifying all access requests without assuming trust.
Intrusion Detection and Prevention
●
●
●
IDS/IPS: Monitoring and responding to network threats.
○ Signature-Based: Detecting known threats.
○ Anomaly-Based: Identifying unusual patterns.
Honeypots: Decoy systems to attract and analyze attackers.
Network Segmentation:
○ VLANs: Isolating network traffic logically.
○ DMZs: Separating public services from internal networks.
Security Operations
Core Security Control Types
●
●
●
Technical Controls: Automated defenses (firewalls, antivirus).
Administrative Controls: Policies and procedures guiding user behavior.
Physical Controls: Barriers like locks and surveillance systems.
Operational Security Practices
●
●
●
●
Patch Management: Keeping systems updated to fix vulnerabilities.
System Hardening: Configuring systems securely by disabling unnecessary features.
Data Loss Prevention (DLP): Preventing unauthorized data transfers.
Logging and Monitoring: Using SIEM tools to analyze security events.
Incident Detection and Response
●
●
●
Incident Detection: Utilizing monitoring tools to identify threats.
Response Protocols: Following predefined steps to address incidents.
Post-Incident Reviews: Learning from incidents to enhance security measures.
Additional Key Concepts
Security Principles
●
●
●
●
●
Adequate Security: Implementing measures proportional to the risks.
Administrative Controls: Enforcing security through policies and procedures.
Asset Management: Inventorying and protecting organizational assets.
Authentication and Authorization: Verifying identity and granting appropriate access.
Availability: Ensuring systems and data are accessible when needed.
Cryptography and Data Protection
●
●
●
●
Confidentiality: Keeping information secret from unauthorized users.
Data Integrity: Ensuring data remains unaltered and accurate.
Encryption: Protecting data by converting it into a secure format.
GDPR and HIPAA Compliance: Adhering to data protection regulations.
Risk and Vulnerability Management
●
●
●
●
Risk Assessment: Identifying and evaluating potential threats.
Impact and Likelihood: Assessing the potential damage and probability of threats.
Non-Repudiation: Ensuring actions cannot be denied by the user.
Risk Management Framework: A structured approach to managing risks.
Governance and Compliance
●
●
●
Governance: Establishing policies and accountability.
ISO and NIST Standards: Following international and national security guidelines.
Privacy and PHI: Protecting personal and health information.
Attack Types and Vulnerabilities
●
●
●
●
●
Malware: Malicious software like viruses and ransomware.
Phishing: Deceptive attempts to obtain sensitive information.
DDoS Attacks: Overloading services to disrupt access.
Privilege Escalation: Gaining unauthorized access to higher privileges.
SQL Injection: Exploiting databases through malicious input.
Threat Actors and Attributes
●
Types of Threat Actors:
○ Script Kiddies: Inexperienced hackers using existing tools.
●
○ Hacktivists: Attackers motivated by political or social causes.
○ Organized Crime: Groups seeking financial gain.
○ Nation-States: Government-sponsored attackers.
○ Insiders: Employees misusing access.
○ Competitors: Organizations seeking an advantage.
Attributes:
○ Internal vs. External: Origin of the threat.
○ Sophistication: Skill level of the attacker.
○ Resources: Available tools and funding.
○ Motivation: Goals driving the attack.
Security Controls
●
●
●
●
●
Technical Controls: Implemented through technology (e.g., encryption).
Physical Controls: Tangible barriers (e.g., locks, fences).
Administrative Controls: Policies and procedures.
Authentication Methods:
○ Single-Factor: One form of verification.
○ Multi-Factor: Combining multiple verification methods.
Control Functions:
○ Deterrent: Discourage attacks.
○ Preventive: Stop incidents from occurring.
○ Detective: Identify incidents.
○ Corrective: Restore systems after an incident.
Incident Response, Business Continuity, and Disaster Recovery
Incident Response (IR)
●
●
Definition: Managing security incidents to minimize impact.
Phases:
1. Preparation
2. Detection and Analysis
3. Containment
4. Eradication
5. Recovery
6. Lessons Learned
Business Continuity (BC)
●
●
Goal: Maintaining essential functions during disruptions.
Plan Components: Roles, responsibilities, and procedures.
Disaster Recovery (DR)
●
●
●
Definition: Restoring systems after significant disruptions.
Plan Components: Steps for recovering IT infrastructure.
Testing: Regular drills to ensure effectiveness.
Business Impact Analysis (BIA)
●
●
Purpose: Identifying critical systems and the impact of disruptions.
Outputs: Establishing RTOs and RPOs.
Recovery Sites
●
●
●
Hot Site: Immediate operational capability.
Warm Site: Some setup required.
Cold Site: Basic setup, significant configuration needed.
Technologies and Tools
Firewalls
●
●
Function: Controlling network traffic based on rules.
Types:
○ Network-Based: Protecting entire networks.
○ Application-Based: Protecting specific applications.
Access Control Lists (ACLs)
●
Purpose: Defining rules for allowing or denying traffic.
VPN Concentrators
●
Role: Managing secure VPN connections.
Intrusion Detection and Prevention Systems
●
NIDS/NIPS: Monitoring network traffic for threats.
●
Detection Methods:
○ Signature-Based: Recognizing known patterns.
○ Behavioral: Identifying anomalies.
Load Balancers
●
Purpose: Distributing network traffic for optimal performance.
SIEM (Security Information and Event Management)
●
Function: Aggregating and analyzing logs for threat detection.
Network Components and Security Mechanisms
Proxy Servers
●
●
Forward Proxy: Handling client requests to external servers.
Reverse Proxy: Managing incoming traffic to internal servers.
IPSec
●
●
Definition: Protocol suite for securing IP communications.
Modes:
○ Tunnel Mode: Encrypting entire packets.
○ Transport Mode: Encrypting payload only.
Protocol Analyzer
●
Function: Capturing and analyzing network traffic for security assessments.
Honeypots
●
Purpose: Attracting attackers to study their methods.
Command-Line Tools
●
●
●
●
ping: Testing connectivity.
tracert/traceroute: Tracing network paths.
nslookup/dig: Querying DNS information.
nmap: Scanning networks for hosts and services.
Summary of Threats, Attacks, and
Vulnerabilities
Analyze Indicators of Compromise and Determine the Type of Malware
Malware: Malicious software designed to harm or exploit any programmable device or network.
●
●
●
●
●
●
●
●
●
●
●
●
●
Virus: Malicious code that replicates by infecting other files or programs.
Crypto-malware: Encrypts files and programs, demanding payment for decryption.
Ransomware: Denies access to data or systems until a ransom is paid; often spread via phishing
emails or infected websites.
Worm: Self-replicating malware that spreads across networks without user intervention.
Trojan: Disguised as legitimate software but performs malicious activities when executed.
Rootkit: Provides privileged access to a computer while hiding its presence.
Keylogger: Records keystrokes to capture sensitive information like passwords.
Adware: Displays unwanted advertisements, possibly replacing browsers and generating fake
ads.
Spyware: Secretly gathers user information and transmits it without consent.
Bot: Automated software controlled remotely, often part of a botnet used for malicious
purposes.
RAT (Remote Access Trojan): Allows attackers to remotely control an infected system.
Logic Bomb: Malicious code that triggers under specific conditions or dates.
Backdoor: Provides unauthorized access to a system, bypassing normal authentication
mechanisms.
Compare and Contrast Types of Attacks
Social Engineering Attacks:
●
●
●
●
●
●
●
●
●
●
Phishing: Fraudulent emails designed to steal sensitive information by appearing legitimate.
Spear Phishing: Targeted phishing attacks aimed at specific individuals or organizations.
Whaling: Phishing attacks targeting high-profile individuals like CEOs.
Vishing: Voice phishing using phone calls or voice messages to deceive victims.
Tailgating: Unauthorized person follows an authorized individual into a secure area.
Impersonation: Attacker assumes someone else's identity to gain access.
Dumpster Diving: Retrieving confidential information from discarded materials.
Shoulder Surfing: Observing someone entering sensitive information.
Hoax: Deceptive information causing users to compromise security.
Watering Hole Attack: Infecting websites frequented by a target group.
Principles of Social Engineering:
●
●
●
●
●
●
●
Authority: Pretending to be someone in power.
Intimidation: Using threats or fear.
Consensus: Leveraging social proof or norms.
Scarcity: Creating a sense of urgency due to limited availability.
Familiarity: Building rapport to gain trust.
Trust: Establishing credibility.
Urgency: Pressuring for immediate action.
Application and Service Attacks:
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
DoS (Denial of Service): Overwhelming a system to make it unavailable.
DDoS (Distributed Denial of Service): DoS attack using multiple compromised systems.
Man-in-the-Middle: Intercepting and possibly altering communication between parties.
Buffer Overflow: Overloading a buffer's capacity, leading to system crashes or code execution.
Injection Attacks: Inserting malicious code into a program (e.g., SQL injection).
Cross-Site Scripting (XSS): Injecting scripts into web pages viewed by other users.
Cross-Site Request Forgery (CSRF/XSRF): Unauthorized commands transmitted from a trusted
user.
Privilege Escalation: Gaining higher access levels by exploiting vulnerabilities.
ARP Poisoning: Redirecting network traffic by falsifying ARP messages.
Amplification Attack: Multiplying attack traffic to overwhelm a target.
DNS Poisoning: Altering DNS records to redirect traffic to malicious sites.
Domain Hijacking: Unauthorized changes to domain registration.
Man-in-the-Browser: Malware that intercepts browser transactions.
Zero-Day Attack: Exploiting unknown vulnerabilities with no available patches.
Replay Attack: Capturing and retransmitting data to impersonate a user.
Pass the Hash: Using hashed credentials to authenticate without cracking the password.
Hijacking and Related Attacks:
●
●
●
Clickjacking: Deceiving users into clicking hidden elements on a web page.
Session Hijacking: Stealing a user's session ID to impersonate them.
URL Hijacking (Typosquatting): Redirecting users to malicious sites due to typographical errors.
Driver Manipulation:
●
●
●
●
Shimming: Injecting code to alter program behavior without changing the original code.
Refactoring: Rewriting code to change its structure without altering functionality.
MAC Spoofing: Changing a device's MAC address to bypass access controls.
IP Spoofing: Altering IP address information to impersonate another system.
Explain Threat Actor Types and Attributes
Types of Threat Actors:
●
●
●
●
●
●
Script Kiddies: Inexperienced individuals using pre-made tools to conduct attacks.
Hacktivists: Attackers motivated by political or social causes.
Organized Crime: Professional criminals focusing on financial gain.
Nation States/APTs (Advanced Persistent Threats): Government-sponsored groups conducting
long-term, sophisticated attacks.
Insiders: Employees or affiliates exploiting their access for malicious purposes.
Competitors: Rival organizations engaging in unethical practices.
Attributes of Threat Actors:
●
●
●
●
●
Internal vs. External: Originating within or outside the organization.
Level of Sophistication: Skill level and complexity of attack methods.
Resources/Funding: Availability of tools, technology, and financial backing.
Intent/Motivation: Objectives such as financial gain, espionage, or activism.
Use of OSINT (Open-Source Intelligence): Gathering publicly available data for planning attacks.
Explain Penetration Testing Concepts
●
●
●
●
●
●
●
●
●
●
Active Reconnaissance: Direct interaction with systems to discover vulnerabilities.
Passive Reconnaissance: Collecting information without direct system interaction.
Pivot: Using a compromised system to access other network resources.
Initial Exploitation: The first successful breach of a system's security.
Persistence: Maintaining access to a system over time.
Privilege Escalation: Increasing access rights beyond initial permissions.
Black Box Testing: Testing without prior knowledge of the system.
White Box Testing: Testing with full knowledge of the system's internals.
Gray Box Testing: Testing with partial knowledge of the system.
Penetration Testing vs. Vulnerability Scanning:
○ Penetration Testing: Simulating attacks to exploit vulnerabilities.
○ Vulnerability Scanning: Identifying potential vulnerabilities without exploitation.
Explain Vulnerability Scanning Concepts
●
●
●
●
●
Passively Test Security Controls: Identifying vulnerabilities without active exploitation.
Identify Vulnerabilities: Finding weaknesses like outdated software or misconfigurations.
Identify Lack of Security Controls: Detecting missing protections such as firewalls or antivirus
software.
Identify Common Misconfigurations: Spotting default passwords, open ports, or weak settings.
Intrusive vs. Non-Intrusive Scans:
●
●
○ Intrusive: May cause service disruptions; detailed analysis.
○ Non-Intrusive: Safe scanning without impacting services.
Credentialed vs. Non-Credentialed Scans:
○ Credentialed: Using valid access credentials to simulate insider threats.
○ Non-Credentialed: Scanning without credentials to simulate external attacks.
False Positive: Incorrectly identifying a non-existent vulnerability.
Explain the Impact Associated with Types of Vulnerabilities
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
Race Conditions: Errors due to the timing of processes, leading to unpredictable behavior.
Vulnerabilities Due To:
○ End-of-Life Systems: No longer receiving updates or support, increasing risk.
○ Embedded Systems: Specialized devices lacking regular security updates.
○ Lack of Vendor Support: Absence of patches or fixes from the vendor.
Improper Input Handling: Failing to validate input, allowing for injection attacks.
Improper Error Handling: Exposing sensitive information through error messages.
Misconfiguration/Weak Configuration: Incorrect settings that open security holes.
Default Configuration: Using manufacturer settings that are often insecure.
Resource Exhaustion: Overconsumption of resources leading to service denial.
Untrained Users: Increased risk due to lack of security awareness.
Improperly Configured Accounts: Users with excessive permissions.
Vulnerable Business Processes: Weaknesses in operational procedures.
Weak Cipher Suites and Implementations: Using outdated encryption methods (e.g., DES,
WEP).
Memory/Buffer Vulnerabilities:
○ Memory Leak: Failing to release memory, causing performance degradation.
○ Integer Overflow: Exceeding storage capacity for numeric values.
○ Buffer Overflow: Exceeding buffer limits, potentially allowing code execution.
○ Null Pointer Dereference: Crashing applications by referencing invalid memory.
○ DLL Injection: Inserting malicious code into processes via Dynamic Link Libraries.
System Sprawl/Undocumented Assets: Unmanaged devices increasing attack surface.
Architecture/Design Weaknesses: Flaws in system design lacking proper security measures.
New Threats/Zero-Day: Unpatched vulnerabilities exploited by attackers.
Improper Certificate and Key Management: Weak handling of cryptographic keys and
certificates, leading to unauthorized access.
Summary of Technologies and Tools
Network Components for Organizational Security
●
●
●
●
●
●
●
●
Firewalls: Control network traffic based on security rules.
○ Application-Based: Software protecting specific applications.
○ Network-Based: Hardware devices protecting entire networks.
○ Stateful vs. Stateless: Stateful track connection states; stateless filter packets
individually.
○ Implicit Deny: Default rule blocking all unspecified traffic.
VPNs and Concentrators:
○ Remote Access VPN: Connects individual users to a network securely.
○ Site-to-Site VPN: Connects entire networks over the internet.
○ IPSec: Secures IP communications with encryption and authentication.
■ Tunnel Mode: Encrypts entire packets.
■ Transport Mode: Encrypts only the payload.
■ AH and ESP: Provide authentication, integrity, and confidentiality.
○ Split Tunnel vs. Full Tunnel: Determines how much traffic routes through the VPN.
Intrusion Detection/Prevention Systems (IDS/IPS):
○ Network IDS/IPS: Monitor network traffic for threats.
○ Detection Methods:
■ Signature-Based: Detect known attack patterns.
■ Heuristic/Behavioral: Identify anomalies compared to a baseline.
○ Inline vs. Passive: Inline can block traffic; passive only alerts.
○ False Positives/Negatives: Incorrect identification of threats.
Routers and Switches:
○ Routers: Direct data packets; use ACLs and anti-spoofing measures.
○ Switches: Connect network devices; employ port security and VLANs.
○ Layer 2 vs. Layer 3: Data link layer vs. network layer functionalities.
○ Loop Prevention and Flood Guards: Prevent network loops and broadcast storms.
Proxies:
○ Forward Proxy: Acts on behalf of clients to access external resources.
○ Reverse Proxy: Handles requests from clients to internal servers.
○ Transparent Proxy: Forwards requests without client configuration.
Load Balancers: Distribute traffic across multiple servers to optimize performance.
○ Scheduling Methods: Round-robin, affinity.
○ Configurations: Active-passive (failover), active-active (load sharing).
○ Virtual IPs: Shared IP addresses for redundancy.
Access Points (APs):
○ SSID: Network identifier.
○ MAC Filtering: Restrict devices based on MAC addresses.
○ Signal Strength and Band Selection: Optimize coverage and performance.
○ Antenna Types: Omnidirectional (360° coverage), directional (focused signal).
○ Controller-Based vs. Standalone: Centralized management vs. individual configuration.
Security Information and Event Management (SIEM):
○ Aggregation and Correlation: Collect and analyze log data.
●
●
●
●
○ Automated Alerts: Notify administrators of security events.
○ Time Synchronization: Ensures consistent timestamps.
Data Loss Prevention (DLP): Prevents unauthorized data access and exfiltration.
○ Features: USB blocking, cloud monitoring, email scanning.
Network Access Control (NAC):
○ Function: Enforces security policies for devices accessing the network.
○ Agents: Dissolvable (temporary) vs. permanent.
○ Host Health Checks: Ensure compliance before granting access.
Mail Gateways:
○ Spam Filtering: Blocks unwanted emails.
○ DLP Integration: Prevents sensitive data leaks.
○ Encryption: Secures email content.
Other Components:
○ Bridges: Connect network segments.
○ SSL/TLS Accelerators: Offload encryption tasks.
○ SSL Decryptors: Inspect encrypted traffic.
○ Media Gateways: Convert communication formats.
○ Hardware Security Module (HSM): Manage cryptographic keys.
2 Security Assessment Tools
●
●
●
●
●
●
●
●
●
●
●
●
Protocol Analyzers: Capture and analyze network traffic (e.g., Wireshark).
Network Scanners: Discover devices and open ports; detect rogue systems.
Wireless Scanners/Crackers: Assess wireless network security.
Password Crackers: Attempt to discover passwords by testing hashes.
Vulnerability Scanners: Identify security weaknesses and misconfigurations.
Exploitation Frameworks: Tools for testing exploits (e.g., Metasploit).
Data Sanitization Tools: Securely erase data to prevent recovery.
Steganography Tools: Hide data within files.
Honeypots: Decoy systems to detect attacker behavior.
Backup Utilities: Ensure data recovery and integrity.
Banner Grabbing: Identify services and versions running on systems.
Command-Line Tools:
○
ping, netstat, tracert/traceroute, nslookup/dig, arp,
ipconfig/ifconfig/ip, tcpdump, nmap, netcat.
Troubleshoot Common Security Issues
●
●
●
●
Unencrypted Credentials: Use encryption for all authentication processes.
Logs and Event Anomalies: Regularly monitor logs for unusual activities.
Permission Issues: Ensure appropriate access controls and perform audits.
Access Violations: Detect and respond to unauthorized access attempts.
●
●
●
●
●
●
●
●
●
Certificate Issues: Maintain valid and trusted certificates; check for expiration.
Data Exfiltration: Implement measures to prevent unauthorized data transfer.
Misconfigured Devices: Verify configurations of firewalls, content filters, and access points.
Weak Security Configurations: Update systems and avoid deprecated protocols.
Personnel Issues:
○ Policy Violations: Enforce compliance with security policies.
○ Insider Threats: Monitor for suspicious internal activities.
○ Social Engineering: Provide employee security training.
Baseline Deviation: Identify and correct deviations from standard configurations.
License Compliance Violations: Ensure all software licenses are valid.
Asset Management: Keep accurate records of hardware and software assets.
Authentication Issues: Use multi-factor authentication to enhance security.
Security Technologies Output Analysis
●
●
●
●
●
●
●
●
●
●
●
●
Host-Based IDS/IPS (HIDS/HIPS): Monitor and protect individual hosts.
Antivirus Software: Detect and eliminate malware.
File Integrity Checkers: Alert on unauthorized file changes.
Host-Based Firewalls: Control traffic to and from a single host.
Application Whitelisting: Allow only approved applications to execute.
Removable Media Control: Restrict use of external storage devices.
Advanced Malware Tools: Use behavioral analysis to detect threats.
Patch Management Tools: Automate software updates.
Unified Threat Management (UTM): Consolidate multiple security functions.
Data Loss Prevention (DLP): Monitor and protect sensitive data.
Data Execution Prevention (DEP): Prevent execution of code in non-executable areas.
Web Application Firewall (WAF): Protect web applications from attacks.
Secure Mobile Device Deployment
●
●
●
Connection Methods:
○ Cellular, Wi-Fi, Bluetooth, NFC: Secure communications against eavesdropping and
unauthorized access.
Mobile Device Management (MDM):
○ Application and Content Management: Control apps and data access.
○ Remote Wipe and Geofencing: Secure lost or stolen devices.
○ Screen Locks and Authentication: Prevent unauthorized device access.
○ Containerization: Separate corporate and personal data.
○ Full Device Encryption: Protect all data on the device.
Enforcement and Monitoring:
○ Avoid risks from third-party app stores, rooting/jailbreaking, and sideloading.
○ Keep devices updated and disable unnecessary features.
●
Deployment Models:
○ BYOD (Bring Your Own Device): Employees use personal devices.
○ COPE (Corporate-Owned, Personally Enabled): Company provides devices for personal
and professional use.
○ CYOD (Choose Your Own Device): Employees select from approved devices.
○ Corporate-Owned: Company retains full control over devices.
○ VDI (Virtual Desktop Infrastructure): Access virtual desktops from mobile devices.
Implement Secure Protocols
●
●
Secure Protocols:
○ DNSSEC: Adds security to DNS queries.
○ SSH: Secure remote command-line access.
○ S/MIME: Encrypts and signs email.
○ SRTP: Secures voice and video communications.
○ LDAPS: Secure LDAP over SSL/TLS.
○ FTPS/SFTP: Secure file transfer protocols.
○ SNMPv3: Secure network management protocol.
○ SSL/TLS and HTTPS: Encrypt web traffic.
○ Secure POP/IMAP: Encrypted email retrieval.
Use Cases:
○ Voice and Video: Implement SRTP.
○ Time Synchronization: Use NTPsec for secure time updates.
○ Email and Web: Protect with S/MIME and HTTPS.
○ File Transfer: Utilize FTPS or SFTP.
○ Directory Services: Secure with LDAPS or SASL.
○ Remote Access: Employ SSH.
○ Domain Name Resolution: Secure with DNSSEC.
○ Routing and Switching: Manage securely using SNMPv3, SSH, or HTTPS.
○ Network Address Allocation: Be aware of DHCP security considerations.
Summary of Architecture and Design
Frameworks, Best Practices, and Secure Configuration Guides
●
Frameworks: Standardized guidelines directing organizational security policies.
○ Regulatory: Mandated by laws (e.g., HIPAA).
○ Non-Regulatory: Voluntary best practices.
○ National/International: Based on national laws or international standards.
○ Industry-Specific: Tailored to specific sectors.
●
●
Secure Configuration Guides:
○ Platform/Vendor-Specific: Hardening instructions for specific systems (web servers, OS,
applications, network devices).
○ General Purpose Guides: Broad security configurations applicable across platforms.
Defense-in-Depth:
○ Vendor Diversity: Using multiple vendors to reduce vulnerabilities.
○ Control Diversity: Implementing administrative, technical, and physical controls.
○ User Training: Regular awareness and training programs.
Secure Network Architecture Concepts
●
●
●
●
Network Zones and Topologies:
○ DMZ: Separates internal networks from the internet.
○ Extranet: Private network for external partners.
○ Intranet: Internal network for organization members.
○ Wireless Networks: Includes internal, guest, and ad hoc networks.
○ Honeynets: Decoy networks to detect attackers.
Network Segmentation:
○ Physical Segregation: Separate physical networks.
○ Logical Segmentation (VLANs): Virtual LANs on the same hardware.
○ Virtualization: Creating virtual networks.
○ Air Gaps: Complete physical isolation of systems.
Security Device Placement:
○ Firewalls, Proxies, VPNs: Control and secure network traffic.
○ Sensors and Collectors: Monitor network data.
○ Load Balancers, DDoS Mitigators: Ensure availability and performance.
Software Defined Networking (SDN):
○ Centralized network management separating control and data planes.
Secure Systems Design
●
●
●
●
Hardware/Firmware Security:
○ FDE/SED: Full disk encryption for data protection.
○ TPM: Secure cryptographic operations in hardware.
○ HSM: Hardware modules managing encryption keys.
UEFI/BIOS Security:
○ Secure boot processes to prevent unauthorized changes.
Operating System Security:
○ Patch Management: Regular updates to fix vulnerabilities.
○ Least Functionality: Disabling unnecessary features.
○ Trusted OS: Systems meeting high-security standards.
Peripheral Device Security:
○
Protecting devices like keyboards, displays, and printers from threats.
Secure Staging Deployment Concepts
●
●
●
Sandboxing:
○ Isolating applications for safe testing and development.
Deployment Environments:
○ Development, Testing, Staging, Production: Segregated environments for controlled
deployment.
Secure Baselines:
○ Establishing standard, secure configurations for systems.
Security Implications of Embedded Systems
●
●
●
Industrial Systems:
○ SCADA/ICS: Securing industrial control systems with proper segmentation.
IoT and Smart Devices:
○ Securing internet-connected devices, wearables, and home automation systems.
Special-Purpose Systems:
○ Medical Devices, Vehicles, UAVs: Ensuring security to protect safety and functionality.
Secure Application Development and Deployment Concepts
●
●
●
●
Development Models:
○ Waterfall: Linear, sequential approach.
○ Agile: Iterative, flexible methodology.
Secure DevOps Practices:
○ Security Automation: Integrating security testing into development pipelines.
○ Continuous Integration: Regularly merging and testing code changes.
Secure Coding Techniques:
○ Input Validation, Error Handling, Code Signing, Encryption.
○ Avoiding vulnerabilities through best practices and code reviews.
Code Quality and Testing:
○ Static/Dynamic Analysis: Tools to detect code issues.
○ Fuzzing: Testing with unexpected inputs.
○ Sandboxing: Isolating applications during testing.
Cloud and Virtualization Concepts
●
Virtualization:
○ Hypervisors:
■ Type I: Runs directly on hardware.
●
●
●
■ Type II: Runs on a host operating system.
○ Containers: Lightweight, isolated application environments.
Cloud Services Models:
○ SaaS: Software as a Service.
○ PaaS: Platform as a Service.
○ IaaS: Infrastructure as a Service.
Cloud Deployment Models:
○ Private, Public, Hybrid, Community clouds.
Security Considerations:
○ VM Sprawl Avoidance, VM Escape Protection.
○ Cloud Access Security Broker (CASB): Enforcing security policies in cloud environments.
Resiliency and Automation Strategies
●
●
●
●
Automation/Scripting:
○ Consistent security configurations and rapid deployment through scripts and templates.
Non-Persistence:
○ Snapshots, Reverting to Known States, Live Boot Media for system recovery.
Scalability and Elasticity:
○ Systems that adapt to workload changes and distribute resources effectively.
Redundancy and Fault Tolerance:
○ Implementing backups and redundant systems to prevent single points of failure.
Physical Security Controls
●
●
●
●
●
●
Access Controls:
○ Locks, Mantraps, Biometrics, Tokens/Cards.
Perimeter Security:
○ Fencing, Gates, Barricades, Bollards.
Monitoring and Detection:
○ Cameras, Motion Detectors, Alarms.
Environmental Controls:
○ HVAC Systems, Fire Suppression, Hot and Cold Aisles in data centers.
Protective Measures:
○ Safes, Secure Cabinets, Faraday Cages, Screen Filters.
Administrative Controls:
○ Signs, Key Management, Security Guards.
Summary of Identity and Access Management
●
●
●
●
●
AAA Framework:
○ Identification: Recognize user identity.
○ Authentication: Verify user identity.
○ Authorization: Determine user permissions.
○ Accounting: Track user activities.
Multifactor Authentication (MFA): Using two or more of the following factors:
○ Something You Know: Password, PIN.
○ Something You Have: Smart card, token.
○ Something You Are: Biometrics (fingerprint, retina scan).
○ Somewhere You Are: Location-based factors.
○ Something You Do: Behavioral patterns.
Federation: Linking user identities across multiple systems or organizations for shared
authentication (e.g., logging in with Google credentials).
Single Sign-On (SSO): Access multiple applications with one set of credentials.
Transitive Trust: Trust relationships extending through intermediaries (if A trusts B, and B trusts
C, then A trusts C).
Install and Configure Identity and Access Services
●
●
●
Directory Services and Protocols:
○ LDAP: Queries/modifies directory services (port 389).
○ Secure LDAP: LDAP over SSL/TLS (port 636) for encrypted communication.
Authentication Protocols:
○ Kerberos: Mutual authentication using tickets; developed by MIT.
○ TACACS+: Encrypts all communication; separates authentication and authorization (port
49).
○ RADIUS: Centralized authentication; encrypts only passwords (ports 1812/1813).
○ CHAP/MS-CHAP: Challenge-response authentication; MS-CHAP adds mutual
authentication.
○ PAP: Sends credentials in plaintext; insecure.
○ NTLM: Windows authentication protocol; mostly replaced by Kerberos.
Federation and SSO Technologies:
○ SAML: XML-based standard for web SSO.
■ Roles: Principal (user), Identity Provider, Service Provider.
○ OpenID Connect: Authentication layer over OAuth 0.
○ OAuth: Token-based authorization standard.
○ Shibboleth: Open-source SAML implementation.
○ Secure Token: Uses tokens for authentication.
Implement Identity and Access Management Controls
●
Access Control Models:
●
●
●
●
○ Mandatory Access Control (MAC): Access based on security classifications.
○ Discretionary Access Control (DAC): Access controlled by data owners.
○ Role-Based Access Control (RBAC): Access based on user roles.
○ Rule-Based Access Control: Access determined by system rules.
○ Attribute-Based Access Control (ABAC): Access based on attributes and policies.
Physical Access Controls:
○ Proximity Cards: Contactless access cards.
○ Smart Cards: Embedded chips; may require PIN.
○ Biometric Factors: Fingerprints, retina/iris scans, voice, facial recognition.
■ Performance Metrics:
■ FAR: False Acceptance Rate.
■ FRR: False Rejection Rate.
■ CER: Crossover Error Rate (optimal balance).
Tokens and One-Time Passwords:
○ Hardware Tokens: Physical devices generating codes.
○ Software Tokens: Apps generating codes.
○ HOTP: One-time password valid until used.
○ TOTP: One-time password valid for a set time period.
Certificate-Based Authentication:
○ PIV/CAC Cards: Government-issued smart cards with certificates.
○ IEEE 801X: Port-based network access control.
File and Database Security:
○ Encrypting files and databases; setting appropriate access permissions.
Common Account Management Practices
●
●
Account Types:
○ User Accounts: Individual users.
○ Shared/Generic Accounts: Used by multiple users; discouraged.
○ Guest Accounts: Temporary, limited access.
○ Service Accounts: For applications/services.
○ Privileged Accounts: Elevated permissions (administrators).
General Practices:
○ Least Privilege: Minimum necessary access for users.
○ Onboarding/Offboarding: Managing user access during hiring and termination.
○ Permission Auditing: Regular reviews of user permissions.
○ Usage Auditing: Monitoring user activities for anomalies.
○ Time-of-Day Restrictions: Limiting access to specific times.
○ Recertification: Periodic validation of user access rights.
○ Standard Naming Convention: Consistent account naming for clarity.
○ Account Maintenance: Updating and disabling accounts as needed.
○ Group-Based Access Control: Assigning permissions to groups.
●
○ Location-Based Policies: Access based on geographic location.
Account Policy Enforcement:
○ Credential Management: Secure storage and handling of credentials.
○ Group Policy: Centralized management in Windows environments.
○ Password Policies:
■ Complexity: Enforcing strong passwords.
■ Expiration: Regular password changes.
■ History/Re-use: Preventing reuse of recent passwords.
■ Length/Age: Setting minimum length and maximum usage duration.
○ Password Recovery: Secure methods for resetting passwords.
○ Account Lockout: Disabling accounts after failed login attempts.
○ Account Disablement: Deactivating accounts when unnecessary or compromised.
Summary of Cryptography and PKI
Basic Concepts of Cryptography
●
●
●
●
●
Encryption Types:
○ Symmetric Encryption: Uses a single shared key for both encryption and decryption
(e.g., AES).
○ Asymmetric Encryption: Uses a key pair—public key for encryption and private key for
decryption (e.g., RSA).
Hashing: Generates a fixed-size hash value from input data to ensure integrity (e.g., SHA-256).
Key Concepts:
○ Digital Signatures: Provide integrity, authentication, and non-repudiation by encrypting
hash values with a private key.
○ Salt, IV, Nonce:
■ Salt: Random data added to passwords before hashing to prevent attacks like
rainbow tables.
■ Initialization Vector (IV): Random value used with a key to ensure unique
encryption output.
■ Nonce: Number used once to prevent replay attacks.
Elliptic Curve Cryptography (ECC): Offers strong security with smaller keys, ideal for low-power
devices.
Data States:
○ Data in Transit: Data moving over a network; should be encrypted (e.g., using TLS).
○ Data at Rest: Stored data; protected by encryption to prevent unauthorized access.
○ Data in Use: Data in memory or processing; typically unencrypted for functionality.
Cryptographic Algorithms and Characteristics
●
●
●
●
Symmetric Algorithms:
○ AES (Advanced Encryption Standard): Secure, fast; key sizes of 128, 192, or 256 bits.
○ 3DES (Triple DES): Applies DES three times; more secure than DES but less efficient than
AES.
○ Blowfish/Twofish: Flexible key lengths; suitable for various applications.
Asymmetric Algorithms:
○ RSA: Widely used for secure data transmission and digital signatures.
○ Diffie-Hellman: Key exchange protocol allowing secure sharing of symmetric keys.
○ ECC: Efficient for mobile devices due to smaller key sizes.
Hashing Algorithms:
○ MD5: Produces a 128-bit hash; deprecated due to vulnerabilities.
○ SHA:
■ SHA-1: 160-bit hash; obsolete.
■ SHA-2: Includes SHA-256 and SHA-512; widely used.
○ HMAC: Combines a hash function with a secret key for message integrity and
authentication.
Key Stretching Algorithms:
○ Bcrypt and PBKDF2: Strengthen weak passwords by making them computationally
intensive to crack.
Wireless Security Settings
●
●
●
Security Protocols:
○ WPA2: Current standard; uses AES with CCMP for robust security.
○ WPA: Uses TKIP; less secure than WPA
Authentication Protocols:
○ EAP (Extensible Authentication Protocol): Framework supporting multiple
authentication methods.
○ Variants include PEAP, EAP-TLS, EAP-TTLS, offering different security features and
certificate requirements.
Wireless Modes:
○ Pre-Shared Key (PSK): Shared passphrase for network access.
○ Enterprise Mode: Uses individual credentials with 801X authentication.
○ Open Mode: No authentication; insecure and not recommended.
Implementing Public Key Infrastructure (PKI)
●
PKI Components:
○ Certificate Authority (CA): Trusted entity that issues digital certificates.
○ Certificates: Bind public keys to identities; used for secure communication.
○ CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol):
Methods to check the revocation status of certificates.
●
●
Certificate Types:
○ Wildcard Certificates: Secure multiple subdomains with a single certificate.
○ SAN (Subject Alternative Name) Certificates: Secure multiple domain names.
○ Code Signing Certificates: Authenticate the source and integrity of software code.
Certificate Formats:
○ DER: Binary format; cannot be edited with a text editor.
○ PEM: Base64 encoded; supports multiple certificates and keys in one file.
○ PFX/P12: Binary format storing certificates and private keys; often password-protected.