Cheat Sheet
For
CompTIA Security+ (SY0-701)
Version 1.0
2025 edition
Presented by
YMT Knowledge Sharing – Cyber Security
Human knowledge belongs to the world
CIA
Confidentiality: Ensuring only
authorized person can access to
asset
Integrity: Ensuring
change/modification is valid or
not
Availability: Ensuring uptime to
access
Encryption
Encryption: transform data to unreadable format
Encrypted data = Cipher text
Human readable data = Plain Text or Clear text
Encryption requires key for encryption
Key need to be secure and not expose to other
Encryption provides confidentiality
Two major elements of encryption are key and algorithm
Famous encryption algorithms: AES, RSA, RC4, ECC
ECC is mainly used for mobile encryption
IAAA
Identification: The thing that represent to you ( Username, User ID )
Authentication: proving that your legitimate or not ( Password, token,
fingerprint et c..)
Authorization: privilege access level ( permission ) based on what your
role.
Accounting: recording your activities ( Logs file )
Username must be unique.
Shared account should not be used.
Authorization should be granted based on the least privilege.
Availability
Main purpose: Ensuring uptime and reducing down time as much as possible.
Must avoid SPOF ( single point of failure )
High Availability ( HA is redundant design for mission critical systems ).
Hard disk redundancy: RAID
RAID-0 = Stripping ( No Redundancy, 2 HDD required, Half data only can be recovered, Faster I/O )
RAID-1 = Mirroring ( Redundancy: yes, 2 HDD required, Full data can be recovered, slower I/O.
RAID-5 = Stripping priority ( Redundancy: yes, 3 HDD required, full data can be recovered, good I/O performance, cost is high.
Server redundancy: Fail-over ( Passive ) and Clustering ( Active )
Fail-over = 1 server ( primary ) is running, another server is no running and prepare to be ready to replace when primary server is down.
Clustering = running multiple servers ( same service ) at the same time. If one server down, other will carry on, Load balancer is required)
Site redundancy
Cold site: Nothing but space and basic facility , recover time is the longest, cheap
Warm site: All infra facility to run application ( Server, Network devices, Rack, UPS etc ..) but no data
Hot site: All facility + Data. But Data is not recent
Mirror site: Most redundant site ever, all is set. Infra facility + Recent Data ). Very expensive.
Rolling hot site: aka mobile site. Temporary small location like container space. Compact but enough facility for running core services.
MAA site: Shared facility.
Business Continuity Planning ( BCP ) = ensures company leaders can react quickly and efficiently to a business interruption.
Authentication type
Something you know: What you know, the knowledge ( password, PIN code etc ..
Something you have: What you have, the physical item! ( Card, Physical Token
Something you are: What you are, your body parts! ( finger-print, face scan, Iris etc .. )
MFA ( Multi-Factor Authentication ) – more then one authentication type ( Authentication should not be the same ).
All critical systems must be used MFA for authentication.
MFA → Are → Have → Known
Defense in Depth
= aka layer
security! Using
multiple security
control in different
layer to protect the
attack
Control type ( Based on Function )
Detective Control: Only monitor and detect the incident and intrusion , can’t prevent ( e.g CCTV, IDS etc ..
Preventive Control: Can prevent the incident and intrusion ( EDR, Firewall etc ..
Corrective Control: able to reverse the impact of that particular event ( e.g Backup, patching )
Deterrent Control: Discouragement or have attackers think twice about the attack that they’re planning (e.g Warning Banner, Guard Dogs )
Directive Control: Instructions, Policy to be followed. (e.g Security Policy, AUP etc .. )
Compensating control: A temporary control that place to satisfy the requirement for a security measure that is deemed too difficult or
impractical to implement at the present time.
Hashing
Hash: generates the unique value ( Checksum ) for data
Hash not transform data to another format ( no like
encryption)
Hash is used for data verification
Hash supports integrity
Famous hashes are MD5, MD4.SHA1, SHA2
Currently SHA2 and SHA3 are most secured
Avoid MD5 and SHA-1 for cryptographic purposes. Coz of
message collision
Message Collision: where two different inputs (messages) produce the same hash
value when passed through a cryptographic hash function
Encryption and hash different
Encryption
Data + ( Key and Algorithm ) = Cipher text
Cipher text is not human unreadable format
Decryption
Cipher text + (Key + Algorithm) = Plain text
Plain text is the human readable format
Algorithm is open. Key is most important element and without having the key no one can
decrypt the cipher text to plain text ( e.g like Password protection for Win Rar file ).
Hashing
Data + Hash Algorithm = Checksum of Data
Non-reputation
provides evidence for the existence of a message or transaction and ensures its contents
cannot be disputed once sent.
Can’t deny his action
Logs and digital signature supports for non-reputation.
Control
Main purpose: to detect and protect attack and incident.
Technical control: aka logical control, that technically detect and prevent attack and
incident. Engineer or technician must implement to run effectively. ( e.g firewall, IDS,
Anti-Virus ).
Managerial control: high level documents and procedures for security improvement. (
Information security policy, Data encryption policy etc .. ). GRC team and information
security management team normally write these policies.
Physical Control: To detect and prevent intruder entering. ( e.g Mantrap, CCTV etc ...
Zero-Trust Model
Objective: ensuring that only authenticated and authorized entities can access
networked resources.
Control Plane is the most important in Zero-trust model acting like Gatekeeper to monitor
and restrict every access to our assets.
Deception
Honeypot is popular for deception to attacker
Fake system that lures to attacker.
Honeyfile = the fake files in Honeypot (e.g password.txt, credential.txt
Honeynet = a group of honeypots which are interconal in a network that simulates an entire
fake network that enables attackers to find fake servers, routers and firewalls.
Honeytoken = fake credentials that is given to attackers to track the malicious attackers.
Why using honeypot?
Ans: to study, analyze and deflect the hacking attempt, especially to zero-day attacks.
Caution: Legal issue
entrapment – illegal (lured into committing a crime )
Entrapment – Legal (capturing evidence of unauthorized access by someone who willingly
targets the system.)
Security Through Obscurity (STO)
A security approach that primarily relies on secrecy for securing networks, systems, or
applications from unauthorized access. ( e.g changing ssh port from 22 to 2222 )
Weak and unreliable security method
DNS Sinkhole
Can redirect the user bad request ( Bad Domain URL) to sinkhole IP ( Control IP).
Corrective control and deception technique.
Blackhole Route
Aka Null route
Mainly used for DDoS attack mitigation. Redirect the DDoS traffic to blackhole IP.
Change Management
Process of making sure changes are made smoothly and efficiently
and do not negatively affect systems reliability, security,
confidentiality, integrity, and availability. Change Management is
preventive control
DoS
DDoS
Attack from single IP
Attack from multiple Ips (
Zombie Ips )
Small scale
Large
scale
Easy to detect
Hard to detect
Control: Block IP
Control: DDoS mitigation
system
Rollback plan: switch back to the secondary system, which at
this point, you haven’t made any changes to.
Bot
Zombie
Botnet
A bot is an automated program or script that
performs specific tasks, which can be either
legitimate (e.g., chatbots) or malicious.
A zombie is a compromised device (infected
by malware) controlled by an attacker without
the owner’s knowledge.
A botnet is a network of zombies
(compromised devices) controlled by an
attacker (botmaster/herder).
Change Management
Change request: Should start from Product owner
CAB: Change Authorization Board, who authority to approve or reject change request
Change should be tested in UAT first
Change windows must be included in CR
Roll back plan: if something happen, go back to original state ( must be included in CR )
CAB aka Change Control Committee
CAB main job: to balance the risk of not making the change versus implementing the change and having a problem.
Every successfully changes must be recorded
owner is responsible for testing their systems and verifying that everything is working properly, after changes complete.
Need to research and identify any of the stakeholders who might be affected by this change. ( Stakeholder - the
individuals or departments that will be impacted by the change that you’re proposing.
Downtime need to be added in CR
Freeze time: No Change happen!
Zero-Day Vulnerability
A software flaw that is unknown to the vendor and lacks a patch,
making it vulnerable to attacks.
Zero-Day Exploit
A tool or technique used by attackers to actively exploit a zero-day
vulnerability before it is patched.
Patch Management
Patch management is the process of identifying, acquiring, testing, and deploying updates (patches) to
software and systems to fix vulnerabilities
Patch Management Process
•Assessment: Evaluate the urgency and risk of unpatched vulnerabilities.
•Testing: Validate patches in a controlled environment to avoid disruptions.
•Deployment: Apply patches to production systems in a phased or prioritized manner.
•Verification: Ensure patches were applied successfully and address the issue.
•Documentation: Maintain records of patches applied for compliance
Threat type
Script kitty: Beginner of hacking, uses hacking tools to make attack
Hacker: skillful hacking, professional
White Hat: Aka ethical hacker or Pentester, good guy, Hack for security improvement
Black Hat: Bad guy, hack for personal gain
Gay Hat: look for vulnerabilities in a system without the owner's permission or knowledge. If issues are
found, they report them to the owner, sometimes requesting a small fee to fix the problem.
APT: Entire government behind it, nation state sponsor (e.g Stuxnet )
Hacktivism: uses hacking techniques for political or social causes.
Insider: The highest risk, too much knowledge about organization structure and nature. Hard to control.
organized crime: motivated by profits, targeting high profile company, selling PII information in dark
web
DAST Vs SAST Vs SCA Vs Network-Based Vulns Scan
DAST: can identify app level vulns, web application vulns scan
SAST: can identify code level vulns, source code scan
SCA: can identify third party libraries and plugins’ vulns
Network-based Vuln Scanner: can identify the vulnerabilities
of operation system and misconfigurations.
Vulnerability, Exploit and Patch relation
Threat vector: aka attack vector,
the methods to gain access to a
system
WSUS is a Microsoft tool that
allows organizations to manage
and deploy updates and patches
for Windows-based systems in a
centralized manner
Vulnerability
A flaw or weakness in a system (e.g., software bug, misconfiguration).
Exploit
A tool, code or method attackers use to take advantage of the vulnerability
Patch
A fix or update provided by the vendor to close the vulnerability and stop exploits
Vulnerability
Discovered
Exploit
Developed by
Hacker
Vendor releases
the patch to fix
vulnerability
Vulnerability
close
Pentest: hack to know the existing vulnerabilities
Need NDA before start pentesting
Scope is important
White box: provides full information to Pentester
Black box: just share company name, Domain, least
information to pentester
Gray box: partial information to pentester, ( e,g IP address,
Network map etc .. )
Background check need to be done for pentest company
Penetration testing
Vulnerability Scanning
an active attack on the
network to exploit
vulnerabilities, can assess
potential damages and the
potential of the exploits
being found
Vulnerability scans
passively scans and
identifies the existing
vulnerabilities and
misconfigurations.
Vulnerability Scanning
Can identify the missing updates, vulnerabilities, misconfigured security settings.
Intrusive scan: deep scanning, can identify much more info, can interrupt service, exploits the existing vulns.
Non-intrusive scan: does not exploit vulnerabilities and does not disrupt service.
Auth-Scan: need credential of system, can get more information and accuracy is high. inside the network, emulates an
insider attack.
Non-Auth Scan : no need credential, less info than auth-scan. outside the network, emulates an outside attack
Agent Scan: Agent need to be installed, can get more reliable info, accuracy is high.
Vuln scan could impact service reliability, need to announce first to Product owner before scanning.
Scan template can be used for specific vulns detection.
Vulnerabilities
Race condition: when a system's outcome depends on the timing or sequence of multiple operations, allowing attackers to
manipulate the process
Improper input handling: System can not properly validate data, allows for an attacker to create an input that is not
expected.
Improper error handling: Error message that showing sensitive information.
Resource exhaustion: number of resources to execute an action are expended
Memory leak: a program repeatedly allocates memory for temporary data but forgets to free it after use
Integer overflow: Large integer exceeds data storage capacity.
Buffer overflow: Too much data for the computer’s memory to buffer
Pointer dereference: : Failed deference can cause memory corruption and the application to crash
DLL injection: Allows for the running of outside code
System sprawl: No proper asset inventory, allowing unsecure devices and systems to connect to the network
Weak Cipher: Using insecure cipher for data encryption.
Aspect
Hotfix
Patch
Service Pack
Purpose
Urgent fix
Regular update
Comprehensive package
Scope
Specific issue
Multiple issues
All previous fixes + features
Release Frequency
As needed (urgent)
Scheduled (e.g., monthly)
Rare (e.g., once a year)
Testing
Minimal
Moderate
Extensive
Examples
Fix for critical bug
Security patch
Major OS update package
IDS: Detect attack, can’t prevent
IPS: Detect and prevent attack
NIDS: Network-based
HIDS: Host-based ( can inspect encrypted traffic )
Detection Methods
Signature-based: can detect known attacks, can’t detect zero-day (unknown
attack)
Heuristic/behavioral: Can detect zero-day attack by checking with Baseline.
Anomaly: Can detect unknown attack patterns.
Modes
Inline: connect to network and check the traffic in real time
Passive: connect to switch and copy the traffic to monitor
SPAN port in switch is used for passive mode.
SPAN port = port mirroring
In-band: real time protection and blocking , Latency need to be considered
Out of the band: Passive monitoring, can’t block the traffic, no latency issue.
IPS/IDS rules need to be tuned properly to avoid false positives.
Application nature is key for IPS/IDS tuning.
Aspect
Router
For traffic routing to another network.
ALC is used for basic access rule setup.
Should not use the default configuration.
Anti-spoofing
Rejects the packet that have invalid source addresses
Load balancer
A reverse proxy that distributes network or application traffic across a number of servers.
Scheduling: Sends requests to servers using set rules.
Affinity: Sends client requests to the same server based on the client's IP address.
Round-robin: Sends requests in a predefined order.
Active-passive: Some servers are not active and only go active to take excess traffic or if an active server fails.
Active-active: All servers are actively processing requests
Virtual IPs: An IP address and a specific port number that can be used to reference different physical servers.
Provides IP addresses that can float between two or more physical network nodes and provide redundancy.
Switch
to connects devices together on a computer network.
Port security: restricts the invalid devices ( MAC Address )
Loop prevention: uses STP, detecting and blocking redundant paths that can
cause broadcast storms
Flood guard protects against excessive network flooding by limiting the number
of MAC addresses learned on a port.
Don’t use default configuration.
WPS
- To connect devices to a Wi-Fi network without needing to manually enter the
Wi-Fi password
Push Button Method: Press a physical WPS button on the router and on the
device to establish a connection
PIN Method: Enter an 8-digit PIN displayed on the router or device to connect
- Not Recommended for Sensitive Networks
- PIN Method: Vulnerable to bruteforce attack
Forward Proxy
Reverse Proxy
Transparent Proxy
SOCKS Proxy
HTTP Proxy
Position
Between the client
and the internet.
Between the client
and backend servers.
Intercepts traffic
invisibly (in the
middle).
Between the client
and the internet.
Between the client
and the internet.
Purpose
Hides the client’s
identity.
Hides and protects
the server.
Filters and monitors
traffic without
awareness.
Handles non-web
traffic (e.g., FTP,
SMTP).
Specifically handles
web traffic
(HTTP/HTTPS).
Client Knowledge
Requires client
configuration.
No client
configuration
needed.
No client knowledge
or configuration
required.
Requires client
configuration.
Requires client
configuration.
Traffic Supported
Mostly HTTP/HTTPS.
Mostly HTTP/HTTPS.
Mostly HTTP/HTTPS.
Any type of traffic.
Only HTTP/HTTPS.
Use Case
Bypassing
restrictions, privacy.
Load balancing,
security for servers.
Content filtering,
monitoring traffic.
File sharing,
torrenting, or gaming.
Content filtering and
web caching.
Wireless Access Point
802.11 Standard
Open Authentication = No Authentication = No Security
Famous wireless auth protocols: WEP, WPA, WPA2, WPA3
Cell sizing: Placement and Antenna positioning
SSID Hiding: Disable SSID broadcasting ( weak security )
WEP and WPA are not secured
WEP uses small IV and easy to crack ( RC4 is used )
MAC filtering: Restricts invalid MAC address
MAC spoofing can bypass MAC filtering
War driving: searching nearby Wifi network.
InSSIDer, Aircrack, Netstumblers are famous war driving tools
War-chalking: symbols of wireless network
WPA/WPA2 Mode: PSK ( personal ) and Enterprise ( RADIUS server , AAA )
Enterprise mode is most secure
DLP
Detect and prevent data leak to
outside parties.
USB storage device, Email, FTP site
etc. ..
Network DLP: Sending sensitive
data via email, FTP, HTTP
Endpoint DLP: Copying files to
USB or taking screenshots
Cloud DLP: Unsecured sensitive
files in cloud storage
SIEM
Aggregation: Gathering the logs from different sources
Correlation: Relating various events to identifiable patterns
Automated alerting and triggers: Sending alert when specific event
trigger
Event deduplication: Ensuring same event is not recorded over and
over again
WORM: Prevents alteration of logs and archives the source logs with
write protection.
Time sync is very important for log correlation.
Zero Trust Network Access: Concept that "Never trust, always verify."
No implicit trust for any user/device, inside or outside the network
SSL/TLS accelerators
Offloading processor-intensive public-key encryption for TLS or its SSL to a
hardware accelerator. Handling multiple https requests for both encryption
and decryption.
SSL decryptors
Decrypts SSL/TLS traffic for inspection.
HSM
Ensures keys are securely generated, stored, and used in cryptographic
operations without exposing them to untrusted system.
Feature
TPM
HSM
Data
Encryption
Small
Bulk
Cryptographic
power
Small
Large
Not scalable
Scalable for
enterprise
needs
Built-in Device
( Motherboard )
Additional
Appliance
Personal
Computer
high-security
vault for
managing and
performing
cryptography
at an
organizational
scale
Scalability
Scalable for
enterprise
needs
Usage
NAC
Enforcing security policies on devices that access
networks.
Compliance fail need to go to remediation center to
be fixed.
Posture Checking (or) Health Check
Agent base NAC: Device need to install agent
Dissolvable agent: Disappears after reporting
information to the NAC device.
Protocol analyzer
Can be hardware or software that can that captures
packets to decode and analyze their contents. Aka
Packet sniffer.
Famous Protocol analyzer: Wireshark, Tcpdump
Firewall
Uses ACL( Access Control List ) to restrict inbound and outbound traffic.
Filtering: IP, Port, Application
Next Gen Firewall = L7 firewall ( can filter app )
Traditional Firewall = L3/L4 ( Port and IP )
Throughput is the max traffic that can inspect in second
UTM = All in one security box, including ( URL filtering, Malware inspection,
Firewall, Web security etc ..
UTM throughput is low
NGFW throughput is high
Implicit deny last rule in an ACL that indicates that, "all traffic that isn't explicitly
allowed is implicitly denied
Stateful Firewall: Smart and remembers connections ( state table )
Stateless Firewall: Simple, fast, and works on fixed rules ( Rules )
Zoning
Public: open to all (e.g web server )
Private: only accessible to internal network, sensitive info ( e.g DB, File server )
DMZ: buffer zone between the public and private networks, limited access (e.g email server, reverse
proxy )
Two firewalls use for zone segmentation.
Extranet: Private network that can only be accessed by authorized individuals. Links a company with
its suppliers and customers
Intranet: Network that exclusively for the use of the members of the organization, cannot be
accessed by anyone outside the organization
AirGap: Physically isolated network, high end security
Secure boot: ensures that only trusted software components (e.g., OS loaders, firmware) are loaded
during boot and preventing malicious files.
Attestation: verifies and reports that the device is in or has remained in a trusted state during or after
the boot process
local attestation, a security agent running on the system verifies the measurements against known
good values
remote attestation, the signed report is sent to a verifier (e.g., a cloud service, administrator server)
Application Whitelisting: Applications allowed on the system, the rest of them is denied.
Application Blacklisting: Applications denied on the system, the rest of them is allowed.
System hardening: disables unnecessary services/ports/functions to be secured. Avoiding default
configurations ( e.g Default username and password.
Golden image : aka Master image, already hardening OS image ( e.g USGCB/CIS )
Data execution prevention (DEP): Memory regions are marked as non-executable which prevents
code from being executed. Can prevent buffer overflow attack
Web application firewall : to detect web application attacks like SQL injection, XSS etc ..
Jump servers: placed between different security zones and provide secure access from devices in
one zone to devices in the other zone
Domain Name System Security Extensions (DNSSEC) : provides
validation for DNS responses by adding a Resource Record Signature
(RRSIG)
RRSIG : provides data integrity and authentication and helps prevent
DNS poisoning attacks.
Dynamic ARP Inspection (DAI): ensures that only trusted ARP replies
are accepted, blocking spoofed or malicious ARP traffic ( prevent ARP
spoofing and poisoning attack )
NetFlow is a feature on many routers and switches that can collect IP
traffic statistics
SASE is a cloud-based security framework that combines networking
and security services to deliver secure and fast access to applications,
no matter where users are locate
SASE = Networking + Security in the Cloud
Mail gateway
Monitoring incoming and outgoing emails. Mail gateway can support the
following features
Spam filter
DLP
Malware check.
Feature
FED
SED
Encryption Method
Software
Hardware
Performance Impact
High
Low
Cost
Low
High
Sandbox: Activity monitoring in isolated area. Mainly uses for malware
analysis.
FIM : Continuously monitoring and comparing files and directories for
changes to ensure their integrity
NAT (Network Address Translation): Translates private IP addresses
into public and public IP addresses to private.
VLAN: Separate areas are segmented for different networks, but still
housed on the same switch
VLAN Hopping Attack: where an attacker tricks a switch into sending
traffic from one VLAN (Virtual Local Area Network) to another. Port
security must be used.
Reconnaissance: aka foot printing, gathering information
about targeted system.
Active Recon: Directly involved with targeted system, sending
data and understanding the response ( e.g port/vulns scanning
). Easy to be detected, result accuracy is high.
Passive Recon: Not directly touch the systems, sniffing,
gathering already available information ( e.g whois, social
network ). Hard to detect, result accuracy is low.
Vulnerability Scanning: Detecting existing vulnerabilities to be
exploited
Exploitation: Using exploit to take advantage of a vulnerability
or weakness in a system, application, or network to gain
unauthorized access.
Privilege Escalation: Allows for a normal user privilege to get a
higher-level access.
Pivot: Aka Island hopping, using a compromised machine to
attack other machines on the same network.
Persistence: To maintain unauthorized access to a
compromised system or network over an extended period
Installing Backdoor, running the malicious task using task
schedular ( corn in Linux ), adding malware in registry startup.
Aspect
Vertical
Escalation
Horizonal
Escalation
Privilege Level
Gains higher
privileges
Maintains the
same privilege
level
Gain admin or root
access
Impersonate or
act as another
user
Objective
Covering tracks in hacking refers to the methods attackers use
to erase evidence of their activities to evade detection and
forensic analysis.
e.g Log Deletion, Log manipulation
Store logs in a secure, remote location (e.g., SIEM solutions) to
prevent tampering
Anti-Forensic: Techniques and tools used by attackers to
obstruct, delay, or prevent forensic investigators from gathering
evidence of their activities
Chain of Custody : ensures that evidence is properly handled, documented, and preserved from the time it is collected until it is presented in legal or investigative
proceedings
Step
Description
Identificatio
n
Determine what constitutes evidence (e.g., logs, devices, files).
Collection
Collect the evidence carefully using appropriate tools and techniques
to avoid contamination
Documentati
on
Record details such as who collected the evidence, the time, date,
location, and description of the evidence
Storage
Secure the evidence in a tamper-proof and secure location
Transfer
Document each time the evidence is transferred, including who
received it, why, and when.
Analysis
Ensure that forensic analysis is performed by authorized individuals
and is documented.
Presentation
Present evidence in a way that retains its integrity and complies with
legal standards.
Kill Chain Step
Definition
Controls to Mitigate
Reconnaissance
Researching and identifying targets, gathering information.
- Network segmentation
- Threat intelligence
- Employee awareness training
Weaponization
Preparing a payload (e.g., malware) to exploit vulnerabilities.
- Secure development lifecycle (SDL)
- Malware detection tools
Delivery
Transmitting the payload (e.g., phishing, USB drops).
- Email filtering
- Endpoint protection
- USB port control
Exploitation
Exploiting a vulnerability to execute malicious actions.
- Regular patching
- Vulnerability management
- EDR (Endpoint Detection and Response)
Installation
Installing malware or a backdoor for persistence.
- Application whitelisting
- File integrity monitoring
Command and Control (C2)
Establishing communication with attacker-controlled systems.
- DNS filtering
- Anomaly-based monitoring
- Network segmentation
Actions on Objectives
Performing the intended attack (e.g., data exfiltration,
destruction).
- Data loss prevention (DLP)
- Continuous monitoring
- Incident response plan
Vulnerability assessment
to assess the security posture of systems and networks,
identifying vulnerabilities or weaknesses within systems,
networks, and organizations
Vuln assessment is one of the risk management plan.
Common Vulnerabilities and Exposures (CVE) : a dictionary of
publicly known security vulnerabilities and exposures. Funded by
the U.S. government
Vulnerability scanner: can identify a wide range of weaknesses
and known security issues that attackers can exploit
SCAP : automate and standardize security compliance checks,
making it easier to ensure systems follow best practices.
Developed by NIST
Credentialed scan
Uses valid credentials to log in to systems
Deep Scan (sees inside OS & software configs)
More accurate – fewer false positives
Non-Credentialed Scan
No login; scans from outside like a hacker would
Surface-level scan
More false positives and false negatives
Physical Pen Testing
Tests physical security controls ( e.g Bypassing locks, doors, guards )
Snapshots to capture data for forensic analysis
Artifacts are pieces of data on a device ( web history, Recycle bin etc .. )
Offensive Pen Testing
Simulates real-world attacks from an external/internal hacker
(Breaking systems like a hacker)
Legal Hold: A legal instruction to preserve all relevant data for a pending
investigation or lawsuit.
Defensive Pen Testing
Focuses on blue team response & resilience (e.g Testing detection &
response )
Integrated Pen Testing Combines offensive + defensive testing (e.g
Red team attacks vs. Blue team defenses (Purple Team)
Rules of Engagement (RoE)
A formal agreement that defines how a penetration test or security
assessment will be conducted.
Key Elements:
Scope – What systems, IPs, and services can be tested
Timing – When testing can occur (e.g., business hours only)
Limitations – Actions not allowed (e.g., no DoS attacks)
Emergency Contacts – Who to call if issues arise
Authorization – Proof that testing is approved by management
Data Handling – How sensitive data will be treated
Intrusive = Tests by exploiting or changing things, Test real-world
impacts of vulnerabilities, May cause disruptions or crashes
Non-Intrusive = Looks only, does not modify systems, Identify
weaknesses without risk, Safe
OSINT – Open-Source Intelligence
The process of gathering publicly available information from legal, open
sources for intelligence or security purposes
Responsible Disclosure Programs
A formal process for security researchers to report vulnerabilities to an
organization ethically and legally.
Bug bounty
A responsible disclosure program that incentivizes individuals or
organizations to report vulnerabilities by offering monetary or
other rewards for valid submissions.
Common Vulnerability Scoring System (CVSS) : assesses
vulnerabilities and assigns severity scores in a range of 0 to 10, with 10
being the most severe and helping security professionals prioritize their
work in mitigating known vulnerabilities. ( 10 is highest, 0 is lowest.
Digital forensics techniques when collecting information after an
incident to prosecute a crime
Acquisition and Preservation : follow specific procedures to ensure
that the data is not modified.
Order of volatility : to the order in which you should collect evidence,
should collect evidence starting with the most volatile and moving to
the least volatile
(Cache > RAM > Swap > Drive > Network)
E-Discovery : The process of identifying, collecting, and reviewing
digital evidence for legal use.
Chain of Custody : A documented record showing who handled
evidence, when, and how, to ensure integrity (Tracks who touched the
evidence )
Admissibility: The legal acceptability of evidence in court—must be
reliable, relevant, and obtained properly. (Is the evidence allowed in
court? )
Windows Log info
- System: OS events (e.g., driver failures).
- Application: App-level events.
- Security: Login/logout, file access (important for auditing).
- Setup: OS install/setup logs.
- Forwarded Events: Logs from other systems
Linux Logs
•Location: Stored in /var/log/
•Common Log Files:
•/var/log/syslog or /var/log/messages: System events.
•/var/log/auth.log or /var/log/secure: Authentication attempts.
•/var/log/kern.log: Kernel messages.
•/var/log/dmesg: Boot process logs.
•/var/log/faillog: Failed login attempts.
Virus
An unsolicited and unwanted malicious program.
Phishing
Sending a false email pretending to be legitimate to steal valuable information from the user, Fake
website login
Crypto-malware
A malicious program that encrypts programs and files on the computer in order to
extort money from the user
Spear Phishing
Phishing attack but target to specific group
Ransomware
Denies access to a computer system or data until a ransom is paid
Whaling
Phishing attack but target to high position/profile person ( e.g CEO )
Worm
A self-contained infection that can spread itself through networks, emails, and
messages
Vishing
Phishing Attack via phone call ( VoIP )
Trojan
A form of malware that pretends to be a harmless application
Smishing
Phishing via SMS or text messages
Rootkit
Runs in kernel mode, uses for evade, hard to remove
Pretexting
Keylogger
Saves all the keystrokes of the infected machine
Impersonation
Taking on the identity of an individual to get access into the system
Adware
A program that produces ads and pop ups using your browser, may replace the
original browser
Tailgating
Following authorized personnel into restricted areas without proper credentials
Spyware
: Software that installs itself to spy on the infected machine, sends the stolen
information over the internet back to the host machine
Dumpster diving
Going through a business’s or person’s trash to find thrown away valuable information or
possessions
Bots
AI that when inside an infected machine performs specific actions, for DDoS
especially.
Shoulder surfing
Watching as a person enters information
RAT (Remote
Access Trojan)
A specific type of Trojan designed to provide attackers remote control over a system
Watering Hole Attack
Watering hole attack targets a specific highly secured group by infecting a commonly visited
website by the group’s members
Logic bomb
A malicious program that lies dormant until a specific date or event occurs.
USB Baiting Attack
Where attackers leave infected USB drives in public places to lure victims into plugging them into
their computers, leading to malware infections or data breaches
Backdoor
Allows for full access to a system, persistence
PUP
Comes packaged with free or shareware applications, often installed without clear
user consent
Dropper
a program designed to install or "drop" other malicious payloads onto a target
system.
Virus Hoax
False information, that leads user to do some serious tasks.
Social engineering: Manipulation technique used by attackers to trick individuals into revealing sensitive
information or performing actions that compromise security.
Control: User Awareness Training
Principle of Social Engineering
Authority: The actor acts as an individual of authority.
Intimidation: Frightening or threatening the victim.
Consensus: Influenced by what others do, everyone else does it.
Scarcity: Limited resources and time to act. Familiarity: The victim is well known.
Trust: Gain their confidence, be their friend.
Urgency: Limited time to act, rush the victim.
Man-In-the-Middle Attack
intercepts communication between two parties to eavesdrop or alter data ( active or passive )
On-path Attack
attacker positions themselves between two communicating parties to intercept, observe, or manipulate data being transmitted ( Passive only )
Buffer overflow Attack
Sending the more data than its allocated memory buffer can handle, causing the excess data to overwrite adjacent memory.
DNS Poisoning Attack
manipulates DNS records to redirect users from legitimate websites to malicious ones
ARP Poisoning Attack
tricks a network's ARP cache into associating an attacker’s MAC address with the IP address of another device, like a gateway
Pharming Attack
A pharming attack redirects users from legitimate websites to malicious ones by manipulating DNS settings or local host files
DNS Amplification Attack
Exploiting open DNS resolvers to send large DNS responses
Domain hijacking Attack
attacker gaining unauthorized control over a domain name, redirecting traffic or locking out the legitimate owner
Man-in-the-browser Attack
a type of man-in-the-middle attack where malware infects a web browser, allowing attackers to intercept and manipulate browser activities without the user’s knowledge.
Replay Attack
attacker intercepts and retransmits valid data or messages to gain unauthorized access or perform malicious actions
Pass the hash Attack
attacker intercepts and retransmits valid data or messages to gain unauthorized access or perform malicious actions
Password Spray Attack
attacker tries a few common passwords (e.g., "Password123", "Welcome2024") against many accounts
Clickjacking Attack
attack tricks a user into clicking on something different from what they perceive, potentially triggering unintended actions or revealing sensitive information
Session hijacking
an attacker steals a valid session token to gain unauthorized access to a user's active session on a website or application
URL hijacking
AKA Typosquatting, registering domain names that are similar to legitimate websites in order to exploit user typing mistakes or misdirection to trick them into visiting malicious sites.
Shimming ( driver manipulation )
Attackers add a small piece of code (the shim) that intercepts and manipulates API calls or system operations, often enabling privilege escalation or evading security controls
Refactoring
modifying or restructuring code to hide malicious activities, often without changing the program’s external functionality, making it difficult to detect by traditional security measures
IP Spoofing
attacker sends a packet to a server with the source IP address of a trusted internal device, tricking the server into responding to the fake device
Evil Twin Attack
attacker sets up a fake Wi-Fi access point that mimics a legitimate network, tricking users into connecting to it. Once connected, the attacker can intercept data or launch other attacks
Rouge AP
an unauthorized wireless access point is installed on a network by an attacker, potentially allowing them to intercept, monitor, or manipulate network traffic.
Jamming Attack
Sending RF signal, causing disruptions or complete failure in communication.
Deauth Attack
an attacker sends deauthentication frames to a targeted device or access point, forcing legitimate users to disconnect from the Wi-Fi network.
Living off the LAND Attack
attacker leverages existing system tools (e.g., PowerShell, Bash scripts, or Windows Management Instrumentation) to perform tasks like data exfiltration, privilege escalation, or persistence
Rainbow table attack
crack password hashes by using precomputed tables that store hash values for many possible password combinations, allowing an attacker to quickly find the corresponding plaintext
password.
MAC Spoofing
attacker changes the MAC address of their device to match that of a legitimate device on the network
Bluejacking Attack
Bluetooth-based attack where an attacker sends unsolicited messages or content (like a text or contact card) to nearby Bluetooth-enabled devices
Bluesnarfing Attack
Bluetooth-based attack where an attacker gains unauthorized access to the data on a Bluetooth-enabled device, such as contacts, messages, or calendars
Smurf Attack
attacker sends ping requests to a broadcast address of a network using the victim’s IP address. All devices on the network reply to the victim, flooding their system with traffic
LAND Attack
attacker sends a TCP SYN packet to the victim with both source and destination IPs set to the victim’s IP address, causing the victim to endlessly reply to itself
Ping of Death Attack
attacker fragments a large packet into smaller chunks and sends them to a target. When the target attempts to reassemble the fragments into an oversized packet, it crashes.
VLAN Hopping Attack
exploits vulnerabilities in Virtual Local Area Networks (VLANs) to gain unauthorized access to traffic on other VLANs, bypassing network segmentation and isolation
DHCP Starvation Attack
Attacker generates thousands of DHCP requests with random MAC addresses, causing all IPs in the DHCP pool to be allocated, leaving none for legitimate users
Cross Domain Attack
exploits the interaction between different security zones, domains, or trust boundaries to bypass security controls and access unauthorized data or functionality, CORS misconfiguration
SQL Injection Attack
web application attack where an attacker manipulates a website's SQL queries by injecting malicious SQL code into input fields, enabling unauthorized access to or manipulation of the database
XSS ( Cross site Scripting ) Attack
attacker injects malicious scripts into a trusted website or application, targeting other users and stealing their data or executing actions on their behalf.
XSRF/CSRF Attack
tricks a victim into performing unintended actions on a web application where they are authenticated, without their knowledge or consent
Directory Traversal
an attacker manipulates file paths to access restricted files or directories outside the intended web directory structure, potentially exposing sensitive data or system files
Command Injection
an attacker injects malicious commands into an application’s input fields, causing the application to execute unintended system-level commands on the underlying operating system
Sub Domain Takeover Attack
attacker takes control of an unused or misconfigured subdomain of a website, typically due to a DNS or hosting misconfiguration, and uses it to carry out malicious activities such as phishing
RFI Attack
when an attacker is able to include a file (usually a script) from a remote server into a vulnerable web application
LFI Attack
attacker is able to include files from the local file system on a vulnerable web server.
Birthday Attack
targets hash functions, aiming to find two different inputs that produce the same hash value (a collision), which can compromise the integrity of the cryptographic system
Disassociation Attack
attack where an attacker sends DE authentication or disassociation frames to disconnect devices from a wireless network
Dictionary Attack
cracking passwords or encryption keys by systematically trying a list of commonly used words, phrases, or password combinations (the "dictionary") until the correct one is found.
Brute force Attack
trying every possible combination until the correct password is found.
Downgrade Attack
attacker forces a system to switch to a less secure protocol or version, making it easier to exploit known vulnerabilities or weaknesses
Sweet32 Attack
exploits vulnerabilities in older, small block cipher encryption algorithms (like 3DES and Blowfish) by taking advantage of their short block size (64 bits). This allows attackers to perform a birthday attack to
extract plaintext data from encrypted communications.
POODLE Attack
attacker forces a client and server to downgrade their secure connection from TLS (a modern protocol) to SSL 3.0 (an outdated protocol).
TOC/TOU ( race channel ) Attack
attacker exploits the gap between the time of check (when a system verifies a resource or condition) and the time of use (when the system actually uses the resource).
Malvertising Attack
embedding malicious code or links within online advertisements. These malicious ads are displayed on legitimate websites, potentially infecting users with malware or redirecting them to phishing sites.
DoS
A single source overwhelms a target system, server, or network with traffic or resource requests, causing service disruption.
DDoS Attack
Multiple sources (often a botnet) flood a target system or network, making it inaccessible to legitimate users.
USB Baiting Attack
a social engineering technique where attackers leave malicious USB drives in public places, hoping victims will plug them into their computers, unknowingly executing malware or exposing sensitive data.
DNS Amplification Attack
a type of DDoS attack where an attacker exploits the functionality of open DNS resolvers to amplify the volume of traffic sent to a target, overwhelming its resources
CAM flooding Attack
sending a high volume of bogus MAC addresses to the switch, the attacker floods the CAM table, causing the switch to fail in forwarding traffic correctly, leading to network disruption or unauthorized access
Mobile device management
Application management: Restricting applications can be installed on a device.
Content m:anagement Limiting access to content hosted on company systems
Remote wipe: Allows for the deletion of all data from a device remotely.
Geofencing: Using GPS to define geographical boundaries where the app can be used.
Geolocation: Tracking the location of a device identified by GPS.
Screen locks: Prevents someone from being able to pick.
Push notification services: Using SMS texts to send messages to selected users or groups.
Passwords and pins: Authentication for mobile devices something you know.
Biometrics: Authentication for mobile devices, fingerprint etc ..
Context-aware authentication: Uses multiple elements to authenticate a user and a mobile device.
Containerization: isolating and protecting the application, including any data used by the
application.
Storage segmentation: Separates the information on a device into partitions. ( Work/Personal )
Full device encryption: Protects against loss of confidentiality
Rooting/jailbreaking
Rooting: for Android OS, the process of modifying the device to gain root-level (full administrator) access.
Jailbreaking: for Apple OS, the process removing all software restrictions from the device.
Sideloading
The process of installing applications or files onto a device from an unofficial source
Custom firmware
An unofficial operating system or software installed on a mobile device, replacing or modifying the original
manufacturer’s firmware
Carrier unlocking
Allows a mobile device to work with different carriers by removing restrictions imposed by the original
carrier
Unlocking could interfere with receiving official firmware or security updates
Firmware OTA updates
Wireless updates sent directly to your mobile device by the manufacturer or carrier
BYOD (Bring Your Own Device): Employees to connect their own personal devices to the corporate
network to work.
COPE (Corporate Owned, Personally Enabled): Are owned by the organization, but can be used
personally by employees.
CYOD (Choose Your Own Device): Employees can purchase devices on the list and bring them to work.
The company then supports, monitors, and manages the device.
Corporate-owned: Company owns and controls all aspects, no personal info at all, most secure for
company.
Mobile Device Management ( MDM ) Platform
Managing and securing mobile devices (smartphones, tablets, laptops) used within an organization to
protect sensitive data and ensure compliance
Segmentation type
Physical: Devices are separate physically. Does not scale well.
Logical (VLAN): Separate areas are segmented for different networks, but still housed on the same switch
Virtualization: The hardware to separate networks is virtualized, including routers, switches, and other devices apart from the
infrastructure. Easier to manage from a security standpoint and everything can be segmented.
Air gaps: Network where the devices are physically separate from another and don’t share any components to communicate.
Great for security but be careful with removable media.
Sandboxing: Isolated area for application/malware analysis, displaying details activities.
Environment
Testing
Staging
UAT
Demo
Production
Purpose
Bug fixing
Final testing
User validation
Showcase app
End-user usage
Users
QA, developers
QA, stakeholders
End-users,
clients
Clients, sales
Public/end-users
Data Used
Mock/test data
Near-production
Realistic test
data
Demo-specific
data
Live, real data
SCADA (Supervisory Control and Data Acquisition)/ICS (Industrial Control System): technologies used to monitor, control,
and automate industrial processes. SCADAs can be protected with VLANs and NIPS, and they require extensive network
segmentation. Segmentation is most important for SCADA security.
Smart devices/IoT (Internet of Things): A mobile device that allows the user: customizable options, applications to help make
daily activities easier, and an AI to assist in tasks.
The IoT is the class of devices that help provide automation and remote control of appliances and devices in the home or office.
1. Wearable technology: Contains personal and health information on a person.
2. Home automation: Technology in the home is not updated frequently and are susceptible to attacks
Zigbee and Z-Wave: Wireless communication protocol for IoT devices, encryption must be used.
MQTT (Message Queuing Telemetry Transport): Lightweight protocol for IoT communication, must use encryption.
Modbus, DNP3: Famous proprietary protocols for SCADA/ICS.
IEC 62443: International standards for industrial cybersecurity.
CISA Recommendations: U.S. agency guidance for critical infrastructure security
NIST SP 800-82: Guidelines for securing ICS environments.
IoT security
Regular patching
Change default credentials and setting
Enable encryption
Network segmentation
Disable unused features
Monitoring traffic
IPS
SoC (System on a Chip): An embedded device where the entire system is on
the chip. RTOS (Real Time Operating System): Attempts to use predictability
to see what happens to meet real time requirements, the guesses must be
secured.
Model
Description
Control Basis
Example
DAC (Discretionary Access Control)
Access is granted/managed by the resource owner
Owner-defined permissions
A file owner allows a colleague to edit a document (NTFS)
RBAC (Role-Based Access Control)
Access is based on predefined roles in the organization.
Roles and responsibilities
Only HR staff can access payroll data
MAC (Mandatory Access Control
Central authority enforces strict rules, typically using security
classifications (e.g., clearance).
Security labels
Only employees with "Top Secret" clearance can view certain documents
ABAC (Attribute-Based Access Control)
Access is granted dynamically based on attributes like user,
resource, action, or environment.
Attributes (dynamic)
Grant access to a document if the user is in the "Finance" department,
accessing during work hours, from a secure location
Rule-Based Access Control
Access is controlled by specific, pre-defined rules (if-then
conditions).
Rule conditions
Deny access to an IP address outside business hours ( Firewall ACL )
Guest accounts: Limited privilege
Service accounts: Performs specific maintenance actions, such as a backup, account and server operators.
Privileged accounts: Access is set to access rights, generally referred to as system or network administrative accounts.
Least privilege: Rights and permission are set to job requirement, minimum as possible.
Onboarding: Integrating a new employee into the organization securely
Offboarding: Securing the organization's data and systems when an employee exits.
Permission Auditing and Review: To ensure that users have appropriate access rights and that there are no unauthorized or unnecessary permissions
Time-of-day restrictions: Certain privileges are permitted or restricted based on the time of day
Image ref: https://doubleoctopus.com/
Authentication Factors
Something you are: Physical parts ( Biometric, Iris, fingerprint etc .. )
Something you have: Items ( Token, Card )
Something you know: Knowledge ( PIN, Password )
Somewhere you are Location ( GPS, Country )
Something you do: Action ( Writing, Speaking )
MFA/2FA: using more than one factors for authentication.
Feature
SSO (Single Sign-On)
Federation
Scope
Within a single
organization or domain.
Across multiple organizations or domains.
Example
One login for Gmail, Drive,
and Youtube
Logging into Zoom with Microsoft credentials.
Identity
Provider
Managed internally within
the organization.
Trust is established between organizations.
Term
Role
Example
Identity
Provider
Authenticates the user and
confirms identity.
Google, Microsoft, or Okta.
Service
Provider
Provides the service and
relies on the IdP.
Zoom, Slack, or Dropbox.
Principal
The user who needs access.
You (the person logging in).
Transitive Trust: when trust
between two entities can be
extended to a third entity through an
intermediate relationship.
Non-Transitive Trust :is a type of
trust relationship where trust does
not extend beyond two entities
The MAC scheme uses sensitivity
labels for users and data. It is
commonly used when access
needs to be restricted based on a
need to know. Sensitivity labels
often reflect classification levels of
data and clearances granted to
individuals.
.•.
LDAP (Lightweight Directory Access Protocol): Queries information
about the directory, AD (windows). Port 389, 636 for SSL/TLS
encryption.
CN=John Doe, OU=HR, DC=example, DC=com
•CN=John Doe → Refers to the user.
•OU=HR → Located in the HR department.
•DC=example, DC=com → Part of the example.com
Kerberos: Developed by MIT, for mutual authorization between client
and server. It uses a ticket granting system for authorization.
SAML: federated identity management system, (XML)–based data
format used for SSO on web browsers. used to exchange
authentication and authorization information between different
parties. SAML provides SSO for web-based applications.
Control
Separation of
Duties (SoD)
Job Rotation
Mandatory
Vacation
Purpose
Real-World
Example
Split responsibilities to
prevent fraud or error
One person
approves payments;
another processes
them
Reduce fraud, increase
skill redundancy
Force employees to
take leave to detect
fraud
IT staff rotate roles
every 6 months to
uncover anomalies
Bank employee
must take 1-week
vacation—audit
reveals misuse
Personal Account: the personnel working in the organizations
Administrator/Root Account: privileged accounts that have additional rights
and privileges beyond what a regular user has
Service account: used by the service or application, not an end user. should not
expire
Third-party account: external entities that have access to a network.
Guest account: limited access to a computer or network
Share account: user account that temporary workers will share
- PAM implements the concept of just-in-time permissions.
- Just-in-time permissions that provide administrative permissions to a user
account when they are needed.
- Requiring administrators to use two accounts, one with administrator privileges
and another with regular user privileges, helps prevent privilege escalation
attacks.
- Users should not use shared accounts.
- Deprovision: disable a user’s account when they leave the organization (
Disable and Delete )
- Disable first coz of security key ( deleting can also remove security key as well
- Time-based login: only can log on to computers during specific times
- User account audit review: checking rights and permissions assigned to users
and helps enforce the least privilege principle
- Privilege creep: when a user is granted more and more privileges due to
changing job requirements, but unneeded privileges are never removed
- Attestation: process of verifying and confirming for user access and
permission by manager
- SID identifies the user or group.
- ACE is an entry that ties a SID to a permission (e.g., "Read" or "Write")
- DACL is the complete list of ACEs for a specific object, showing which
users/groups (by their SIDs) have which permissions
- Oauth: Open standard for authorization that many companies use to provide
secure access to protected resources. For Authorization
- SAML - Authentication; OAuth – Authorization
- SAML - Identity verification and SSO; OAuth - Access delegation
•EAP is a framework; it allows plug-in methods (like TLS, TTLS, PEAP).
•EAP-TLS = most secure (requires certs on both sides).
•PEAP & EAP-TTLS = server cert only + username/password = common and
easier to deploy.
•EAP-FAST = fast, lightweight, no certs — Cisco proprietary.
•LEAP = outdated, vulnerable to attacks, avoid
VPN
•Remote Access VPN: A sales rep connects to the corporate intranet via SSL
VPN.
•Site-to-Site VPN: A company HQ and remote office are linked using IPsec VPN
between routers.
•Always-On VPN: Employees’ laptops auto-connect to corporate network via
IKEv2 VPN when online
•Split Tunneling: Sends corporate traffic through VPN, but local/internet traffic
goes directly
•Full Tunnel: Routes all traffic (internal + internet) through VPN
•VPN Concentrator: A dedicated device that handles multiple VPN connections
(especially remote access VPNs)
•Encryption & Integrity: VPNs use encryption (AES/IPsec) & hashing (SHA) to
protect confidentiality & integrity
Protocol
Purpose
Port
Encryption
Used for
Key Feature
Kerberos
Authentication only
UDP/TCP 88
Encrypted tickets (symmetric)
Internal AD domains
Time-based TGT & mutual authentication
RADIUS
AAA (centralized)
UDP 1812/1813
Password only encrypted
VPN, Wi-Fi, switches
DIAMETER
AAA (RADIUS replacement)
TCP/SCTP 3868
Full message (via IPsec)
Telecom (LTE/5G, IMS)
TACACS
Authentication only (obsolete)
TCP
TACACS+
AAA (Cisco proprietary)
TCP 49
None
Full packet encrypted
Fast and scalable
AVPs, better error handling
Legacy Cisco systems
No longer use
Device admin access (Cisco)
Command-level access control
•PPTP is obsolete – avoid it (easy question!)
•L2TP uses IPsec for encryption – not secure
alone
•SSL VPN = web-based, easier for non-technical
users
•IPsec uses AH (integrity) and ESP (encryption +
integrity)
•Split tunneling can improve performance but
poses data leakage risk
802.1X
- Port based network access control
- Used in enterprise environments with
WPA2/WPA3-Enterprise wireless
- Main three components Supplicant( device ),
Authenticator (Switch/WAP), Authentication
Server( RADIUS server )
Project
Initiation
- Obtain management support and funding
Assign a BCP team with representatives from all key departments.
Define the scope and objectives of the BCP.
Identify legal, regulatory, and business requirements
Business
Impact
Analysis
(BIA)
-
Risk
Assessme
nt
-
Strategy
Developm
ent
-
Plan
Developm
ent
-
Emergency response procedures (e.g., evacuation plans).
Recovery procedures for systems, data, and operations.
Communication plans for employees, stakeholders, and media.
Contact lists for emergency services, vendors, and key personnel.
Testing
and
Training
-
Perform tabletop exercises (discussion-based tests).
Conduct simulation drills to test recovery processes.
Train employees on their specific responsibilities.
Test communication systems like alert notifications.
Maintenan
ce and
Review
-
-
-
-
-
Identify critical processes and resources.
Determine the Maximum Tolerable Downtime (MTD) for each process.
Define Recovery Time Objectives (RTO) and Recovery Point Objectives
(RPO) for systems and data.
Prioritize processes based on their importance to the organization.
Analyze potential risks like natural disasters, cyberattacks, hardware
failures, etc.
Assess the likelihood and impact of each risk.Identify existing controls and
gaps in protection.
Avoidance strategies: Reduce the likelihood of risks (e.g., better fire
suppression).
Mitigation strategies: Reduce the impact (e.g., data backups).
Acceptance strategies: Recognize low-priority risks without mitigation.
Decide on redundancies (e.g., alternate sites, backup power, failover
systems).
Regularly review the BCP to reflect changes Business
processes,technology or infrastructure.,Personnel or vendors.
Update after testing or real-world incidents.
Schedule periodic reviews (e.g., annually or biannually).
RTO (Recovery Time Objective)
•Definition: The maximum acceptable time your systems or business processes can be down after a disruption.
•Example: If your website goes down, you may want it to be back online within 4 hours. So, your RTO is 4 hours.
RPO (Recovery Point Objective)
•Definition: The maximum amount of data loss you're willing to accept. It indicates the point in time to which you can recover after a
disruption.
•Example: If you're running a database and back it up every 24 hours, then your RPO is 24 hours, meaning you're okay with losing up
to a day of data.
MTBF (Mean Time Between Failures)
•Definition: The average time between system failures, representing how reliable a system is.
•Example: If a piece of machinery typically operates for 1000 hours before breaking down, the MTBF is 1000 hours.
MTTR (Mean Time To Repair)
•Definition: The average time it takes to fix a system or component after a failure.
•Example: If a server crashes, and the average time it takes to restore it is 2 hours, then the MTTR is 2 hours.
•MTTF (Mean Time To Failure)
•Definition: The average time until a component or system fails, often used for non-repairable items.
•Example: A light bulb typically lasts for 500 hours before it burns out, so the MTTF is 500 hours.
MTTA (Mean Time To Acknowledge)
•Definition: The average time it takes to recognize that a failure or issue has occurred.
•Example: If an alarm system goes off, the time it takes for a technician to acknowledge the alert is the MTTA. If it takes 5 minutes on
average, that's your MTTA.
BCP
DRP
The focus is on overall business operations and
continuity. This includes not only IT systems but
also people, facilities, communication, and
supply chains
The focus is on IT systems—servers, databases,
applications, and other technology—that
support business operations
Example: If a natural disaster causes an office to
be unavailable, the BCP would outline how
employees can work remotely, how critical
services will be delivered, and how suppliers will
be contacted
If a server crashes or a data center is flooded,
the DRP would detail how to restore data, bring
systems back online, and minimize downtime.
Snapshot backup:captures the data at a moment in time. It is commonly used with virtual machines
Replication is the process of creating an exact copy of data or a system in real-time or near-real-time.
Maintaining a secondary site or system that can be quickly brought online in case of a primary site failure
or data corruption
Journaling is a backup technique that records changes to data or files sequentially in a separate log, also
known as a journal. In case of a system failure or data corruption, the journal can be used to recover the
data to its most recent state by applying the changes recorded in the journal to a previous backup. Mostly
uses in Database.
Geographic dispersion is important for recovery site location
and it should not be located close to your primary site or the
same disaster may affect both locations
Offside storage: Storing
backups in a separate
geographic location protects
them against a disaster such as
a fire or a flood. Even if a disaster
destroys the site, the
organization will still have
another copy of the critical data
Continuity of operations planning (COOP) focuses on restoring
mission-essential functions at a recovery site after a critical
outage.
Offside storage: Storing
backups in a separate
geographic location protects
them against a disaster such as
a fire or a flood. Even if a disaster
destroys the site, the
organization will still have
another copy of the critical data
Backup
frequency is
depended on
storage space and
backup time.
site risk assessment is a focused assessment of a specific
location or site. Choosing low crime rate areas, avoiding flood
areas etc ..
Legal implications. The
legal implications related
to backups depend on
the data stored in the
backups. For example, if
the backups include
Personally Identifiable
Information (PII) or
Protected Health
Information (PHI), the
backups need to be
protected according to
governing laws
Data sovereignty: Data
sovereignty refers to the
legal implications when
data is stored off-site. If
the backups are stored in
a different country, they
are subject to that
country’s laws.
Test Type
Description
Pros
Cons
Example
Checklist Testing
A review of the BCP document to ensure
all components are accurate and
complete.
- Easy to perform
- Quick verification
- Limited real-world testing
- Surface-level validation
Reviewing a checklist to verify contact
details, resources, and recovery
procedures are up-to-date.
Walkthrough Testing
A structured meeting where team
members discuss the BCP to identify
gaps or inconsistencies.
- Involves multiple stakeholders
- Identifies process gaps
- Does not simulate real-world events
- Limited practical feedback
Key staff members review recovery
steps in a group session to ensure roles
and responsibilities are clear.
Tabletop Testing
A scenario-based discussion where
participants talk through their roles and
responses to a disaster scenario.
- Helps identify weak points
- Encourages collaboration
- No practical execution
- Limited realism
Team simulates a power outage and
discusses how to recover critical
business operations.
Simulation Testing
A simulated disaster is staged to test the
BCP without disrupting actual
operations.
- Provides realistic feedback
- Tests preparedness effectively
- Can be time-consuming
- May incur costs
IT simulates a server failure to test
backup and recovery procedures.
Parallel Testing
Recovery systems are activated in
parallel to production systems to test
their readiness.
- Minimizes operational disruption
- Validates recovery systems
- Resource-intensive
- Can reveal issues late
Running backup servers alongside live
servers without switching fully to the
backup environment.
Fail Over Testing/full interruption
tests
A complete implementation of the BCP,
switching operations to backup systems
or locations.
- Tests the full plan
- Identifies all gaps
- High cost
- Potential operational risk
Shutting down the primary data center
and operating entirely from a backup
site for a specified period.
Full Backup
Differential Backup
Incremental Backup
A full backup means making a copy of everything in your folder, no
matter what. It’s like taking a snapshot of the entire folder.
A differential backup only saves the changes made since the last full
backup.
An incremental backup only saves what changed since the last
backup (of any type).
Example: On Day 1, you copy A, B, C, and D into the backup.
Example:
On Day 1, you do a full backup (A, B, C, D).
On Day 2, only files E and F are added. The backup saves
only E and F.
On Day 3, files G and H are added. The differential backup
now saves E, F, G, and H (everything changed since Day 1).
Example:
On Day 1, you do a full backup (A, B, C, D).
On Day 2, only file E was added. The incremental backup
saves E.
On Day 3, file F was added. The backup only saves F.
On Day 4, file G was added. It only saves G.
This means differential backups grow larger each day until the next
full backup.
Incremental backups are much smaller and faster, but restoring files
takes longer because you need every backup in sequence.
Every time you do a full backup, it saves everything, even if nothing
changed.
Business Impact Analysis: identify critical systems and components
that are essential to the organization’s success. It also identifies
maximum downtime limits for these systems and components
Backup Time
Full: Slowest, as all data is backed up every time
Incremental: Fastest, as it only backs up changed data.
Differential: Starts fast but slows as more changes accumulate
Restore Time
Full: Fastest, as it requires only one backup file
Incremental: Slowest, as it needs the full backup plus all incremental backups in sequence.
Differential: Faster than incremental, as it needs only the full backup and the most recent differential backup
Industrial Camouflage: a concept where
organizations intentionally obscure, disguise,
or mask digital assets, processes, or
infrastructure to avoid detection by cyber
attackers.
Perimeter: fence, security guard, barricades to block vehicles
Buildings: locked doors restrict entry, lighting and video cameras to monitor the entrances and exits.
Secure work areas: restrict access to specific work areas for only authorized person, visitors should not be able to enter internal work areas without an escort.
Server rooms: Only the appropriate IT personnel can access servers and network devices, locking a wiring closet prevents an attacker from installing illicit monitoring hardware
Hardware: Cable locks protect laptop computers, smaller devices can be stored in safes, locking cabinets to protect servers and other equipment installed in the equipment bays
Access badges: Proximity cards use these for
access points, such as the entry to a building. Some
access control points use proximity cards with PINs
for authentication
Environmental Controls
•HVAC: Temperature and humidity control to
protect hardware.
•Fire Suppression:
•
Smoke Detectors
(ionization/photoelectric)
•
Fire Extinguishers (ABC types)
•
Gas-based Systems (e.g., FM-200)
•Water Detection: Alerts on leaks or floods.
•Shielding: Prevents EMI and TEMPEST attacks.
Physical Security of LAN Cables
•Secure Cable Routing: Use conduits, run cables
in ceilings/floors away from public access.
•Lockable Wiring Closets: Prevents physical
access to switches and patch panels.
•Port Security: Disable unused switch ports or use
MAC filtering.
•Cable Locks: Prevent physical disconnection or
tampering.
Use plenum-rated cables in ceilings/floors
Video surveillance: CCTV, to monitor entrances of highsecurity areas ( Server room and Data center. Must not
record voice ( privacy concerns ).
Can also enhance safety by deterring threats.
Many cameras include motion detection and object
detection capabilities
PTZ function: Pan, Tilt, Zoom; can be manually or
automatically controlled
Thermal Cameras: Detect heat signatures; useful in
low-light or total darkness
Monitoring & Response
•Security Alarms: Detect break-ins or fire.
•Motion Sensors: Detect unauthorized movement.
•Duress Alarms: Silent panic alerts.
•Security Incident Response: SOP for breaches or
alerts.
Hot Aisle and Cold Aisle: data center cooling strategies,
for managing airflow and temperature around IT
equipment.
•Visitor Management: Procedures for registering,
escorting, and monitoring visitors.
•Asset Management: Tracking the location and
security of physical assets.
Cold Aisle Containment (CAC)
•Encloses the cold aisle to prevent mixing with hot air.
•Improves cooling efficiency.
•Cold air is directed only to the front of servers.
Hot Aisle Containment (HAC)
•Encloses hot aisle so hot air is extracted directly.
•Requires overhead or rear cooling ducts.
•Reduces the overall room temperature.
TEMPEST: A standard/program to prevent leakage of data
via electromagnetic emissions
Faraday Cage: An enclosure made of conductive material
that blocks electromagnetic signals (Secure Facilities )
Fire Extinguishers (Portable)
•Class A: Ordinary combustibles (wood, paper)
•Class B: Flammable liquids (gasoline, oil)
•Class C: Electrical fires (computers, wiring)
•Class D: Flammable metals (rare in IT)
•Class K: Kitchen fires (oils and fats)
Gaseous Fire Suppression (Data Centers)
•FM-200 / HFC-227ea:
•
Suppresses fire without
damaging electronics
•
Leaves no residue
•CO₂ Systems:
•
Smothers fire by removing oxygen
•
Dangerous to humans in confined
spaces
Perimeter Security
•Fencing: Deters unauthorized access, defines boundaries.
•Lighting: Increases visibility and deters intruders.
•Security Guards: Human deterrents and responders.
•CCTV: Video surveillance for deterrence and evidence.
•Signage: Warns of restricted areas or surveillance
Access Control
•Mantraps: Two-door system to prevent tailgating.
•Turnstiles: Restricts access to one person at a time.
•Badges/ID Cards: Verifies identity for entry.
•Biometric Readers: Fingerprint, retina, facial recognition.
•Keypads / PINs: Simple access control.
•Smart Cards / Proximity Cards: Secure entry.
Internal Security
•Locked Doors / Cabinets: Prevents unauthorized
internal access.
•Security Zones: Segmented areas by trust level.
•Visitor Logs & Escorts: Required in sensitive
areas.
•Access Control Lists (ACLs): Who can go where,
when.
Device Protection
•Cable Locks: Prevent laptop/theft removal.
•Laptop Safe: Secure storage.
•Port Security (Physical): Block unused
USBs/network ports.
•Faraday Cages: Block electromagnetic
emissions.
•Input validation – Sanitize all user input
•Output encoding – Prevent XSS
•Least privilege – Use minimal permissions
•Error handling – Avoid detailed error messages
•Secure defaults – Disable insecure features by default
•Use MFA (Multi-Factor Authentication)
•Store hashed and salted passwords (e.g., bcrypt)
•Use secure cookies,
•Set short session timeouts
•Use token-based authentication (e.g., OAuth2,
JWT
•Use authentication (API keys, OAuth)
•Rate-limit access to prevent abuse
•Use HTTPS to protect data in transit
•Validate all API input and output
•Keep software and libraries up to date
•Use container security best practices
•Remove unused features or sample apps
•Protect against open-source dependency risks
Application Testing Tools
•SAST – Static Application Security Testing (e.g.,
SonarQube)
•DAST – Dynamic Application Security Testing (e.g.,
OWASP ZAP)
•Fuzzing – Send random data to detect crashes
•Code reviews – Manual review of critical logic
Memory leak: a bug in a
computer application
that causes the
application to consume
more and more memory
the longer it runs
Common Secure Coding Standards
•OWASP Top 10 – Avoid common web app
vulnerabilities
•NIST SP 800-64 – Security in SDLC
•CERT Coding Standards – Secure C/C++ coding
Code Obfuscation: attempts to make something
unclear or difficult to understand.
Sandboxing: isolated area specifically
created for testing (Dev playground)
Model
Description
Pros
Cons
Focus
Waterfall
A linear and sequential
model; each phase must be
completed before next.
- Easy to manage
- Clear documentation
Hard to adapt to changes
- Late testing
Security is often added at the end.
- High risk of late discovery of
vulnerabilities.
Spiral
Combines iterative design
with risk assessment at each
loop or phase
- Good for complex, high-risk
projects
- Risk analysis
- More expensive
- Requires skilled risk analysts
- Security is integrated at each loop.
- Risk-based approach helps identify
threats early.
Agile
Iterative and incremental
model with frequent updates
and collaboration.
- Fast delivery
- Adaptive to change
- DevSecOps fit
- May lack full documentation
- Needs disciplined teams
- Security is embedded in every sprint.
- Encourages DevSecOps and
continuous security testing.
DLL Injection: Inject malicious DLL into a running process(App control,
privilege escalation).
XML Injection: Inject malicious XML content to alter logic or extract data
(Logic bypass, data disclosure).
LDAP Injection: Inject into LDAP queries to alter or retrieve unauthorized
data (Login bypass, unauthorized queries)
Integer overflow: occurs if an application receives a numeric value that is
too big for the application to handle.
Buffer overflow: when an application receives more input, or different
input, than it expects. Attacker can exploit it and overwrite memory
locations with their own code ( Memory injection )
Strict-Transport-Security (HSTS): Forces browser to only use HTTPS
(prevents downgrade attacks).
Content-Security-Policy (CSP): Controls what resources (scripts, styles)
can load on a page.
X-Frame-Options: Prevents site from being embedded in an iframe ( to
prevent clickjacking attack
X-Content-Type-Options: Prevents browsers from MIME-sniffing content
types.
Encryption: Converting plaintext into ciphertext
Decryption: Reversing ciphertext back to plaintext
Hashing: One-way function - creates a fixed-length output (digest)
Key Exchange: Securely sharing encryption keys over an untrusted
network
Digital Signature: Proves integrity + authenticity using hashing + private
key
Salt: Random data added to passwords before hashing (thwarts rainbow
tables)
Nonce: Number used once - adds randomness (e.g., in IVs or auth)
Symmetric
Asymmetric
-
-
One key (same for encryption/decryption)
Fast - Used for file encryption, VPN (AES)
Algorithms: AES, DES, 3DES, RC4
-
CSR Process
Two keys (public + private)
Slower
Used for SSL/TLS, Email Signing, Secure Key
Exchange
Algorithms: RSA, ECC, DSA
Hash Algorithms
MD5: Legacy; weak - avoid in modern systems
SHA-1: Deprecated - vulnerable to collisions
SHA-256/512: Modern hashing - SHA-2 family
SHA-3: Future-ready - based on Keccak
Format
Extension
Encoding
Description
PEM
.pem, .crt,
.cer, .key
Base64
(ASCII)
Easy to read and copy. Often used
in web servers.
Root
Certificate:
Issued by the root CA; highest level of trust.
Intermediate
Certificate:
Issued by root CA; used to sign end-user certs.
DER
.der, .cer
Binary
Used in Java platforms and
Windows. Not human-readable.
End-Entity
Certificate:
Issued to users, servers, or devices.
PFX/P12
.pfx, .p12
Binary
Contains both certificate + private
key (often password protected).
Wildcard
Certificate
Covers all subdomains (e.g., *.example.com).
CER
.cer
DER or PEM
Just the certificate (no key).
Extension used on Windows.
SAN
Certificate
Supports multiple domains (Subject Alternative Names).
.pfx or .p12, it likely includes the private key. Handle with care!
Code Signing
Certificate
Verifies publisher and integrity of software.
•Certificate Authority (CA): Issues and signs digital certificates.
•Registration Authority (RA): Verifies the identity of users before certificate
issuance.
•Certificates: Digital files that link a public key to an identity.
•Public/Private Key Pair: Keys used for encryption and digital signatures.
•CSR (Certificate Signing Request): Request sent to CA to get a certificate.
•CRL (Certificate Revocation List): List of certificates revoked by the CA.
•OCSP (Online Certificate Status Protocol): Checks certificate validity in real-time
•OSCP stapling: server checks with the CA in advance, and sends a signed proof
(OCSP response) to the browser during the TLS handshake
Self-signed certificate: signed by the same entity it certifies, not issued by
CA, Browsers often display a warning/error , susceptible to Man-in-theMiddle (MitM) attack, mostly used internally ( network devices ).
Attack Type
Description
Example / Impact
Brute Force Attack
Tries every possible key or password until the correct one is
found
Rainbow Table Attack
Uses precomputed hash values to reverse cryptographic
hashes
Birthday Attack
Exploits the probability of hash collisions
Certificate Authority (CA): Centralized, High Scalability, mostly used in Website (
SSL/TLS certificate ).
Web of Trust (WoT): Decentralized (Peer-to-peer), Low Scalability, mostly used in
Email (PGP),
Known-plaintext Attack
Attacker has both plaintext and ciphertext to discover key
Used in historical cipher breaking
Chosen-plaintext Attack
Attacker can encrypt chosen plaintexts to observe outputs
Common against block ciphers
Trusted Path: ensures a certificate can be validated through an unbroken chain
back to a known trusted root CA
Ciphertext-only Attack
Only has access to ciphertext, trying to guess plaintext or key
End-Entity Certificate (Leaf) → Intermediate Certificate → Root CA Certificate
Pass-the-Hash
Uses stolen NTLM hash to authenticate without decrypting
Cracking weak encryption like DES
Bypasses hashed password storage
Affects MD5, SHA-1 (non-collision resistant)
More difficult, but feasible with weak ciphers
Exploits Windows authentication flaws
X.509 Certificate
•Standard: Most widely used certificate format (defined by ITU-T).
•Used In: SSL/TLS, digital signatures, email security, VPNs.
•Contains:
•
Version
•
Serial number
•
Signature algorithm
•
Issuer (CA)
•
Subject (owner of the cert)
•
Validity period
•
Public key
•
Extensions (optional)
•
Signature
Digital Signature
Proves the authenticity and integrity of a message or file (
Email )
A hashed and encrypted digest of data
Created by the sender of the data
Used by the recipient to verify the digital signature
Sender hashes the message and encrypts hash with
private key (the signature)
Message Authentication Code (MAC)
Short piece of information used to
Verify the integrity and authenticity of a message.
Used in TLS, IPSec, JWT, and APIs to prevent tampering.
Key Scrambling: Randomizing or transforming a key to increase
security
•Key Stretching: where a weak or short key (like a password) is
processed to make it more secure and resistant to brute-force
attacks. (PBKDF2,bcrypt
,scrypt ,Argon2 )
ECC
Cryptography method based on the mathematics of
elliptic curves over finite fields
High security with smaller key sizes
Mobile devices, SSL/TLS (with ECDHE), Bitcoin wallets, etc
•Obfuscation = Make code/data confusing.
•Steganography = Hide data in plain sight (e.g., inside media).
•Tokenization = Replace with unrelated placeholder (no
mathematical link).
•Masking = Blur/obscure part of data for privacy.
Feature
Block
Cipher
Stream Cipher
Data Handling
Encrypt
s fixedsize
blocks
(e.g.,
128
bits)
Encrypts one bit or byte at a time
Speed
Slow
Fast
Common Use
Cases
File
encrypt
ion
(e.g.,
disk,
email)
Voice, video, and streaming data
encryption
Key
Management
Often
simpler
Requires careful synchronization
Algorithms
AES,
DES,
Blowfis
h
RC4, Salsa20, ChaCha20
Perfect Forward Secrecy
Ensures that even if a long-term private key is compromised,
past communications remain secure
Relies on using ephemeral keys so that each session has a
unique key
Protects past sessions even if keys are compromised
Ephemeral Key
- Important part of PFS
Temporary session-specific encryption key
Ensures session uniqueness
TLS 1.2/1.3 often uses Ephemeral Diffie-Hellman
(DHE/ECDHE) for key exchange, providing Perfect Forward
Secrecy
Entropy: represents how unpredictable or random a piece of data
is
Lack of entropy results in a weaker algorithm and makes it much
easier for the algorithm to be cracked
File & Directory Navigation
ls / dir: List files and folders
cd: Change directory
pwd: Print working directory
mkdir: Make a new directory
rmdir / rm -r: Remove directory / files
File Viewing & Search
cat file.txt: View file contents
more / less file.txt: View file page-by-page
grep 'keyword' file.txt: Search keyword in file (Linux/macOS)
find . -name file.txt: Find a file
type file.txt: Display contents of a file (Windows)
•nmap <target>
→ Basic scan (default TCP scan of top 1000 ports)
•nmap -v <target>
→ Verbose output
•nmap -p 80,443 <target>
→ Scan specific ports (80 and 443)
•nmap -p- <target>
•→ Scan all 65535 TCP ports
•nmap -sV <target>
→ Detect service versions
•nmap -A <target>
→ Aggressive scan: includes OS detection, version, script scanning, and traceroute
•nmap -O <target>
→ OS detection
•nmap -sS <target>
→ SYN (stealth) scan
•nmap -Pn <target>
→ Skip host discovery (assumes host is up)
•nmap -f <target>
→ Fragment packets to evade firewalls
•nmap -D RND:10 <target>
→ Use decoy IPs to hide real source
•nmap -sI <zombie_ip> <target>
→ Idle (zombie) scan for stealth
•nmap -T0 <target> → Paranoid (very slow, stealthy)
•nmap -T4 <target> → Aggressive (faster for LAN scanning)
•nmap -T5 <target> → Insane (very fast, may miss packets)
•nmap -oN output.txt <target>
→ Normal output to file
•nmap -oX output.xml <target>
→ XML output
•nmap -oG output.gnmap <target>
→ Grepable output
File Operations
cp file1 file2: Copy file
mv file1 file2: Move or rename file
rm / del file.txt: Delete file
Permissions & Ownership (Linux)
chmod 755 file: Change file permissions
chown user:group file: Change file owner
umask: View/set default permissions
Network Commands
ipconfig / ifconfig / ip a: Show IP/network settings
ping <ip>: Test network connectivity
tracert / traceroute: Trace route to host
netstat -an: Show network connections
nslookup: Resolve domain names
nmap: Scan ports/services
System Cleanup & Processes
tasklist / ps aux: Show running processes
kill PID: Kill process by ID
cls / clear: Clear screen
shutdown /r: Restart system
DNS (Domain Name Service): Does not have any security in its original design, use for name resolution
DNSSEC (Domain Name Service Security Extensions): Primary purpose is to provide a reliable authorization service between devices
when performing operations on the DNS
SSH (Secure Shell): Replaces Telnet. TCP over Port 22 and use encryption
S/MIME (Secure/Multipurpose Internet Mail Extensions): Digitally signed email content using public key encryption.
SRTP (Secure Real-time Transport Protocol): Protected and encrypted voice communications.
LDAPS (Lightweight Directory Access Protocol Secure): TCP ports 389 and 636. Protocol used for reading and writing directories over an
IP network. AD service, using encryption.
FTPS (File Transfer Protocol Secure): TCP Ports 989/990. File transfer using SSL/TLS.
SFTP (Secure File Transfer Protocol): TCP Port 22. FTP over an SSH channel.
SNMPv3 (Simple Network Management Protocol Version 3): Ports 161/162. Encrypted statistics gathering from network devices.
SSL (Secure Sockets Layer)/TLS (Transport Layer Security): HTTPS connection! Encryption technology developed for web and email over
the transport layer.
TLS (Transport Layer Security): The replacement for SSL, more secure. Used to encrypt the communication of servers in an organization.
Secure POP (Post Office Protocol)/IMAP (Internet Message Access Protocol): 1. Secure POP (Post Office Protocol): Sends from port 110
to 995. Encrypted email communications used for retrieving email from a mail server over SSL/TLS.
Secure IMAP (Internet Message Access Protocol): Sends from port 143 to 993. Is standard email protocol for storing email messages on a
mail server over SSL/TLS.
SASL (Simple Authentication and Security Layer): Provides a source of additional authentication using many different methods, such as
Kerberos or client certificates.
RADIUS: AAA service, uses 1812,1813
TACACS+: AAA service, uses TCP 49
ICMP- Uses for ping, network connectivity test
TFTP – hackers use to upload backdoor
IPSec – AH ( Only Authentication , Header only) ESP ( payload encryption )
Port
Protoco
l
UDP/TC
P
Service Name
Usage Summary
Port
Protocol
UDP/T
CP
Service Name
Usage Summary
20
FTP
TCP
File Transfer Protocol
Data transfer
389
LDAP
UDP/TC
P
Directory Service
Directory lookups (e.g., Active Directory)
21
FTP
TCP
File Transfer Protocol
FTP control (commands)
443
SSL
TCP
Secure HTTP
Encrypted web traffic (SSL/TLS)
22
SSH
TCP
Secure Shell
445
SMB
TCP
Server Message Block
23
Telnet
TCP
Telnet
Unencrypted remote login (legacy)
500
IKE
UDP
IPsec VPN negotiation
25
SMTP
TCP
Mail Transfer
Email sending
636
LDAPS
UDP
Secure LDAP
53
DNS
UDP
Domain Name Service
DNS queries (UDP) / zone transfers (TCP)
993
IMAPS
TCP
Secure IMAP
67/68
DHCP
UDP
DHCP
Offer/Request IP
995
POP3
TCP
Secure POP3
Encrypted email retrieval
69
TFTP
UDP
Trivial FTP
Lightweight file transfers
1433
MSSQL
TCP
Microsoft SQL Server
SQL database connections
80
HTTP
TCP
Web
Plain Text transmission ( Web )
3389
RDP
TCP
Remote Desktop
Remote Windows GUI access
110
POP3
TCP
Post Office Protocol
Receiving emails (legacy)
49
TACACS+
TCP
AAA
AAA
119
NNTP
TCP
Usenet/news groups
1812/181
3
RADIUS
UDP
AAA for network
access
AAA
123
NTP
UDP
Network Time Protocol
Time synchronization
88
Kerberos
TCP
TGT
Network authentication (AD)
143
IMAP
TCP
Internet Mail Access
Accessing email on server
53
TCP
Domain Name Service
Zone Transfer
161/162
SNMP
UDP
Network Management
Network device monitoring
DNS
Zone
transfer
Network News Transfer
Secure remote login and file transfer
File/printer sharing (Windows)
VPN tunnel establishment
Encrypted LDAP (TLS/SSL)
Encrypted email access
Cybersecurity framework: A structure of basic concepts, and they
provide guidance to professionals on how to implement security in
various systems
ISO 27001, NIST etc ..
ISO 27001 : “Information Security Management Systems,” provides
information on information security management systems (ISMS)
requirements
ISO 27002 : “Information security, cybersecurity and privacy
protection
ISO 27701 : “Privacy Information Management System (PIMS),”
ISO 31000 : “Risk management,” is a family of standards related to
risk management
NIST SP 800-37: NIST Risk Management Framework, U.S. federal
government agencies must adopt the RMF
NIST Cybersecurity Framework (CSF) aligns with the RMF. Many
private sector organizations have adopted it to improve their ability to
prevent, detect, and respond to cyberattacks.
Main component: Core, Tier, Profile
Security Governance: set of responsibilities and practices used to
direct and control an organization's security efforts. Ensures
alignment with business goals, compliance, and risk management.
Centralized Governance: Central authority ( CISO ). One team
controls security
Decentralized Governance: Security decisions are made at the
department or business-unit level, flexible but hard to control
Audit: confirming that the organization has put security controls
in place
Internal audit : performed by an auditing team within the
organization itself
External audit : performed by an independent auditing firm
Assessment : are less formal reviews of an organization’s
cybersecurity defenses
Gap analysis : comparing current state vs desired state to
identify what’s missing or needs improvement.
Attestation : outcome of an audit made by auditor. Independent
validation + formal report. Example - Auditor attests that security
controls meet ISO 27001 requirements
Due Diligence
Due Care
Taking steps to research and assess risks
before taking action
Taking reasonable steps to protect assets
after taking action
Example : Reviewing a vendor’s security
posture before signing a contract.
Example : Regularly patching systems to
prevent vulnerabilities.
Data governance : refers to the processes an organization uses to manage, process, and
protect data. ensuring that critical data elements are identified
External Considerations : include regulatory requirements, legal obligations, industry
standards, and the security environment at local, regional, national, and global levels
Term
What it Defines
Mandatory?
Level
Example
Policy
Overall rule or intention
Yes
High
“All users must use multi-factor authentication.”
Standard
Specific requirement
Yes
Mid-Level
“MFA must use TOTP-based apps like Google Authenticator.”
Procedure
How to do it
Yes
Detailed
“How to enroll a device in MFA.”
Baseline
Minimum acceptable level
Yes
Technical
“All laptops must have antivirus and disk encryption.”
Best Practice
Industry-recommended approach
No
Advisory
“Rotate passwords every 90 days and use passphrases.”
Protects
Applies To
Focus Area
Role
Responsibility
Cardholder data
Merchants,
processors
Card Data Environment (CDE)
Data Owner
Person or department accountable for data — defines access & classification
HIPPA
Health data (PHI)
Healthcare sector
Privacy, data protection
Data Steward
Ensures data quality and accuracy — manages metadata, policies, and standards.
SOX
Financial records
Public companies
Accountability, audit trails
Data Processor
A third party that processes data on behalf of the controller (e.g., a cloud provider).
GLBA
Financial info (PII)
Financial institutions
Consumer privacy, safeguards
Data Custodian
Handles day-to-day maintenance and protection of data (e.g., backups, security controls).
ISO 27001
Information assets
All industries
Risk-based security framework
Data Controller
Entity that determines why and how personal data is processed. Legally accountable
SOC 2
Customer
data/services
Cloud & SaaS
companies
Security controls (5 Trust Areas)
Data User
End user who accesses and uses the data under policy guidelines.
Framework
PCI-DSS
Vendor Assessment
The process of evaluating third-party vendors for security posture, risks, and compliance before or during
engagement.
Right-to-Audit Clause
A contract term that allows an organization to inspect a vendor’s systems, processes, and controls to ensure
compliance and security.
Vendor Diversity
Using multiple suppliers for similar services/products to reduce reliance on a single vendor. Increases
resilience and availability
Right to Be Forgotten
•A data privacy right that allows individuals to
request the deletion of their personal data
from an organization’s systems.
•Common under laws like the GDPR (EU).
•Applies when data is no longer needed,
inaccurate, or the person withdraws
consent
Document
Short Note
Definition
SLA (Service Level Agreement)
Service guarantees
Defines performance expectations (e.g., uptime, response time) between
provider and client.
MOU (Memorandum of Understanding)
Intent to work together
A non-binding agreement showing mutual intent to collaborate.
BPA (Business Partnership Agreement)
Partnership terms
Formal contract between business partners detailing roles, responsibilities, and
profit/loss.
NDA (Non-Disclosure Agreement)
Keep it secret
Legal contract to protect confidential information from being shared.
MSA (Master Service Agreement)
Master rules for work
A broad agreement that sets terms for future contracts or projects between
parties.
SOW (Statement of Work)
ask-level detail
A document that defines the specific work, timelines, and deliverables of a
project.
Supply Chain Analysis
The process of identifying, evaluating, and securing all components and
third parties involved in delivering a product or service. Helps detect
security risks, dependencies, or disruptions
•Data Inventory = Know what data you
have
•Data Retention = Know how long to keep
it
Risk Management Process
1.Identify Risks – Spot threats and vulnerabilities.
2.Assess Risks – Analyze likelihood and impact.
3.Prioritize Risks – Rank based on risk level.
4.Treat Risks – Choose a mitigation strategy
5.Monitor & Review – Continuously reassess and improve
Treatme
nt
Action
Avoid
Eliminate the risk source.
Mitigate
Reduce the likelihood or impact.
Transfer
Share the risk (e.g., insurance
Accept
Acknowledge and take no action
Risk
The potential for loss or damage when a threat exploits a vulnerability.
Threat
Something that can cause harm (e.g., hacker, natural disaster).
Vulnerability
A weakness that can be exploited
Impact
The consequence or effect of a risk event.
Likelihood
The probability that a threat will occur.
Asset
Anything valuable to the organization (data, people, systems)
Exposure
The extent to which an asset is at risk
Risk Appetite
The amount of risk an organization is willing to accept
Risk = Threat × Vulnerability × Impact
Type
Definition
Example
Qualitative
Uses subjective values (e.g., High/Medium/Low) based on expert opinion,
experience, or risk matrices.
"A data breach is High Risk due to sensitive info exposure."
Quantitative
Uses measurable numbers (e.g., $ loss, % likelihood) to calculate actual
risk value.
"A data breach could cost $100,000 and has a 20% chance/year."
Quantitative Risk Calculation
Asset Value (AV) : The dollar value of the asset (e.g., server worth $10,000).
Exposure Factor (EF) : The % of asset lost in an event (e.g., 50% = 0.5).
Single Loss Expectancy (SLE) : Expected loss from one event. Formula ( AV x EF = SLE )
Annual Rate of Occurrence (ARO) : How often the event is expected to occur per year.
Annual Loss Expectancy (ALE) : Expected loss per year. Formula: ( SLE x ARO = ALE
Example
Let’s say:
•Asset Value (AV) = $20,000
•Exposure Factor (EF) = 0.5 (50% damage)
•ARO = 2 (incident expected twice per year)
SLE = 20,000 × 0.5 = $10,000
ALE = 10,000 × 2 = $20,000/year
Qualitative Risk Assessment
Evaluate risks using descriptive values like High, Medium, Low.
Formula
Risk = Likelihood × Impact
Likelihood: High (attacks are frequent in the industry)
Impact: Critical (could stop operations and cause major data loss)
Resulting Risk Level: High or Critical
Often visualized using a Risk Matrix
•Subjective (uses words, not numbers)
•Prioritizes risks using expert opinion and risk matrices
•Formula: Risk = Likelihood × Impact
Risk Awareness
Understanding potential risks and their impact within an
organization
Inherent Risk
The natural level of risk before any controls are applied. (e.g., data
breach risk without encryption).
Residual Risk
The remaining risk after controls are implemented. (e.g., risk still
present after firewalls).
Control Risk
The risk that security controls may fail or be bypassed.
Risk Appetite
The total amount of risk an organization is willing to accept in
pursuit of objectives.
Risk Tolerance
The acceptable variation from the risk appetite — how much
deviation is tolerable.
Note
•Inherent → Control → Residual (risk lifecycle)
•Appetite = What org is OK with
•Tolerance = How much wiggle room allowed
•Awareness = How well people understand the risks
Risk Register – Short Note
•A documented list of all identified risks.
•Includes details like:
•
Risk description
•
Likelihood & impact
•
Owner
•
Response plan
•
Status
Personal Account: the personnel working in the organizations
Administrator/Root Account: privileged accounts that have additional rights
and privileges beyond what a regular user has
Service account: used by the service or application, not an end user. should not
expire
Third-party account: external entities that have access to a network.
Guest account: limited access to a computer or network
Share account: user account that temporary workers will share
- PAM implements the concept of just-in-time permissions.
- Just-in-time permissions that provide administrative permissions to a user
account when they are needed.
- Requiring administrators to use two accounts, one with administrator privileges
and another with regular user privileges, helps prevent privilege escalation
attacks.
- Users should not use shared accounts.
- Deprovision: disable a user’s account when they leave the organization (
Disable and Delete )
- Disable first coz of security key ( deleting can also remove security key as well
- Time-based login: only can log on to computers during specific times \
- User account audit review: checking rights and permissions assigned to users
and helps enforce the least privilege principle
- Privilege creep: when a user is granted more and more privileges due to
changing job requirements, but unneeded privileges are never removed
- Attestation: process of verifying and confirming for user access and
permission by manager
- Oauth: Open standard for authorization that many companies use to provide
secure access to protected resources. For Authorization
- SAML - Authentication; OAuth – Authorization
- SAML - Identity verification and SSO; OAuth - Access delegation
- SID identifies the user or group.
- ACE is an entry that ties a SID to a permission (e.g., "Read" or "Write")
- DACL is the complete list of ACEs for a specific object, showing which
users/groups (by their SIDs) have which permissions
Shared Responsibility: Cloud provider secures the infrastructure; customer
secures data & apps
Multi-tenancy : Isolation needed between different customer data in shared
cloud environments
Container Security : Protect each service container (e.g., Docker) with image
scanning and runtime protection
Log Aggregation
•What It Means: Collecting and combining logs from multiple
sources into a central repository for analysis and storage.
•Why It’s Important: Simplifies monitoring by providing a single
view of events across the network.
Example:
•Scenario: Logs are generated by:
•
A firewall tracking incoming connections.
•
A server recording login attempts.
•
An antivirus system detecting malware.
•Aggregation:
•
The SIEM collects logs from all these sources and
consolidates them into a unified dashboard.
•Outcome: You can see all security events in one place, rather than
logging into multiple devices to view logs.
Log Correlation
•What It Means: Analyzing logs to find relationships between events
that may indicate a security incident.
•Why It’s Important: Detects patterns or threats that may not be
obvious when looking at individual logs.
Example:
•Scenario:
•
A firewall log shows multiple failed login attempts
from IP 192.168.0.10
•
A server log shows a successful login from the same
IP a few minutes later.
•
An antivirus log detects malware being executed
from that server.
•Correlation:
•
The SIEM links these events together:
•
Failed logins → Brute force attack.
•
Successful login → Potential compromise.
•
Malware detection → Post-exploitation
activity.
•Outcome: The SIEM raises an alert: “Suspicious login followed by
malware execution. Possible breach.
Log Normalization
•What It Means: Converting logs from various devices and formats into a
standard, unified structure that the SIEM can process and analyze.
•Why It’s Important: Different devices (e.g., firewalls, routers, and
applications) generate logs in unique formats. Normalization ensures that all
logs are standardized for easier analysis.
Example:
•Before Normalization:
Firewall Log: src_ip=192.168.1.10, dst_ip=10.0.0.5, action-allow
Server Log: source=192.168.1.10 accessed 10.0.0.5 success
After Normalization:
Normalized Log: Source IP: 192.168.1.10, Destination IP: 10.0.0.5, Event:
Access Allowed
Outcome: All logs now follow the same structure, making it easier to analyze
across devices
Redundancy: Use of extra components or systems
Fault Tolerance: The ability of a system to keep running despite a failure,
without interruption. Builds on redundancy.
SPOF (Single Point of Failure): A component or process that, if it fails, will
bring down the whole system
Horizontal = Add more servers
Vertical = Make one server stronger
Scalability = Can grow with demand
Elasticity = Can auto-adjust with demand
Resiliency = Bounce back fast and keep running, even after failure or attack.
VM Sprawl: Uncontrolled growth of virtual machines, leading to inefficiency,
management issues, and security risks.
VM Escape: A serious exploit where a malicious program breaks out of a VM
to access the host or other VMs.
Resource Reuse: When virtual resources (e.g., memory, storage) are
reallocated but may still contain residual data if not properly cleared.
API Security
API (Application Programming Interface) : Interface that allows systems to communicate securely
Authentication : Use API keys, OAuth, or JWT tokens to verify identity
Authorization : Ensure access control via RBAC / ABAC or scopes
Rate Limiting : Protects APIs from DoS attacks and abuse
Input Validation : Prevents injection attacks (e.g., SQLi, XSS) through user input
HTTPS Only : Enforce encrypted communication between clients and APIs
CASB = Security guard for cloud
apps (placed between cloud service
users and cloud providers )
Controls access, ensures
compliance, and protects data in
cloud environments
Secure Web Gateway (SWG) : A cloud-based or on-prem security
solution that monitors and filters outbound web traffic to prevent
unauthorized access, malware, and data leaks.
Including URL Filtering, SSL filtering, Malware Scanning, DLP etc ..
IaC : is the practice of managing and provisioning infrastructure
(servers, networks, etc.) using code instead of manual setup
Edge Computing : Processes data close to the source/device (e.g.,
IoT sensors), reducing latency and bandwidth use
Fog Computing : Extends cloud closer to the edge by using
intermediate devices (e.g., routers, gateways) to process data before
reaching the cloud.
UEM : a centralized solution that manages and secures all
endpoints (laptops, smartphones, tablets, desktops, IoT devices)
from a single platform.
Context-aware authentication : enhances login security by
evaluating additional factors such as location, device, time,
behavior, or network before granting access.
Shadow IT : refers to unauthorized systems or applications used
within an organization without authorization or approval.
Regular Audits is essential to detect shadow IT
Bloatware = Unwanted pre-installed apps that waste resources and
pose security risks.
BEC – Business Email Compromise
A type of cyberattack where attackers impersonate a trusted
executive, vendor, or employee via email to trick victims into sending
money or sensitive data.
Bluetooth Security
- Use strong pairing methods (e.g., PIN, encryption).
- Disable Bluetooth when not in use.
- Set devices to non-discoverable mode.
- Keep firmware updated
Jamming Attack
A Denial-of-Service (DoS) attack where a malicious actor floods a
wireless frequency (like Bluetooth or Wi-Fi) with noise or signals
UEM : a centralized solution that manages and secures all
endpoints (laptops, smartphones, tablets, desktops, IoT devices)
from a single platform.
NVD (National Vulnerability Database)
- U.S. government repository of known software
vulnerabilities.
- Provides CVEs (Common Vulnerabilities and Exposures),
severity scores, and fix info.
- Helps in patch management and risk assessments
STIX (Structured Threat Information Expression)
- What: A standard format for sharing threat intelligence
(e.g., IOCs, TTPs).
- Use: Enables automation and interoperability between
threat tools.
- Example: Describes a phishing campaign with attacker
details
TAXII (Trusted Automated eXchange of Indicator
Information)
- What: A protocol for sharing cyber threat data (often in
STIX format).
- Use: Automates secure, real-time threat data exchange
between systems
Threat Map
- Definition: A visual, real-time display showing global or regional cyber attack activity.
- Use: Gives security teams situational awareness of current threats.
- Example: FireEye or Fortinet live threat maps
Predictive Analysis
- Definition: Uses machine learning and data trends to forecast potential threats.
- Use: Helps proactively defend against likely attacks (e.g., based on past patterns).
- Example: Predicting phishing spikes during tax season
Secure Web Gateway (SWG) : A cloud-based or on-prem security solution that monitors and
filters outbound web traffic to prevent unauthorized access, malware, and data leaks.
Including URL Filtering, SSL filtering, Malware Scanning, DLP etc ..
Edge Computing : Processes data close to the source/device (e.g., IoT sensors), reducing latency
and bandwidth use
Fog Computing : Extends cloud closer to the edge by using intermediate devices (e.g., routers,
gateways) to process data before reaching the cloud.
Context-aware authentication : enhances login security by evaluating additional factors such as
location, device, time, behavior, or network before granting access.
AIS (Automated Indicator Sharing)
- What: DHS/CISA program that shares threat indicators in
real time with partners.
- Use: Helps organizations defend against known threats
faster
Shadow IT : refers to unauthorized systems or applications used within an organization without
authorization or approval.
Regular Audits is essential to detect shadow IT
Dark Web
- What: Part of the internet not indexed by search engines
and accessed via tools like Tor.
- Risks: Often used for illegal activity, such as selling
credentials, malware, or exploits.
- Security Role: Monitoring it can reveal compromised
data or threats
IaC : is the practice of managing and provisioning infrastructure (servers, networks, etc.) using
code instead of manual setup
Indicators of Compromise (IoCs)
- Definition: Artifacts or clues that indicate a system may
be compromised.
- Examples: Malicious IPs, file hashes, suspicious registry
changes, unusual traffic.
- Use: Helps in detecting and responding to cyberattacks.
BEC – Business Email Compromise
A type of cyberattack where attackers impersonate a
trusted executive, vendor, or employee via email to trick
victims into sending money or sensitive data.
Bloatware = Unwanted pre-installed apps that waste resources and pose security risks.
Log Normalization
•What It Means: Converting logs from various devices and formats into a standard, unified
structure that the SIEM can process and analyze.
•Why It’s Important: Different devices (e.g., firewalls, routers, and applications) generate logs in
unique formats. Normalization ensures that all logs are standardized for easier analysis.
Example:
•Before Normalization:
Firewall Log: src_ip=192.168.1.10, dst_ip=10.0.0.5, action-allow
Server Log: source=192.168.1.10 accessed 10.0.0.5 success
After Normalization:
Normalized Log: Source IP: 192.168.1.10, Destination IP: 10.0.0.5, Event: Access Allowed
Outcome: All logs now follow the same structure, making it easier to analyze across devices
Log Aggregation
•What It Means: Collecting and combining logs from multiple
sources into a central repository for analysis and storage.
•Why It’s Important: Simplifies monitoring by providing a single
view of events across the network.
Example:
•Scenario: Logs are generated by:
•
A firewall tracking incoming connections.
•
A server recording login attempts.
•
An antivirus system detecting malware.
•Aggregation:
•
The SIEM collects logs from all these sources and
consolidates them into a unified dashboard.
•Outcome: You can see all security events in one place, rather than
logging into multiple devices to view logs.
Log Correlation
•What It Means: Analyzing logs to find relationships between events
that may indicate a security incident.
•Why It’s Important: Detects patterns or threats that may not be
obvious when looking at individual logs.
Example:
•Scenario:
•
A firewall log shows multiple failed login attempts
from IP 192.168.0.10
•
A server log shows a successful login from the same
IP a few minutes later.
•
An antivirus log detects malware being executed
from that server.
•Correlation:
•
The SIEM links these events together:
•
Failed logins → Brute force attack.
•
Successful login → Potential compromise.
•
Malware detection → Post-exploitation
activity.
•Outcome: The SIEM raises an alert: “Suspicious login followed by
malware execution. Possible breach.
Lateral movement: refers to the way attackers maneuver
throughout a network. Mostly uses Windows Management
Instrumentation (WMI) and PowerShell
General Data Protection Regulation (GDPR) : European Union (EU)
directive mandates the protection of privacy data for individuals
who live in the EU.
SPAM
•Definition: Unsolicited, bulk email messages.
•Channel: Email
•Purpose: Advertising, phishing, spreading malware
•Example: Fake prize emails or product ads in your inbox.
SPIM (Spam over Instant Messaging)
•Definition: Unsolicited messages sent via messaging apps.
•Channel: IM platforms like Skype, WhatsApp, or Slack
•Purpose: Malicious links, scams, social engineering
•Example: Random chat message with a suspicious link
Nmap: Port scanning, service identification, OS detection
Netcat: Read/write to network connections; backdoors, banner
grabbing
Scanless: Performs port scans using third-party sites to avoid
detection
DNSEnum: DNS enumeration; gathers subdomains and IPs.
Sn1per: Automated recon, vulnerability scanning, and reporting.
Metasploit: Framework for developing and executing exploits
Burp Suite: Web vulnerability scanning, intercepting HTTP/S
traffic
Hydra: Brute-force login cracker (supports many protocols).
Medusa: Fast brute-forcer similar to Hydra; supports parallel
attacks
Mimikatz: Extracts credentials from Windows memory (hashes,
plaintext).
Wireshark: GUI-based packet capture and analysis. Tshark is CLI
version.
Tcpdump: CLI-based network packet sniffer and analyzer
HashCat: GPU-powered hash cracking (passwords, keys).
Pwdump: Extracts password hashes from Windows systems
Curl: Sends HTTP requests, tests APIs, downloads files.
IP Scanner: Finds live hosts and open ports in a network.
Nessus: Professional vulnerability scanner for full system audits.
Netstumbler: Wireless network discovery tool (Windows); shows
signal, SSID, encryption.
SQLmap: Automates SQL injection attacks to extract database
data.
Aircrack: Cracks WEP/WPA/WPA2 Wi-Fi passwords via captured
handshakes
Qualys: Cloud-based vulnerability management and compliance
platform.
Tcpreplay : a suite of utilities used to edit packet captures and
then send the edited packets over the network.
NetFlow: A protocol that captures metadata about traffic (e.g., IPs, ports, protocol, bytes)
to help monitor and analyze network activity for anomalies or trends.
•NetFlow Collector: A tool or server that receives and stores NetFlow data from network
devices to enable analysis and reporting (e.g., bandwidth usage, suspicious behavior).
Reference Architecture (RA): A pre-defined, standardized blueprint that guides secure
system design by outlining components, configurations, and best practices—used to ensure
consistency, security, and compliance
Acceptable Use Policy (AUP): defines the approved and prohibited ways users can access
and use an organization’s IT resources to ensure security and responsible behavior. Do and
Don’t
Data Classification
- Organizes data by sensitivity.
- Common levels: Public, Internal, Confidential, Restricted.
- Helps apply proper security controls.
- Supports compliance and risk management.
Incident Response Phases
1.Preparation – Policies, tools, training
2.Identification (Detection ) – Detect & report incident
3.Containment – Short-term & long-term isolation
4.Eradication – Remove root cause
5.Recovery – Restore & validate systems
6.Lessons Learned – Review and improve process
War Room
- Secure coordination hub for incident response
- incident response team base
- Real-time updates & decisions
First responders : Initial responders, such as a help-desk technician, should know when to
inform incident response entities of an incident and who to contact.
Threat Hunting
- Proactive detection of threats
- Goes beyond automated alerts
- Uses intel + analyst expertise
Method
Action
Medium
Use Case
File Shredding
Deletes & overwrites file data
Digital (HDD/SSD)
Secure file-level deletion
Wiping
Overwrites entire drive
Digital (HDD/SSD)
Full disk sanitization
Erasing
Deletes pointers (not secure)
Digital
Basic file removal
Overwriting
Writes random data multiple times
Digital
Secure deletion, prevents recovery
Paper Shredding
Cuts paper into strips/pieces
Physical (Paper)
Disposes sensitive documents
Burning
Incinerates material
Physical (Paper/Media)
Total destruction
Pulping
Mixes paper into slurry
Physical (Paper)
Irreversible destruction
Pulverizing
Crushes material into powder
Physical (Drives, CDs)
Final destruction step
Degaussing
Removes magnetic fields
Magnetic (HDD/Tapes)
Destroys data on magnetic media
Third-party Solutions
Outsourced destruction
Digital/Physical
Professional/compliant disposal
SOAR (Security Orchestration, Automation, and
Response)
A platform that helps coordinate, automate, and
streamline security operations.
Speeds up incident response by integrating tools
and automating repetitive tasks.
Automatically isolating a compromised endpoint after
a malware alert
Playbook
- A standardized set of steps to handle specific incidents
(e.g., phishing email response).
- Guides analysts through the detection and response
process.
- A phishing playbook includes user alert, header analysis,
URL inspection, and blocking sender.
Antivirus (AV)
- Basic software that detects and removes known
malware.
- Signature-based detection, some heuristic analysis.
- Protects individual devices (endpoints).
- No – user or admin manages it.
- Avast, Norton, Windows Defender.
MDR (Managed Detection and Response)
A third-party service that monitors, detects, and
responds to threats on your behalf
Helps organizations that lack in-house security
expertise or resources.
E.g - CrowdStrike Falcon Complete providing 24/7
threat hunting and response
Runbook
- A more detailed, technical procedure—often part of a
playbook.
- Contains step-by-step instructions for system tasks
(manual or automated).
- How to block a domain in a firewall or how to isolate a
device via EDR.
EDR (Endpoint Detection and Response)
- Advanced security for endpoints that detects and
investigates threats.
- Real-time monitoring, behavioral analysis, forensic
tools.
- Endpoint only.
- No – requires in-house analysts or a security team.
- CrowdStrike Falcon, SentinelOne.
XDR (Extended Detection and Response)
- Unified threat detection across multiple
layers: endpoints, network, email, cloud,
etc.
- Aggregates and correlates data across
systems for more contextual detections.
- Endpoints + other layers (network, email,
etc.).
- No – typically managed in-house but can
integrate with MDR.
- Example: Palo Alto Cortex XDR, Microsoft
Defender XDR.
MDR (Managed Detection and Response)
- A service (not a tool) provided by a thirdparty team to monitor, detect, and respond to
threats. 24/7 monitoring