2026 NEW VERSION D329 Network and Security - Applications COMPTIA Security+ OA Study Notes Key Conce

2026 NEW VERSION D329 Network and Security Applications COMPTIA Security+ OA Study Notes: Key Concepts & Definitions Western Governors University

Information Security = Protecting the data Information Systems Security = Devices that hold the data Confidentiality: ensures that info is only accessible to those with the appropriate authorization Integrity: ensures data remains accurate & unaltered unless modification is required Availability: ensures that information & resources are accessible & functional when needed by authorized users Threat: anything that could cause harm, loss, damage, or compromise to IT systems -natural disasters, cyber-attacks, data integrity breaches, disclosure of information Vulnerability: any weakness in the system design or implementation -bugs, misconfigurations, improper protection, missing patches, lack of physical security Threat + Vulnerability = Risk Confidentiality------ Encryption*** Encryption: process of converting data into code to prevent unauthorized access Access Controls: ensure only authorized ppl can access certain types of data Data Masking: method that involves obscuring data within a database to make it inaccessible for unauthorized users while retaining the real data’s authenticity & use for authorized users Physical Sec. Measures: used to ensure confidentiality for physical types of data &

digital info contained on servers & workstations Training/Awareness: conducting regular training on the security awareness best practices that employees can use to protect the organizations sensitive data Integrity ------- Hashing*** Hashing: process of converting data into a fixed-size value = Hash Digest (digital fingerprint) Digital Signatures: use encryption to ensure integrity & authenticity Checksums: method to verify the integrity of data during transmission Access Controls: ensure that only authorized ppl can modify data & reduce the risk of unintentional or malicious alterations Regular Audits: involve reviewing logs & operations to ensure that only authorized changes have been made & any discrepancies are addressed Availability ------- Redundancy***

Non-repudiation -------- Digital Signatures*** -focused on providing undeniable proof in digital transactions – a security measure that ensures individuals or entities involved in a transaction cannot deny their participation or the authenticity of their actions.

Digital Signature: created by first hashing a particular message or communication to be digitally signed & encrypting the has digest w/ the user’s private key using asymmetric encryption Authentication -security measure that ensures individuals/entities are who they claim to be during a communication/transaction Factors: MFA or 2FA -Something you know -Something you do -Something you have -Somewhere you are -Something you are Authorization -permissions & privileges granted to users/entities after they have been authenticated Accounting -security measure that ensures all user activities are properly tracked & recorded

SECURITY CONTROLS Technical Controls: the technologies, hardware & software mechanisms that are implemented to manage & reduce risks Managerial Controls: aka Admin governance side of security

controls; involve

the strategic

planning

&

Operational Controls: procedures & measures that are designed to protect data on a day-to-day basis & are mainly governed by internal processes & human actions -backup procedures, account audits, user training programs Physical Controls: tangible, real-world measures taken to protect assets

CONTROL TYPES Preventative: (build our foundation) proactive measures implemented to thwart potential security threats or breaches Deterrent: (discourage threats) aim to discourage potential attackers by making the effort seem les appealing or more challenging

Detective: (keep a watchful eye) monitor & alert organizations to malicious activities as they occur or shortly thereafter Corrective: (jump in during emergencies) mitigate any potential damage & restore the systems to their normal state Compensating: (offer backups & migrations) alternative measure implemented when primary security controls are not feasible or effective

that

are

Directive: (guide the entire process) often rooted in policy or documentation & set the standards for behavior within an organization (they guide, inform, or mandate different actions)

Gap Analysis: process of evaluating the differences between an organization’s current performance and its desired performance -is a powerful tool that can help organizations to improve their security & their performance by identifying areas where improvements can be made Zero-Trust: demands verification for every device, user & transaction within the network, regardless of its origin Need to use two different planes to create a Zero Trust architecture: Control Plane & Data Plane Control Plane: lays out the policies & procedures -the overarching framework & set of components responsible for defining, managing, & enforcing the policies related to user & system access within an organization – provides a centralized way to dictate & control how, when & where access is going to be granted to ensure that only authenticated & authorized entities can access specific resources.

Adaptive Identity: use adaptive identities that rely on real-time validation that takes into account the user’s behavior, device, location, & more.

Threat scope reduction: limit the user’s access to only what they need for their work tasks because this drastically reduces the networks potential attack surface Policy-driven access control: entails developing, managing, & enforcing user access policies based on their roles & responsibilities The control plane will use a Policy Engine & a Policy Administrator to make decision about access Policy Engine: cross-references the access request with its predefined policies, like a rule book Policy Administrator: is used to establish & manage the access policies, who gets access to what

Data Plane: ensures these policies are properly executed Subject/System: refers to the individual or entity attempting to gain access, the primary objective is to verify the authenticity of the subject or system before granting access to your sensitive data or systems.

Policy Enforcement Point: allow or restrict access & it will effectively act as a gatekeeper to the sensitive areas of the systems/networks – grant or deny access

PHYSICAL SECURITY Bollards: short, sturdy vertical posts designed to control or prevent access by vehicles to an area Fences: barriers that are node of posts, wire, or boards that are erected to enclose/separate areas -brute force: access is gained by trying all the possibilities until getting in Video Surveillance: organized strategy or setup designed to observe & report activities in an area Access control vestibule: double-door system with two electronically controlled doorssally port Access Control badge: use RFID & NFC technologies for contactless authentication -access badge cloning Lighting: proper lighting is crucial for conducting effective surveillance using both video & security guards Infrared: detect changes infrared radiation that is emitted by warm bodies like humans/animals Pressure: activate when a specified min amount of weight is detected on the sensor embedded into floor Microwave: detect movement in an area by emitting microwave pulses & measuring their reflection off moving objects Ultrasonic: measure the reflection of ultrasonic waves off moving objects

DECEPTION & DISRUPTION TECHNOLOGIES: designed to mislead, confuse & divert attackers Honeypot: decoy system or network set up to attract potential hackers, log all interactions/ transactions for research, should be placed in a screened subnet Honeynet: network of honeypots to create a more complex system that is designed to mimic an entire network of systems, including servers, routers, & switches, logs all activities

Honeyfiles: decoy file places within a system to lure in potential attackers, when accessed an alert is triggered Honeytokens: piece of data or a resource that has no legitimate value or use but is monitored for access or use, useful in detecting insider threats

THREAT ACTORS Unskilled attacker: individual who lacks the technical knowledge to develop their own hacking tools/exploits- “Script Kiddie” Hacktivist: individuals/groups that use their technical skills to promote a cause a drive asocial change instead of personal gain Organized crime: sophisticated & well-structured entities that leverage resources & technical skills for illicit gain Nation-state actor: most sophisticated type- groups that are sponsored by a gov’t to conduct cyber operations against other nations, organizations, or individuals – may also act independently with state backed resources so that the state may maintain plausible deniability Insider threat: cybersecurity threats that originate from with the organization Shadow IT: the use of information tech systems, devices, software, apps & services without explicit organizational approval

THREAT ACTOR MOTIVATIONS Data Exfiltration: unauthorized transfer of data from a computer Espionage: spying to gather sensitive/classified information Service disruption: DDoS attack to interrupt network availability Blackmail: attacker obtains compromising info and threatens to leak unless demands are met Financial Gain: one of the most common motivations for cybercriminals Philosophical/political: hacking to promote a political agenda, social change, or protest (Hacktivism) Ethical: ethical hackers are motivated by a desire to improve security Revenge: a disgruntled employee may want to harm current/former employee Disruption/Chaos: motivated by the thrill, challenge or damage caused by their malicious acts War: a tool for nations to attack each other both on and off the battlefield

ATTRIBUTES OF ACTORS

Internal vs. External: Internal threat actors are individuals/entities within an organization who pose a threat to its security External threat actors are individuals/groups outside the organization who attempt to breach its cybersecurity defenses Resources & Funding: refers to the tools, skills & personnel at the disposal of a given threat actor Level of sophistication & capability: refers to their technical skill, the complexity of the tools & techniques they use, & their ability to evade detection & countermeasures

Threat vector: the means or pathway by which an attacker can gain unauthorized access to a computer/network to deliver a malicious payload or carry out an unwanted action Attack surface: encompasses all the various points where an unauthorized user can try to enter data to or extract data from an environment Messages: message-based threat vectors include threats delivered via email, SMS, or other forms of instant messaging – phishing campaigns Images: embedding of malicious code inside of an image file by the threat actorFiles: use of malicious files to deliver a cyber threat disguised as legitimate documents Voice call: involve the use of voice calls to trick victims into revealing their sensitive information Removable device: threats delivered via removable devices (USB thumbs & external storage devices) – baiting Unsecure networks: include wired, wireless & Bluetooth networks lacking security measures- evil twins

SUPPLY CHAIN Managed Service Providers (MSPs): organization’s that provide a range of technology services & support to businesses & other clients Vendor Due Diligence: understanding the vendors cybersecurity posture & their own supply chain management & security practices; rigorous evaluation that goes beyond surface-level credentials -financial stability, operational history, client reviews, on-the-ground practices Vendor conflict of interest: arises when personal/financial relationships could potentially cloud the judgement of individuals involved in vendor selection

Vendor Questionnaires: comprehensive documents that potential vendors fill out to offer insights into the operations, capabilities & compliance Rules of Engagement: guidelines that dictate the terms of interaction between an organization & its potential vendors Vendor monitoring: continuous monitoring & audits of your supply chain are essential for early detection in suspicious activities/vulnerabilities Vendor assessment: process that organization’s implement to evaluate the security, reliability & performance of external entities Penetration testing: simulated cyberattack against the supplier’s system to check for exploitable vulnerabilities Right-to-audit clause: grants your organizations the right to evaluate the vendor’s internal processes & ensure that they’re in compliance with the agreed upon standards Evidence of internal audits: vendor’s self-assessment where they evaluate their own practices against industry standards or organizational requirements Independent assessments: evaluation conducted by 3-pary entities that have no stake in the organizations or vendor’s operations Supply chain analysis: used to dive deep into a vendor’s entire supply chain & assess the security & reliability of each link

Service-level agreement (SLA): the standard of service a client can expect from a provider Memorandum of agreement (MOA): formal & outlines the specific responsibilities & roles of the involved parties Memorandum of understanding (MOU): less binding & more of a declaration of mutual intent Master service agreement (MSA): blanket agreement that covers the general terms of engagement between parties across multiple transactions Statement of work (SOW): used to specify details for a particular project (deliverables, timelines, milestones) Non-disclosure agreement (NDA): commitment to privacy that ensures that any sensitive information shared during negotiations remains confidential between both parties Business partners agreement (BPA): document that goes a step beyond the basic contract when two entities decide to pool their resources for mutual benefit

SOCIAL ENGINEERING

Phishing: fraudulent attack using deceptive emails from trusted sources to trick individuals into disclosing personal info like passwords & credit card #’s Vishing: (voice) phone-based attack in which the attacker deceives victims into divulging personal or financial information Smishing: (SMS) attack that uses text messages to deceive individuals into sharing their personal information Business email compromise: advanced phishing attack that leverages internal email accounts within a company to manipulate employees into carrying out malicious actions for the attacker Impersonation: an attack where an adversary assumes the identity of another person to gain unauthorized access to resources or steal sensitive data Brand Impersonation: specific form of impersonation where an attacker pretends to represent a legitimate company/brand Typosquatting: aka URL hijacking or cyber-squatting – an attacker registers a domain name that is similar to a popular website but contains some kind of common typographical errors Watering hole: targeted form of cyber-attack where attackers compromise a specific website or service that their target is known to use – passive attack, they sit and wait to attack Pretexting: someone tricking another person to fill in the gaps of info the attacker is missing by acting like an innocent person Misinformation: inaccurate information shared unintentionally (like spreading myths) Disinformation: intentional spread of false information to deceive or mislead

MALWARE ATTACKS Virus: malicious code that’s run on a machine without the user’s knowledge & this allow the code to infect the computer whenever it has been run -installing/downloading a program, downloading files, requires user to take some action for virus to do its thing Worm: piece of malicious software, much like a virus, but it can replicate itself without any user interaction -worms don’t need any user action to do its thing & searches for vulnerabilities & can spread over network in a short amount of time Trojans: a piece of malicious software that is disguised as a piece of harmless or desirable software

-exploit vulnerabilities & conducting data exfiltration Ransomware: type of malicious software that is designed to block access to a computer system or its data by encrypting it until a ransom is paid to the attacker Rootkit: type of software that is designed to gain admin-level control over a given computer system without being detected -designed to dig deeply into the operating system without being detected Logic Bomb: malicious code that’s inserted into a program & will only execute when certain conditions have been met Keylogger: piece of software or hardware (plugged in) that records every single keystroke that is made on a computer or mobile device and transmits data back to a remote server Spyware: type of malicious software that is designed to gather & send info about a user or organization Bloatware: any software that comes pre-installed on a new computer or smartphone -isn’t dangerous but consumes resources, memory, RAM, etc.

INDICATORS OF MALWARE Account Lockouts Blocked Content Resource consumption Out-of-cycle logging Impossible travel Resource inaccessibility

Published/documented Concurrent session usage Resource inaccessibility Missing logs

NETWORK ATTACKS Distributed Denial-of-service (DDoS): used to describe an attack that attempts to make a computer or server’s resources unavailable, several machines attacking a single server simultaneously Amplified: Reflected: Domain Name System (DNS) attacks: exploit the DNS vulnerabilities to disrupt service, steal information, or redirect a websites traffic

APPLICATION ATTACKS Directory traversal attack: a type of injection attack that allows access to commands, files, & directories, that may or not be connected to web document root directory ***exam will ask you to look at logs & proxy servers, as you’re looking through the proxy server logs, anytime you see “ ../ “ think directory traversal***

Privilege escalation: occurs when a user accesses or modifies specific resources that they are not entitled to normally access On-path attack: an attack where the penetration tester puts the workstation logically between two hosts during the communication, by placing themselves in the path between the client & the server, the attacker can intercept the authorization packets being sent & received & then use those to take over the authorized session -ARP poisoning, DNS poisoning, rogue WAP, rogue switch Injection attack: -LDAP injections, command injections, & process injections

PASSWORD ATTACKS Brute force attacks: involves trying every possible combination of characters until the correct password is found Spraying attacks: a form of brute force attack that involves trying a small # of commonly used passwords against a large # of usernames or accounts

CRYPTOGRAPHIC ATTACKS Downgrade Attacks: aka version rollback attack; aims to force a system into using a weaker or older cryptographic standard or protocol than what its currently utilizing; systems that support backward compatibility are at risk for this Collision Attacks: aims to find two different inputs that produce the same hash output Birthday Attack: the probability that two distinct inputs, when processed through a hashing function, will produce the same output, or a collision

DATA TYPES, CLASSIFICATIONS, STATES & METHODS TO SECURE DATA Regulated Data: information controlled by laws, regulations or industry standards Trade Secrets: type of confidential business info that provides a company with a competitive edge Intellectual Property: creations of the mind: inventions, literary & artistic works, designs & symbols Legal information: includes any data related to legal proceedings, contracts, or regulatory compliance Financial Information: data related to an organization’s financial transactions: sales records, invoices, taxes, bank statements…

Human readable: information that can be understood by humans without the need for a machine or software Non-human readable: information that requires a machine or software to interpret

Sensitive Data: any information that can result in a loss of security or a loss of advantage to a company if accessed by an unauthorized person Public: no impact on the company if released & is often posted in an open-source environment Sensitive: has minimal impact if released Private: contains data that should only be used within the organization (PII, $$) Confidential: contains items such as trade secrets, intellectual property data, & source code that affect if disclosed Critical: contains valuable information (credit card #’s)

Data at rest: refers to any data stored in a databases, file systems, or other storage systems; not actively moving/ prime target for threat actors Data in transit: refers to data actively moving from one location to another, such as across the Internet or through a private network; vulnerable to interception -SSL & TLS, VPNs, IPSec to protect data in transit Data in use: refers to data in the process of being created, retrieved, updated or deleted

Data Sovereignty: refers to the concept that digital information is subject to the laws of the country in which it is located Geolocation: Geographic restrictions: (Geofencing) involves setting up virtual boundaries to restrict data access based on geographic location Encryption: fundamental data security method that transforms readable data (plaintext) into unreadable data (ciphertext) using an algorithm & an encryption key Hashing: technique that converts data into a fixed size of numerical or alphanumeric characters, known as a hash value Masking: involves replacing some or all the data in a field with a placeholder, such as “x” to conceal the original content

Tokenization: replaces sensitive data with non-sensitive substitutes, known as tokens; the original data is stored securely in a separate database with a token serving as a reference to the original data Obfuscation: involves making data unclear or unintelligible, making it difficult for unauthorized users to understand; can involve various techniques: encryption, masking, & use of pseudonyms Segmentation: involves dividing a network into separate segments, each with its own security controls Permission restrictions: involve defining who has access to specific data & what they can do with it

Data Ownership: process of identifying the person responsible for the confidentiality, integrity, availability, & privacy of then information assets

Data Loss Prevention: set up to monitor the data of a system while it’s in use, in transit, or at rest in order to detect any attempts to steal the data

CRYPTOGRAPHIC SOLUTIONS Public Key Infrastructure (PKI): system entirely based on asymmetric encryption; framework for managing digital keys & certs that facilitate secure data transfer, authentication, & encrypted communications over networks Certificate authority: issues digital certificates & keeps the level of trust between all of the certificate authorities around the world Key Escrow: process where cryptographic keys are stored in a secure, third-party location, which is effectively an “escrow”; in case someone loses their key or legal investigations Symmetric: single key to encrypt & decrypt (Private Key) encryption algorithm in which both the sender & the receiver must know the same shared secret using a privately held key Asymmetric: two different keys to encrypt/decrypt; (Public Key) encryption algorithm where different keys are used to encrypt & decrypt the data

Hashing: one-way cryptographic function that takes an input & produces a unique message digest as its output; hash digests are always the same length Birthday Attack: occurs when an attacker is able to send two different messages through a hash algorithm & it results in the same identical hash digest, referred to as a collision, primary objective is to create collisions Key Stretching: increases the strength of hashes; technique that is used to mitigate a weaker key by increasing the time needed to crack it; creates a longer more secure key Salting: adding random data into a one-way cryptographic hash to help protect against password cracking techniques; amplifies password security.

Digital Signatures: a hash digest of a message encrypted with the sender’s private key to let the recipient know the document was created & sent by the person claiming to have sent it

Digital Certificate: digitally signed electronic document that binds a public key with a user’s identity Certificate signing request (CSR): a block of encoded text that contains information about the entity requesting the certificate (org’s name domain name, country, & locality) Certificate revocation lists (CRLs): serves as an online list of digital certificates that the certificate authority has already revoked; each CA has its own CRL. Online Certificate Status Protocol (OCSP): allows to determine the revocation status of any digital certificate using its serial #; Wildcard: allows all of the subdomains to use the same public key cert & have it displayed as valid; ease of maintainability.

Self-signed: digital cert that is signed by the same entity whose identity it certifies; can provide encryption but not same level of trust since there’s no external verification of user’s identity Third-party certificate: digital cert issued & signed by a trusted certificate authority (CA); preferred choice for any public facing websites Root of trust: each certificate is validated using the concept of a root of trust or the chain of trust; like a family tree of trust Obfuscation Techniques: Steganography: concealing a message within another message; hiding secret data within ordinary non-secret files or messages to avoid detection; goal is to make things appear as if there is no sensitive data being held vs preventing unauthorized access

Tokenization: transformative technique in data protection that involves substituting sensitive data elements with non-sensitive equivalents, called tokens, which have no meaningful value.

Data masking: used to protect data by ensuring that it remains recognizable but does not actually include sensitive information Encryption tools: Blockchain: a shared immutable ledger for recording transactions, tracking assets & building trust Public Ledger: a record-keeping system that maintains participants identities in a secure & anonymous format

ENCYPTION TOOLS Trusted Platform Module (TPM): dedicated microcontroller designed to secure hardware through integrated cryptographic keys- used with BitLocker -TPM is like a personal vault Hardware Security Module (HSM): physical device that safeguards & manages digital keys, primarily used for mission-critical situations like financial transactions; will perform accelerated encryption operations within a tamper-proof environment -HSM is like a high security vault Key Management System: integrated approach for generating, distributing & managing cryptographic keys for devices and applications; a centralized mechanism that controls the entire lifecycle from inception to retirement/destruction Secure enclave: co-processor integrated into the main processor of some devices, designed with the sole purpose of ensuring data protection -like a fortress inside your device to safeguard sensitive information; keeps this data segregated from main processor

Risk Identification: recognizing potential risks that could negatively impact an organization’s ability to operate or achieve its objectives -once the risks are identified, usually followed up by conducting a business impact analysis

BUSINESS IMPACT ANALYSIS Recovery Time Objective (RTO): represents the max acceptable length of time that can elapse before the lack of a business function severely impacts the organization Recovery Point Objective (RPO): represents the max acceptable amount of data loss measured in time

Mean time to repair (MTTR): represents the average time required to repair a failed component/system Mean time between failures (MTBF): represents the average time between failures

RISK ASSESSMENT Ad Hoc: conducted as and when needed, often in response to a specific event or situation that has the potential to introduce new risks or change the nature of existing risks Recurring: conducted at regular intervals, as mandated by SOP One-Time: conducted for specific purpose or project & are not repeated Continuous: ongoing monitoring & evaluation of risks

RISK ANALYSIS Qualitative: a method of assessing risks based on their potential impact & the likelihood of their occurrence -this method is subjective & relies on the expertise & experience of the project team/stakeholders Quantitative: an objective & numerical evaluation of risks; a probabilistic analysis of potential future events; this method allows for more precise understanding of potential impacts & the effectiveness of proposed solutions Single Loss Expectancy (SLE): monetary value expected to be lost in a single event $$ Annualized Rate of Occurrence (ARO): estimated frequency with which a threat is expected to occur within a year Annualized Loss of Expectancy (ALE): expected annual loss from a risk (SLE x ARO=ALE) Exposure Factor (EF): proportion of an asset that is lost in an event expressed in %

RISK REGISTER: a document detailing identified risks, including their description, impact likelihood & mitigation strategies; may resemble the heat map risk matrix Key risk indicators: essential predictive metrics used by organizations to signal rising levels in different parts of the enterprise; serve as a barometer of risk or safety levels to help evaluate likelihood of risks Risk owners: person or group responsible for managing the risk Risk threshold:

RISK APPETITE: signifies an organization’s willingness to embrace or retain specific types & levels of risk to fulfill its strategic goals

Expansionary: organization is open to taking ore risk in the hopes of achieving greater returns Conservative: organization favors less risk, even if it leads to lower returns Neutral: a balance between risk & return

RISK MANAGEMENT STRATEGIES Transfer: (Risk Transference or Risk Sharing) involves shifting the risk from the organization to another party- like insurance or a contract indemnity clause Accept: recognizing a risk & choosing to address it when it arises Exemption: provision that grants an exception from a specific rule or requirement Exception: provision that permits a party to bypass a rule or requirement in certain situations Avoidance: strategy of altering plans or approaches to eliminate a specific risk entirely Mitigate: implementing measures to decrease the likelihood or impact of a risk Risk Reporting: process of communicating information about risk management activities, including the results of risk identification, assessment, response, & monitoring to stakeholders/project team in form of a risk report

GOVERNANCE: strategic leadership, structures, & processes that ensure an organization’s IT infrastructure aligns with its business objectives Boards: a board of directors is a group of individuals elected by shareholders to oversee the management of an organization; they set the company’s strategic direction by setting policies & making significant decisions Committees: subgroups of a board of directors, each with a specific focus Government entities: they establish laws & regulations that organizations must comply with Centralized: decision-making authority is concentrated at the top level of management Decentralized: distributes decision making authority throughout the organization

POLICIES Acceptable use policy (AUP): a document that outlines the do’s & don’ts for users when interacting with an organization’s IT systems & resources Information Security policies: outline how an organization protects its information assets from threats, both internal and external

Business continuity: focuses on how an organization will continue its critical operations during and after a disruption Disaster Recovery: focuses specifically on how an organization will recover its IT systems & data after a disaster Incident Response: a plan for handling security incidents Software development lifecycle (SDLC): guides how software is developed within an organization, ensures high quality products Change Management: aims to ensure that changes are implemented in a controlled & coordinated manner, minimizing the risk of disruptions

STANDARDS Passwords: dictate the complexity & management of passwords, which are the first line of defense against unauthorized access Access Control: determine who has access to what resources within an organization Physical Security: these standards cover the physical measures taken to protect an organizations assets and information, including environmental controls (HVAC & power redundancy) Encryption: ensure that data intercepted or accessed without authorization remains unreadable & secure

PROCEDURES Change Management: systematic approach to dealing with changes within an organization Onboarding: the process of integrating new employees into the organization Offboarding: the process of managing the transition when an employee leaves.

Playbooks: checklist of actions to perform to detect & respond to a specific type of incident, a step-by-step guide

GOVERNANCE/EXTERNAL CONSIDERATIONS Regulatory: these regulations can cover a wide range of areas, from data protection & privacy to environmental standards & labor laws Legal: closely tied to regulatory considerations, but they also encompass other areas such as contract law, intellectual property & corporate law Industry: the specific standards & practices that are prevalent in a particular industry Local: local ordinance in a city or zoning laws

National & Global also have applicable laws to adhere to

COMPLIANCE REPORTING: systematic process of collecting & presenting data to demonstrate adherence to compliance requirements Internal: collection & analysis of data to ensure than an organization is following its internal policies & procedures External: demonstrating compliance to external entities, such as regulatory bodies, auditors, or customers, often mandated by law or contract Compliance monitoring: the process of regularly reviewing & analyzing an organization’s operations to ensure compliance with laws, regulations & internal polices Due diligence: conducting an exhaustive review of an organization’s operations to identify potential compliance risks Due care: the steps taken to mitigate these risks Attestation: formal declaration by a responsible party that the organizations processes & controls are compliant Acknowledgement: recognition & acceptance of compliance requirements by all relevant parties Internal: regularly reviewing an organization’s operations to ensure compliance with internal policies External: 3rd party reviews/audits to verify compliance with external regulations or standards Automation: automated compliance systems can streamline data collection, improve accuracy, & provide real-time compliance monitoring

CONSEQUENCES OF NON-COMPLIANCE Fines: monetary penalties imposed by regulatory bodies for non-compliance Sanctions: strict measures taken by regulatory bodies to enforce compliance Reputational damage: the negative impact on a company’s reputation due to noncompliance Loss of license: non-compliance can lead to the loss of a company’s license to operate Contractual impacts: consequences or effects that arise as a result of a contract between two or more parties, in breach of contract

Acquisition: process of obtaining goods & services

Procurement: encompasses the full process f acquiring goods & services, including all preceding steps Assignment/Accounting: every organization should designate individuals or groups as owners for each of its assets Ownership: which asset belongs to whom, or which department Classification: involves categorizing assets based on criteria like function, value, or other relevant parameters as determined by the organization Monitoring/tracking: ensures proper accountability & optimal use of each asset Asset tracking: involves maintaining a comprehensive inventory with asset specifications, locations, assigned users, & relevant details Inventory: Enumeration: through the use of software tools & scanners to determine which assets are connected to a given network & what type of software/OS is being used on those assets; involves identifying & counting assets, especially in large organizations or during times of asset procurement or retirement Disposal/decommissioning Sanitization: thorough process of making data inaccessible & irretrievable from a storage medium using traditional forensic methods -overwriting data, degaussing, encryption techniques Destruction: ensures the physical device itself is beyond recovery or reuse -shredding, pulverizing, melting, incinerating Certification: an act of proof that the data or hardware has been securely disposed of Data retention is focused on strategically deciding what to keep & for how long

MOBILE SOLUTIONS Mobile Device Management (MDM): lets organizations securely oversee employee devices, ensuring policy enforcement, software consistency, and data protection Deployment models: BYOD: permits employees to use personal devices for work COPE: Involves the company providing a mobile device to employees for both work & personal use CYOD: offers a middle ground between BYOD & COPE by allowing employees to choose devices from a company-approved list

CHANGE MANAGEMENT Stakeholders: a person with a vested interest in the proposed change Impact analysis: an integral part of change management process that involves understanding of change’s potential fallout Maintenance window: take advantage of these windows to install other updates as its already scheduled downtime, but if there’s an emergency then you must install updates on-the-go Backout plan: unforeseen issues can arise; predetermined strategy for restoring systems to their initial state in case a change does not go as expected Test results: changes need to be validated to ensure desired outcome; confirms success or further work needed Standard operating procedure: a step-by-step instruction that guides the carrying out of a specific task to maintain consistency and efficiency TECHNICAL IMPLICATIONS Allow/Deny lists: used by routers & firewalls to either allow or deny certain resources from being accessed Restricted activities: some tasks or operations might be listed as restricted due to their potential impacts on a systems health or security Downtime: any proposed change, no matter how small, does run the risk of causing downtime to systems Service/Application restarts: after installing updates/patches, services or apps will need to be restarted to apply the change, consider the potential impacts from this type of downtime Legacy applications: these are sensitive to changes because they’re generally less supported and may not adapt as easily to new installs/updates/patches Dependencies: a lot of applications/services are dependent on other applications/services, consider potential implications of changing one area and then disrupting another due to these dependencies DOCUMENTATION Version Control: each implemented change can carry other changes or impacts to systems/networks, version control is the safety net that ensures our changes do not create more chaos; a system that tracks & manages changers to our documents, software & other collections of information to allow multiple users to work collaboratively & revert to a previous version whenever its needed.

Updating diagrams whenever changes are implemented Updating policies/procedures whenever changes are implemented

AUDITS & ASSESSMENTS Internal audit: systematic evaluation of the effectiveness of internal controls, compliance & integrity of information systems & processes Audit committee: group of people responsible for supervising the organization’s audit & compliance functions Internal assessment: an in-depth analysis to identify & assess potential risks & vulnerabilities in an organization’s information systems Self-assessment: internal review conducted by an organization to gauge it adherence to particular standards or regulations External audit: systematic evaluation carried out by external entities to assess an organization’s information systems & controls External assessment: detailed analysis conducted by independent entities to identify vulnerabilities & risks Regulatory compliance: objective that organizations aim to reach in adherence to applicable laws, policies, & regulations Examination: comprehensive security infrastructure inspections that are conducted externally, they review policies, procedures & controls & address weaknesses; industrybased exams can also arise based on sector regulations Independent 3rd party audit: offers validation of security practices, fostering trust with customers, stakeholders, & regulatory authorities

PENETRATION TESTING: simulated cyber-attack that helps in the assessment of computer systems for exploitable vulnerabilities Physical pentesting: testing an organization’s physical security through testing locks, access cards, security cameras, & other protective measures; aims to find weaknesses & suggest enhancements Offensive pentesting: (Red team) proactive approach that involves use of attack techniques, akin to real cyber threats, that seek & exploit system vulnerabilities Defensive pentesting: (Blue team) reactive approach that entails fortifying systems, identifying & addressing attacks, & enhancing incident response times; improves incident response times & helps strengthen systems, enhances detection capabilities Integrated pentesting: (Purple team) combination of aspects of both offensive and defensive testing into a single penetration test; promotes teamwork Reconnaissance: an initial phase where critical information about a target system is gathered to enhance an attack’s effectiveness & success

Passive: does not directly engage with the target system, less detection risk; will try to research the target online, using open-source intelligence, observe network traffic & other public data Active: the attacker engages with the target system directly, trying to gain more information with a higher detection risk (ping the system, port scanning (using Nmap), or trying to connect to systems) Known environment: detailed target infrastructure information from the organization is received prior to the test- aims to thoroughly evaluate vulnerabilities; tests insider threats Partially known environment: involves limited info provided to testers; aims to identify vulnerabilities in both known and hidden assets; reconnaissance is important here so attacker can fill in information gaps Unknown environment: testers receive minimal to no information about the target system; aims to mimic a real-world external attack; uses extensive reconnaissance Attestation: process that involves the formal validation or confirmation provided by an entity that is used to assert the accuracy & authenticity of specific information

RESILIENCE & RECOVERY High availability: the ability of a service to be continuously available by minimizing the downtime to lowest amount possible Load balancing: the process of distributing workloads across multiple computing resources Clustering: the use of multiple computers, multiple storage devices, and redundant network connections that all work together as a single system to provide high levels of availability, reliability & scalability; clustering provides redundancy Multi-cloud systems: distributes data, applications, & services across several different cloud-based environments as an additional form of redundancy; mitigates a single point of failure Capacity planning: crucial strategic planning to meet future demands cost-effectively People: involves analyzing current skills & forecasting future needs for hiring or training Technology: involves assessing current resources, utilizations, & anticipating future technological needs Infrastructure: involves considering physical space & utilities to support organizational operations

Uninterruptible Power Supply (UPS): a device that provides emergency power to a system when the normal input power source has failed Generator: machine that converts mechanical energy into electrical energy for use in an external circuit through the process of electromagnetic induction BACKUPS Onsite/Offsite: where the backups of the data are physically being stored Offsite: the practice of storing duplicate copies of data at a geographically separate location from the primary data source to provide protection against physical disasters and to ensure data continuity Frequency: how much data are we willing to lose?

Encryption: fundamental safeguard that protects the backup data from unauthorized access & potential breaches Snapshots: point-in-time copies of the data that capture a consistent state that is essentially a frozen in time copy of the data Recovery: used to regain access to the data in the event of a data loss or a system failure Replication: making real-time, o near real-time copies of the data Journaling: maintaining a meticulous record of every change made to an organization’s data over time Continuity of operations: ensures an org ability to recover from disruptive events or disasters Hot: a fully equipped backup facility to swiftly take over in case of a primary site failure or disruption; very expensive Cold: a site with no immediate equipment or infrastructure but can be transformed into a functional backup facility Warm: a partially equipped backup site that can become operational within days of a primary site disruption; may provide essentials like power, phone lines & network connectivity Platform diversity: a vital aspect in redundant site design that uses different platforms to prevent single points of failure in disaster recovery Tabletop exercises: a simulated discussion to improve crisis readiness without deploying resources.

Failover: verifies seamless system transition to a backup for uninterrupted functionality during disasters

Simulation: computer-generated representations of real-world scenarios; allow responders to perform actions in a virtualized environment Parallel processing: replicates data & processes onto a secondary system, running both in parallel; aims to check reliability & stability of your secondary setup to make sure it can handle processing data without disrupting day-to-day operations during a disaster

ARCHITECTURE MODELS Considerations: Availability: system’s ability to be accessed when needed Resilience: system’s ability to recover from failures & continue to function Cost: it’s essential to consider both the immediate & long-term costs of cloud adoption Responsiveness: the speed at which the system can adapt to changes in demand Scalability: system’s ability to handle increased workloads Ease of deployment: cloud services are easier to deploy than on-premises solutions Risk transference: when using clous services, some risks are transferred to the provider Ease of recovery: cloud services often offer easy data recovery & backup solutions Patch availability: cloud services regularly release patches to fix vulnerabilities Inability to patch: sometimes businesses might not be able to apply patches due to compatibility issues Power: customers don’t have to worry about power consumption Compute: the amount of computational resources that a customer can use (amount of CPUs, memory, etc.)

Cloud Computing: Responsibility matrix: outliners the division of responsibilities between the cloud service provider and the customer Hybrid considerations: combine on-premises infrastructure, private cloud services & public cloud services 3rd party vendors: provide specialized services that enhance the functionality, security & efficiency of cloud solutions.

Architecture & infrastructure concepts:

Infrastructure as code (IaC): a method in which IT infrastructures are defined in code files that can be versioned, tested & audited, instead of manually configuring & managing servers.

Idempotence: the ability of an operation to produce the same results no matter how many times its executed.

On-premises solutions: computing infrastructure that’s physically located on-site at a business Serverless computing: model where the responsibility of managing servers, databases, & some application logic is shifted away from developers on handled by cloud service providers to allow developers to focus solely on the individual functions that make up their application Microservices: an architectural style that structures an application as a collection of small autonomous services. A software architecture where large applications are broken down into smaller & independent services, each microservice is self-contained & able to run independently.

Network Infrastructure: separated into either physically or logically Physical isolation/Air Gapping: isolation of a network by removing any direct or indirect connections from other networks- a security measure. An air gap system is isolated from other networks both local & internet.

Logical segmentation: creating boundaries within a network, restricting access to certain areas. Achieved through firewalls, VLANs, & other network devices that can control network traffic.

Software defined networking (SDN): enables efficient network configuration to improve performance & monitoring; a revolutionary approach to network management that enables dynamic programmatically efficient network configuration to improve network performance & monitoring. SDN is designed to reduce the complexity & static, inflexible network architectures by using a standardized platform.

Centralized architecture: all the computing functions are coordinated & managed from a single location or authority, all apps/resources stored in one place, Decentralized architecture: computing functions are distributed across multiple systems or locations, no single point of control, each node operates independently.

IoT: refers to the network of physical items with embedded systems that enables connection & data exchange Industrial control systems (ICS): control systems used to monitor & control industrial processes ranging from simple systems to complex systems Supervisory control & data acquisition (SCADA): a type of ICS used to monitor & control geographically dispersed industrial processes

Embedded systems: specialized computing component designed to perform dedicated functions within a larger structure

VIRTUALIZATION: technology that allows for the emulation of servers Virtual machine escape: occurs when an attacker is able to break out of one of these normally isolated virtual machines Resource reuse: concept in computing where system resources like memory or processing power are reused; a reuse vulnerability occurs when a system resource such as memory in not properly cleared or reset before being assigned to another task, this can expose sensitive information to the new task Containerization: a lightweight alternative to full machine virtualization that encapsulates an application in a container with its own operating environment

Protocol: rules governing device communication & data exchange Firewall: safeguard networks by monitoring & controlling traffic based on predefined security rules Rules: Access control lists (ACLs): a rule set that is places on firewalls, routers & other network infrastructure devices that permit or allow traffic through a particular interface; rules are followed according to the order in which they are listed from top to bottom.

Ports/protocols Screened subnet: (dual-homed host) acts as a security barrier between external untrusted networks & internal trusted networks, using a protected host with security measures like a packet-filtering firewall Next generation Firewall (NGFW): aims to address the limitations of traditional firewalls by being more aware of applications & their behaviors Unified Threat Management Firewall (UTM): provides the ability to conduct multiple security functions in a single appliance Web Application Firewall (WAF): focuses on the inspection of the HTTP/HTTPS traffic; can be installed as a separate appliance or a software plugin Layer 4 firewall: operates at the layer 4(transport); filters based on port #’s & protocols without inspecting packet content Layer 7: operates at the layer 7 (application); inspects & controls traffic based on data content & application characteristics IDS/IPS

Trends: Signatures: Network Appliances: dedicated hardware devices with pre-installed software that is designed to provide specific networking services Load Balancers: crucial component in any high-availability network or system that is designed to distribute network or application traffic across multiple servers Jump server: dedicated gateway used by system administrators to securely access devices located in different security zones within the network Proxy server: intermediary between a client & a server to provide various functions like content caching, request filtering, & login management Sensors: designed to monitor, detect, & analyze traffic & data flow across a network in order to identify any unusual activities, potential security breaches, or performance issues Port Security: common security feature found on network switches that allows administrators to restrict which devices can connect to a specific port based on the network interface cards MAC address 802.1X: standardized framework that is used or port-based authentication for both wired & wireless networks; using RADIUS or TACACS+ Extensible Authentication Protocol (EAP): not a single protocol by itself, but instead, it is a framework in a series of protocol that allows for the numerous different ways for us to conduct authentications VPN: extends a private network over a public one, enabling users to securely send & receive data TLS: a protocol that provides cryptographic security for secure connections & is used for secure web browsing & data transfer IPSec: a protocol suite for secure communication through authentication & data encryption in IP networks Software-defined wide area network (SD-WAN): virtualized approach to managing & optimizing wide area network connections to efficiently route traffic between remote sites, data centers & cloud environments SD WAN employs a centralized control function to securely & intelligently route traffic across the wide area network (WAN) Secure access service edge (SASE): used to consolidate numerous networking & security functions into a single cloud-native service to ensure that secure & access for end-users can be achieved

Uses SDN to provide security and networking ser from the cloud rather than traditional hardware-based appliances, allows for more flexibility, scalability, & cost efficiencies than a traditional network INFRASTRUCTURE CONSIDERATIONS Device placement: proper placement of your networking devices can greatly influence both the performance & security of your entire network; proper placement will ensure optimal data flow, minimized latency & robust defense; placing devices in the wrong places can lead to network bottlenecks, vulnerability points, & loss of connectivity Security zones: distinct segment within a network often created by logically isolating the segment using a firewall or other security device; these security zones or segments are going to be designed to contain devices with similar security requirements / a screened subnet can also be created to act as a protective layer or buffer zone between an organization’s internal network & an untrusted external network (Internet) Attack surface: refers to all the points where an unauthorized user can try to enter data to or extract data from an environment, as network and devices grow, so does your attack surface as there is now more room for error. To reduce surface, identify vulnerabilities & eliminate them or ensure proper controls are in place Connectivity: refers to how different components of a network communicate with each other & with other external networks, like wired or wireless, whatever connectivity method will have its pros/cons Failure modes: the failure mode elected will determine how a device behaves when it encounters an error or malfunction Fail-open: it’s going to allow all traffic in the event of a failure to ensure no disruption to network connectivity, provides zero security when in this mode Fail-closed: blocks all traffic in the event of a failure Device attribute: whether or not the device is considered active or passive Active: like IPS systems, actively reacts to threats Passive: like IDS systems, sits back, monitors, & reports if there is a threat but does nothing else Inline: sits in the network traffic path & can control or block traffic as it passes through this device, like a firewall, router, or IPS Tap/monitor: operate discretely outside the network path, capturing data for analysis without impacting traffic SELECTION OF EFFECTIVE CONTROLS Key Principles: -principle of least privilege risk assessment

Methodologies: -assess the current state

Best Practices: -conduct comprehensive

-defense in depth established -risk-based approach -lifecycle management controls -open design principle engagement/trainin

-conduct gap analysis

-align control selection w/

-set clear objectives -benchmarking

frameworks -customize framework

-cost benefit analysis

-emphasize stakeholder

-monitoring & feedback loops

IDENTITY AND ACCESS MANAGEMENT (IAM): systems & processes used to manage access to information in an organization to ensure that the right individuals have access to the right resources at the right times for the right reasons Provisioning: process of creating new user accounts, assigning them appropriate permissions, & providing users with access to systems Deprovisioning: removing an individual’s access rights when the rights are no longer required Identity proofing: process of verifying the identity of a user before the account is created Interoperability: ability of different systems, devices & apps to work together & share information Attestation: process of validating that user accounts & access rights are correct & up to date

Multifactor authentication Factors: Something you know: knowledge-based factor, password or PIN Something you have: possession-based factor, smart card or software token Something you are: inherence-based factor, fingerprint, facial, or voice recognition Somewhere you are: location-based factor Something you do: behavior-based factor, keystroke patterns, mouse movement, etc.

Password security -Length -Age -Complexity -Expiration -Reuse: Password managers: store, generate, & autofill passwords to enhance security

Passwordless authentication: provides improved security & a more user friendly experience, can be achieved through biometric authentication, hardware tokens, OTPs, magic links & passkeys Single sign-on (SSO): authentication process that allows a user to access multiple applications or websites by logging in only once with a single set of credentials Lightweight Directory Access Protocol (LDAP): used to access & maintain distributed directory information services over an Internet protocol network Open authorization (OAuth): open standard for token-based authentication & authorization that allows an individual’s account information to be used by third-party services without exposing the user’s password (like signing in with ID.me to authenticate) Security Assertions Markup Language (SAML): a standard for logging users into applications based on their sessions in another context Federation: process that allows for the linking of electronic identities & attributes to store information across multiple distinct identity management systems -Federation allows users to access apps/resources across multiple organization’s vs SSO is only within a single organization; federated identity provides seamless access for users interacting w/ multiple external services while standard SSO simplifies internal logins PRIVILEGED ACCESS MANAGEMENT (PAM): solution that helps organizations restrict & monitor privileges access within an IT environment Just-in-time permission (JIT): security model where administrative access is granted only when needed for a specific period Password vaulting: technique used environment, such as in a digital vault

to

store

&

manage

passwords

in

a

secure

Ephemeral credentials: (temporary creds) used to provide time-limited access to resources, & they are automatically disabled or deleted after a certain period of time– like for a contractor for a one-time project ACCESS CONTROL MODELS Mandatory Access Control (MAC): employs security labels to authorize user access to specific resources Discretionary Access Control (DAC): resources owner determines which users can access each resource Role-based access control (RBAC): assigns users to roles & uses these roles to grant permission to resources

Attribute-based (ABAC): uses object characteristics for access control decisions Rule-based access control (RBAC): all users

enables administrators to apply security policies to

Time-of-day restrictions: controls restrict resources access based on request times Least privilege: granting users the minimum access required for their tasks, without extra privileges

HARDWARE

VULNERABILITIES: security flaws or weaknesses inherent in a

device’s physical components or design that can be exploited to compromise the integrity, confidentiality or availability of the system & its data Firmware: specialized form of software stored on a hardware device, like a router or a smart thermostat, that provides low-level control for the device’s specific hardware. This vulnerability can be dangerous because they often provide the attacker with full control of the device so that they can manipulate or control the hardware’s behavior.

End-of-life: refer to hardware or software products that have reached the end of their life cycle & the developer is no longer providing updates, support or enhancements for them.

Legacy: outdated computing software, hardware, or technologies that have been largely superseded by newer & more efficient alternatives Unsupported systems: hardware or software products that no longer receive official technical support, security updates or patches from their respective vendors or developers Hardware misconfiguration: occurs when a device’s settings, parameters, or options are not optimally set up & this can cause vulnerabilities to exist, a decrease in performance, or unintended behavior of devices or systems Hardening: involves tightening the security of a system by closing unnecessary ports, disabling unnecessary services, & setting up proper permissions Patching: regular updating of the software, firmware & apps with the latest security patches Configuration enforcement: used to ensure all devices & systems adhere to a standard secure configuration Decommissioning: the system is retired & removed from the network Isolation: used to limit the potential damage that might occur from a potential security breach Segmentation: used to divide the network into segments, also to limit potential damage from a breach

MOBILE DEVICE Sideloading: the practice of installing apps on a device from unofficial sources which actually bypasses the device’s default app store Jailbreaking/Rooting: process that gives users escalated privileges on the devices & allows users to circumvent the built-in security measures provided by the devices Zero-Day Vulnerability: any vulnerability that’s discovered or exploited before the vendor can issue a patch for it Operating System Vulnerabilities: these vulnerabilities include unpatched systems, zeroday vulnerabilities, misconfigurations, data exfiltration, & malicious updates Operating System Security: Group Policy: set of rules or policies that can be applied to a set of users or computer accounts within an operating system SELinux: in Linux, there are 2 main context-based permission schemes that are available, SELinux & AppArmor, they both leverage mandatory access control (MAC) to do their work.

Context-based permissions: permission schemes that are defined by various properties for a given file or process Linux uses DAC by default, but SELinux doesn’t allow DAC, it relies on MAC to do its permissions & access control. It was created by the NSA; SELinux is the default contextbased permission scheme that’s included inside of CentOS and Red Hat Enterprise Linux.

By using SELinux, we have a way to provide additional file system & network security so that unauthorized processes cannot access or tamper with our data, bypass our security mechanisms violate our security policies or execute untrustworthy programs.

Structured Query Language injection (SQLi): an injection attach occurs when an attacker sends malicious data to a system which is then processed as port of a command or query which can lead to unintended consequences. The goal is to send some kind of code into our systems so that the attacker can manipulate or exploit a database-driven application.

When dealing with a database, you have to have a way to talk to the database in order to read, write, or search for data inside of it. This is done using statements in a language: SQL. SQL has 4 main actions: Select, Insert, Delete & Update. SQL injections are performed by code injections ***anytime you see something with an apostrophe & something that = something, most likely an SQL injection attempt*** ****how to prevent an SQL injection?? By input validation & sanitization, or use a web application firewall because it performs the validation/sanitization for you ***

Cross site scripting (XSS): injects a malicious script into a trusted site to compromise the site’s visitors. This allows the attacker to circumvent the browsers security model or trusted zones, & the attackers goal is to get you to run some kind of malicious script so that your system will process this thing & bypass its normal security mechanisms, relies on your website not conducting proper input validation. ***if somebody is trying to get a victim to unintentionally carry out an action on a website, this is normally going to be a form of XSS request forgery. Most often occurs by trying to get the victim to do some kind of unknown update to their default email address or by changing that user’s password***

Buffer overflow: occurs when data exceeds allocated memory, potentially enabling unauthorized access or code execution What is a buffer? A temp storage area where a program stores its data ***a buffer overflow is going to be used to put more data into memory than it’s designed to hold so that the attacker can try to get their malicious code to be run*** Race Conditions: software vulnerability where the outcome depends on the timing of events not matching the developer’s intended order; race conditions occur when multiple threads write to the same variable or object in the same memory location simultaneously.

Time-of-check (TOC): type of race condition where an attacker can alter a system resource after an application checks its state but before the operation is performed Time-of-use (TOU): type of race condition that occurs when an attacker can change the state of a system resource between the time it is checked & the time it is used

ENCRYPTION Full disk: encrypts the entire hard drive to protect all the data being stored on it, like BitLocker Partition; similar to full disk, but it is only applied to a specific partition on the storage device File: used to encrypt an individual files instead of an e tire partition or entire drive Volume: used to encrypt a set space on the storage medium, creating an encrypted container that can house various files & folders Database: secures the entire database, extending to multiple storage devices or cloud storage, similar to full disk Record: used to encrypt individual records or rows within a database

Secure baseline: standard security configuration applied to guarantee minimum security for a system, network, or application Establish: by conducting a thorough assessment of your system, network, or application that needs protection, in order to identify the type of data being handled, to understand the data’s workflow & to evaluate any potential vulnerabilities & threats, best practices, industry standards, & compliance requirements – can make images of this baseline to easily apply for future, new devices quickly Deploy: can involve configuring firewalls, setting up user permissions, implementing encryption protocols, ensuring that anti-virus & antimalware solutions are properly installed & updated. Automated tools & scripts can be employed to ensure that the secure baselines is going to be uniformly applied across all your devices & systems that are not installed using the disk image.

Maintain: done by locking down our systems so that our users can’t install additional software or modify our existing configurations. & conduct regular audits & monitoring to ensure baseline remains effective & up to date with the latest trends.

Wireless devices: installation considerations…

Site surveys: process of planning & designing a wireless network to provide a solution that will deliver the required wireless coverage, data rates, network capacity, roaming capability, & quality of service levels Heat maps: graphical representation of the wireless coverage, the signal strength, & frequency utilization data at different locations on a map. Useful when troubleshooting coverage areas or dead zones Wireless security settings WiFi Protected Access 3 (WPA3): latest version using AES encryption & introducing new features like SAE, Enhanced Open, updated cryptographic protocols & management protection frames Cryptographic Protocol: uses a newer variant of AES known as the AES GCMPGalois Counter Mode protocol; supports 128-bit AES for personal networks & 193-bit AES for enterprise or personal networks with the WPA3 protocol AAA/Remote Authentication Dial-In User Service (RADIUS): plays a vital role in network security by centralizing user authentication to permit only authorized user to access network resources. RADIUS is a client/server model protocol offering AAA services for network users, used for secure network access, confirming user & enforcing predefined access rules & monitors user activity Authentication Protocol: used to verify the identity of users trying to access a network & there are a crucial aspect of network security that ensures that only authorized individuals can access the networking. Examples: EAP, PEAP, EAP-TTLS, & EAP-FAST

Application security: critical aspect of software development that focuses on building applications that are secure by design Input validation: acts as a gatekeeper to ensure that apps only act on well-defined & uncontaminated data; input validation is focused on directly countering various forms of attacks aimed at exploiting data input vulnerabilities to preserve the integrity behavior of the application. Serves as a kind of quality control for data to ensure that every piece of information is valid, secure, & correctly formatted; proper input validation catches issues before the app attempts to perform an operation on the wrong type of data.

Secure cookies: transmitted over secure HTTPS connections to prevent potential eavesdroppers from intercepting the cookie data; even if an attacker can intercept the traffic, they cannot read or modify the data Static code analysis/Static application security testing (SAST: a method of debugging an app by reviewing & examining its source code before the program is ever run; usually performed using software analyzers Code signing: technique used to confirm the identity of the software author & guarantee that the code has not been altered or corrupted since it was signed; involves using a digital signature to authenticate source & integrity Network access control (NAC): scans devices for their current security status before granting network access, safeguarding against both known & unknown devices; can be used for devices located physically present or those connected via VPN; before a device connects to the network the device is placed into a virtual holding area while being scanned, if passes checks, device is granted access. If fails, placed into a digital quarantine & awaits remediation Web filtering: technique used to restrict or control the contact a user can access on the internet Agent-based: installing a small piece of software known as an agent on each device that will require web filtering; will always filter the device, no matter which network its connected to Centralized proxies: server that acts as an intermediary between organizations end users & the Internet Universal Resource Locator (URL) scanning: used to analyze a website’s URL to determine if it is safe or not to access; URL scanning will first check the URL requested by the user against a database of known malicious websites Content categorization: websites are categorized based on content, like social media, adult content, or gambling which are frequently restricted in workplaces Block rules: specific guidelines set by an organization to prevent access to certain website or categories of websites

Reputation: blocking or allowing websites based on their reputation score. this score is typically determined by a 3rd party service DNS filtering: a technique used to block access to certain websites by preventing the translation of specific domain names to their corresponding IP addresses; if the domain name is on a DNS filters block list the DNS server will not provide the IP address back to the device requesting it EMAIL SECURITY Domain-based message Authentication Reporting & Conformance (DMARC): an email validation system designed to detect & prevent email spoofing; DMARC allows the administrative owner of a domain to publish a policy on which mechanisms should be employed when sending emails from the domain & how the receiver should deal with the failures. In modern networks, every email server should be configured with DMARC at a minimum. DMARC can work with either DKIM, SPF or both. Primary goal of DMARC is to prevent business email compromise attacks, phishing emails & other email scams DomainKeys Identified Mail (DKIM): allows the receiver to check if the email was actually sent by the domain it claims to be sent from & if the content was tampered with during transit; adds a digital signature to the headers of the email which can then be validated against a public cryptographic key that is located on the domains DNS records.

Sender Policy Framework (SPF): email authentication method designed to prevent forging sender addresses during email delivery; when an SPF enabled server receives email, it can verify the sender’s IP address against a list of authorized IPs published in the sender’s domain DNS records.

ENDPOINT DETECTION & RESPONSE (EDR): category of security tools that monitor endpoint & network events & record the information in a central database where further analysis detection, & investigation, reporting & alerting takes places. Primary purpose of an endpoint detection & response solution is to provide incident data to our cybersecurity analysts to help enhance the security monitoring incident response & forensic investigations FILE INTEGRITY MONITORING (FIM): used to validate the integrity of operating system & application software files using a verification method between the current file state & a known, good baseline; FIM uses software known as an agent to continuously monitor critical system files for changes EXTENDED DETECTION & RESPONSE (XDR): security strategy that integrates multiple protection technologies into a single platform to improve detection accuracy & simplify the incident response process; used to collect & automatically correlate data across multiple security layers including email, endpoint, server, cloud workloads & networks so that threats can be detected faster & security analysts can minimize the time req to respond.

USER BEHAVIOR ANALYTICS (UBA): deploys big data & machine learning to analyze user behaviors for detecting security threats to create a more proactive defense posture;

goal is to detect anomalous behavior or instances that deviate from these established patterns that could indicate threats, compromised credentials, or external attacks.

IMPLEMENTING SECURE PROTOCOLS Protocol selection: there are many protocols that can accomplish the same things, but which one you select can either increase or decrease the overall security of your networks.

Port selection: same as above; all ports work fine depending on your use case, but you should really use the secure version of these ports instead of their unencrypted versions & only open the ports necessary for your app to function & blocking all others to minimize attack surface Transport method: refers to the way data is moved from one place to another, usually either TCP or UDP to transmit the data; always consider WHAT is being sent to determine HOW to send it VULNERABILITY MANAGEMENT Identification methods: Vulnerability scan: automated method of probing networks, systems & applications to discover potential vulnerabilities Application Security: used to safeguard the software from being manipulated during its lifecycle Static analysis: used to analyze an applications source code without executing it; used to spot potential vulnerabilities inside your code base either manually or with automated tools Dynamic analysis: evaluates an app as it is being run to determine if there are any vulnerabilities in the application Package monitoring: ensures that the libraries & components that the application depends on are secure & up to date, consistently scan your application’s dependencies & then alert your developers to any known vulnerabilities that may exist within those dependencies Penetration testing: when looking through the pen test results, you’ll understand how the testers were able to infiltrate your systems & then mitigate these issues identified during the test System/Process audit: these audits help ensure that your organization adheres to the security best practices & relevant industry standards THREAT FEED: a continuous stream of data related to potential or current threats to an organization’s security might be facing.

Open-source intelligence (OSINT): intel that is collected from publicly available sources including reports, forums, news articles, blogs & social media posts

Propreitary/third party: threat intelligence feeds that are provided by commercial vendors, usually under a subscription service type of business model Information sharing organization: organizations & alliances that have been formed to share threat intel among their members Dark web: part of the Internet that is intentionally hidden & is inaccessible through standard web browsers; can be a great source of threat intelligence for security researchers Responsible disclosure: term used to describe the ethical practice where a security researcher discloses information about vulnerabilities in a software, hardware, or online service in a confidential manner ot the relevant stakeholders; goal is to allow the affected party enough time to address the vulnerability before a public disclosure occurs Bug bounty: encourage cybersecurity researchers to find & report vulnerabilities; they offer monetary rewards; can be run internally or externally ANALYZING VULNERABILITIES Confirmation: when reviewing results of a vulnerability scan, some vulnerabilities will be real and other will not be a big issue False positive: when the system incorrectly states that a vulnerability exists on the system, but it actually doesn’t False negative: most serious finding, the vulnerability scanner does not detect a known vulnerability on the system even though that vulnerability does actually exist on the system Prioritize: rank identified vulnerabilities in the order of their severity & potential impact on the organization Common Vulnerability Scoring System (CVSS): provides a standardized framework for assessing the severity of a vulnerability & then assigns a score based on metrics; Vulnerability classification: categorizing the identified vulnerabilities based on factors like the type of threat the potential impact on the organization & the systems or data that may be affected. Like software flaws, configuration errors, or security policy gaps.

Common Vulnerability Enumeration (CVE): system that provides a standardized way to uniquely identify & reference known vulnerabilities in software & hardware; a large database of every known vulnerability in the world Exposure factor: used as a quantifiable metric to help a cybersecurity professional understand the exact percentage of an asset that I likely to be damaged or affected if a particular vulnerability is exploited; it’s an estimation of the amount of loss that a vulnerability might cause to your organization Industry/Organizational impact:

Risk Tolerance: refers to the level of risk that an organization is willing to accept in pursuit of its objectives & before action is deemed necessary to mitigate the risk; VULNERABILITY RESPONSE & REMEDIATION: strategies that identify, assess, & address vulnerabilities in a system or network to strengthen an organizations security posture Patching: applying updates to software, systems or applications in order to fix vulnerabilities or to improve performance Insurance: procuring a policy to mitigate any financial losses from cyber incidents Segmentation: dividing a network into smaller segments for improved security & performance Compensating controls: alternative security measures are used for situations where standard controls are not feasible or effective Exception: temporarily relaxes security controls for operational business needs Exemption: permanently waives a security control or a policy for specific reasons such as when using a legacy system VALIDATION OF REMEDIATION Rescanning: after the initial vulnerability scan & subsequent remediation efforts have been completed, its important to conduct a rescan of your targeted system to double-check your work.

Audit: refers to the process of systematically reviewing logs, configuration & patches to ensure that they’re aligned with the established security standards & policies Verification: involves testing the system to confirm that the patches & configuration changes have the desired effect; can be performed via pen test or feedback loops VULNERABILTY REPORTING: process of documenting & communicating details about security weaknesses identified in software or systems to the individuals or organizations responsible for addressing the issue; must remain confidential as it contains all the details of our current vulnerabilities

MONITORING COMPUTING RESOURCES Systems: observing the performance of a computer system, including the utilization & consumption of its resources like CPU utilization, resource consumption, memory consumption, disk usage, network performance in order to help us identify any potential issues that could affect the systems performance or stability; must already have an established baseline.

Applications: focuses on managing & monitoring the performance & availability of your software applications, by tracking errors, bottlenecks, & other potential issues that could affect an applications performance or user experience

Infrastructure: involves observing the performance & availability of an organization’s physical & virtual infrastructure, including servers, networks, virtual machines, containers, cloud services & other hardware.

Log aggregation: the process of collecting & consolidating log data from various sources into a centralized location; helps with the analysis & troubleshooting of system issues, security incidents, & performance problems.

Alerting: setting up notifications to inform relevant stakeholders when specific events or conditions occur. Alerting can be triggered based on predefined thresholds or anomalies that can be delivered via various channels like email, texts etc.

Scanning: involves examining systems, networks, or applications to identify vulnerabilities, configuration issues, or other potential problems Reporting: generating summaries or detailed reports based on the collected & analyzed data Archiving: involves storing data for long-term retention & future reference, including organization’s log data, performance data, and incident data Alert response & remediation/validation: involves taking appropriate actions in response to alerts & ensuring that the identified issues have been effectively addressed Quarantine: isolating a system, network, or application to prevent the spread of a threat & limit its potential impact Alert tuning: adjusting alert parameters to reduce errors, false positives, & to improve the overall relevance of the alerts being generated by a given system Simple Network Management Protocol (SNMP): Internet protocol for collecting & organizing information about managed devices on IP networks & for modifying that information to change device behavior ???

Trap message:

SIEM: solution that provides real-time or near-real-time analysis of security alerts that are generated by network hardware & applications (Splunk, ELK or Elastic Stack, ArcSight & QRadar) Agent: software agent installed on each system, such as a server or workstation, from which the SIEM needs to collect log data.

Agentless: under this approach, the SIEM system directly collects log data from each system using standard protocols such as SNMP or WMI; doesn’t require installing any systems; doesn’t provide as much detail as an agent-bases system Antivirus: fundamental security tool that protects systems, against malware, including viruses, worms, Trojans, ransomware & spyware

Vulnerability scanners: tools that identify security weaknesses in a system, including missing patches, incorrect configurations & other types of known vulnerabilities Data Loss prevention: used to monitor & control data endpoints, network traffic & data stored in the cloud to prevent potential data breaches from occurring; can also generate data about potential data leaks, policy violations, & other suspicious user activities.

Security Content Automation Protocol (SCAP): plays a vital role in maintaining the security posture of an organization’s technology infrastructure; it’s a suite of open standards that enhances the automation of vulnerability management, measurement & policy compliance, evaluation of systems that are deployed across your organization.

SCAP was developed by NIST to provide organizations with a standardized approach to maintaining the security of their systems & includes a # of components that are used together to automate security tasks, including vulnerability scanning, configuration checking & software inventory.

Benchmarks: one of the reasons of using SCAP in the first place; a set of security configuration rules for some specific set of products to provide a detailed checklist that can be used to secure the systems back to a specific baseline.

Netflow: a network protocol system created by Cisco means of reporting network flow info to a structured database; collects active IP network traffic as it flows in or out of an interface, including its points of origin, destination, volume, & paths on the network

INCIDENT RESPONSE PROCESS (according to NIST guidelines- seven phase model) Preparation: involves strengthening systems & networks to resists attacks; where policies & procedures are written; and communication plan is created to set up encrypted out-of-band- communication paths; conduct training, testing & exercising of your staff with simulated incidents & creation of incident response kits Detection: focused on determining whether a security incident has occurred. Categorize & assess potential incident severity.

Analysis: when an incident is thoroughly examined & evaluated to understand scope/impact of such incident; relevant stakeholders are notified Containment: used to limit scope & magnitude of the incident by securing data & minimizing the impact on business operations & your organizations customer & business partners Eradication: begins once the incident is contained & its focused on removing the malicious activity from a given system/network.

Recovery: focused on restoring the effective system & services to their normal secured state; either from a known good backup, installing patches, or config updates to ensure any vulnerabilities exploited during the incident are fully remediated

Post incident: (Lessons learned) occurs after the system has been contained & malicious activity is eradicated & systems full recovered & resume normal operations; 3 things occur here: root cause analysis, the lessons learned process & the after-action report Threat hunting: a cybersecurity technique that is designed to detect the presence of threats that have not been discovered by normal security of monitoring; it is the act of being proactive in your security defense instead of being reactive Root cause analysis: a systematic process to identify the initial source of the incident & how to prevent it from occurring again (4 step process) Incident response training: ensures staff grasp processes & priorities for incident response Incident response testing: practical exercise of incident response procedures Tabletop exercise: exercises simulate incidents within a control framework; actually done from a tabletop and is more like a discussion Simulation: replicate real incidents for hands-on scenarios; assess technical skills & determines your ability to make decisions under pressure & effectively communicate Digital forensics: process of investigating & analyzing digital devices & data to uncover evidence for legal purposes Legal hold: formal notification that instructs employees to preserve all potentially relevant electronic data, documents & records when litigation is reasonably expected Chain of custody: documented & verifiable record that tracks the handling, transfer, & preservation of digital evidence from the moment it is collected until it is presented in a court of law Acquisition: the method & tools used to create a forensically sound copy of the data from a source device, such as system memory or a hard disk “do I have the right to search or seize this legally?”- BYOD can complicate these policies since they are not owned by the company; Reporting: involves documenting the findings, processes, & methodologies used during a digital forensic investigation Preservation: Electronic discovery: process of identifying, collecting, & producing electronically stored information during potential legal proceedings INVESTIGATING DATA Log file: a file that records either events that occur in an operating system or other software that runs, or messages between different users of a communication software

Firewall logs: Application logs: created for every single application you have on your system, & are logged directly inside of the apps folder itself or may be consolidated centrally inside a SIEM Endpoint logs: very descriptive logs OS-specific security logs: in these logs you’re going to be able to look through the security logs & see what type of things have been happening, such as failed login attempts, incorrect # of attempts to log in over multiple times & in some cases even with the password being attempted for the login was IDS/IPS logs: shows severity and action taken by IPS, whether it was blocked or not, assigns event IDs Network logs: Metadata: data that describes other data by providing an underlying definition or description by summarizing basic information about data that makes finding & working with particular instances of data easier- data about the data Dashboards: visually display info from various systems, used in security operation centers for a comprehensive overview Automated reports: computer generated report created automatically on your behalf to advise you of current status Vulnerability scan: generates scan reports automatically, review the scan results to confirm if the detected vulnerabilities actually exist in the systems (false positive) Packet captures: gathers all data sent to or from a specific network device

AUTOMATION & ORCHESTRATION Other considerations Complexity: work best when they are applied to repetitive tasks that are somewhat complex since this makes a positive return on investment more likely than automating a simplistic process.

Cost: usually a key factor in whether or not automation/orchestration will be used; these technologies often entail a large upfront or initial investment to create them in terms of hiring a service provider to create them or to pay a team of developers to implement them Single point of failure: many organizations forget to build backup systems or manual processes that can be used if automation or orchestration systems fail; this creates a single point of failure as everything relies on these technologies

Technical Debt: can accumulate if not regularly maintained or updated; refers to the accumulated cost & complexity of suboptimal or hastily implemented software solutions that need to be addresses or refactored in the future Ongoing supportability: long-term supportability is crucial for adapting automation to evolving technology BENEFITS OF AUTOMATION/ORCHESTRATION Efficiency/time saving: automating tasks frees up employee time Enforcing baselines: streamlined security & compliance through automation Standard infrastructure configurations: maintaining a standardized infrastructure configuration is essential for security & operational stability. Ensures all systems are set up consistently Scaling in a secure manner: automation/orchestration provide the means to scale resources up or down dynamically while adhering to security protocols Employee retention: automation/orchestration has been proven to have a positive impact on your employee’s overall satisfaction & retention levels as it makes work less repetitive and reduces burnout Reaction times: automation/orchestration enable organizations to respond more quickly to security incidents & anomalies since these systems are never distracted, tired, or on vacation Workforce multiplier; automation/orchestration acts as a workforce multiplier by augmenting the capabilities of your existing staff. With these tools, a smaller team can manage & secure a larger & more complex infrastructure; reduces the need for extensive staffing USE CASES OF AUTOMATION & SCRIPTING User provisioning: involves the creation & management of user accounts & access rights to internal systems Resource provisioning: allocating the necessary tools & resources that new employees need to perform their jobs Guardrails: automated safety controls put in place to protect against insecure infrastructure configurations, prevents any deviations Security groups: acts as a virtual firewall for your cloud-based server instances & their associated resources; control incoming & outgoing network traffic Enabling/disabling services & access: automation tools can be used to regularly review who has access to what, so that we can ensure that our employees only have access necessary for their roles

Ticket creation: involves the automatic generation of tickets when users or customers report issues or requests Ticket escalation: critical aspect of support ticket management that ensures that complex or high-priority issues are addressed promptly & by the appropriate personnel Continuous integration: practice in software development where developers merge code changes frequently in one place Integrations & Application programming interfaces (APIs): when it comes to automation/orchestration, integrations & APIs are really the fundamental elements that drive efficiency, innovation & scalability in modern system.

Integration: process of combining different subsystems or components into one comprehensive system to ensure that they function properly together API: set of rules & protocols that are used for building & integrating application software; an API will allow your product or service to talk to another product or service in a controlled environment in using a specific data exchange format

SECURITY AWARENESS Password manager: a specialized tool that is used with a web browser to remember all the different usernames & passwords for all the various sites