Cybersecurity Analyst

Cybersecurity is the practice of protecting systems, networks, and data from digital attacks. It is critical because our modern world relies on digital infrastructure for everything from banking to healthcare; a breach can lead to identity theft, financial loss, or the disruption of essential services.

The CIA Triad is a foundational security model consisting of Confidentiality, Integrity, and Availability. It serves as a benchmark for evaluating a system's security posture and ensuring all three aspects are balanced. [Image of the CIA Triad diagram showing Confidentiality, Integrity, and Availability]

Confidentiality ensures that sensitive data is accessible only to authorized users. Integrity ensures that data remains accurate and has not been tampered with. Availability ensures that systems and data are accessible to authorized users when needed (e.g., uptime).

A vulnerability is a weakness in a system (like a software bug). A threat is a potential actor or event that could exploit that weakness (like a hacker or a virus). Risk is the intersection of the two—the potential for loss or damage when a threat exploits a vulnerability.

Risk assessment is the process of identifying, analyzing, and evaluating security risks. This involves determining which assets are most valuable, what threats exist, and how likely they are to cause harm, allowing an organization to prioritize security spending.

AAA stands for Authentication (verifying who you are), Authorization (determining what you are allowed to do), and Accounting (tracking what you did). This framework provides a standardized way to manage network access and security auditing.

Defense in Depth is a layered security approach where multiple security controls are placed throughout an IT system. If one layer (like a firewall) fails, others (like antivirus or encryption) are in place to stop the attack. [Image of Defense in Depth layered security model showing physical, network, and data layers]

The principle of Least Privilege (PoLP) dictates that users and systems should only have the minimum level of access necessary to perform their job functions. This limits the potential damage if an account is compromised.

Zero Trust is a security framework based on the philosophy 'never trust, always verify.' It assumes that threats could exist both inside and outside the network, requiring continuous authentication and validation for every access request.

Information security is the broader practice of protecting data in any form (physical or digital). Cybersecurity is a subset of information security that specifically focuses on protecting data, systems, and networks from digital/cyber attacks.

A security event is any observable occurrence in a system or network (e.g., a user logging in). A security incident is a security event that indicates a violation of security policies or a threat to the environment (e.g., a successful data breach).

Incident response is the organized approach an organization takes to manage and address the aftermath of a security breach or cyberattack, with the goal of limiting damage and reducing recovery time.

The incident response lifecycle is a set of steps used to handle a security incident. It typically follows a circular or linear path starting with preparation and ending with learning from the event to improve future defenses.

The NIST 800-61 framework defines four phases: 1. Preparation, 2. Detection and Analysis, 3. Containment, Eradication, and Recovery, and 4. Post-Incident Activity (Lessons Learned). [Image of the NIST Incident Response Life Cycle diagram]

A security breach is an incident where an unauthorized individual gains access to a computer system or network, often resulting in the theft, loss, or alteration of sensitive data.

A system breach involves unauthorized access to hardware or software. A data breach specifically refers to an incident where sensitive, protected, or confidential data has potentially been viewed, stolen, or used by an unauthorized individual.

A security policy is a formal document that outlines an organization's rules, expectations, and procedures for protecting its information assets and technology infrastructure.

An AUP is a set of rules applied by an organization that outlines the ways in which a network or system can be used by employees or guests, specifically prohibiting illegal or harmful activities.

It is an educational program designed to help employees understand the security risks associated with their actions and teach them best practices for protecting company data (e.g., identifying phishing).

Social engineering is the psychological manipulation of people into performing actions or divulging confidential information. It exploits human error rather than technical vulnerabilities.

Common techniques include Phishing (emails), Pretexting (fabricating scenarios), Baiting (using a lure), Tailgating (following into restricted areas), and Quid Pro Quo (promising a benefit).

Phishing is a type of social engineering where attackers send fraudulent communications (usually email) that appear to come from a reputable source to steal sensitive data or install malware.

Spear phishing is a targeted attack aimed at a specific individual or group. Whaling is a form of spear phishing that specifically targets high-ranking executives like the CEO or CFO.

Vishing is phishing conducted via voice calls or VoIP. Smishing is phishing conducted via SMS (text messages).

Pretexting is a social engineering tactic where an attacker creates a fabricated scenario (the 'pretext') to trick a victim into providing information or access, such as pretending to be an IT auditor.

Baiting involves leaving a physical lure—like a malware-infected USB drive labeled 'Executive Salaries'—in a public place, hoping a curious victim will plug it into their computer.

Tailgating occurs when an unauthorized person follows an authorized person into a secure physical location (e.g., catching a door before it closes).

Dumpster diving is the practice of searching through trash to find information that can be used for a cyberattack, such as discarded passwords, financial statements, or internal memos.

Prevention requires a combination of security awareness training, strict physical access controls, multi-factor authentication, and encouraging a culture of healthy skepticism regarding unsolicited requests.

Security hygiene refers to the routine practices individuals and organizations perform to maintain the health and security of their systems, such as regular patching, using strong passwords, and deleting old accounts.

A decoy system or server set up to attract and trap hackers, allowing security teams to study their methods without risking real production systems.

A firewall is a network security device that monitors and filters incoming and outgoing network traffic based on an organization's previously established security rules. [Image of a network firewall architecture]

A stateless firewall filters packets based on individual header info (source/destination) in isolation. A stateful firewall keeps track of the 'state' of active connections and can tell if a packet is part of an existing, authorized conversation.

An NGFW goes beyond traditional port/protocol filtering to include features like application-layer inspection, integrated intrusion prevention (IPS), and deep packet inspection (DPI).

A WAF specifically protects web applications by filtering and monitoring HTTP traffic between a web application and the Internet. It defends against attacks like SQL injection and Cross-Site Scripting (XSS).

A traditional firewall protects the network (Layers 3 & 4), while a WAF specifically protects the web application at the application layer (Layer 7).

A DMZ is a physical or logical subnetwork that contains an organization's external-facing services (like web servers) to separate them from the untrusted internet and the sensitive internal network. [Image of a network DMZ setup]

Network segmentation is the practice of splitting a network into smaller, isolated subnetworks. This limits the 'blast radius' of a breach, preventing an attacker from moving laterally through the whole environment.

A VLAN is a logical grouping of devices on the same network that acts as if they are on separate physical networks, even if they share the same hardware.

A VPN creates an encrypted 'tunnel' over a public network (like the internet), allowing users to send and receive data as if their computing devices were directly connected to a private network.

A site-to-site VPN connects two entire networks (e.g., a branch office to HQ). A remote access VPN connects an individual user's device to a secure network.

IPsec (Internet Protocol Security) is a suite of protocols used to secure IP communications by authenticating and encrypting each IP packet in a communication session. It is commonly used for site-to-site VPNs.

An SSL/TLS VPN uses the standard browser encryption protocols to provide secure remote access. It is often easier to deploy than IPsec because it doesn't require specialized client software.

Split tunneling allows a VPN user to access a public network (like the internet) and a private network (the office) simultaneously through the same physical connection, but only sending 'office' traffic through the secure tunnel.

An IDS is a monitoring system that detects suspicious activities and generates alerts. It is 'passive'—it identifies threats but does not block them.

An IPS is an 'active' system that both detects and automatically blocks suspicious activity or known attack patterns in real-time. [Image of IDS vs IPS placement in a network]

IDS monitors and alerts; IPS monitors, alerts, and takes action to block or drop the malicious traffic.

NIDS monitors traffic for the entire network segment. HIDS is installed on a specific host (server or workstation) to monitor activity on that individual device.

Signature-based detection looks for specific 'fingerprints' of known malware. Anomaly-based detection creates a baseline of 'normal' behavior and flags anything that deviates from it, which can detect unknown (zero-day) attacks.

Snort is a famous open-source NIDS capable of performing real-time traffic analysis and packet logging on IP networks.

Suricata is a high-performance, open-source network analysis and IDS/IPS engine that is often preferred for multi-threaded processing and deep packet inspection.

A Distributed Denial of Service attack occurs when multiple compromised systems flood a target's bandwidth or resources to make it unavailable to legitimate users. [Image of a DDoS attack structure]

Volumetric attacks flood the bandwidth (e.g., UDP flood). Protocol attacks target server resources or firewalls (e.g., SYN flood). Application layer attacks target specific web functions (e.g., HTTP flood).

Mitigation involves using traffic scrubbing services, implementing rate-limiting, using a Content Delivery Network (CDN), and configuring firewalls to drop suspicious traffic patterns.

A SYN flood exploits the TCP handshake by sending many SYN requests but never completing the final ACK. This leaves the server's connection slots 'half-open,' eventually exhausting its resources.

In a UDP flood, the attacker sends large numbers of UDP packets to random ports on a remote host. The host checks for applications at those ports and, finding none, responds with an ICMP 'Destination Unreachable' packet, exhausting its resources.

A reflection-based DDoS where an attacker sends small DNS queries with a spoofed source IP (the victim's) to open DNS servers. The servers send much larger responses to the victim, magnifying the traffic volume.

An MITM attack is where an attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. [Image of a Man-in-the-Middle attack diagram]

ARP spoofing involves sending fake ARP (Address Resolution Protocol) messages onto a LAN to link the attacker's MAC address with the IP address of a legitimate server or gateway, allowing the attacker to intercept traffic.

Also called DNS cache poisoning, it involves introducing corrupt DNS data into a resolver's cache, causing it to return an incorrect IP address and redirecting users to an attacker-controlled website.

Session hijacking is the exploitation of a valid computer session to gain unauthorized access to information or services. This is often done by stealing the session token or cookie.

Packet sniffing is the process of intercepting and logging traffic that passes over a digital network. It can be used legitimately for troubleshooting or maliciously to steal passwords/data.

Wireshark is the world’s most widely-used network protocol analyzer. It allows you to see what’s happening on your network at a microscopic level. [Image of Wireshark interface showing packet capture]

tcpdump is a common command-line packet analyzer that allows the user to display TCP/IP and other packets being transmitted or received over a network.

Analysis involves looking for unusual patterns, such as spikes in traffic, connections to known malicious IPs, unexpected port usage, or cleartext credentials in packet captures.

Port scanning is a technique used to identify which ports on a network are open and could potentially be used to send or receive data, often used as a reconnaissance step in an attack.

Nmap ('Network Mapper') is an open-source tool for network exploration and security auditing. It is used to discover hosts and services on a computer network.

Common commands include `nmap -sP` (ping sweep), `nmap -sS` (SYN scan), `nmap -sV` (version detection), and `nmap -O` (OS fingerprinting).

Banner grabbing is a technique used to gain information about a computer system on a network and the services running on its open ports (e.g., learning the version of a web server).

NAC is a security solution that enforces policy on devices that attempt to access a network. It can deny access to non-compliant devices (e.g., those without up-to-date antivirus).

802.1X is an IEEE standard for port-based Network Access Control. It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN.

MAC address filtering is a security method where only devices with specific, pre-approved MAC addresses are allowed to connect to a network.

Network monitoring is the continuous use of a system that scans a computer network for slow or failing components and that notifies the network administrator in case of outages or threats.

NetFlow is a network protocol developed by Cisco for collecting IP traffic information and monitoring network flow, providing data on who is talking to whom, for how long, and using what protocol.

This involves sending logs from firewalls, switches, and routers to a central SIEM for correlation and analysis to identify complex attack patterns across the network.

North-South traffic moves between the data center and the outside world (internet). East-West traffic moves laterally between devices or servers within the data center.

Micro-segmentation is a method of creating secure zones in data centers and cloud environments that allows an organization to isolate workloads and protect them individually.

VXLAN (Virtual Extensible LAN) is a network virtualization technology that attempts to address the scalability problems associated with large cloud computing deployments.

SDN security leverages the centralized control of the network to dynamically apply security policies, automate responses to threats, and provide better visibility into network traffic.

ZTNA is a type of security solution that provides secure remote access to applications based on defined access control policies. Unlike a VPN, it only gives access to specific apps, not the whole network.

It involves designing a network with security at the core, utilizing segmentation, DMZs, redundant firewalls, and monitoring to ensure the integrity and availability of data.

A method of monitoring network traffic by sending a copy of all network packets seen on one switch port to a network monitoring connection on another port.

Endpoint security is the practice of securing the entry points of end-user devices, such as desktops, laptops, and mobile devices, from being exploited by malicious actors.

Historically, antivirus targeted traditional viruses. Anti-malware is a broader term that targets all types of malicious software, including ransomware, spyware, and Trojans.

EDR is an integrated endpoint security solution that combines real-time continuous monitoring and collection of endpoint data with rules-based automated response and analysis capabilities.

Antivirus is largely preventative and focuses on known signatures. EDR focuses on detection and response, recording activity to help investigate how an attacker got in and what they did.

XDR is an evolution of EDR that collects and automatically correlates data across multiple security layers—email, endpoint, server, cloud, and network.

A host-based firewall is software installed on an individual computer that monitors and controls the incoming and outgoing network traffic for that specific machine (e.g., Windows Firewall).

A security practice of allowing only pre-approved and trusted programs to run on a system. Anything not on the list is blocked by default.

The opposite of whitelisting; it allows all programs to run except those that are explicitly listed as harmful.

Whitelisting is a 'default-deny' approach (more secure); blacklisting is a 'default-allow' approach (less secure, harder to maintain against new threats).

Device encryption uses mathematical algorithms to transform data on a device into an unreadable format that can only be unlocked with the correct key or password.

FDE is a security measure that protects all data on a hard drive by encrypting every bit of data that goes onto the drive, including the operating system.

BitLocker is the full disk encryption feature included with Windows Pro and Enterprise editions designed to protect data by providing encryption for entire volumes.

FileVault is the built-in full disk encryption feature for macOS.

A TPM is a specialized chip on an endpoint device that stores cryptographic keys and provides hardware-based security-related functions.

The process of distributing and applying updates to software to fix vulnerabilities, resolve bugs, and improve performance.

It is critical because it closes known security holes that attackers use to gain unauthorized access to systems.

Specifically refers to applying patches that address security vulnerabilities listed in databases like CVE.

A zero-day is a vulnerability that is unknown to the software vendor and for which no patch currently exists. [Image of zero-day exploit timeline]

An exploit is a piece of software, data, or a sequence of commands that takes advantage of a vulnerability to cause unintended behavior in a system.

A vulnerability is the hole; the exploit is the tool used to walk through the hole.

MDM is a type of security software used by IT departments to monitor, manage, and secure employees' mobile devices (laptops, smartphones, tablets) that are deployed across multiple mobile service providers and across multiple mobile operating systems.

BYOD security refers to the set of policies and technologies used to protect an organization's network and data when employees use their personal devices for work. It often involves 'containerization' to separate personal data from corporate data.

A security feature that allows an administrator or device owner to send a command to a device to delete all its data. This is crucial when a device containing sensitive work info is lost or stolen.

A security policy or tool that restricts or monitors the use of USB ports on an endpoint. It prevents unauthorized data exfiltration and blocks the introduction of malware via 'Rubber Ducky' or infected thumb drives.

Endpoint DLP monitors data being used on individual devices. It can block actions like copying sensitive files to a USB drive, uploading them to personal cloud storage, or printing them without authorization.

Instead of looking for a file's 'signature,' behavioral analysis looks for suspicious actions—like a word document trying to launch a PowerShell script. This is highly effective against fileless malware.

Sandboxing is a security mechanism for separating running programs. It provides an isolated environment in which suspicious files can be opened and tested without risk to the host system.

A way to control memory access rights on a computer. It prevents a process from accessing memory that has not been allocated to it, stopping various types of exploits like buffer overflows.

ASLR is a memory protection technique that randomly arranges the address space positions of key data areas of a process. This makes it much harder for an attacker to predict target addresses for exploits.

DEP is a security feature that prevents code from being executed from 'data-only' memory pages. It helps block attacks that try to run code from the stack or heap (e.g., buffer overflows).

Malware (Malicious Software) is an umbrella term for any software intentionally designed to cause damage to a computer, server, client, or computer network.

Common types include Viruses, Worms, Trojans, Ransomware, Spyware, Adware, Rootkits, and Keyloggers.

A virus is a type of malware that attaches itself to a legitimate program or file and requires human action (like opening an attachment) to spread and infect other systems.

A worm is self-replicating malware that spreads across networks without needing a host file or human interaction. It typically exploits vulnerabilities in operating systems.

A Trojan is malware disguised as legitimate software. Unlike viruses or worms, Trojans do not self-replicate; they rely on social engineering to trick a user into executing them.

Ransomware is malware that encrypts a victim's files. The attacker then demands a ransom (usually in cryptocurrency) from the victim to restore access to the data upon payment.

A virus needs a host file and human action to spread. A worm is a standalone program that spreads automatically over the network.

Spyware is malware that secretly monitors a user's activity and gathers information (like passwords or browsing habits) without their consent, often sending the data to a third party.

Adware is software that automatically displays or downloads advertising material (often in the form of pop-ups) when a user is online. While often just annoying, it can be used to deliver more dangerous malware.

A rootkit is a collection of tools that enables an attacker to gain privileged (root) access to a computer while hiding its presence from the OS and security software.

A bootkit is an advanced type of rootkit that infects the Master Boot Record (MBR) or Volume Boot Record (VBR), allowing it to load before the operating system itself.

A keylogger is a type of spyware that records every keystroke made by the user, used primarily to steal login credentials, credit card numbers, and other sensitive typed data.

A backdoor is a method of bypassing normal authentication in a system. It allows an attacker to maintain persistent access to a compromised system without being detected.

A RAT is a type of malware that provides an attacker with full remote control over a target system, including the ability to access files, monitor the webcam, and execute commands.

Cryptojacking is the unauthorized use of a person's or organization's computing resources (CPU/GPU) to mine cryptocurrency for the attacker.

Fileless malware does not install files on the hard drive; instead, it lives in the system's RAM or uses legitimate tools like PowerShell to execute malicious code, making it very hard to detect with traditional antivirus.

Polymorphic malware constantly changes its identifiable features (like its file name or encryption keys) to evade detection by signature-based antivirus while keeping its primary malicious purpose the same.

Metamorphic malware goes a step beyond polymorphic; it completely rewrites its own code with each new infection so that the code structure looks different every time, but functions identically.

The process of determining the functionality, origin, and potential impact of a given malware sample. It is used to develop better defenses and indicators of compromise.

Static Analysis involves examining the code or file without running it (e.g., checking strings or headers). Dynamic Analysis involves running the malware in a controlled environment (sandbox) to observe its behavior.

Running a suspicious file in a virtual machine that is isolated from the rest of the network. This allows researchers to see what registry keys the malware changes or what IPs it contacts safely.

Observing how a piece of malware interacts with the system—for example, looking for unauthorized file deletions, unexpected network connections, or attempts to disable security services.

Disassembling (or decompiling) the malware binary to understand its underlying logic and code instructions. Tools like Ghidra or IDA Pro are used for this.

IOCs are pieces of forensic data found on a network or OS that indicate a high probability of a security breach, such as specific file hashes, IP addresses, or domain names used by attackers.

YARA is a tool used to identify and classify malware samples based on textual or binary patterns. Analysts write YARA rules to detect specific families of malware across their environment.

Creating a unique 'fingerprint' of a file. Analysts use these hashes to check if a file matches a known piece of malware in databases like VirusTotal.

A free online service that analyzes files and URLs for viruses, worms, trojans, and other kinds of malicious content using over 70 different antivirus engines and website scanners.

A unique identifier or pattern in a file's code that antivirus software uses to recognize and block known malware.

A detection method that looks for suspicious characteristics or commands rather than a perfect signature match. It can detect new, previously unseen malware that 'acts' like known threats.

One of the first major ransomware attacks (2013). It spread via email attachments and used RSA public-key cryptography to lock users' files, demanding payment in Bitcoin.

A global 2017 cyberattack that used the 'EternalBlue' exploit (leaked from the NSA) to spread automatically via SMB. It affected hundreds of thousands of computers, including the UK's NHS.

Primarily through Phishing emails, RDP (Remote Desktop Protocol) exploits, and unpatched software vulnerabilities that allow for worm-like self-propagation.

The primary way is by restoring from verified, offline backups. Alternatively, for some older ransomware, decryption tools may be available from sites like 'No More Ransom.'

A multi-layered defense: User training, regular patching, EDR solutions, and most importantly, maintaining frequent, immutable, and off-site backups.

Identify and isolate the infected system, run deep scans, manually clean registry/startup entries, and if the infection is deep (like a rootkit), re-image the machine from scratch.

A safe 'holding area' where antivirus software moves infected files to prevent them from executing or spreading while the user decides whether to delete them or restore them.

An error where legitimate, safe software is incorrectly flagged as being malicious by a security tool.

A stealthy threat actor, typically a nation-state or state-sponsored group, which conducts a large-scale, long-term campaign to steal data or spy on a specific target.

A centralized computer used by an attacker to send commands to a network of infected botnet computers and receive stolen data from them.

The process by which an attacker, after gaining an initial foothold in a network, moves from computer to computer to find the 'crown jewels' (like the Domain Controller or customer databases).

The continuous process of identifying, evaluating, treating, and reporting on security vulnerabilities in systems and the software that runs on them.

An automated process that checks computers, systems, or networks for known security weaknesses (e.g., outdated software or misconfigurations).

A systematic review of security weaknesses in an information system. It evaluates if the system is susceptible to any known vulnerabilities and assigns severity levels to those risks.

A Vulnerability Scan is automated and finds potential holes. A Penetration Test is a manual effort to actually exploit those holes to see how deep an attacker can get.

Nessus is a widely used proprietary vulnerability scanner that helps security professionals identify vulnerabilities, configuration issues, and malware in systems.

OpenVAS (Open Vulnerability Assessment System) is an open-source framework of several services and tools offering a comprehensive vulnerability scanning and management solution.

Qualys is a cloud-based security and compliance platform that provides vulnerability management, policy compliance, and web application security scanning services.

The process of assigning a numerical value to a vulnerability to represent its severity, helping organizations decide what to fix first.

CVSS is an industry standard for assessing the severity of computer system security vulnerabilities. It provides a score from 0.0 to 10.0 (Critical).

CVE is a list of publicly disclosed cybersecurity vulnerabilities. Each CVE entry has a unique ID number (e.g., CVE-2021-44228 for Log4Shell).

CVE is the ID of the vulnerability (The Name). CVSS is the score representing how dangerous it is (The Severity).

The NVD is the U.S. government repository of standards-based vulnerability management data, synchronized with the CVE list and enhanced with CVSS scores and search capabilities.

The process of ranking vulnerabilities based on their CVSS score, the importance of the affected asset, and whether there is an active exploit 'in the wild.'

A strategy that focuses on remediating vulnerabilities that pose the greatest risk to the organization, rather than trying to fix every single bug found by a scanner.

Remediation is fixing the root cause (e.g., installing the patch). Mitigation is reducing the risk without fixing the root cause (e.g., blocking the vulnerable port at the firewall).

An alternative security measure put in place when the primary security control (like a patch) cannot be implemented, effectively reducing the risk to an acceptable level.

The stages a vulnerability goes through: Discovery -> Analysis -> Prioritization -> Remediation -> Verification.

The practice of running scans at high frequency (daily or triggered by changes) rather than monthly or quarterly, ensuring new vulnerabilities are caught immediately.

An Unauthenticated scan looks from the 'outside-in' like an attacker. An Authenticated scan uses credentials to log into the system and see missing patches or registry errors from the 'inside-out.'

Agentless uses the network to scan targets. Agent-based installs a small piece of software on every endpoint that reports vulnerabilities back, which is better for remote or offline devices.

Scanning network devices (routers, switches, firewalls) and their open ports for misconfigurations or outdated firmware.

Specifically looking for application-layer flaws like XSS, SQLi, and broken authentication in web services (DAST/SAST).

A False Positive is a tool saying there is a bug when there isn't. A False Negative is a tool saying everything is safe when there actually is a hidden vulnerability.

The output of a scan, organized to show stakeholders what the risks are, which systems are affected, and the recommended steps for remediation.

Service Level Agreement. A policy defining how fast a bug must be fixed (e.g., 'Critical vulnerabilities must be patched within 48 hours').

Critical (9.0-10.0) usually allows remote code execution. High (7.0-8.9) allows significant access but might need user interaction. Medium (4.0-6.9) usually involves information disclosure.

An assessment of how easy it is for an attacker to use a specific vulnerability. Factors include if the exploit is public, if it requires authentication, or if the attacker needs local access.

The sum of all possible points (the 'exposure') where an unauthorized user can try to enter or extract data from an environment.

The specific path or method used by a hacker to gain access to a system (e.g., an unpatched VPN, a phishing email, or a compromised supply chain).

A broader concept than vulnerability management that includes managing risky user behaviors, misconfigurations, and external-facing assets that create paths for attackers.

A simulated cyberattack against your computer system to check for exploitable vulnerabilities.

The practice of using hacking techniques and tools to find security holes with the permission of the owner to help secure the system.

White Hat (Ethical hackers), Black Hat (Malicious/Illegal hackers), and Grey Hat (Hackers who might violate laws but without malicious intent, often looking for rewards).

A structured approach to a pentest, such as OSSTMM or PTES, which ensures all areas are tested and results are consistent.

1. Reconnaissance, 2. Scanning & Enumeration, 3. Gaining Access (Exploitation), 4. Maintaining Access, 5. Analysis/Reporting.

The information-gathering phase where the tester learns about the target organization's network, employees, and infrastructure.

Passive gathering data without directly interacting with the target (e.g., Google, LinkedIn). Active interacting with the target (e.g., port scanning).

Collecting information from public records, social media, and search engines to build a profile of the target.

Identifying live hosts, open ports, and then 'enumerating' them to find what services are running (e.g., discovering a specific version of Apache).

The attempt to bypass security controls by using exploits to gain control of a system or network resource.

Activities performed after gaining access, such as searching for sensitive files or attempting to escalate privileges to 'System' or 'Root' level.

Taking a low-privileged account (like a regular user) and finding a bug to gain the permissions of a higher-privileged account (like an administrator).

Using a compromised account on one system to move to another system within the same network.

Techniques used to ensure that a tester (or attacker) retains access even if the system is rebooted or the original vulnerability is patched.

Using a compromised system to 'hop' into a different network segment that was not directly accessible from the outside.

A world-renowned open-source tool for developing, testing, and executing exploit code against a remote target machine.

An integrated platform for performing security testing of web applications. It acts as a proxy between the browser and the target server, allowing for request manipulation.

The Zed Attack Proxy (ZAP) is a free, open-source DAST tool for finding vulnerabilities in web applications while they are running.

A Debian-derived Linux distribution designed for digital forensics and penetration testing. It comes pre-installed with hundreds of security tools.

A Linux distribution similar to Kali, but designed to be more lightweight and privacy-focused, intended for security researchers and developers.

It is the branch of information security that deals specifically with the security of websites, web applications, and web services. It focuses on identifying and mitigating flaws in the application layer (Layer 7) that could lead to data theft or unauthorized access.

The Open Web Application Security Project (OWASP) Top 10 is a regularly updated report outlining the ten most critical web application security risks, as identified by security experts from around the world.

The 2021 list includes: 1. Broken Access Control, 2. Cryptographic Failures, 3. Injection, 4. Insecure Design, 5. Security Misconfiguration, 6. Vulnerable and Outdated Components, 7. Identification and Authentication Failures, 8. Software and Data Integrity Failures, 9. Security Logging and Monitoring Failures, 10. SSRF.

An injection attack occurs when untrusted data is sent to an interpreter as part of a command or query. The attacker's hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.

SQL injection (SQLi) is an attack that inserts malicious SQL code into entry fields for execution. Prevention involves using Prepared Statements (Parameterized Queries), stored procedures, and input validation.

A prepared statement is a template for the SQL query. It separates the query's structure from its data, ensuring that user input is treated as text (a parameter) and never as part of the SQL command itself.

It is essentially another name for prepared statements. It ensures the database treats input as data rather than executable code.

Vulnerabilities that allow attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users' identities.

Flaws in how a web app handles user sessions, such as using predictable session IDs, long timeouts, or failing to invalidate session tokens after logout.

An attack where the attacker 'fixes' a user's session ID before the user logs in. If the application doesn't renew the session ID upon login, the attacker can use the fixed ID to hijack the authenticated session.

When an application fails to adequately protect sensitive information, such as financial data, health info, or PII. This often results from lack of encryption at rest or in transit.

At Rest protects data stored on disks (e.g., AES-256). In Transit protects data moving across the network (e.g., TLS/HTTPS).

An attack against an application that parses XML input. It occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser, potentially leading to LFI or SSRF.

A failure to enforce restrictions on what authenticated users are allowed to do. Attackers exploit these flaws to access unauthorized functionality or data.

When a user gains access to resources or data belonging to another user with the same level of privileges (e.g., User A accessing User B's private messages).

When a user with lower privileges gains access to functions or data reserved for higher-privileged users, such as an employee gaining Admin rights.

The most common issue, involving insecure default settings, incomplete or ad hoc configurations, open cloud storage, or verbose error messages containing sensitive info.

Failing to change the 'admin/admin' or 'guest/password' logins on hardware or software, allowing attackers to easily take control of systems.

A misconfiguration where a web server displays the list of files in a directory that has no index file, potentially revealing source code or sensitive backup files.

XSS occurs when an application includes untrusted data in a new web page without proper validation. This allows attackers to execute malicious scripts in the victim's browser.

A type of XSS where the vulnerability exists in the client-side code rather than the server-side code. The script is executed when the client's browser parses the page logic.

Primary methods include: Output Encoding (converting `<` to `&lt;`), Input Validation, and implementing a strong Content Security Policy (CSP).

A security header that tells the browser which sources of scripts, styles, and images are trusted, effectively blocking unauthorized third-party scripts from running.

When an application desynchronizes untrusted data to reconstruct an object. Attackers can use this to execute code or manipulate the application's logic.

Relying on third-party libraries, frameworks, or modules that have unpatched CVEs, which attackers can exploit to bypass app security.

Failing to record security events or generate alerts, which prevents the detection of breaches in progress or forensic analysis after an attack.

A malicious technique of tricking a user into clicking on something different from what they perceive, usually by using transparent layers or iframes.

A security header used to prevent clickjacking by indicating whether or not a browser should be allowed to render a page in a `<frame>` or `<iframe>`.

When an application takes a user-provided URL and redirects the user to that URL without validation, often used in phishing to make a malicious link look official.

A vulnerability that occurs when data is included in an HTTP response header without validation, allowing an attacker to inject CRLF characters to 'split' the response into two.

The practice of protecting Application Programming Interfaces from attack. It focuses on authentication, rate limiting, and ensuring data is not over-exposed through the API endpoint.

Use HTTPS, implement OAuth2/OpenID for auth, use API Keys, implement Rate Limiting, and perform strict input validation/output filtering.

An industry-standard protocol for authorization. Security relies on protecting 'Access Tokens' and ensuring 'Redirect URIs' are strictly whitelisted to prevent token theft.

Common flaws include using the 'none' algorithm (bypassing signature check) or using weak secret keys that can be brute-forced to forge tokens.

Restricting the number of requests a user can make to an API in a given timeframe to prevent DoS attacks and brute-force attempts.

A mechanism that uses additional HTTP headers to tell browsers to give a web application running at one origin access to selected resources from a different origin.

A critical security mechanism in browsers that restricts how a document or script loaded from one origin can interact with a resource from another origin.

HTTPS is HTTP over an encrypted connection. SSL/TLS are the underlying protocols that provide that encryption, ensuring data privacy and integrity.

A security technique where an application is hard-coded to trust only a specific SSL certificate or public key, preventing MITM attacks that use fraudulent CAs.

A web security policy mechanism that helps to protect websites against protocol downgrade attacks and cookie hijacking by forcing browsers to use only HTTPS.

SAST (Static) analyzes source code for bugs without running it (inside-out). DAST (Dynamic) tests the running application for vulnerabilities like a hacker would (outside-in).

A framework of policies and technologies to ensure that the right users have the appropriate access to technology resources. It is the gatekeeper of enterprise security.

The process of verifying the identity of a user, device, or system (e.g., 'Are you who you say you are?').

The process of determining what an authenticated user is permitted to do or access (e.g., 'What are you allowed to see?').

Authentication checks your ID; Authorization checks your permissions.

The act of a user claiming an identity to a system, usually by providing a username or ID number.

A security system that requires more than one method of authentication from independent categories of credentials to verify a user's identity.

1. Knowledge (Password), 2. Possession (Smart card/phone), 3. Inherence (Biometrics). [Image showing the three factors of authentication]

A subset of MFA that specifically requires exactly two different factors for verification.

Receiving a code via text. Risks include SIM Swapping and interception by rogue cell towers or malware, making it less secure than app-based or hardware MFA.

An algorithm that computes a one-time password from a shared secret key and the current time, used by apps like Google Authenticator.

A mobile application that generates TOTP codes locally on the device, offering a more secure alternative to SMS-based codes.

A physical device that a user must plug in or tap to authenticate. It provides the strongest protection against remote phishing attacks.

Using physical or behavioral characteristics (fingerprint, face scan, iris) to verify identity.

Verifying identity without a password, typically using biometrics, hardware keys, or magic links, which removes the risk of password-based attacks.

A session and user authentication service that permits a user to use one set of login credentials to access multiple applications.

An XML-based standard for exchanging authentication and authorization data between an Identity Provider (IdP) and a Service Provider (SP).

OAuth is primarily for authorization (accessing APIs); SAML is primarily for authentication (SSO into web apps).

An identity layer on top of the OAuth 2.0 protocol that allows clients to verify the identity of the end-user based on the authentication performed by an Authorization Server.

A method of linking a user's identity across multiple identity management systems, allowing them to use the same credentials for different organizations.

A system that creates, maintains, and manages identity information while providing authentication services to relying applications (e.g., Okta, Azure AD).

Microsoft’s directory service used to manage users, computers, and other resources on a Windows network.

An open, vendor-neutral protocol for accessing and maintaining distributed directory information services over an IP network.

The default authentication protocol for Windows domains. It uses 'Tickets' and a trusted third party (KDC) to prove identity over insecure networks.

An older Microsoft authentication protocol that uses a challenge-response mechanism. It is considered less secure than Kerberos and prone to relay attacks.

An attack where the hacker steals a hashed user credential and, without decrypting it, uses it to create a new authenticated session on the network.

A post-exploitation technique where an attacker requests a service ticket for a service account and attempts to crack the password hash offline.

An attack where a hacker compromises the Kerberos Key Distribution Center (KDC) to create 'forged' tickets, giving them unlimited, permanent access to the entire domain.

Security tools and policies designed to safeguard accounts with elevated permissions (admins, root) through vaulting, rotation, and session recording.

A PAM practice where users are granted elevated privileges only for the specific timeframe needed to complete a task, after which access is revoked.

Assigning permissions to 'Roles' (e.g., HR, IT) and then assigning users to those roles, making access management more scalable.

A flexible model that grants access based on attributes (e.g., 'User is in Finance AND it is between 9-5 AND user is on a managed device').

The core security concept of giving users only the absolute minimum permissions required to do their job.

A control policy that ensures more than one person is required to complete a critical task to prevent fraud or error (e.g., one person requests access, another approves).

The periodic audit of user permissions to ensure they are still appropriate for their current role, helping to remove 'Privilege Creep.'

Provisioning is creating an account when an employee starts. Deprovisioning is disabling/deleting the account immediately when they leave.

An active account that remains in the system after the owner has left the organization, representing a high security risk.

A type of attack where hackers use lists of compromised usernames and passwords from one breach to attempt to log into other unrelated services.

Attacking many different accounts with a few commonly used passwords (like 'Password123') to avoid account lockouts while searching for a weak link.

The systematic attempt to guess a password by trying every possible combination of characters until the correct one is found.

A security setting that disables a user account after a specific number of failed login attempts to prevent brute-force attacks.

The science of protecting information by transforming it into an unreadable format that can only be understood by those with the correct key.

The process of converting plain text into scrambled 'cipher text' using a mathematical algorithm and a key.

Encryption is two-way (you can scramble and unscramble). Hashing is one-way (once scrambled, it cannot be reversed; used for data integrity).

A type of encryption where the same key is used to both encrypt and decrypt the data (e.g., AES).

Also known as Public-Key Cryptography, it uses a Public Key for encryption and a matching Private Key for decryption (e.g., RSA).

Symmetric is fast and uses one key; asymmetric is slow, uses a key pair, and is much better for secure key exchange.

Advanced Encryption Standard. The industry-standard symmetric algorithm used by governments and businesses worldwide for its high speed and security.

The first widely used asymmetric algorithm, based on the difficulty of factoring large prime numbers, commonly used for digital signatures and SSL/TLS.

Data Encryption Standard (DES) is an old symmetric algorithm. Triple DES (3DES) applies DES three times to improve security, though both are now considered legacy.

Because its 56-bit key size is too small and can be cracked by modern computers in less than a day using brute-force.

A string of bits used by a cryptographic algorithm to transform plain text into cipher text or vice versa.

The number of bits in a key. Longer keys (e.g., 256-bit) are exponentially more difficult to crack through brute-force than shorter keys.

In asymmetric crypto, the Public Key can be shared with anyone to encrypt data; the Private Key must be kept secret and is the only thing that can decrypt it.

A system of roles, policies, and hardware/software to create, manage, and revoke digital certificates and manage public-key encryption.

An electronic document used to prove the ownership of a public key, similar to a digital passport.

A trusted third-party organization (like DigiCert or Let's Encrypt) that issues digital certificates to verify identities.

The standard format for public-key certificates used widely in SSL/TLS to secure web traffic.

Protocols that provide secure communication over a network, used by browsers to establish a secure connection with a website.

TLS 1.3 is faster (fewer handshakes) and more secure (removes old, weak cipher suites) compared to TLS 1.2.

Domain Validated (cheapest/easiest), Organization Validated (verifies business identity), and Extended Validation (highest trust level).

A certificate that is signed by the same entity whose identity it certifies, rather than a trusted Certificate Authority (CA). They are free but trigger browser warnings, making them suitable only for internal testing environments.

A list of certificates starting from the server certificate, going through one or more intermediate CAs, and ending at the root CA. This 'chain of trust' allows a browser to verify that a site's certificate was issued by a legitimate source.

A security mechanism where an application is hard-coded to accept only a specific certificate or public key. This prevents attackers from using fraudulent certificates issued by compromised CAs to perform Man-in-the-Middle attacks.

The process of invalidating a certificate before its scheduled expiration date, usually because the private key was compromised or the entity's details changed.

A list of digital certificates that have been revoked by the issuing CA before their scheduled expiration date. Browsers check this list to ensure a site's certificate is still valid.

A more efficient alternative to CRLs. It allows a browser to query a CA's server in real-time to check the status of a single certificate rather than downloading a massive list.

A one-way mathematical function that turns an input of any size into a fixed-length string of characters. It is used to verify data integrity, as even a tiny change in input results in a completely different hash.

The specific algorithm (like SHA-256) used to perform hashing. A good hash function is fast, deterministic, and resistant to collisions.

Message Digest 5. A once-popular hash function that is now considered cryptographically broken and insecure because it is vulnerable to collision attacks.

Secure Hash Algorithms developed by the NSA. SHA-1 is now considered weak. SHA-256 and SHA-512 are current industry standards for securing data and passwords.

It suffers from 'collision vulnerabilities,' where two different inputs can produce the same hash output. This allows attackers to forge files or digital signatures.

When two different pieces of data produce the exact same hash value. In a secure hash algorithm, this should be mathematically near-impossible.

Adding a random string of characters (a 'salt') to a password before hashing it. This ensures that two users with the same password will have different hashes, preventing rainbow table attacks.

A pre-computed table used for reversing cryptographic hash functions, primarily for cracking password hashes. Salting effectively defeats these tables.

A specific type of message authentication code involving a cryptographic hash function and a secret cryptographic key, used to simultaneously verify both the data integrity and the authenticity of a message.

A mathematical scheme used to verify the authenticity and integrity of a digital message or document. It provides 'non-repudiation,' meaning the sender cannot deny sending it.

The process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed.

A system of communication where only the communicating users can read the messages. The data is encrypted on the sender's device and only decrypted on the recipient's device; no middleman (like an ISP or app provider) can access it.

A feature of specific key agreement protocols that ensures that if a long-term private key is compromised in the future, the session keys used in past communications remain secure.

A method of securely exchanging cryptographic keys over a public channel. It allows two parties to establish a shared secret key without ever having met or sent the key directly.

The measure of randomness or unpredictability in data, such as a password or an encryption key. Higher entropy means it is harder to guess or crack.

The consistent observation of an IT environment to identify and respond to security threats, unauthorized activities, or policy violations in real-time.

A software solution that aggregates log data from throughout an organization’s infrastructure (apps, network devices, servers) and analyzes it to detect suspicious activity and ensure compliance.

Log management is about collecting and storing logs. SIEM adds real-time analysis, event correlation, and alerting on top of that stored data.

A technology that enables organizations to collect security threat data and alerts from different sources and automatically respond to low-level security events without human intervention.

SIEM is primarily for Detection and Alerting (finding the needle in the haystack). SOAR is for Automation and Response (automatically removing the needle once found).

A leading SIEM and data analysis platform that indexes and searches machine-generated data for security, operations, and business intelligence.

An enterprise SIEM platform that provides situational awareness and compliance support by collecting, processing, and correlating huge volumes of data in real-time.

One of the oldest enterprise-scale SIEM solutions, known for its powerful correlation engine and ability to handle massive data ingestions.

A unified security intelligence platform that combines SIEM, log management, and endpoint monitoring into a single solution.

A popular open-source suite (Elasticsearch, Logstash, Kibana) often used for security monitoring and log analysis due to its speed and flexibility.

The process of collecting logs from many different sources (firewalls, servers, databases) and bringing them into a single, centralized location for analysis.

The process of looking for relationships between different log entries to identify a complex attack. For example, correlating a failed login on a server with an unusual outbound connection from the same IP.

Any observable occurrence in a system or network that is relevant to security, such as a user changing their password or a firewall blocking a port.

An Event is just an occurrence (neutral). An Alert is a high-priority event that has triggered a specific rule, notifying an analyst that something suspicious is happening.

When a SIEM triggers an alert for activity that is actually legitimate and authorized (e.g., an admin performing maintenance that looks like a brute-force attack).

The process of adjusting SIEM rules and thresholds to reduce the number of false positives and ensure that only truly suspicious activity triggers an alert.

A state where security analysts become desensitized to alerts because they are overwhelmed by a high volume of false positives, leading to the risk of missing a real attack.

A specific security problem or attack scenario that you want to detect (e.g., 'Detecting Ransomware activity' or 'Detecting Unauthorized Cloud Access'). Each use case has a specific set of logic and rules.

A logical statement that tells the SIEM to trigger an alert if a specific sequence of events occurs within a certain timeframe.

A record of 'normal' activity in a network or system. Anything that falls significantly outside this baseline is flagged as an anomaly.

A technique that identifies patterns in data that do not conform to expected behavior. It is excellent for finding unknown threats or insider activity.

User and Entity Behavior Analytics. It uses machine learning to track the normal behavior of users and devices and alerts when they act unusually (e.g., an employee logging in from a new country at 3 AM).

The same as UEBA; it focuses on both human users and non-human entities like servers, routers, and IoT devices.

Information an organization uses to understand the threats that have, will, or are currently targeting them. This includes knowledge about threat actors, their tools, and their motives.

A real-time stream of data about new and existing security threats (like malicious IPs and file hashes) that can be automatically ingested by SIEMs and firewalls.

Forensic evidence found on a system or network that indicates a security breach has occurred, such as a known malicious URL or an unusual registry key.

The 'behavioral' description of an attacker. Tactics are the 'what' (initial access), Techniques are the 'how' (phishing), and Procedures are the specific steps taken.

A globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It is the industry standard for mapping an organization's detection capabilities.

Developed by Lockheed Martin, it describes the seven stages of a cyberattack: Reconnaissance -> Weaponization -> Delivery -> Exploitation -> Installation -> Command & Control -> Actions on Objectives.

A model for analyzing cyber intrusions based on four interconnected features: Adversary, Infrastructure, Capability, and Victim.

The process of analyzing alerts and events to determine the scope, impact, and root cause of a potential security breach.

A policy that defines how long an organization must keep its logs (e.g., 90 days or 1 year) based on security needs and regulatory compliance.

Collecting specific logs required by regulations (like PCI-DSS or HIPAA) to prove that data is being handled securely and according to the law.

A chronological record of system activities that provides documentary evidence of the sequence of activities that have affected at any time a specific operation or event.

The deep examination of logs after an incident to reconstruct the timeline of an attack and determine exactly what the attacker accessed or stole.

Ensuring all devices have the exact same time is critical for correlating events from different systems. If clocks are off, it's impossible to build an accurate timeline of an attack.

A visual interface that provides a real-time overview of an organization's security posture, showing key metrics like open alerts, blocked attacks, and patch status.

KPIs (Key Performance Indicators) measure how well the security team is doing (e.g., time to patch). KRIs (Key Risk Indicators) measure how much risk the organization is facing (e.g., number of open critical vulnerabilities).

The average time it takes for a security team to identify that a threat or breach is occurring in their environment.

The average time it takes for a security team to contain and neutralize a threat once it has been detected.

A set of instructions to help IT staff detect, respond to, and recover from network security incidents.

Common roles include the Incident Commander (leader), Scribes (documentation), Analysts (technical investigation), and Legal/PR representatives.

The phase where the organization establishes the team, tools, policies, and training necessary to respond to incidents before they happen.

Monitoring for precursors and indicators of a breach and confirming if an incident is actually occurring and what its scope is.

The immediate actions taken to prevent an incident from spreading or causing more damage, such as isolating an infected server from the network.

Short-term containment is isolating the system (stopping the bleeding). Long-term containment is applying temporary patches or hardening while a full recovery plan is built.

Removing the root cause of the incident, such as deleting malware, closing compromised accounts, and patching the vulnerabilities that were exploited.

Restoring systems to normal operation, confirming they are functioning correctly, and monitoring for any signs of the attacker returning.

Reviewing what happened, how the team performed, and updating the Incident Response Plan to prevent similar incidents in the future.

A post-mortem meeting where the team discusses the incident details and identifies areas for improvement in the organization's security posture.

Ranking incidents (Low, Medium, High, Critical) based on factors like data sensitivity, system criticality, and potential financial or reputational impact.

Deciding which incidents to handle first when multiple occur simultaneously, usually based on the severity and impact classification.

A plan defining who needs to be notified (executives, customers, law enforcement), when, and through what channels during a major breach.

The process of involving higher levels of management or specialized external experts when an incident exceeds the capabilities or authority of the initial response team.

A Playbook is a high-level strategy for a type of attack (e.g., 'Phishing Playbook'). A Runbook is a detailed, step-by-step technical guide for a specific task within that playbook.

A documented, standardized set of steps that analysts follow to handle specific types of threats consistently and efficiently.

The application of scientific investigation techniques to digital data to identify, preserve, and analyze information for use as evidence in legal or disciplinary proceedings.

Identification -> Preservation -> Analysis -> Documentation -> Presentation.

The careful gathering of digital data (disk images, memory dumps, logs) while ensuring that the data is not modified during the process.

A chronological document that tracks who has had access to a piece of evidence from the moment it was collected until it is presented in court, ensuring its integrity.

Ensuring evidence is stored in a secure, write-protected environment to prevent any accidental or intentional alteration of the data.

Creating a bit-for-bit copy of a storage device (hard drive, USB) to ensure that the original data is never touched during analysis.

A physical or software tool that prevents any data from being written to a storage device while it is being imaged or analyzed, maintaining forensic integrity.

A standard Unix command-line utility used for bit-by-bit copying of files or disks, often used in forensics for creating raw disk images.

A popular data preview and imaging tool that allows investigators to quickly examine files and create forensic images of hard drives and memory.

The analysis of a computer's RAM to find evidence that doesn't leave a trace on the hard drive, such as running processes, network connections, and encryption keys.

Volatile data is lost when power is removed (e.g., RAM). Non-volatile data persists after power-off (e.g., Hard drive, SSD). In forensics, volatile data must be collected first.

Specifically searching the RAM dump for evidence of fileless malware, hidden processes, or user activity that occurred just before the system was imaged.

Examining the persistent storage of a computer to find evidence like deleted files, web history, and installed applications.

A forensic technique used to recover files from unallocated space on a disk by looking for specific file headers and footers, even when the file system metadata is missing or corrupted.

The process of identifying and restoring files that were marked as deleted by the OS but whose data has not yet been overwritten on the physical disk.

The monitoring and analysis of computer network traffic for the purposes of information gathering, legal evidence, or intrusion detection.

Looking at the raw data packets (PCAP files) to see exactly what data was sent over the network, which is crucial for identifying data exfiltration.

Building a chronological sequence of events across multiple logs and systems to understand exactly how an attacker moved through the environment over time.

Parsing and searching system, application, and security logs to find evidence of unauthorized logins, command execution, or data access.

Using specialized tools to find malware that is hiding itself at the OS kernel level, which often requires booting from a clean, external forensic OS.

Methods used by attackers to thwart forensic investigation, such as data wiping, using encryption, changing file timestamps (timestomping), or running purely in memory.

The process of identifying information that has been hidden inside other files, like a secret message hidden within an image pixel by pixel.

Specifically analyzing the malware found on an infected system to determine its command and control (C2) servers and the specific damage it did to that host.

Legal obligations (under laws like GDPR or state laws) that require an organization to notify the authorities and affected individuals within a specific timeframe after a data breach is confirmed.

IT systems, software, and services used within an organization without explicit departmental approval, creating unmanaged security risks.

Security compliance is the process of adhering to external laws, regulations, and industry standards, as well as internal policies, to ensure that an organization's data and systems meet specific security requirements.

Adherence to laws and regulations established by government bodies. Examples include GDPR for data privacy or HIPAA for healthcare information security.

The Payment Card Industry Data Security Standard is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment.

The Health Insurance Portability and Accountability Act is a US federal law that set national standards for the protection of sensitive patient health information (PHI) from being disclosed without the patient’s consent or knowledge.

The General Data Protection Regulation is a comprehensive data privacy law in the EU that gives individuals control over their personal data and imposes strict obligations on organizations that collect and process such data.

A US law that mandates strict financial reporting and auditing requirements for public companies to prevent accounting fraud, which includes securing the IT systems that handle financial data.

An international standard for an Information Security Management System (ISMS). It provides a framework for managing information security through people, processes, and technology.

A voluntary framework consisting of standards, guidelines, and best practices to manage cybersecurity-related risk. It is organized around five core functions: Identify, Protect, Detect, Respond, and Recover.

A prioritized set of 18 best practices (formerly SANS Top 20) designed to mitigate the most common cyberattacks. They are highly practical and focus on actionable security improvements.

An auditing procedure that ensures service providers manage data securely. Type I reports on the system design at a specific point in time; Type II reports on the operational effectiveness of those controls over a period (usually 6-12 months).

The Federal Information Security Management Act requires US federal agencies to develop, document, and implement agency-wide information security programs.

A US government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies.

A systematic evaluation of an organization's security posture by measuring how well it conforms to a set of established criteria, such as a security policy or a compliance regulation.

Internal audits are performed by employees to prepare for official reviews. External audits are performed by independent third-party organizations to provide an unbiased certification of compliance.

A Vulnerability Assessment looks for technical bugs and holes. A Compliance Scan checks if system configurations match a specific regulatory standard (e.g., 'Is password length set to 12?').

A high-level document that outlines an organization's overall requirements and approach to security, setting the direction for all other security activities.

A mandatory rule or set of requirements that support a policy. For example, a policy might require 'strong encryption,' while the standard specifies 'AES-256.'

A step-by-step document explaining exactly how to perform a specific security task, such as how to provision a new user account.

The minimum level of security required for an asset. It serves as a starting point for ensuring all systems (like servers or laptops) are configured securely before being deployed.

The process of ensuring that systems are consistently configured and maintained according to security baselines, often using automated tools like Ansible or Terraform.

A formal process to ensure that changes to the IT environment are documented, tested, and approved before implementation to avoid security gaps or system outages.

The ongoing process of identifying, assessing, and responding to risks to minimize the impact of security threats on the organization.

A structured approach to evaluating risk, such as NIST SP 800-30, which defines how to calculate risk based on threat likelihood and impact.

Quantitative uses numerical values and dollar amounts (e.g., 'This will cost $50k'). Qualitative uses descriptive rankings (e.g., 'High,' 'Medium,' 'Low').

A centralized document that lists all identified risks, their severity, their current status, and the plan for addressing them.

1. Accept: Do nothing (if risk is low). 2. Mitigate: Apply security controls. 3. Transfer: Buy insurance or outsource. 4. Avoid: Stop the risky activity entirely.

The amount of risk that remains after security controls (mitigation) have been applied.

The process of determining the potential effects of an interruption to critical business operations as a result of a disaster or security incident.

A documented process to recover and protect a business IT infrastructure in the event of a disaster. It focuses on the technical restoration of systems.

A broader plan than DRP that ensures the entire business can continue to operate during and after a disaster, including non-IT processes like payroll and facilities.

The maximum amount of time allowed to restore a system after a failure (e.g., 'This server must be back up in 4 hours').

The maximum amount of data loss measured in time (e.g., 'We can afford to lose 1 hour of data, so we must back up every hour').

A strategy to educate employees about cyber threats and organizational policies to reduce human-related security risks.

The practice of sending 'fake' phishing emails to employees to test their awareness and identify who needs additional training.

Measuring if training works by tracking metrics like reduced infection rates, higher reporting of phishing, or fewer policy violations.

A focused effort to detect and prevent harmful activity by employees or contractors, whether intentional (malice) or accidental (negligence).

The process of labeling data (e.g., Public, Internal, Confidential, Secret) based on its sensitivity to ensure it receives the appropriate level of protection.

Specific rules for how classified data should be stored, transmitted, and destroyed (e.g., 'Confidential data must be encrypted during transfer').

A set of rules outlining what employees can and cannot do on company networks and devices, such as prohibiting illegal downloads or personal use during work hours.

Ensuring that third-party vendors and partners do not introduce security risks into your organization's environment.

The process of auditing a vendor's security controls through questionnaires, audits, or technical scans before signing a contract.

A document sent to vendors asking detailed questions about their security practices, such as 'Do you use MFA?' or 'How do you handle data breaches?'

Some regulations (like PCI-DSS) strictly require annual penetration tests to prove that security controls are effective against real-world attacks.

A formal way for external researchers to report security bugs they find in your systems without fear of legal action, often called 'Responsible Disclosure.'

A program where organizations pay ethical hackers for finding and reporting valid security vulnerabilities in their software.

1. Identify the source internal IP. 2. Look up the destination IP (is it a known malicious IP or C2?). 3. Check what process on the host is generating traffic. 4. If suspicious, isolate the host immediately to prevent data exfiltration and start the incident response process.

1. Instruct the user not to click any links. 2. Analyze the email headers and link/attachment. 3. Check if any other users received the same email. 4. Block the sender/domain at the gateway. 5. If the user clicked, reset their credentials and scan their host for malware.

1. Determine if the attempts are against one account (Brute-force) or many accounts (Password Spraying). 2. Identify the source IP. 3. If it's an external IP, block it at the firewall. 4. Verify if any attempts were successful. 5. Notify the affected users to change their passwords if necessary.

1. Disconnect the device from the network immediately (Containment). 2. Identify the ransomware variant to see if a decryptor exists. 3. Determine how it entered. 4. Check for lateral movement to other servers. 5. Wipe and restore the host from the latest clean backup.

1. Check the account's recent login logs (Time, IP, Location). 2. Look for unusual activity like changed settings or sent emails. 3. Force a password reset and sign out of all active sessions. 4. Implement MFA if not already present. 5. Review logs to see how the compromise occurred (e.g., phishing).

1. Check the firewall logs to see if any traffic was allowed. 2. Identify which ports are being scanned. 3. Verify if any services are actually running on those ports. 4. If the IP is scanning many ports rapidly, block it. 5. Ensure that no management ports (like RDP or SSH) are exposed to the internet.

1. Block the destination IP/Domain at the firewall instantly. 2. Identify the internal host and the specific files being sent. 3. Kill the associated process. 4. Isolate the machine. 5. Perform forensic analysis to determine the total amount and sensitivity of the stolen data.

1. Assess if an active exploit exists. 2. Check if a patch is available. 3. If a patch cannot be applied immediately, implement mitigating controls (like WAF rules or IP whitelisting). 4. Schedule the patch for the next maintenance window. 5. Verify the fix after patching.

1. Notify the CEO and the executive team. 2. Force an immediate password change across all systems. 3. Rotate their MFA keys. 4. Review recent logs for any unauthorized access using those credentials. 5. Monitor for any suspicious activity related to their accounts.

1. Examine the command line arguments used in the script. 2. Decode any Base64 encoded portions. 3. Determine which user/process launched it. 4. Check if it contacted any external IPs. 5. If it attempted to dump credentials (e.g., Mimikatz), initiate full host remediation.

1. Capture the sample and run it in an isolated sandbox. 2. Identify its behavioral patterns (registry changes, network calls). 3. Create a custom YARA rule or IOC list to search the network. 4. Manually block the identified IPs and Domains. 5. Upload the sample to the AV vendor for signature generation.

1. Engage your ISP or a DDoS protection service (like Cloudflare/Akamai). 2. Enable rate-limiting and GEO-blocking for irrelevant regions. 3. Set up a 'Waiting Room' or CAPTCHA to filter bot traffic. 4. Scale up resources if it's a volumetric attack. 5. Monitor logs for the attack duration.

1. Perform a 'silent' review of the user's access logs and file activity. 2. Check for unusual patterns like bulk data downloads or after-hours logins. 3. Coordinate with HR and Legal to ensure compliance with privacy laws. 4. Use DLP tools to monitor their outbound data. 5. Maintain a strict chain of custody for any evidence found.

1. Identify all instances of the software in the environment. 2. Check the vendor for official workarounds or temporary fixes. 3. Disable the affected service if not mission-critical. 4. Monitor logs specifically for exploitation attempts related to the vulnerability. 5. Apply the patch as soon as it is released.

1. Prioritize external-facing systems (Web servers, VPNs). 2. Group by CVSS score (Critical/High first). 3. Factor in the importance of the data on the system. 4. Address systems with publicly available exploit code first. 5. Create a remediation timeline and report progress to management.

1. Identify the technical gap that allowed the bypass. 2. Close the gap immediately. 3. Interview the user to understand if it was malicious intent or just 'trying to get work done.' 4. Provide remedial security training. 5. Update the security policy if the control was causing significant business friction.

1. Identify the specific rule triggering the false positives. 2. Analyze the 'noisy' legitimate traffic. 3. Tune the rule parameters (e.g., exclude certain IPs or change thresholds). 4. If the tool is consistently unreliable, consider a different detection logic or a different vendor.

1. Prioritize high-impact gaps. 2. Implement 'Quick Wins' (e.g., changing default passwords, enabling logs). 3. Document any gaps that cannot be fixed in time as 'Accepted Risk' with a future remediation plan. 4. Brief management on the expected audit findings.

1. Identify what data of yours the vendor handles. 2. Check if your connection to their network is compromised. 3. Disable any shared access or API keys. 4. Request an official incident report from the vendor. 5. Inform your legal and PR teams if your customers' data was involved.

1. Identify the malicious process consuming high CPU/GPU. 2. Kill the process and delete the binary. 3. Find the entry point (usually a web exploit or weak SSH password). 4. Patch the vulnerability. 5. Scan all other servers for the same indicators.

1. Isolate the account immediately. 2. Review the activity logs (what commands were run? what data was accessed?). 3. Verify if the activity was authorized but poorly documented. 4. If unauthorized, identify the person behind the keyboard. 5. Re-evaluate the 'Separation of Duties' for that role.

1. Isolate the device into a restricted VLAN. 2. Capture its network traffic to see where it's communicating. 3. Check for default credentials or unpatched firmware. 4. Disable the device if it's contacting known malicious IPs. 5. Implement strict outbound firewall rules for all IoT devices.

1. Review the account termination checklist. 2. Disable the Active Directory account, VPN access, and SaaS accounts immediately. 3. Review logs for any activity after their departure date. 4. Revoke any physical badges. 5. Update the 'Offboarding' procedure to ensure this doesn't happen again.

1. Maintain the 'Crown Jewels' (data protection and critical servers). 2. Keep regulatory compliance tools (to avoid fines). 3. Focus on high-impact, low-cost items like security awareness and MFA. 4. Delay new projects or luxury features. 5. Re-negotiate vendor contracts.

1. Perform a 'Gap Analysis' to see what you're missing. 2. Define a project timeline and budget. 3. Update internal policies and procedures. 4. Implement necessary technical controls. 5. Perform a mock audit to verify compliance before the official deadline.