🛡️ Stuff Every Security Pro Should Know: Training Guide

Core security properties and access control

Confidentiality is about keeping information readable only by authorized people. Encryption protects confidentiality because a thief without the key sees scrambled data.

Integrity means information is not improperly modified or destroyed. A changed file gives a different hash value, so a mismatch reveals tampering.

Availability means authorized users can get timely, reliable access to information and services. A denial of service attack targets availability by preventing access.

NIST treats non-repudiation and authenticity as part of integrity. A digital signature gives non-repudiation because the signer cannot later deny signing.

Access control has three steps: authentication proves who you are, authorization grants access, and accounting records what you did.

Least privilege gives each user only the access needed for assigned tasks. This limits damage if an account is stolen or misused.

Zero trust and security controls

Zero trust treats no user or device as safe just because it is inside the network or owned by the organization. Access requests are checked each time using identity, device condition, and surrounding context.

In NIST zero trust, the policy engine makes the final access decision. The policy administrator sets up or tears down the session, and the enforcement point opens and closes the connection.

Controls are described by category and type. Categories include technical, managerial, operational and physical. Types include preventive, deterrent, detective, corrective, compensating and directive.

A compensating control is an alternative that gives equivalent or comparable protection when the normal required control cannot be used.

Hardening starts with patching and then removing or disabling unnecessary services, applications and network protocols. A minimal install leaves fewer ways in.

An application allow list permits only approved applications and blocks everything else by default. A honeypot is a decoy system designed to attract attackers, so any traffic to it is suspicious.

Governance, risk, and organizational programs

Policies state broad goals. Standards and guidelines specify technologies and methods. Procedures give detailed step-by-step instructions for a security task.

Separation of duties splits a sensitive task among different people, such as creating and approving payments. This makes fraud harder because two or more people must work together.

Risk combines how likely something bad is with how much harm it would do. A likely but trivial event and an unlikely but catastrophic one can both be notable risks.

Buying cyber insurance is a risk transfer response. The attack can still happen, but the financial burden shifts to the insurer.

Risk appetite is the broad amount of risk an organization is willing to accept. Risk tolerance is narrower and describes acceptable variance at a program or system level.

FIPS 199 uses three potential impact levels: Low means limited harm, Moderate means serious harm, and High means severe or catastrophic harm.

Organization-wide programs

NIST CSF 2.0 organizes cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern sits at the center and informs the other five.

Cybersecurity supply chain risk management is a systematic enterprise-wide process for managing risk across vendors and suppliers.

Security awareness is not a once-a-year event. Short reminders for all users, such as messages on logon screens, help keep security in mind every day.

People and phishing

An insider threat already has authorized access to the organization's systems. Insiders can cause harm on purpose or by accident.

Social engineering tricks a person into revealing information or taking a harmful action by exploiting trust, urgency and helpfulness.

Spearphishing targets a specific person, company or industry using real names and roles. It is harder to spot than mass phishing.

Vishing is phishing over a phone call or voicemail. Attackers may pretend to be a bank, vendor, or help desk and press you to act fast. To stay safe, hang up and call back using a number you know is real.

A watering hole attack compromises a website that a target group often visits. Visitors then get infected just by browsing.

Typosquatting registers a domain that looks like a real one, such as a near-miss spelling or a different top-level domain. Attackers also use homoglyph lookalikes. Check the exact address before you trust a site.

Malware types

A virus spreads by inserting copies of itself into host programs or data files. It is often triggered when someone opens a file or runs a program.

A worm is self-contained and spreads across a network on its own, without user action. It does not need a host file.

A Trojan horse looks like a useful program but has a hidden malicious purpose and does not replicate. The victim installs it.

A rootkit hides the presence of malware by intercepting or hooking operating system calls. It can hide files, processes and connections.

A logic bomb is code intentionally hidden in software that triggers a malicious action when specified conditions are met, such as a date or deleted record.

Ransomware encrypts files and demands payment for the decryption key. Tested offline backups let you restore data without paying.

Web application attacks

SQL injection inserts SQL query text into an input field that the application runs. Successful attacks can read, change or delete data.

Cross-site scripting injects malicious scripts into otherwise trusted websites so they run in other users' browsers.

Cross-site request forgery forces a logged-in user's browser to perform an unwanted action. The attacker often sends a link by email or chat.

Path traversal uses sequences like ../ to reach files outside the web application's folder, such as configuration files or source code.

Network and traffic attacks

A replay attack captures valid login data and sends it again later to impersonate a user. Nonces, timestamps and one-time values make old messages useless.

An on-path attack positions the attacker between two devices to sniff or change traffic. TLS and certificate checks help make the attack visible.

In a reflection DDoS attack, attackers send packets with the victim's spoofed source address to third-party reflectors. The replies flood the victim.

Impossible travel is an indicator of compromise when one account shows activity from two distant locations in too short a time.

Vulnerability scoring and patching

CVSS labels a Base Score of 9.0 to 10.0 as Critical. Qualitative labels like Medium and High help teams prioritize patches.

CVSS v4.0 has four metric groups: Base, Threat, Environmental and Supplemental. The Threat group changes over time, such as when exploit code appears.

The Attack Vector metric scores highest when the attacker can be anywhere on the internet, called Network. Physical access scores lowest.

Supplemental metrics such as Safety and Automatable add context but never change the numeric CVSS score.

If a legacy device cannot be patched, NIST suggests isolating it or applying other compensating mitigations.

Encryption, hashing, and signatures

AES is a symmetric cipher, so the same key encrypts and decrypts. It supports key lengths of 128, 192 and 256 bits and works on 128-bit blocks.

SHA-256 turns any input into a fixed 256-bit message digest. A different input can produce a different digest, which helps detect changes.

MD5 is not prudent to use when collision resistance is required because published attacks allow two different inputs to share the same hash.

A digital signature uses the signer's private key and provides non-repudiation, origin authentication and data integrity. Anyone can verify it with the signer's public key.

Certificates and keys

A Trusted Platform Module is a tamper-resistant chip on a motherboard that generates and stores cryptographic keys inside hardware.

A certificate signing request holds the public key and the name to be certified, and is signed with the matching private key. The private key never leaves your system.

A certificate revocation list is a signed, time-stamped list of revoked certificates. Clients check it before trusting a certificate.

OCSP lets software check the revocation status of one certificate online, providing more timely information than a periodically published CRL.

Certificates in use and tamper evidence

A wildcard certificate for *.example.com matches www.example.com but not a.b.example.com. The wildcard must be the complete left-most label and covers only one label.

TLS 1.3 removed static RSA and static Diffie-Hellman key exchange. Every public-key key exchange now provides forward secrecy, and most handshake messages are encrypted.

A blockchain links each block to the one before it with the previous block header's hash. This makes the chain tamper evident and tamper resistant.

Password storage and online guessing

Adding a unique random salt to each password before hashing defends against rainbow tables. Without a salt, two users with the same password get the same stored hash.

NIST requires a salt of at least 32 bits. The salt value and the resulting hash are both stored for each password.

Password storage should use slow, tunable hashing algorithms such as Argon2id, bcrypt or PBKDF2. Plain SHA-256 is not suitable because it is fast.

Rate limiting or throttling limits how many failed login attempts can be made against an account. This slows online guessing and helps stop attackers from testing many passwords quickly.

Credential stuffing uses stolen username and password pairs from one breach against other websites. Unique passwords and MFA stop it.

Password spraying tries one common password against many different accounts. Spreading attempts helps attackers avoid lockouts on a single account.

NIST password rules

Under NIST SP 800-63B-4, a password used as the only factor must be at least 15 characters. When it is one piece of multi-factor authentication, eight characters is the minimum.

NIST says not to impose composition rules such as requiring symbols, digits and capitals. It prefers longer passwords, blocklists and MFA.

NIST also says verifiers must allow password managers and autofill, and should not force regular password changes without a reason.

Authentication protocols and one-time codes

TACACS+ is used for network device administration and runs over TCP port 49.

Kerberos servers, called KDCs, listen on port 88 by default. They hand out tickets so users can prove who they are without sending passwords around.

TOTP authenticator apps compute a new one-time code from the time and a shared secret. The default time step is 30 seconds.

Cloud service models and shared responsibility

In IaaS you rent computing, storage and networking, then install and manage your own operating system and software. The provider runs the physical hardware and hypervisor.

In PaaS you deploy your app without managing servers or the operating system. The provider runs the runtime and OS underneath.

In SaaS you sign in and use ready-made apps such as Microsoft 365. The provider runs nearly everything, but you still handle app settings, user access and your own data.

A hybrid cloud mixes two or more distinct cloud types, such as a private cloud plus a public cloud. Cloud bursting spills extra load into the public cloud.

Under Microsoft's shared responsibility model, the customer always owns and must protect data and identities in every deployment type.

Network architecture and device protection

RFC 1918 reserves 172.16.0.0 to 172.31.255.255 for private networks. These addresses are only unique inside one enterprise.

A DMZ is a separate network segment off the firewall, commonly used for public-facing web and email servers. If a public server is compromised, the internal network is still separated by the firewall.

Operational technology networks should not be reachable directly from the corporate network. NIST recommends a DMZ between the corporate and OT networks.

A deny-by-default firewall rule set blocks all traffic that has not been expressly permitted. NIST says this should apply to inbound and outbound traffic.

An intrusion detection system watches and alerts. An intrusion prevention system can also attempt to stop possible incidents, such as dropping malicious packets.

NIST media sanitization defines Clear, Purge and Destroy. Clear and Purge leave media reusable, while Destroy ruins the media so it cannot store data. Do not use degaussing on flash storage such as SSDs.

Logging, email authentication, and incident forensics

Syslog severity runs from 0 to 7, and lower numbers are worse. Severity 0 means Emergency, when the system is unusable.

NTP keeps log source clocks consistent so events from different systems can be correlated in time. Accurate timestamps help analysts reconstruct an attack.

A SIEM gathers logs in one place and analyzes them to generate alerts. It can spot patterns no single log would reveal.

A DMARC record with p=reject tells receiving mail systems that failing mail should be rejected. p=none expresses no preference and p=quarantine marks mail suspicious.

NIST's classic incident response phases are Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. After an incident, a lessons learned meeting reviews what worked and what to change.

When collecting live evidence, capture volatile data first and do not shut down the system until collection is complete. Do not trust programs already on the compromised system; run your tools from protected media. Document who handled evidence and use a write-blocker so the original media is not changed. NIST's forensic process phases are collection, examination, analysis and reporting.

Continuity and recovery

A business impact analysis identifies and prioritizes systems critical to supporting mission and business processes. Its results drive recovery priorities and objectives like RTO.

The Recovery Time Objective measures the maximum downtime before the impact is unacceptable.

The Recovery Point Objective describes the point in time to which data must be recoverable. If backups run nightly, you may lose up to a day of data.

A system's Recovery Time Objective must be shorter than its Maximum Tolerable Downtime. Recovery has to finish before the business cannot accept any more outage.

To restore from differential backups, you need the full backup and the latest differential. Incremental backups need the whole chain.

A hot site is already fully equipped and ready to take over, so failover is fast. That speed costs more than a cold site. A tabletop exercise is a discussion-based walkthrough that validates the plan before a real incident. Rules of engagement give a penetration test team authority and boundaries.