course | CompTIA CySA+Cybersecutiy Analyst

Threat Management

 

Given a scenario, apply environmental reconnaissance techniques using appropriate tools and processes

Procedures/common tasks: 
 

• Topology discovery 
• OS fingerprinting 
• Service discovery 
• Packet capture 
• Log review 
• Router/firewall ACLs review 
• Email harvesting 
• Social media profiling 
• Social engineering 
• DNS harvesting 
• Phishing
   

Variables: 
 

• Wireless vs. wired 
• Virtual vs. physical 
• Internal vs. external 
• On-premises vs. cloud
   

Tools:
 

• NMAP 
• Host scanning 
• Network mapping 
• NETSTAT 
• Packet analyzer 
• IDS/IPS 
• HIDS/NIDS 
• Firewall rule-based and logs 
• Syslog 
• Vulnerability scanner
   

Given a scenario, analyze the results of a network reconnaissance

Point-in-time data analysis: 
 

• Packet analysis 
• Protocol analysis 
• Traffic analysis 
• Netflow analysis 
• Wireless analysis
   

Data correlation and analytics: 
 

• Anomaly analysis 
• Trend analysis 
• Availability analysis 
• Heuristic analysis 
• Behavioral analysis
   

Data output: 
 

• Firewall logs 
• Packet captures 
• NMAP scan results 
• Event logs 
• Syslogs 
• IDS report
   

Tools: 
 

• SIEM 
• Packet analyzer 
• IDS 
• Resource monitoring tool 
• Netflow analyzer
   

Given a network-based threat, implement or recommend the appropriate response and countermeasure

Network segmentation: 
 

• System isolation 
• Jump box
• Honeypot
• Endpoint security
• Group policies
   

ACLs:
 

• Sinkhole
   

Hardening: 
 

• Mandatory Access Control (MAC) 
• Compensating controls 
• Blocking unused ports/services 
• Patching
   

Network Access Control (NAC): 
 

• Time-based 
• Rule-based 
• Role-based
• Location-based
   

Explain the purpose of practices used to secure a corporate environment

Penetration testing: 
 

• Rules of engagement
   

Reverse engineering: 
 

• Isolation/sandboxing 
• Hardware 
• Software/malware
   

Training and exercises: 
 

• Red team 
• Blue team 
• White team
   

Risk evaluation: 
 

• Technical control review 
• Operational control review 
• Technical impact and likelihood

Vulnerability Management
 

Given a scenario, implement an information security vulnerability management process

Identification of requirements: 
 

• Regulatory environments 
• Corporate policy 
• Data classification 
• Asset inventory
   

Establish scanning frequency: 
 

• Risk appetite 
• Regulatory requirements 
• Technical constraints 
• Workflow
   

Configure tools to perform scans according to the specification: 
 

• Determine scanning criteria 
• Tool updates/plug-ins 
• Permissions and access
• Execute scanning
   

Generate reports: 
 

• Automated vs. manual distribution
   

Remediation:
 

• Prioritizing
• Communication/change control
• Sandboxing/testing
• Inhibitors to remediation
• Ongoing scanning and continuous monitoring
   

Given a scenario, analyze the output resulting from a vulnerability scan

Analyze reports from a vulnerability scan: 
 

• Review and interpret scan results
• Validate results and correlate other data points 
• Compared to best practices or compliance 
• Reconcile results 
• Review related logs and/or other data sources 
• Determine trends
• Compare and contrast common vulnerabilities found in the following targets within an organization
• Servers
• Endpoints
• Network infrastructure
• Network appliances
   

Virtual infrastructure:
 

• Virtual hosts
• Virtual networks
• Management interface
• Mobile devices
• Interconnected networks
• Virtual private networks (VPNs)
• Industrial Control Systems (ICSs)
• SCADA devices

Cyber Incident Response

 

Given a scenario, distinguish threat data or behavior to determine the impact of an incident

Threat classification: 
 

• Known threats vs. unknown threats 
• Zero day 
• Advanced persistent threat
• Factors contributing to incident severity and prioritization: 
• Scope of impact
• Types of data
• Given a scenario, prepare a toolkit and use appropriate forensics tools during an investigation
   

Forensics kit: 
 

• Digital forensics workstation 
• Write blockers 
• Cables 
• Drive adapters 
• Wiped removable media 
• Cameras 
• Crime tape 
• Tamper-proof seals 
• Documentation/forms
   

Forensic investigation suite:
 

• Imaging utilities 
• Analysis utilities 
• Chain of custody 
• Hashing utilities 
• OS and process analysis 
• Mobile device forensics 
• Password crackers 
• Cryptography tools 
• Log viewers
   

Explain the importance of communication during the incident response process

Stakeholders:
 

• HR
• Legal
• Marketing
• Management
   

Purpose of communication processes:
 

• Limit communication to trusted parties
• Disclosure based on regulatory/legislative requirements
• Prevent inadvertent release of information
• Secure method of communication
   

Role-based responsibilities:
 

• Technical 
• Management 
• Law enforcement 
• Retain incident response provider
   

Given a scenario, analyze common symptoms to select the best course of action to support incident response

Common network-related symptoms:
 

• Bandwidth consumption
• Beaconing
• Irregular peer-to-peer communication
• Rogue devices on the network
• Scan sweeps
• Unusual traffic spikes
   

Common host-related symptoms:
 

• Processor consumption
• Memory consumption
• Drive capacity consumption
• Unauthorized software
• Malicious processes
• Unauthorized changes
• Unauthorized privileges
• Data exfiltration
   

Common application-related symptoms:
 

• Anomalous activity 
• Introduction of new accounts 
• Unexpected output 
• Unexpected outbound communication 
• Service interruption 
• Memory overflows
• Summarize the incident recovery and post-incident response process
   

Containment techniques:
 

• Segmentation
• Isolation
• Removal
• Reverse engineering
   

Eradication techniques:
 

• Sanitization 
• Reconstruction/reimage 
• Secure disposal
   

Validation:
 

• Patching
• Permissions
• Scanning
• Verify logging/communication to security monitoring
   

Corrective actions:
 

• Lessons learned report
• Change control process
• Update the incident response plan
• Incident summary report

Security Architecture and Tool Sets
 

Explain the relationship between frameworks, common policies, controls, and procedures

Regulatory compliance
 

Frameworks:
 

• NIST
• ISO
• COBIT
• SABSA
• TOGAF
• ITIL
   

Policies:
 

• Password policy
• Acceptable use policy
• Data ownership policy
• Data retention policy
• Account management policy
• Data classification policy
   

Controls:
 

• Control selection based on criteria
• Organizationally defined parameters
• Physical controls
• Logical controls
• Administrative controls
   

Procedures: 
 

• Continuous monitoring 
• Evidence production 
• Patching 
• Compensating control development 
• Control testing procedures 
• Manage exceptions 
• Remediation plans
   

Verifications and quality control: 
 

• Audits 
• Evaluations
• Assessments
• Maturity model
• Certification
   

Given a scenario, use data to recommend remediation of security issues related to identity and access management

Security issues associated with context-based authentication:
 

• Time
• Location
• Frequency
• Behavioral
   

Security issues associated with identities:
 

• Personnel
• Endpoints
• Servers
• Services
• Roles
• Applications
   

Security issues associated with identity repositories:
 

• Directory services
• TACACS+
• RADIUS
   

Security issues associated with federation and single sign-on:
 

• Manual vs. automatic provisioning/deprovisioning
• Self-service password reset
   

Exploits:
 

• Impersonation
• Man-in-the-middle
• Session hijack
• Cross-site scripting
• Privilege escalation
• Rootkit
   

Given a scenario, review security architecture and make recommendations to implement compensating controls
 

Security data analytics:
 

• Data aggregation and correlation
• Trend analysis
• Historical analysis
   

Manual review: 
 

• Firewall log 
• Syslogs 
• Authentication logs 
• Event logs
   

Defense in depth:
 

• Personnel
• Processes
• Technologies
• Other security concepts

Security Architecture and Tool Sets (continuation)
 

Given a scenario, use application security best practices while participating in the Software Development Life Cycle (SDLC)

Best practices during software development:
 

• Security requirements definition
• Security testing phases
• Manual peer reviews
• User acceptance testing
• Stress test application
• Security regression testing
• Input validation
   

Secure coding best practices:
 

• OWASP
• SANS
• Center for Internet Security
   

Compare and contrast the general purpose and reasons for using various cybersecurity tools and technologies

Preventative:
 

• IPS
• HIPS
• Firewall
• Antivirus
• Anti-malware
• EMET
• Web proxy
• Web Application Firewall (WAF)
   

Collective:
 

• SIEM
• Network scanning
• Vulnerability scanning
• Packet capture
• Command line/IP utilities
• IDS/HIDS
   

Analytical:
 

• Vulnerability scanning
• Monitoring tools
• Interception proxy
   

Exploit:
 

• Interception proxy
• Exploit framework
• Fuzzers
   

Forensics:
 

• Forensic suites
• Hashing
• Password cracking
• Imaging