Chapter 1

Cybersecurity Fundamentals

• Cybersecurity programs aim to protect all connections and organizational data, regardless of storage or transmission.
• Cybersecurity concepts include the difference between threats, vulnerabilities, and exploits.
• Common threats include viruses, Trojans, DoS/DDoS attacks, phishing, rootkits, man-in-the-middle attacks, SQL injection, and cross-site scripting.
• Common software and hardware vulnerabilities include weak or hardcoded passwords, software bugs, missing encryption, buffer overflows, and path traversal.
• The CIA triad (Confidentiality, Integrity, Availability) defines security policies to protect assets.
• Cloud security threats include data breaches, insecure APIs, DoS attacks, and compromised credentials.
• IoT (Internet of Things) security threats include device vulnerabilities, lack of security features, and physical access issues.
• Digital forensics and incident response (DFIR) involves understanding digital evidence and responding to security incidents.

"Do I Know This Already?" Quiz

• The quiz assesses prior knowledge of the chapter's topics, helping determine if the entire chapter or relevant sections should be read.
• Questions cover introduction to cybersecurity, definitions, common threats, vulnerabilities, CIA triad, cloud security, and IoT security.

Technical Questions

• A threat is any potential danger to an asset.
• A vulnerability is a weakness in system design, implementation, software, code, or a missing mechanism
• An exploit is a piece of software, tool, or process that takes advantage of a vulnerability.
• Malware attack mechanisms include Master Boot Record, File Infector, Macro Infector, etc.
• Vulnerability is identified by a CVE (Common Vulnerabilities and Exposures) identifier.
• SQL injection attacks can be blind, out-of-band, or in-band.
• A web application vulnerability occurs when a flaw is in a web application targeting an end user.
• A denial-of-service attack impacts availability.
• Security mechanisms like encryption, controlled traffic routing, and access controls preserve confidentiality.
• Cloud deployment models include public, private, community, and hybrid.

Risk, Assets, Threats, and Vulnerabilities

• Risk is the probability a threat will manifest.
• An asset has economic value to an individual or organization.
• A threat actor is an individual or group responsible for security incidents.
• Natural disasters, user attacks, and disclosure of confidential information threaten systems.

Defining Threat Actors

• Script kiddies use existing tools to attack systems.
• Organized crime groups aim to steal information and make money.
• State-sponsored actors steal data or conduct political attacks.
• Hacktivists perform attacks to promote a cause.
• Terrorist groups perform attacks based on political or religious beliefs.

Threats, Vulnerabilities, and Exploits

• A security threat is any potential danger to an asset.
• Security vulnerabilities include flaws in systems, software, or code.
• An exploit takes advantage of a vulnerability during a security breach.

Viruses and Worms

• Viruses need an existing program to infect; Worms can spread independently.
• Spyware, a type of malware, steals information without user acknowledgement.
• Malware uses several propagation methods including master boot record infection, BIOS infection, file infection, and macro infection.

Malware Payloads

• Malware may overwrite parts of an infected file, put the code at the beginning or end, or prepender or appender.
• Malware detection is increasingly challenging due to the variety of techniques used to obfuscate code, encrypt, and make malicious code undetectable by antivirus software.

Trojan Types

• Remote Access Trojans (RATs) give attackers complete control over the system.
• Data hiding Trojans hide the data, usually involving ransom payments for release.
• Banking Trojans steal banking information.
• Denial-of-Service (DoS) Trojans disrupt services by overwhelming them.
• Proxy Trojans mask attackers' identity.
• FTP Trojans allow malicious file transfer.

Cloud Security Threats

• Cloud security threats include data breaches, insecure APIs, DoS attacks, and privilege escalation.

IoT Security Threats

• IoT device vulnerabilities, lack of security features, compromised credentials, and physical access.

Incident Response

• Incident response addresses security incidents, providing a predictable and managed response.
• Incident response plans (IRPs), policies, procedures, and personnel are components of a response program.
• Incident classification and handling, information classification and protection, record retention and destruction, and acceptable usage of encryption are all important considerations during incident response.

Incident Response Teams

• CSIRT (Computer Security Incident Response Team) is responsible for investigating and resolving computer security incidents.
• PSIRT (Product Security Incident Response Team) handles security vulnerabilities in products or services.

Common Vulnerability Scoring Systems (CVSS)

• CVSS provides a standardized method for scoring vulnerabilities based on the severity, such as base, temporal, and environmental aspects for analysis.

Security Vulnerabilities in Open-Source Software

• Open-source software vulnerabilities frequently require urgent attention, so organizations and individuals routinely update software and tools.

Digital Forensics and Incident Response (DFIR)

• Digital evidence preservation ensures evidence integrity from collection through presentation in a court of law.
• Digital forensics and incident response methodologies involve policies, plans, procedures, and personnel.