Study notes covering Security Concepts.
📖 Useful Vocabulary / Acronyms
| Terminology | Definition |
|---|---|
| SOC | Security Operations Center – A centralized team that monitors, detects, and responds to security incidents in an organization. |
| DevOps | Development + Operations – A collaborative approach to software development and IT operations. |
| DevSecOps | Development + Security + Operations – Extends DevOps by integrating security practices throughout the development lifecycle. |
| CIRT | Computer Incident Response Team – A group that responds to computer security incidents within an organization. |
| CSIRT | Computer Security Incident Response Team – Similar to CIRT, but emphasizes broader security incident handling. |
| CERT | Computer Emergency Response Team – A specialized group that handles and coordinates responses to major security incidents. |
| Assets | Anything of value to an organization (data, systems, hardware, software, people). |
| Threats | Any potential danger that could exploit a vulnerability and cause harm. |
| Threat Agents | Entities (human or non-human) that carry out threats, such as hackers, insiders, or malware. |
| Vulnerability | A weakness in a system, process, or control that can be exploited by a threat. |
| Insider Threats | Security risks that originate from within the organization (employees, contractors, partners). |
| Threat Actor | Any individual or group responsible for a malicious action or attack. |
| Service Disruption | An event that interrupts or degrades the normal operation of services (e.g., DoS attack). |
| Data Exfiltration | Unauthorized transfer of data from a system, often by attackers. |
| Hacker | A person who uses technical skills to gain unauthorized access to systems. Motivations may vary. |
| Hacktivist | A hacker motivated by political, social, or ideological reasons. |
| APT (Advanced Persistent Threat) | A prolonged and targeted cyberattack where an intruder gains and maintains access to a network. Typically state-sponsored. |
| Nation-State Actors | Government-backed hackers with significant resources, often focused on espionage or disruption. |
| Shadow IT | Hardware, software, or services used within an organization without official approval. |
| Lure | A social engineering tactic used to trick users into taking an unsafe action. |
| Supply Chain | The network of organizations, people, and processes involved in delivering products or services — a frequent attack target for inserting vulnerabilities. |
🔑 CIA Triad
Confidentiality – Protect data from unauthorized access.
Integrity – Ensure data is accurate, unchanged, and reliable.
Availability – Ensure data/resources are accessible when needed, without compromising confidentiality or integrity.
🔗 Lockheed Martin Cyber Kill Chain
- Reconnaissance – Gather information on the target.
- Weaponization – Develop malware/attack payload.
- Delivery – Send the payload to the target.
- Exploitation – Execute the attack and exploit a vulnerability.
- Installation – Install malware/backdoor.
- Command & Control (C2) – Establish communication with attacker.
- Actions on Objectives – Achieve attacker’s goals (data theft, disruption, etc.).
👤 Threat Actor Types
- Easy Money – Quick-profit attacks.
- Smash-and-Grab – Fast, noisy attacks.
- Automated – Botnets or scripts conducting attacks.
🎯 Targeted Attacks
- Dangerous – Can cause severe damage.
- Methodical – Planned and precise.
- APT Tactics – Persistent, stealthy, and resourceful.
- Sophisticated – Advanced techniques and tools.
🕵️ Insider Threats
- Often overlooked but dangerous.
- May act out of personal vendetta or bribery.
- Prevention: monitoring, training, access control.
⚠️ Unintentional Threat Actors
- Everyday users making mistakes.
- Lack of awareness or training.
- Can be anyone in the organization.
💻 Hackers
- Seek access to protected information.
- Motivations: attention, bragging rights, thrills.
🐱 Script Kiddies
- Unskilled attackers using pre-made tools.
- Sometimes part of hacker groups or hacktivist movements.
💼 Organized Crime
- Operate across different jurisdictions.
- Difficult legal prosecution.
- Common goals: fraud, blackmail, financial gain.
🏢 Competitors
- Industrial espionage.
- Theft or disruption for competitive advantage.
🌍 Nation-State Threat Actors
- Highly sophisticated, well-funded.
- Focused on espionage, disruption, or geopolitical influence.