Cyber Threat Landscape and Cyber Attacks

Cyber Threat Landscape and Cyber Attacks

8.1 The Exam Blueprint and Today's Roadmap

8.1.1 The Exam Pattern

This session opened with the exam blueprint, because every topic that follows needs to be studied with the exam format in mind. The syllabus for the internal examination covers chapters 1 through 4 only, and the topics on the four chapter handouts cover roughly 99% of what you need — you will not be tested beyond them.

The exam is worth 30 marks. The pattern is five questions, each carrying six marks:

$$5\times 6=30$$

The professor splits the five questions into three theoretical questions and two scenario based questions. The scenario questions present a situation — an attack that happened, a framework being followed — and ask you to explain what the threat is, which vulnerability caused it, or which part of a framework applies. Exam note: expect the practical questions to test how you apply the knowledge from all four chapters, not recall.

There is one more structural detail worth noting. Out of the four chapters, one theory question comes from each chapter, which means one chapter will not have a theory question. The stated breakdown is 70% theoretical and 30% practical — three theoretical and two scenario questions out of five is a 60/40 split, which does not match the 70/30 numbers exactly. Both figures are preserved exactly as the professor stated them, with the arithmetic spelled out so the conflict is visible rather than silently "fixed": three of five questions is 60%, and two of five is 40%, so the 70/30 percentages and the 3-of-5 plus 2-of-5 question counts cannot both be true at once. The five-question pattern is the reliable one to study from; if the percentages appear in an exam answer, say the pattern is three theoretical and two scenario questions — the counts are what the question paper will follow.

The answers are written by hand and the exam is closed book, the same mode used in the other subjects. Whether you draw figures or diagrams is entirely up to you — you choose how to present so that the person evaluating your paper is impressed. The real objective is showing that you understand the topic and can present the expected answer. Exam note: presentation choices are free marks, so write in a way that shows your understanding.

8.1.2 The Course Schedule and Where the Marks Live

The marks for this subject live in more than one place, and the professor separated them deliberately so students do not mix up the weights:

• Quiz one is done and carries a 5% weightage.
• Quiz two will come after chapter five is finished, covering the remaining topics.
• The competency examination is worth 50 marks.
• The internal exam itself sits in the schedule after the chapter five content.

Exam note: keep the quiz and competency weights separate in your mind — quiz one at 5%, the internal exam at 30 marks with the five-question pattern, and the competency examination at 50.

8.1.3 Assignments: Timing Advice

Assignments carry marks that are tagged to them, and the marks are uploaded by the end of the following week so the internal assessment records are complete. The practical advice is simple: complete your assignments before the syllabus is finished. That is the ideal time so you do not lose assignment marks unnecessarily. There is no per-assignment deadline; the goal is simply to have everything submitted before the course content ends.

8.1.4 Student Questions About the Exam Setup

8.2 The Threat Landscape

8.2.1 What "Threat Landscape" Means

A threat landscape (the full set of possible threats that an organization must consider) is evaluated against the given context. The context is everything about your environment: the organization's network, its servers, its databases, its infrastructure, and its endpoint machines — whether they run Windows and which version, or macOS and which version. All of this information is gathered so you can understand the risks and vulnerabilities that could affect the organization.

Why consider all that context? Because the same threat means different things on different setups. The landscape is not an abstract list of attacks; it is the answer to the question "which of these threats can actually hurt this organization, with this configuration?" Evaluating every possible threat in context is the definition that matters for this course.

8.2.2 Threat Landscape, Threat Modeling, and Threat Intelligence — Three Different Ideas

The terms threat landscape, threat modeling, and threat intelligence are easy to mix up, and the class spent time separating them:

• Threat intelligence is about gaining information. You constantly check for all possible threats that could happen to your network or infrastructure, gathering that information from different sources — open source such as OSINT, or paid resources you purchase. Once you know the intelligence, you examine your own infrastructure: are we prone to these attacks? Do we have enough controls? Do existing controls need improvement? Do we need new controls? Those discussions follow from the intelligence.
• Threat modeling is about identifying the threats to a specific target system. You model, or name, the threats that can happen to that system, then reason about them.
• Threat landscape is the scenario in which attacks can happen — the field of possible threats combined with your environment.

The three ideas differ in what each one does with threats, as the comparison shows:

Real-world: OSINT (open source intelligence) is a concrete example of a threat intelligence source; companies also buy paid threat feeds to get richer data.

8.2.3 Why Attackers Attack: The CIA Objective

Every threat actor, from whatever source, ultimately aims to impact the CIA triad:

• Confidentiality — protecting data from unauthorized reading or access. A confidentiality breach means someone who should not see the data has seen it.
• Integrity — ensuring there is no unauthorized modification of data. An integrity breach means data has been changed, and you can no longer trust it.
• Availability — keeping systems and services reachable by legitimate users. An availability breach means the service exists but the people entitled to use it cannot reach it.

Making availability "down" means ensuring legitimate users cannot access the business services they need. Attackers do this by making the server busy — for example a denial of service (DoS) attack from a single system, or a distributed denial of service (DDoS) attack launched from multiple systems at once. The overall objective of the actors is always some impact on the CIA triad.

8.2.4 Risk and the Four Ways to Respond to Risk

Risk is a combined calculation: the probability of a threat exploiting a vulnerability, multiplied by the impact once the exploitation succeeds:

$$\text{Risk}=\mathrm{Pr}(\text{threat exploits vulnerability})\times \text{Impact}$$

The professor described risk verbally as "the probability of your threat exploiting the vulnerability and once it has been exploited successfully then how much is the impact" — the multiplication is the standard way to combine likelihood and impact, and it matches the reference treatment: risk equals the probability of the threat occurring times the cost of the loss to the organization. The landscape exists so this risk becomes visible and manageable.

In words, the formula says: a threat that almost never succeeds gives low risk even if the impact would be severe, and a threat with small impact gives low risk even if it happens often. Both the probability and the impact have to be high for the risk to be high.

Risk management has stages: first risk identification — find the risk; then risk assessment — measure how big it is; then risk response — decide what to do. There are exactly four ways to respond to a risk, and the class worked through them:

1. Risk transfer — move the risk elsewhere, for example by opting for insurance. The risk still exists, but someone else carries the financial loss.
2. Risk mitigation — reduce the risk by implementing the necessary compensating controls so it stays within your acceptable level, your risk appetite.
3. Risk avoidance — stop the action or transaction that creates the risk. The risk disappears because the activity disappears.
4. Risk acceptance — accept the risk when nothing can be changed and the business must continue anyway. The risk is consciously retained and evaluated against the business case.

The health checkup analogy ties the four responses together. When you do a health checkup you learn your health risks. If you are overweight, you mitigate by following a diet plan — that is implementing compensating controls to bring risk within acceptable range. If your cholesterol is too high because of certain food, you avoid that food — risk avoidance. If age increases the chance of a heart attack, you transfer the financial risk by buying a one crore or two crore insurance policy so your dependents are protected. And the last case: a business whose job is delivering goods from home to home always faces the risk that a delivery person meets with an accident. Can the business stop doing business? No — it accepts the risk and evaluates it against the return on investment and the controls already implemented. These are the four methods: mitigate with compensating controls, transfer with insurance, avoid by stopping the activity, accept because the business must go on.

Exam note: when a question offers controls to choose from, remember this full set — students in the session kept repeating "avoid" and forgot acceptance, the fourth option.

8.2.5 The Growing Attack Surface

The attack surface is the set of chances we give attackers to exploit us. The class discussed metrics shared by a top vendor showing how the cyber attack surface keeps increasing: more smartphones, more IP connected devices, more data being transferred. Each of these adds exposure. The more surface you expose, the more opportunities exist for a threat to exploit a vulnerability.

8.2.6 The Controls We Use: Categories and Functions

To protect against the landscape, an organization must build a proactive strategy out of controls. Controls are classified in two independent ways — the two classifications answer different questions, so a single control has both a category and a function.

By category, there are three types:

• Technical controls — using technology to implement the control.
• Physical controls — something you can see physically.
• Administrative controls — organization policies and procedures.

By function, a control can be:

• Preventive — stops something from happening in the first place.
• Detective — detects something after it happens, as early as possible.
• Deterrent — makes the person attempting an attack afraid, discouraging them.
• Corrective — recovers from something after it has happened.

Putting the two classifications together:

Exam note: when the exam asks which control you recommend, prefer the preventive one — a control that prevents something is always better than one that only detects or corrects after the fact.

8.2.7 Cost–Benefit: We Recommend, the Business Decides

You cannot simply implement a control because it sounds good. Before deploying any control you do a cost benefit analysis: how much does this control cost, and how much benefit does the business get?

A control that costs 20 lakhs does not make sense when the asset it protects is worth only 10 lakhs. That is the arithmetic of the example used in class: cost outweighs the asset value, so the control is not justified.

As a cyber security practitioner you only recommend the control, listing the options with pros and cons — the cost, the benefits — and it is the business that takes the final call. This division of responsibility matters: your job is analysis, their job is decision.

8.2.8 Everyday Actions That Shrink the Landscape

Implementing controls reduces the threat landscape, and shrinking the landscape reduces the chance of the infrastructure — network, servers, databases — being exploited. Common ways to do this:

• Keep software and systems up to date with security patches. Some patches add functionality to the existing platform; other patches exist specifically to improve the security posture of the system. Both kinds matter.
• Enforce strong, unique passwords for online accounts. This ties into identity and access management (IAM). From the earlier sessions: role based access control, rule based access control, attribute based access control, and ACL based access control are the different mechanisms to restrict who can access your systems, and the more advanced ones are least privilege and need to know.
• Make attackers pass your authentication first. The triple A: authentication is proving your identity — you log in with username and password every day; authorization is the level of access granted after login, restricted by your job type or department; accountability ensures non-repudiation, so tomorrow you cannot say "I did not do that activity" — logs trace exactly how an incident happened.
• Filter email from unknown senders. Companies check email security mechanisms such as SPF and DMARC: when an email enters, the checks decide whether it goes to your inbox at all.
• Back up data regularly. In the CIA triad, one of the important criteria is availability of data. If the primary server is down, you recover from the secondary — that is what regular backups enable. "Regular" depends on business need: daily backups, weekly backups, whatever the business requires.

Real-world: the shrinking routine above is the daily work of real security teams — patch cadence, IAM reviews, email authentication (SPF/DMARC), and backup drills are standard items on an enterprise security checklist, and vendors publish threat landscape reports precisely so teams know which part of the surface to watch next.

8.3 Vulnerabilities

8.3.1 What a Vulnerability Is

A vulnerability (a security weakness in your system) can live in the system, the network, the application, the database, or any infrastructure component. A weakness can arise from how you configure things: for example, an insecure configuration on a Windows server can itself become a vulnerability — it is a vulnerability created by improper secure configuration.

The professor's analogy: vulnerabilities are like cracks in a wall — they provide attackers with an entry point to access your data or disrupt your systems. The wall is your defense; each crack is a place where the defense is thinner. The security engineer's job is to find the cracks before the attackers do, and to seal them — by patching, configuring properly, and training users.

8.3.2 Where Weaknesses Come From

Weaknesses can happen in four main places:

• Software — flaws in the programs you use; weaknesses in an application are application security issues. Bugs in code, insecure libraries, and missing input checks all belong here.
• Hardware — flaws in hardware components. Real-world: Intel has released important patches for vulnerabilities in its chips that hackers could exploit to attack your system. Your work is never just software; the hardware supporting it matters too.
• Misconfiguration — improper configuration settings. A Windows system with the guest account enabled without a password, or a configuration that makes it easy for hackers to log in remotely, are misconfigurations. Security engineers harden systems so configuration issues stay minimal.
• Human error — weaknesses in the human. Social engineering is the classic example: someone sends a spam email pretending to be from your institution, and if you do not carefully check which email address it came from, the social engineering succeeds easily.

8.3.3 Application Vulnerabilities: OWASP Top 10, SAST, and DAST

For applications, the reference list of common flaws is the OWASP Top 10 — the Open Web Application Security Project's list of the most common vulnerabilities. SQL injection, cross-site scripting, and CSRF are all entries on that list. Most applications undergo testing against these flaws as they are developed.

The testing comes in two forms, and the two differ in when and how they look for flaws:

• SAST — static application security testing — a person studies each line of code one by one to identify vulnerabilities.
• DAST — dynamic application security testing — the application is run as if it were in a proxy environment and exercised with tools to find issues.

Real-world: the tools in this space include the Acunetix web scanner, and Qualys, which can perform network scans to find loopholes in your network and can also run both authenticated and unauthenticated scans to find web application security issues. The scanners work from the list of known common vulnerabilities and try to identify the loopholes in the application you developed.

8.3.4 From SDLC to Secure SDLC

Why are there so many vulnerabilities in applications? Because an application is a software product built through the SDLC — the software development life cycle — and in the classic cycle, from gathering requirements to deploying code to production, there is no step where security is added. You gather requirements, develop the code, test it with unit testing and regression testing, validate in pre-production, and deploy to production — security never appears. That missing piece is the reason applications ship with vulnerabilities.

The fix is the secure SDLC: inculcate security requirements into the cycle from the start. In the requirement phase itself, you list the regulatory requirements and the security requirements so attacks are minimized. The same idea is called security by design, and privacy should be designed in too — privacy by design — so privacy is part of application development rather than an afterthought.

8.3.5 Common Vulnerabilities in Real Organizations

The common vulnerabilities that appear in most organizations:

• Outdated software — the patch was released but not installed.
• Weak passwords — the most common control organizations implement.
• Insecure configurations — default passwords left on deployed devices, ports left open by default.
• Phishing scams — phishing emails and their variants, including spear phishing when specific people are targeted.
• Missing security awareness — all the technical controls in the world are weak without user awareness, covered below.

Outdated software gives hackers an easy platform to exploit your network.

Lack of proper password controls is a common vulnerability. Insecure configurations: ignoring default passwords on deployed devices such as Cisco or Juniper routers; ports enabled by default. When a port must stay open for business, you should scan ports, identify which are open, check the business need, and close what is not required — you are closing doors so fewer vulnerabilities can be exploited.

Exam note: a scenario question can be built exactly on this list — the professor's example: "this attack happened — what is the common vulnerability that resulted over this, and what is your recommendation to overcome it?" Practise mapping an attack description to the vulnerability that enabled it and to a concrete recommendation.

8.3.6 Hardening and Benchmarks

To reduce configuration vulnerabilities, security engineers harden systems so there are minimal issues from a configuration perspective. Some companies scan your entire system the moment you leave the organization network and connect from home; only when the scan passes with a green check can you connect to the corporate network.

For guidance on what secure configuration looks like, the industry references benchmarks: CIS benchmarks and SANS hardening guides. You give them your OS or database version, and they give you the best ways to configure — and harden — that system or database.

8.3.7 Security Awareness: The Human Layer

If all controls are in place but there is no user awareness, the controls do not make much sense. Every company makes security training and privacy training part of employee onboarding, alongside other mandatory trainings. Every year employees must complete the training again, because it is needed for organization audits — ISO audits, SOC 2 audits. The human layer is a control like any other, and it is the one that protects against social engineering.

Real-world: the vulnerability-to-recommendation loop is the daily routine of vulnerability management teams — Qualys-style scans on a monthly/quarterly cadence, CIS-benchmark hardening checks before devices join the network, and annual ISO/SOC 2 audit evidence driven by completed awareness training.

8.4 Common Cyber Attacks

8.4.1 Phishing

Phishing uses deceptive emails or websites designed to steal your personal information. The attacker crafts an email so it looks like it comes from a legitimate source, and below it sits a URL — and clicking that URL is the phishing attack. The email technique targets people to click the link. The variant spear phishing narrows the target: if you are targeting only specific C-level executives, or filling out a list of specific business people and sending them spam, it is spear phishing.

8.4.2 Malware: Virus, Trojan, and Adware — Code with Different Objectives

Malware covers adware, trojans, and viruses — all of them are sets of lines of code, and every code has some objective. They are different from each other, not synonyms:

• A trojan horse installs itself on your machine and whatever activities happen in your system are sent to the person who made sure it was installed — a remote person receives your activity.
• A virus has the objective of damaging system files and making the system slow.
• Adware and other malware variants complete the picture; a keylogger is another example — every key you type on the keypad is sent to the remote person.

Real-world: spyware and remote access trojans are everyday versions of this pattern in modern attacks.

8.4.3 Denial of Service and Distributed Denial of Service

A denial of service (DoS) attack makes a service unavailable — unavailable to the legitimate users who are really eligible to view or access the services they intend to use. The way to do that is to keep making the server busy. There are several ways to make a server busy; two are examined here.

The ping of death continuously sends ping packets — ICMP packets — so the server is busy responding to them. When the attack comes from a single system it is a DoS attack; when multiple systems, distributed, target one server, it is a distributed denial of service (DDoS) attack. Example: an attacker sends multiple access requests to the organization's CRM software to make it so busy that legitimate professionals cannot work.

The SYN flood abuses the TCP three-way handshake. To establish a connection, the client sends a SYN packet, the server replies with SYN plus acknowledge, and the client sends a final acknowledgement — only then does data transfer happen. Instead of completing the three transactions, the attacker keeps sending SYN requests, leaving connections half open and continuously making the server busy responding. The objective is the same: make the server too busy to respond to legitimate requests.

8.4.4 Ransomware

Ransomware is one of the most common attacks of the last two years — a topic that could take hours on its own given the generations of ransomware hackers have developed. The core definition: ransomware is a specific type of malware that encrypts your data and demands a payment — the ransom — to decrypt it. That is the whole business model: your data is locked, and the decryption is sold back to you.

8.4.5 Man-in-the-Middle Attacks

A man in the middle (MITM) attack inserts an attacker between two parties. Person A sends data to person B; if the data is not encrypted, person C sits in between and, using scanning tools such as Wireshark, captures the data that is on the wire and reframes it. That is why companies insist that data in transit should be encrypted: when data travels from source to destination in encrypted form, the plain text becomes ciphertext, and to decrypt it the attacker needs the key. That is where cryptography enters: different algorithms exist — AES, DES, triple DES (3DES) — developed over the past 20–25 years. In private key cryptography the same key is used for encrypting and decrypting; in public key cryptography one key encrypts and a different key decrypts. The main objective of all this cryptographic technology is to prevent man in the middle attacks.

The MITM flow was re-explained once more for clarity: the threat actor is introduced as a legitimate resource between the two parties — a system or server between the client and a web application. The client requests information; the server should respond only if the client is truly authenticated. But if a system in between captures the request coming from client A, changes that entire request, makes the source appear as itself, and gets the response from the server, the legitimate person never receives the response — a middle system recrafted the request and routed it per the needs of the middle person. That is the man in the middle attack.

Encryption is not the only control. Session IDs valid for a limited amount of time prevent session hijacking. The class revisited cookies: when you browse a website, information is stored in cookies on your laptop, and next time, based on the cookies, the site can regenerate the page you requested. If somebody captures your machine and gathers those cookies, they can browse your authenticated login sites with your credentials. That is why even cookies now have a limited timeframe, and why a session ID is generated that is valid only for a specific time — that is the reason banking transactions time out automatically when a session is idle for a certain period. These are the controls used to prevent man in the middle attacks.

8.4.6 SQL Injection and Cross-Site Scripting

SQL injection was covered in earlier classes. In the username and password fields, if there is no proper data input validation, an attacker can pass an SQL query that bypasses validation, logs in directly, reaches the SQL database, and fetches the required information. That is SQL injection. Cross-site scripting (XSS) is the situation where a successful injection — a query result — gives commands to the system and performs all the actions it is not supposed to perform. Both are OWASP Top 10 entries and both stem from missing input validation.

8.4.7 Zero-Day Exploits

A zero-day exploit targets a weakness for which there is no patch yet — no imminent patch available — so every system that has the application installed is vulnerable to that exploit. One of the assignments asks about zero-day exploits: what they are, and which defense in depth controls can be implemented to reduce the impact of a zero-day exploit. The depth note: since a patch does not exist, the response is layered controls that reduce the impact even when the weakness is exploited.

8.4.8 DNS Tunneling

The DNS (domain name server) resolves the domain names you type into IP addresses. DNS is similar to a phone book: the entries translate between domain names and their corresponding IP addresses. When you type a URL such as wbl.facebook.com, the request goes to DNS, it searches its records, and based on the records the packet is redirected to the concerned router interface.

Tunneling means establishing a closed path. Real-world: a VPN tunnel in a public network establishes a private network — communication happens only inside the tunnel, so even over a public network nobody can access the data traveling through it. DNS tunneling is the attack version: the attacker establishes a tunnel so they can bypass your firewalls at the entry and exit points. Since the tunnel traffic looks like DNS requests that need updating, people think it is legitimate DNS traffic. The attacker takes control of your infrastructure — called C2, command and control — and can poison your DNS entries, making it very difficult for domain names to be converted correctly to their IP addresses.

DNS tunneling is one of the toughest attacks for existing detection controls to catch. That is why, whenever somebody tries to establish a tunnel, you authenticate and check where the request is coming from, and decide whether to accept it. Real-world: real DNS-based attacks were reported in 2017, 2020, and 2021. If the DNS entries are not properly secured, multiple attacks become possible — DNS spoofing, DNS poisoning, DNS cache poisoning, and tunneling that passes traffic undetected through the firewall.

The fix starts at the DNS level: maintain trusted entries and untrusted entries when updating DNS records. If you outsource DNS entirely, the vendor is responsible for the security controls — filtering every entry request, checking the content, and deciding whether a site is on a block list, is malware, or is spam. Implementing levels of controls at the domain level minimizes DNS tunneling issues. Exam note: DNS was used as the worked example of the thought process — understand the threat surface, the chance of it impacting your system, and the recommended control for it; the same reasoning applies to every attack in this chapter.

Real-world: this chapter's attacks are the recurring headlines in incident reports — phishing is the most common initial access method in enterprise breaches, ransomware dominates the last two years of cybercrime, Wireshark remains the standard packet-capture tool in penetration testing, and DNS-based attacks in 2017, 2020, and 2021 showed that even infrastructure services need their own controls.

8.5 Targeted and Untargeted Attacks, APTs, and Botnets

8.5.1 Targeted vs Untargeted Attacks

Targeted attacks choose a specific group of people, a specific organization, or a specific industry. The name says it: you are targeting a specific group. In email spamming, if you target only specific C-level executives, it is spear phishing; if you target business folks by sending out spam lists, it is still targeted phishing. Recent attacks discussed in earlier sessions targeted specific industries. Untargeted attacks have no specific target: there is no particular group you want to attack, no network you chose — you exploit whatever machines you can. Ransomware, malvertising, and phishing attacks are untargeted examples.

The two differ in who gets chosen, how much effort the attacker spends, and what the defense looks like:

APTs — advanced persistent threats — were also discussed in earlier sessions, along with how to defend against them, and spear phishing came up there too. An APT is the extreme of targeted: a patient, well-resourced attacker who gains a foothold and keeps it for a long time to collect specific data.

8.5.2 Watering Hole Attacks

A watering hole attack compromises the legitimate sites that the target organization visits frequently. The attacker's job is to infect the visitor's device with malware: the moment somebody visits the website, malware is injected into their machine through the site they are accessing.

8.5.3 Botnets

A botnet is a network of infected systems. All the systems that have been infected by the virus or other malware form a network, and they perform an attack together — that combined attack is the botnet attack. Real-world: whenever there is a financial data breach, the names of different botnets come into the picture — IRC botnets, zombie botnets, and more, where a group of already-infected systems tries to damage a target system.

8.5.4 Patterns of Cyberattacks

Attackers infiltrate in more than one way:

• Sequential — attackers follow the traditional stages in a linear fashion, step by step. If you remember the Certified Ethical Hacking (CEH) course, there are six defined stages starting with reconnaissance, and attackers can move through them one by one; the MITRE tactics we cover next can also be walked through in sequence.
• Piggybacking — the attacker exploits a vulnerability created by a legitimate process, riding on something that already has access.
• Combination — the attacker uses a combination of different techniques, mixing steps and direct exploitation of a weakness in the system.

Real-world: botnet names like IRC and zombie botnets surface in financial data breach reports; the CEH certification teaches the six sequential stages starting with reconnaissance; watering holes have been used against industry groups whose members share trusted websites — the combination of the three patterns covers most real intrusion paths.

8.6 Attack Frameworks: MITRE ATT&CK and the Rest

8.6.1 The MITRE ATT&CK Tactics

Frameworks organize how attackers operate. MITRE ATT&CK is the framework the class focused on, and it is very important in the latest security tools. It explains the techniques most threats follow, from initial access to the system all the way to final control. Based on the attacks that have happened, the industry identified 14 steps, called tactics:

1. Reconnaissance — information gathering: this organization has so many Windows servers, so many Linux servers, so many Juniper routers, so many Cisco routers.
2. Resource development — based on the reconnaissance, develop the resources needed to attack: the necessary tools.
3. Initial access — gain the first access to the organization's network or systems, via email or whatever mechanism.
4. Execution — execute the successful access.
5. Persistence — maintain access, so the access is not lost.
6. Privilege escalation — move from normal access to privileged, admin level access, for example by entering system files and changing entries.
7. Defense evasion — find out what defense controls are implemented and how to evade them.
8. Credential access — see where the credentials are being accessed and obtain them.
9. Discovery — explore the network: which servers are located where, what type of information exists.
10. Lateral movement — move sideways through the network so detection mechanisms cannot identify where you are.
11. Collection — collect whatever information the attacker wants.
12. Command and control — reach the C2 stage: full command of the machine and control of the machine or network.
13. Exfiltration — data moving from the organization network to the hacker's system.
14. Impact — the impact happens to the system.

This is the walkthrough of the 14 tactics as listed by the ATT&CK framework.

8.6.2 How Security Products Use the Framework

Whenever an attack is happening, most EDRs (endpoint detection and response) and XDRs (extended detection and response) — whatever the tool — try to post which phase the threat is in: initial access, persistence, lateral movement, discovery, or another. Real-world: Carbon Black, CrowdStrike, and SentinelOne are EDR/XDR products that follow these attack phases at the back end. CrowdStrike and SentinelOne, the top vendors for automating endpoint security, both use the MITRE ATT&CK framework. In security incident management this matters directly: when an alert fires at the back end, many ML based tools show which attack framework phase or stage the attacker is in, which tells the incident responder what is happening. That is why these phases are very important in incident management.

8.6.3 Other Attack Frameworks

MITRE ATT&CK is one of several frameworks. The others named in the discussion:

• STRIDE — a threat modeling framework from a web security perspective.
• OCTAVE — another framework used for risk assessment.
• Kill Chain — the Cyber Kill Chain, one of the most popular frameworks.
• Fast Kill Chain — a more recent variant.
• OWASP — relevant from a web security perspective.

Of all of them, the Kill Chain and MITRE are the two frameworks that most cyber security product companies embed at the back end of their applications.

Real-world: CrowdStrike, SentinelOne, and Carbon Black — the major EDR/XDR vendors — map detections to ATT&CK techniques at the back end, and security product companies embed MITRE and the Kill Chain in their applications, so a security analyst in almost any SOC reads the same 14-stage vocabulary.

8.7 Essential Cyber Security Controls

8.7.1 The Goal: Reduce Exposure

Reducing your exposure is very, very crucial: the smaller the attack surface, the less chance attackers have to exploit it. The main point for a cyber security engineer is to reduce exposure — that significantly improves the security posture and minimizes the risk of data breaches, financial losses, and operational disruptions. The approaches: regular updates, continuous awareness sessions as part of onboarding and on a frequent basis, secure SDLC for developers, MFA (multifactor authentication), network segmentation implementing a DMZ, deploying intrusion detection systems (IDS) and intrusion prevention systems (IPS) — though the current trend has moved to XDR, extended detection and response — and application whitelisting, where companies list the allowed applications in their transparent or non-transparent proxy servers.

A first-by-default practice: users get limited access to their laptops and do not have admin level privileges by default, so they cannot install software. To install software for business needs, you raise a ticket, get manager approval, and the IT team checks whether it is a licensed or open source version, verifies it per process and procedure, and then installs it remotely or makes it available through a shared drive.

Other exposure-reducing measures: disable unnecessary services and unnecessary ports; restrict remote access by default; disable remote procedure calls that are not required; disable the download option by default; and continuously monitor systems. Modern EDRs continuously monitor how process to process communication happens — any abnormal process to process communication is immediately detected and raised as an alert to the security team. VPNs establish a dedicated tunnel even inside a private network.

8.7.2 Application Control and Whitelisting

Application control prevents the execution of malicious programs — including EXEs, DLLs, scripts such as Windows scripts or PowerShell, and installers. When you control what applications get installed, you reduce the threat. The mechanism is a whitelist of allowed applications. Open source software cannot be installed without approval, and ordinary users do not have the privilege to install an application — only the admin installs.

The strategy question: should we list the whitelist or the blacklist? It is always best to have fewer entries, so we go with whitelisting — you know exactly which applications are allowed, and anything beyond that is blocked.

8.7.3 Patch Management

Patch management is a very important control, run by a dedicated team for production servers. It is a process, not a single action, so it is best understood as a workflow.

The program works like this: a change ticket is raised; the team pulls the patches from the vendor releases; they test the patches and make sure the system functions as expected; they push the patches in a phased manner; and finally, as per the committed SLA, they deploy all patches and ensure systems are up to date. Patch scanning tools verify whether the patches are up to date.

8.7.4 Application Hardening

Application hardening applies as simply as web browsers blocking Flash or Java. The reason Flash and Java are targeted: the moment a Flash file is allowed in, it directly has the privileges to go deep into system level access files or root level privileges. That is why browsers disable these features, why you get a pop-up saying Flash has been disabled on a website full of Flash players, and why disabling them prevents malicious code from entering your system. The same approach applies to Microsoft Office, which most people use — macros are restricted to authorized users.

8.7.5 Multifactor Authentication and Admin Privileges

MFA — multifactor authentication — combines what you have, what you are, and what you know. It is recommended and often mandated when using critical services or performing risky operations like a remote connection. Admin privileges should be limited by default — one of the most important controls — with admins restricted to only the system administrators and network administrators. A normal user gets the minimum level of privileges needed to do their work. Daily or weekly backups of laptops and servers complete the routine picture.

8.7.6 Firewalls, Gateways, and the DMZ

A firewall is a security control, software based or hardware based. By the way it operates, a firewall can be a layer 2 firewall: in the older days, blocking or allowing based on the MAC address. A firewall that allows or blocks based on the source or destination IP address is a layer 3 firewall. There are also layer 7 firewalls, software firewalls, and dedicated hardware devices. Which one to deploy depends on the organization's requirement — and as always, the cost benefit analysis comes first, considering the benefits of deploying the firewall, and then the architects or business stakeholders decide which type or layer of firewall to implement.

All the network behind the firewall is the internal network. Servers that must be reachable from the internet are placed in a separate zone called the DMZ — the demilitarized zone. Requests are redirected to the DMZ servers and processed there, so that traffic never enters the internal network while the required services are still delivered to clients. This is how an architect segregates the organization network by business need — publicly facing servers live in the DMZ, and the risk to the internal network stays minimum.

The critical roles of the firewall set: traffic filtering — allowing or filtering packets, both ingress (incoming) and egress (outgoing); access controls; threat prevention; and DLP — preventing data leakage. The egress filtering purpose is to make sure no exfiltration happens: no organization confidential critical data leaves the internal network. These are the crucial controls of a normal, pre-cloud network — in the cloud the picture is different, with concepts like VPC logs.

8.7.7 Stateful vs Stateless Firewalling

Multi-layer defense means implementing controls at different layers — code filtering, packet filtering, stateful inspection. A stateless firewall (the first generation) checks packets based on source and destination only and allows or blocks; it does not check the state of the request. A stateful firewall also inspects the state of the connection: it checks the previous connection that was established and, based on that, allows or blocks. Remember the TCP three-way handshake: with the SYN flood attack, if the firewall does not check state, there is a high chance of the SYN flood succeeding; with stateful inspection, the connection state is checked and the attack is blocked. Layer after layer of such controls is the multi-layered defense.

Firewall best practices: firewalls are completely rule based, so define strong and complex rules.

Review the firewall rules regularly to make sure they are aligned to business needs and updated for the latest threats, and the sequence of the rules is very important. Send the firewall logs to a centralized monitoring system: collating and cross-correlating logs from multiple sources helps the security engineer quickly identify where an incident is happening.

Secure configuration completes the set: hardening of your system, patch management, and configuration management. Encryption for data in transit and data at rest is part of this — with one open question, below.

8.7.8 Traffic Filtering, DLP, and Monitoring

Data inspection — content checking — means inspecting what comes in and goes out. Outside to inside: check for harm to the organization, so no virus or malicious malware enters as part of a word document or email. Inside to outside: check whether confidential data is leaving — exfiltration.

Exam note: a question may ask you to name the control that inspects outbound content — the answer is DLP, data leakage prevention.

Now the open question the class was asked to think about. We say data in transit should be encrypted so no man in the middle attack happens. But the same encryption can be leveraged by hackers: they send encrypted data with a virus or malware injected inside. What control detects the malware inside the encrypted data even though it is encrypted? Do we have such a mechanism in place? Yes, we definitely do — the question is how it works, and that is left for you to think about. Exam note: this is the kind of reasoning question that shows deeper understanding — encryption prevents interception, but detection must still operate on the traffic.

8.7.9 Zero Trust

The current trend is the Zero Trust mechanism: do not trust. Earlier, if this was an organizational laptop, it was trusted and granted access. Zero Trust says do not trust even if the request comes from corporate systems or the corporate network. It enforces compliance checks before granting data access — even a legitimate person must pass the checks before being granted access to the applications they need. Zero Trust minimizes the attack surface; it never nullifies it.

This is the same principle as the home-network scan: the moment you connect from your home network, an entire scan runs, and once it confirms you are good to connect, you can connect to the corporate network.

8.7.10 Insider Threats

Even with N number of technical controls and multiple lines of defense, insider threats remain the damage that cannot be detected quickly. Insiders are already legitimate people with access to everything — attacks from your employees. Insider threats can easily impact confidentiality, integrity, or availability. An insider knows the weaknesses in the organization, knows where the data is and how to exploit it, so the damage caused by insider threats is always high.

Insider threats come in two flavors: unintentional — human oversight, an error that resulted in a threat — and intentional — a person deliberately damaging your system. The signs a monitoring tool should catch: a person uploading large amounts of data from the organization's Google Drive to a personal laptop is a sign of data exfiltration; a payroll person logging in at midnight, 12 to 4 AM, with no business requirement, is suspicious. Monitoring tools should list all possible scenarios so insider threats can be detected early.

The administrative controls against insiders: periodic review of user access — when an admin moves from one department to another, the previous roles must be removed in a timely manner; when an employee leaves the organization, access is removed within a stipulated time, say 24 or 48 hours. Password policies define how strong and complex passwords must be, and awareness sessions teach employees not to write passwords where they can be seen by others but to keep them in mind. Content checking covers both directions: inbound content so no malicious file enters, outbound content so no confidential data leaves.

8.7.11 The Best Practices at a Glance

The eight recommended best practices listed in the session: application control, patch management, application hardening, MFA for critical applications, admin privileges limited by default, daily or weekly backups, continuous monitoring, and security awareness. This list is an example, not a guarantee — having these eight does not make you secure. There are many more practices, and the right set depends on the context of your organization's network, servers, and databases. Exam note: be able to argue which control fits which situation, using the cost benefit logic, rather than memorizing a fixed list.

Real-world: the eight practices map directly to what real enterprises run — CrowdStrike-style enforcement engines for Zero Trust, WebSense-style DLP for outbound keywords, centralized firewall log correlation in a SIEM, and access reviews at every role change — and the encrypted-traffic detection question is one that modern security teams answer with inspection technologies that look inside encrypted flows.

8.8 The Four-Chapter Recap

8.8.1 Chapter One: Security Fundamentals

The first chapter asked the basic questions: what is security, why do we need security, and what are the different types — computer security, infrastructure security, cyber security. The CIA triad reappeared: confidentiality protects against unauthorized access and reading, integrity ensures no unauthorized modification, and availability keeps the service usable. We defined threat, threat modeling, and threat intelligence, and the sources for intelligence including open source. We covered attack surfaces, what an attack is, and what a vulnerability is, plus the different types of vulnerabilities. Controls were classified by category — physical, administrative, technical — and by function — preventive, detective, corrective, deterrent — with the reminder that preventive is always preferred.

We understood the difference between policy, procedure, standards, and frameworks, and which organization policies protect confidentiality, integrity, and availability. The confidentiality model was the Bell-LaPadula model, the military model; Biba was the integrity model. The exact read and write restrictions of these models were referred to in the earlier session. In the recap the class was asked to recall which controls allow only read operations, and the answer needs both models spelled out: Bell-LaPadula protects confidentiality with two rules — the simple security condition, "no reads up" (a subject cannot read an object at a higher classification), and the -property, "no writes down" (a subject cannot write to an object at a lower classification, because that would leak secret data into a less protected place). Biba protects integrity with the dual rules — "no reads down" (a subject cannot read from a lower-integrity object, because the untrusted data would taint the subject) and "no writes up" (a subject cannot write to a higher-integrity object, because lower-trust content must not change higher-trust data). The two models are opposites on the same axes: Bell-LaPadula stops high data from flowing down; Biba stops low data from flowing up*.

Then the networking fundamentals: the internet, what a network is, LAN, MAN, WAN, what a computer is, MAC address versus IP address and the difference, and how they connect in a LAN. The LAN technologies started with the Ethernet framework, then token bus, token ring, and FDDI to understand how communication happens. The seven layers of OSI were covered, and why the seven layer model moved to the TCP/IP four layer approach. Each layer's role appeared in the walkthrough of a sender and receiver communicating through an application: the flow goes top to bottom, from application to physical layer, on the sender side, and bottom to top on the receiver side — the Google Chat example, where everything typed moves through each layer. The network utilities closed the chapter: hub, switch, router, gateway, the differences, and when each is preferred.

8.8.2 The Defense-in-Depth Wheel

The wheel diagram ties the course together: controls are implemented at different layers — data security, detection response, incident, IAM, endpoint, and network security. Each control implemented at a different layer helps minimize the risk, and the wheel helps you see holistically why we implement a different set of controls at each layer.

Exam note: go through the defense in depth wheel diagram when revising — it covers the material of two chapters at once, and it was flagged as the diagram to review.

Real-world: the wheel is a real architecture pattern — enterprise security teams staff IAM, network security, and detection response teams separately, and the ISO/SOC audit evidence structure maps its controls to the same six layers, which is why reviewing the wheel effectively reviews two chapters at once.

Exam Guidance Summary

• The exam covers chapters 1 to 4, and the four chapter handouts contain roughly 99% of the topics — you will not be asked beyond them.
• The exam is 30 marks: five questions of six marks each. Three questions are theoretical and two are scenario based. One theory question comes from each chapter, so one of the four chapters carries no theory question. The stated 70% theoretical / 30% practical split does not match the 3-of-5 and 2-of-5 counts arithmetically — the five-question pattern is the reliable figure.
• Scenario questions give a situation and ask you to identify the threat or the vulnerability behind an attack and recommend controls, or to say which framework and which part of it applies. Practise the "what is the common vulnerability over this attack and what is your recommendation" format.
• The exam is closed book and answers are written by hand. Drawing figures and diagrams is optional — presentation choices are yours, and the evaluator judges how well you understand the topic and how well you present the expected answer.
• When asked which control to recommend, prefer a preventive control over detective, deterrent, or corrective ones.
• Control recommendations rest on cost benefit analysis: cost against benefit, and the business takes the final call.
• Know the four ways to respond to risk: transfer, mitigate, avoid, accept — the most commonly forgotten one is acceptance.
• Revise the defense in depth wheel diagram (data security, detection response, incident, IAM, endpoint, network security) — it covers two chapters at once.
• Revise the chapter one fundamentals: CIA, threat vs threat modeling vs threat intelligence, control classifications, policy/procedure/standards/frameworks, Bell-LaPadula for confidentiality and Biba for integrity, LAN/MAN/WAN, MAC vs IP, Ethernet/token bus/token ring/FDDI, the OSI seven layers vs TCP/IP four layers, and hub/switch/router/gateway.
• Quizzes and weights: quiz one done at 5% weightage, quiz two after chapter five, competency examination at 50 marks.
• Submit assignments before the syllabus finishes so assignment marks are uploaded and not lost.

Key Industry Applications

• Real-world: CrowdStrike and SentinelOne are the top EDR/XDR vendors automating endpoint security, and both use the MITRE ATT&CK framework at the back end; Carbon Black also maps alerts to attack phases. MITRE and the Kill Chain are the two frameworks most security product companies embed.
• Real-world: Qualys performs network scans and authenticated and unauthenticated web application scans; Acunetix is a web scanner; both work from the OWASP Top 10 style list of common vulnerabilities. Monthly and quarterly scans with these tools find outdated software such as version 1.2 needing version 3.4.
• Real-world: CIS benchmarks and SANS guides provide the hardening configurations for OS and database versions; hardening scans gate home-network connections to corporate networks.
• Real-world: Wireshark is the classic tool used in man in the middle capture; the defense is encrypting data in transit with algorithms such as AES, DES, and 3DES, plus session IDs and limited-lifetime cookies, which is why banking sessions time out when idle.
• Real-world: SPF and DMARC checks decide whether an email enters the inbox; WebSense is the older DLP product that blocks data leaving the organization by keywords; DLP stops exfiltration.
• Real-world: OSINT and paid feeds supply threat intelligence; VPN tunnels and DMZ network segmentation are standard enterprise controls; Zero Trust is the current trend, with enforcement engines checking hardware type, geolocation, and patch levels before granting access.
• Real-world: real DNS attacks occurred in 2017, 2020, and 2021 — DNS poisoning, DNS cache poisoning, and DNS tunneling — and outsourced DNS puts the filtering responsibility on the vendor.
• Real-world: Intel has released hardware patches for chip vulnerabilities; IRC botnets and zombie botnets appear in financial data breaches; the CEH certification defines the six stages of an attack starting with reconnaissance.