Section 25.243 Endpoint Log Flashcards by Amreek Paul

Section 2.5 Threats and Vulnerabilities

Section 2.6 Confidentiality

Section 2.7 Integrity

Section 2.8 Availability

Section 2.9 Non-Repudiation

Section 2.10 Authentication

Section 2.11 Authorisation

Section 2.12 Accounting

Section 2.13 Security control categories

Section 2.14 Security control types

Section 2.15 Gap Analysis

Section 2.16 Zero Trust

Section 3.18 Threat Actor

Section 3.19 Threat Actor Attributes

Section 3.20 Unskilled Attackers

Section 3.21 Hacktivists

Section 3.22 Organised Crime

Section 3.23 Nation State Actor

Section 3.24 Insider Threats

Section 3.25 Shadow IT

Section 3.26 Threat Vectors and Attack Surfaces

Section 3.27 Outsmarting Threat Actors

Section 4.29 Physical Security: Fencing and Bollards

Section 4.30 Attacking with Brute Force

Section 4.31 Surveillance Systems

Section 4.32 Bypassing Surveillance Systems

Section 4.33 Access Control Vestibule's

Section 4.34 Door Locks

Section 4.35 Access Badge cloning

Section 5.37 Social Engineering Motivation Triggers

Section 5.38 Impersonation

Section 5.39 Pretexting

Section 5.40 Phishing Attacks

Section 5.41 Preventing Phishing Attacks

Section 5.42 Conducting an Anti-Phishing attack

Section 5.43 Frauds and Scams

Section 5.44 Influence Campaigns

Section 5.45 Other Social Engineering Attacks

Section 6.46 Malware

Section 6.47 Viruses

Section 6.48 Worms

Section 6.49 Trojans

Section 6.51 Ransomware

Section 6.52 Zombies and Botnets

Section 6.53 Rootkits

Section 6.54 Backdoors and Logic Bombs

Section 6.55 Keylogger

Section 6.56 Spyware and Bloatware

Section 6.57 Malware Attack Techniques

Section 6.58 Indications of Malware attacks

Section 7.60 Data Protection and Classifications

Section 7.61 Data Ownership

Section 7.62 Data States

Section 7.63 Data Types

Section 7.64 Data Sovereignty

Section 7.65 Securing Data

Section 7.66 Data Loss Prevention (DLP)

Section 8.68 Cryptographic Solutions: Symmetric v Asymmetric

Section 8.69 Symmetric vs Asymmetric

Section 8.70 Symmetric Algorithms

Section 8.71 Asymmetric Algorithms

Section 8.72 Hashing

Section 8.73 Increasing Hash Security

Section 8.74 Public Key Infrastructure (PKI)

Section 8.75 Digital Certificates

Section 8.77 Blockchain

Section 8.78 Encryption Tools

Section 8.79 Obfuscation

Section 8.80 Cryptographic Attacks

Section 9.81 Risk Management

Section 9.82 Risk Assessment Frequency

Section 9.83 Risk Identification and Analysis

Section 9.84 Risk Register

Section 9.85 Qualitative Risk Analysis

Section 9.86 Quantitative Risk Analysis

Section 9.87 Risk Management Strategies

Section 9.89 Risk Monitoring and Reporting

Section 10.90 Third-party Vendor Risks & Supply Chain Risks

Section 10.91 Supply Chain Attacks

Section 10.92 Vendor Assessment

Section 10.93 Vendor Selection and Monitoring

Section 10.94 Contracts and Agreements

Section 11.95 Governance and Compliance

Section 11.96 Governance

Section 11.97 Governance Structures

Section 11.98 Policies

Section 11.99 Standards

Section 11.100 Procedures

Section 11.101 Governance Considerations

Section 11.102 Compliance

Section 11.103 Non-compliance Consequences

Section 12.104 Asset and Change Management

Section 12.105 Acquisition and Procurement

Section 12.106 Mobile Asset Deployments

Section 12.107 Asset Management

Section 12.108 Asset Disposal and Decommissioning

Section 12.109 Change Management

Section 12.110 Change Management process

Section 12.111 Technical Implications of Changes

Section 12.112 Documenting Changes

Section 13.113 Audits and Assessments

Section 13.114 Internal Audits and Assessments

Section 13.115 Performing an Internal Assessment

Section 13.116 External Audits and Assessments

Section 13.117 Performing an External Assessment

Section 13.118 Penetration Testing

Section 13.119 Reconnaissance in Pentesting

Section 13.120 Performing a Basic PenTest

Section 113.121 Attestation of Findings

Section 14.122 Cyber Resilience and Redundancy

Section 14.123 High Availability

Section 14.124 Data Redundancy

Section 14.126 Capacity Planning

Section 14.127 Powering Data Centers

Section 14.128 Data Backups

Section 14.129 Continuity of Operations Plan

Section 14.130 Redundant Site Considerations

Section 14.131 Resilience and Recovery Testing

Section 15.133 Security Architecture: On Premise vs The Cloud

Section 15.134 Cloud Security

Section 15.135 Virtualisation and Containerisation

Section 15.136 Serverless

Section 15.137 Microservices

Section 15.138 Network Infrastructure

Section 15.139 Software-defined Network (SDN)

Section 15.140 Infrastructure as Code (IaC)

Section 15.141 Centralised vs Decentralised Architectures

Section 15.142 Internet of Things (IoT)

Section 15.143 ICS and SCADA

Section 15.144 Embedded Systems

Section 16.146 Security Infrastructure: Ports and Protocols

Section 16.147 Firewalls

Section 16.148 Configuring Firewalls

Section 16.149 IDS and IPS

Section 16.150 Network Appliances

Section 16.151 Port Security

Section 16.152 Securing Network Communications

Section 16.153 SD-WAN and SASE

Section 16.154 Infrastructure Considerations

Section 16.155 Selecting Infrastructure Controls

Section 17.156 Identity and Access Management (IAM) Solutions

Section 17.157 Identity and Access Management (IAM)

Section 17.158 Multi-factor Authentication

Section 17.159 Password Security

Section 17.160 Password Attacks

Section 17.161 Single Sign-On (SSO)

Section 17.162 Federation

Section 17.163 Privileged Access Management (PAM)

Section 17.164 Access Control Models

Section 17.165 Assigning Permissions

Section 18.166 Vulnerabilities and Attacks

Section 18.167 Hardware Vulnerabilities

Section 18.168 Bluetooth Vulnerabilities and Attacks

Section 18.169 Mobile Vulnerabilities and Attacks

Section 18.170 Zero-day Vulnerabilities

Section 18.171 Operating System Vulnerabilities

Section 18.172 SQL and XML Injections

Section 18.174 XSS and XSRF

Section 18.175 Buffer Overflow

Section 18.176 Race Conditions

Section 19.178 Malicious Activity: and Distributed Denial of Service

Section 19.179 Domain Name System (DNS) Attacks

Section 19.180 Directory Traversal Attack

Section 19.181 Execution and Escalation Attacks

Section 19.182 Replay Attacks

Section 19.183 Session Hijacking

Section 19.184 On-path Attacks

Section 19.185 Injection Attacks

Section 19.186 Indicators of compromise (IoC)

Section 20.188 Hardening: and Changing Default Configurations

Section 20.189 Restricting Applications

Section 20.190 Unnecessary Services

Section 20.191 Trusted Operating Systems

Section 20.192 Updates and Patches

Section 20.193 Patch Management

Section 20.194 Group Policies

Section 20.195 SELinux Policies

Section 20.196 Data Encryption Levels

Section 20.197 Secure Baselines

Section 21.199 Security Techniques: and Wireless Infrastructure Security

Section 21. 200 Wireless Security Settings

Section 21.201 Application Security

Section 21.202 Network Access Control (NAC)

Section 21.203 Web and DNS Filtering

Section 21.204 Email Secuirty

Section 21.205 Endpoint Detection and Response

Section 21.206 User Behaviour Analytics

Section 21.207 Selecting Secure Protocols

Section 22.209 Vulnerability Management: & Identifying Vulnerabilities

Section 22.210 Threat Intelligence Feeds

Section 22.211 Responsible Disclosure Programs

Section 22.212 Analysing Vulnerabilities

Section 22.213 Conducting Vulnerability Scans

Section 22.214 Assessing Vulnerability Scan Reports

Section 22.215 Vulnerability Response and Remediation

Section 22.216 Validating Vulnerability Remediation

Section 22.217 Vulnerability Reporting

Section 23.219 Alerting and Monitoring: & Monitoring Resources

Section 23.220 Alerting and Monitoring Activities

Section 23.221 Simple Network Management Protocol (SNMP)

Section 23.222 Security Information and Event Management (SIEM)

Section 23.223 Data from Security Tools

Section 23.224 Security Content Automation and Protocol (SCAP)

Section 23.225 Network and Flow Analysis

Section 23.226 Single Pane of Glass

Section 24.228 Incident Response: & Incident Response Process

Section 24.229 Threat Hunting

Section 24.230 Root Cause Analysis

Section 24.231 Incident Response Training and Testing

Section 24.232 Digital Forensic Procedures

Section 24.233 Data Collection Procedures

Section 24.234 Disk Imaging and Analysis

Section 25.236 Investigating an Incident: & Investigate data

Section 25.237 Dashboards

Section 25.238 Automated Reports

Section 25.239 Vulnerability Scans

Section 25.240 Packet Captures

Section 25.241 Firewall Logs

Section 25.242 Application Logs

Section 25.243 Endpoint Log

Section 25.244 OS-specific Security Logs

Section 25.245 IPS/IDS Logs

Section 25.246 Network Logs

Section 25.247 Metadata

Section 26.248 Automation and Orchestration

Section 26.249 When to Automate and Orchestrate

Section 26.250 Benefits of Automation and Orchestration

Section 26.251 Automating Support Tickets

Section 26.252 Automating Onboarding

Section 26.253 Automating Security

Section 26.254 Automating Application Development

Section 26.255 Integrations and APIs

Section 27.257 Security Awareness: & Recognising Insider Threats

Section 27.258 Objective 5.6 Password Managers

Section 27.259 Avoiding Social Engineering

Section 27.260 Policy and Handbooks

Section 27.261 Remote and Hybrid Work Environments

Section 27.262 Creating a Culture of Security