Security

Cybersecurity

Virtual protection focused on preventing attacks, protecting systems, preventing disruptions, and maintaining uptime.

Perfect Solution Fallacy

The idea that no security measure can guarantee 100% security. Technology and attackers constantly evolve, creating an ongoing game of cat and mouse.

2. SECURITY TERMINOLOGY

Vulnerability

A weakness or lack of a countermeasure that can be exploited by a threat.

Risk

The probability and potential impact of exposure, loss, or harm. Risk = Value × Likelihood.

Control / Countermeasure

Actions or configurations implemented to remediate vulnerabilities and reduce risk.

3. ASSETS, THREATS, AND VULNERABILITIES

Assets

Anything valuable that an organization wants to protect.

Information/Data Assets

Customer databases, intellectual property (IP), and secrets.

Intentional (Malicious) Threats

Deliberate attacks, including hackers, Shadow IT, phishing, malware, and DDoS.

Accidental Threats

Threats caused by human error or a lack of training and skills.

Environmental/Natural Threats

Natural disasters or environmental events, such as hurricanes, earthquakes, power grid failures, and floods.

Technological Vulnerabilities

Weaknesses involving technology, such as unpatched software, zero-day exploits, weak encryption, and open ports.

Configuration Vulnerabilities

Improper configurations, such as default passwords, misconfigured cloud storage, and open AWS S3 buckets.

Human/Process Vulnerabilities

Weaknesses caused by poor training, poor employee onboarding/offboarding, and poor database maintenance.

4. RISK MANAGEMENT

Risk

The probability and impact of exposure, loss, or harm.

Risk Formula

Risk = Probability × Value.

Accept Risk

Accept the possibility of a loss and take the hit if it happens.

Transfer Risk

Have a third party take responsibility for dealing with the risk.

Mitigate Risk

Add preventative measures and recovery methods to reduce the risk.

Fix Risk

Remove the risk entirely by eliminating the vulnerable function.

Qualitative Risk Assessment

Evaluates risk using generalized categories such as Low, Medium, and High.

Risk Matrix

Evaluates risk by comparing Likelihood (Probability) × Impact (Severity).

Quantitative Risk Assessment

Uses actual financial numbers to calculate potential losses.

Single Loss Expectancy (SLE)

The financial cost of one incident.

Annualized Rate of Occurrence (ARO)

The estimated number of times an incident will occur in one year.

Annualized Loss Expectancy (ALE)

The expected financial loss per year. ALE = SLE × ARO.

5. COUNTERMEASURES (SECURITY CONTROLS)

Countermeasures / Security Controls

Measures implemented to protect assets and reduce security risks.

Preventive Controls

Measures designed to prevent security incidents before they happen. Examples: firewalls, security guards, and MFA.

Detective Controls

Measures designed to identify security incidents or suspicious activity. Examples: IDS, NIDS, security cameras, and log monitoring.

Corrective Controls

Measures designed to correct problems and recover after an incident. Examples: backups, incident response plans, and patching.

Deterrent Controls

Measures intended to discourage attackers or prevent unwanted behavior. Examples: security policies, blacklists, bans, physical security measures, and legal action.

6. SENSITIVE INFORMATION

Personally Identifiable Information (PII)

Information that identifies a person directly or when combined with other information.

Examples of PII

Names, Social Security numbers, biometrics, dates of birth, medical records, and financial records.

PII Protection

Collect only necessary information, restrict access, encrypt PII, redact logs, and delete data when its retention period ends.

Secrets

Sensitive internal information used to interact with other resources.

Examples of Secrets

Credentials, API keys, private keys, and sensitive character strings.

Plaintext Secrets

Sensitive information stored in an unencrypted, readable format. Secrets may accidentally be uploaded to GitHub.

AWS Secrets Manager

An AWS service used to securely store and manage sensitive information such as credentials and API keys.

Azure Key Vault

An Azure service used to securely store and manage secrets and keys.

GCP KMS

Google Cloud Key Management Service, used to manage cryptographic keys.

Secret Rotation

Regularly changing credentials, API keys, and other secrets to reduce the risk of compromised credentials being reused.

7. SECURITY FRAMEWORKS

Security Frameworks

Models used to understand how attacks happen, why security failures occur, and who is responsible for security. They are theories and guidelines rather than strict rules.

Swiss Cheese Model (James T. Reason)

A security model where each security control represents a protective layer and each vulnerability represents a hole. An incident occurs when a threat passes through all the layers.

Swiss Cheese Model Principle

Major incidents are rarely caused by only one failure. Adding more layers or strengthening existing layers reduces risk.

Defense in Depth

A security strategy that uses multiple layers of protection involving people, technology, and operations.

Layered Protection

Multiple security controls protect against the same attack path.

Different Failure Modes

Using different types of security controls reduces the chance that one weakness defeats every layer.

Blast Radius

The amount of damage or number of resources affected when a system or account is compromised.

Segmentation

Separating systems and resources to limit how far an attacker can move after gaining access.

Least Privilege

Giving users and systems only the permissions they need to perform their tasks.

Recovery

Using monitoring, incident response plans, and tested backups to recover from failures that preventative measures miss.

CSP Shared Responsibility Model

A model that divides security responsibilities between the Cloud Service Provider (CSP) and the customer. Responsibilities change depending on which cloud service is being used.

8. COMMON CLOUD THREATS

Cloud Threats

Security threats that target cloud environments and their resources.

Misconfiguration Attacks

Exploiting improperly configured cloud resources, such as open S3 buckets and overly permissive firewall rules.

Identity Theft

Stealing credentials or identities to gain unauthorized access to systems.

Compromised Admin Account

An administrator account that has been stolen or accessed by an attacker.

Privilege Escalation

An attacker gains higher-level permissions than they originally had.

DDoS Attacks

Distributed Denial-of-Service attacks that overwhelm a system or service with traffic to make it unavailable.

Lateral Movement

An attacker gains access to a low-level resource and moves to higher-level resources within a system or network.

9. SOCIAL ENGINEERING AND PHISHING

Social Engineering

Using human psychology and manipulation as an attack method to trick people into performing actions that compromise security.

Phishing

Attempting to persuade a human or AI to provide credentials or install malware through fraudulent messages or other deceptive methods.

Spear-Phishing

A targeted phishing attack directed at a specific individual.

Social Engineering Techniques

Attackers often create stress, excitement, urgency, or time pressure to manipulate victims into making mistakes.

Phishing Prevention

Train employees to recognize suspicious messages, avoid suspicious links, and identify warning signs such as urgency and time pressure.

IP Blacklists

Lists of known malicious IP addresses used to block repeat spam senders and known phishing sources.

10. SUPPLY CHAIN ATTACKS

Supply Chain Attack

An attack where an attacker compromises a trusted supplier or service to reach its downstream customers or users.

Compromised Supplier

A legitimate service or software provider that has been compromised by an attacker.

Legitimate Certificate

A digital certificate that can make compromised software appear trustworthy to antivirus systems.

Supply Chain Attack Process

1. A legitimate service is compromised. 2. The attacker sends an infected package signed with a legitimate certificate. 3. Antivirus trusts the certificate and allows the malware through. 4. An automatic update infects the system.

Supply Chain Attack Examples

Notepad++ and SolarWinds.

11. AI AND LLM SECURITY THREATS

AI Social Engineering

Using AI to create convincing fraudulent messages, synthetic voices, or fake videos to impersonate people.

AI Scale

AI makes it easier and faster to create deceptive content with relatively little effort.

AI Trust Risk

People may trust AI agents more than they should, creating additional security risks.

AI Cloud Impact

AI errors and false requests can target payments, credential resets, or privileged access approvals.

Prompt Injection

An attack where an input prompt redirects an AI model to behave in unintended or unauthorized ways.

Sensitive Information Disclosure

An AI model reveals sensitive information, such as PII or secrets, through its reasoning or responses.

Excessive Agency

Giving AI systems overly broad permissions or allowing them to perform actions with excessive privileges.

Context Poisoning

Bad input or unchecked output corrupts decision-making and can contribute to hallucinations.

AI Arrogance

Replacing workers with AI can reduce an organization's knowledge base and weaken its ability to protect and recover systems.

12. CLOUD SECURITY PRACTICES

Microsegmentation

Isolating workloads from one another to limit the blast radius if an instance is compromised.

Infrastructure as Code (IaC)

Managing and configuring infrastructure resources using files or code instead of manually configuring everything.

IaC Security

Scanning infrastructure scripts before deploying resources to identify security weaknesses.

Terraform

An Infrastructure as Code tool used to manage and provision infrastructure.

AWS CloudFormation

An AWS Infrastructure as Code service used to define and deploy cloud resources.

Data Residency

Understanding where data is physically stored within a data center or geographic location.

Data Sovereignty

Understanding which country's laws and regulations apply to data based on where it is stored.

13. NETWORK SECURITY AND PORTS

Layer 3 and Layer 4 Filtering

Filtering network traffic using network-layer and transport-layer information, including IP addresses and ports.

Firewall

A security control that monitors and filters incoming and outgoing network traffic.

IP Tables

A Linux firewall utility used to configure rules for filtering network traffic.

Access Control Lists (ACLs)

Rules that determine which traffic is allowed or denied.

AWS Security Groups

AWS virtual firewalls that control inbound and outbound traffic for associated resources.

Network Access Control Lists (NACLs)

AWS network-level controls that filter inbound and outbound traffic at the subnet level.

Azure Network Security Groups (NSG)

Azure controls that filter network traffic using security rules.

GCP VPC Firewall

Google Cloud firewall rules that control network traffic within a VPC.

14. IMPORTANT NETWORK PORTS

SSH - Port 22

Used for secure remote access to systems.

FTP - Ports 20/21

File Transfer Protocol. Port 21 handles control, while port 20 handles active-mode data transfer.

HTTP - Port 80

Used for standard, unencrypted web traffic.

HTTPS - Port 443

Used for encrypted web traffic.

DNS - Port 53

Used to translate domain names into IP addresses.

RDP - Port 3389

Remote Desktop Protocol, used for remote access to Windows systems.

MySQL - Port 3306

Default port for MySQL databases.