Cybersecurity Certification Exam

. Chain of Custody

Definition: A documented process that shows who had access to the evidence and when.

Importance: Preserves the integrity and trustworthiness of the evidence.

2. Evidence Preservation

Procedures: Use write blockers, create bit-by-bit forensic images, and avoid altering original media.

Goal: Prevent tampering or data loss.

3. Data Acquisition

Tools used: FTK Imager, EnCase, dd (Linux command).

Concepts: Understand how to properly capture volatile (RAM) and non-volatile (disk) data.

4. Legal Considerations

Includes: Search warrants, privacy laws, and jurisdictional issues.

Relevance: Forensics must follow legal procedures to avoid compromising investigations.

5. Documentation

Practice: Record every action, tool used, timestamps, and findings.

Reason: Ensures repeatability and supports findings in legal/organizational contexts.

6. Validation of Tools

Why it matters: Tools must be tested and validated to ensure accuracy and reliability.

Practice: Compare results from multiple tools when possible.

7. Analysis Techniques

Concepts include: Timeline analysis, file carving, hash analysis, and metadata examination.

Tools: Autopsy, Sleuth Kit, X-Ways, etc.

8. Reporting and Presentation

Skill: Creating clear, objective reports for technical and non-technical audiences.

Includes: Screenshots, logs, and a summary of findings.

While incident documentation, a one-to-one copy needs to be created and devices need to be kept in the same state that they were found

HTTPS: Secures web traffic.

SSL/TLS: Encrypts data in transit.

SSH: Secure remote login and command execution.

SFTP/FTPS: Secure file transfer.

Firewalls: Control incoming and outgoing network traffic.

Intrusion Detection/Prevention Systems (IDS/IPS): Monitor for suspicious activity.

Antivirus/Anti-malware Software: Detect and remove malicious software.

VPNs (Virtual Private Networks): Encrypt data and mask IP addresses.

Authentication: Ensure users are who they claim (e.g., 2FA, biometrics).

Access Control: Restrict who can access what (e.g., role-based access).

WPA2 (Wi-Fi Protected Access 2):

A security protocol that protects wireless networks using strong encryption (AES).

RADIUS (Remote Authentication Dial-In User Service):

A network protocol that manages user authentication, authorization, and accounting.

Port 443:

The default port is used for secure web traffic over HTTPS.

• SSL/TLS (Secure Sockets Layer / Transport Layer Security): A set of protocols that provide encryption for secure data transmission over a network

Zero-Day Exploit: A cyberattack that takes advantage of a software vulnerability unknown to the vendor and unpatched at the time of the attack.

Ping of Death: A denial-of-service attack that sends oversized or malformed ping packets to a target, causing system crashes or instability.

Risk Categorize: The process of identifying and classifying risks based on their potential impact and likelihood (e.g., low, medium, high).

Risk Mitigate: Taking actions to reduce the likelihood or impact of a risk (e.g., installing antivirus, applying patches).

Risk Accept: A decision to acknowledge a risk without taking action, often because the cost of mitigation is higher than the potential damage.

Unauthorized Hacking (black)

Performed by an unethical criminal hacker who breaks laws, steals data, holds information for ransom, and commits other criminal acts. Their behavior is meant to cause harm, to draw attention to something, or to achieve personal gain.

Authorized Hacking (white)

Performed by an ethical cybersecurity expert who has permission to perform security tests and who fully discloses their activities. They report vulnerabilities and improve the security of a system. Their behavior is noble and their actions align with society’s greater good.

Botnet

    Software that replicates and infects many computers, turning the computer into     a “zombie”. Zombie devices are remotely controlled by an attacker for malicious     purposes.

Keylogger

    Software and hardware that track all keyboard clicks, including backspaces, to     discover usernames, passwords, credit card numbers, and other sensitive     information.

On Path Attack

    A human-based attack in which the malicious user intercepts communication     between the victim’s computer and the internet.

Ransomware

    Software that locks your computer or makes it inoperable, requiring you to pay     someone to remove it. Ransomware can spread like a virus, worm, or Trojan horse.

Rootkit

    Software running with elevated privileges to control a computer or to gain     access to restricted accounts and data.

Programming Errors

    Problems, faults, and bugs in the program that are exploitable, allowing     attackers access to the computer on which the program is running.

RBAC (Role-Based Access Control): A security model where access permissions are assigned based on a user's role within an organization.

DAC (Discretionary Access Control): A security model where the owner of a resource decides who can access it and what permissions they have.

Clickjacking: A malicious technique where users are tricked into clicking on something different from what they perceive, often by hiding a legitimate button or link under a fake UI.

Hacker: A person who uses technical skills to gain unauthorized access to systems or data; can be ethical (white hat) or malicious (black hat).

Dictionary Attack: A method of breaking passwords by systematically trying common words or phrases from a precompiled list (dictionary).

Cryptography:

The science and practice of securing information through codes and techniques like encryption, hashing, and digital signatures.

Encryption:

A subset of cryptography that transforms readable data (plaintext) into unreadable form (ciphertext) to prevent unauthorized access.

• Caesar Cipher: A substitution cipher that shifts letters a fixed number of positions in the alphabet.

• Affine Cipher: A mathematical substitution cipher using the formula (ax + b mod m).

• Vigenère Cipher: A polyalphabetic substitution cipher using a repeated keyword to vary letter shifts.

• Pigpen Cipher: A symbolic substitution cipher replacing letters with geometric symbols.

• Substitution Cipher: A cipher that replaces each unit of plaintext with another (letter, symbol, or group).

• Transposition Cipher: A cipher that changes the order of characters without altering the actual characters.

• Symmetric vs. Asymmetric Key Encryption:

  • Symmetric Encryption: Uses the same key for encryption and decryption (e.g., AES).

  • Asymmetric Encryption: Uses a public key for encryption and a private key for decryption (e.g., RSA).

• Updates:

  General improvements or changes to software that may include new features, bug fixes, performance enhancements, or security fixes.

  Patches:

  Specific changes applied to fix security vulnerabilities, bugs, or other known issues in software — usually released in response to a known flaw.

• Steganography:
  The practice of hiding a secret message within an ordinary, non-secret file or message (e.g., embedding text in an image or audio file) so that the existence of the message is concealed.

  Cryptography:
  The practice of transforming a message into an unreadable form (ciphertext) using encryption so that only authorized parties can read it, even if the message is detected.

• Penetration Testing: A simulated cyber attack on a computer system, network, or web application to assess its security and identify vulnerabilities before they can be exploited by malicious actors.

Behavioral Biometrics:
A form of biometric security that analyzes patterns in human behavior, such as typing speed, mouse movements, and walking patterns, to verify identity or detect fraud.

• Examples:

  • Keystroke dynamics (how you type)

  • Mouse movement patterns

  • Gait analysis (how you walk)

  • Signature dynamics (how you sign your name)

Malware: Viruses, worms, ransomware.

Phishing: Deceptive messages to steal credentials.

Denial-of-Service (DoS/DDoS): Overloading systems to crash them.

Man-in-the-Middle (MitM): Intercepting data between two parties.

Packet Sniffing: Monitoring network traffic to steal data.

Tailgating: A physical security attack where an unauthorized person gains access to a restricted area by following closely behind an authorized person, typically without their knowledge or permission.

Whaling Attack: A type of phishing attack targeting high-profile individuals (e.g., CEOs, executives) with highly personalized messages to steal sensitive information or money.

Vulnerabilities in Information Systems and File Systems

Information System Vulnerabilities:

• Unpatched Software: Security flaws in outdated or unpatched applications that can be exploited by attackers.

• Weak Authentication: Weak passwords, lack of multi-factor authentication (MFA), or default credentials can allow unauthorized access.

• Insecure Communication: Using unencrypted protocols (e.g., HTTP instead of HTTPS) can expose sensitive data during transmission.

• Poor Access Control: Improper permissions or role-based access controls (RBAC) can allow unauthorized users to access sensitive information.

• Human Error: Social engineering attacks (like phishing) that trick users into disclosing sensitive information.

• Misconfigurations: Incorrect system configurations (e.g., leaving unnecessary ports open or default settings) can lead to vulnerabilities.

File System Vulnerabilities:

• Unencrypted Files: Files stored without encryption can be easily accessed if the system is compromised.

• Directory Traversal: Attackers can exploit improper input validation in file paths to access restricted files outside the intended directory.

• Inadequate Permissions: Files with improper or overly permissive access rights can be accessed, modified, or deleted by unauthorized users.

• File System Corruption: Errors in file system design or management (e.g., lost clusters, bad sectors) can lead to data integrity issues.

• Executable Files: Malicious executable files hidden in legitimate locations can be executed to compromise the system.

Procedures Necessary for Finding and Containing Malware and Viruses

1. Finding Malware and Viruses:

• Use Antivirus/Antimalware Software: Run a full system scan to detect known malware or viruses. Keep the antivirus definitions up to date.

• Analyze System Logs: Review event logs (e.g., Windows Event Viewer) for unusual activities, such as unexpected logins or service failures.

• Monitor Network Traffic: Look for unusual network traffic patterns, such as high outbound traffic, which could indicate data exfiltration.

• File Integrity Checking: Use tools to monitor critical files for unauthorized changes.

• Behavioral Analysis: Use sandboxes or isolation environments to run suspicious files and monitor their behavior.

2. Containing Malware and Viruses:

• Isolate Infected Systems: Disconnect compromised systems from the network to prevent the spread of malware.

• Quarantine Infected Files: Place suspicious files in quarantine to prevent them from executing or causing further damage.

• Disable Network Shares and Remote Access: Disable file-sharing and remote access to limit the reach of the attack.

• Revert to Backups: If available, restore clean, uninfected system backups.

• Patching and Updates: Ensure the system is up to date with the latest security patches to close vulnerabilities exploited by malware.

• Perform a Full Cleanup: After containment, fully clean the system using antimalware tools, re-scan, and verify that the malware is eradicated.

• Forensic Analysis: Conduct a post-incident analysis to identify how the malware entered, what it affected, and ensure the root cause is addressed.

Identity Theft:
A crime where someone steals personal information (e.g., Social Security number, credit card details) to impersonate the victim and commit fraud or other crimes.

Phishing:
A type of social engineering attack where an attacker sends fraudulent communications (usually emails) that appear to be from a trusted source to trick individuals into revealing sensitive information like passwords or financial details.

Hacking:
The act of gaining unauthorized access to computer systems or networks, often to steal, modify, or destroy data, or to disrupt normal operations.

WPA2 (Wi-Fi Protected Access 2):
A security protocol used to secure wireless networks by employing strong encryption (AES) to protect data transmitted over Wi-Fi.

RADIUS (Remote Authentication Dial-In User Service):
A protocol for centralized authentication, authorization, and accounting (AAA) that manages user access to a network, typically used with wireless networks and VPNs.

Port 443:
The default port used for HTTPS (secure HTTP), ensuring encrypted communication between a web browser and a web server.

Ping Flood:
A Denial of Service (DoS) attack where an attacker sends a large number of ICMP echo request (ping) packets to overwhelm the target system, consuming resources and causing it to slow down or crash.

Ping of Death:
An outdated DoS attack where an attacker sends a maliciously large ping packet to a target, causing the system to crash or become unresponsive due to buffer overflow vulnerabilities in older systems.

Smurf Attack:
A type of DoS attack where an attacker sends a large number of ICMP packets with the victim's IP address as the source address, causing the target system to be flooded with responses from many machines in the network.

Mailbomb:
An email-based DoS attack where the attacker sends a large volume of emails to a specific email address or mail server, overwhelming the server and potentially causing a system crash or delays in mail delivery.

Teardrop Attack:
A DoS attack where malformed or oversized packets are sent to a target system, causing it to crash due to an inability to reassemble the packets correctly (vulnerable systems that don't handle fragmentation errors properly).

Identification:

The process of presenting an identity to the system.

Methods:

• Username/ID number: A unique identifier used by the system to distinguish different users.

• Smartcards/RFID: Physical tokens used to identify users through hardware.

• Biometrics: Identifiers such as fingerprints, facial recognition, or retina scans.

• Public Key Infrastructure (PKI): Certificates or keys that establish user identity.

Authentication:

The process of verifying the identity of the user or system.

Methods:

• Something you know:

  • Password/PIN: A secret combination of characters or numbers known only to the user.

• Something you have:

  • Security tokens: Physical devices or apps that generate one-time passwords (OTP).

  • Smartcards/RFID cards: Physical tokens used to authenticate a user.

• Something you are:

  • Biometric authentication: Fingerprint, facial recognition, iris scans, voice recognition, etc.

• Something you do:

  • Behavioral biometrics: Patterns in how you type, move the mouse, or walk.

• Two-Factor Authentication (2FA): Combines two of the methods above for enhanced security (e.g., password + OTP).

Authorization:

The process of determining what actions or resources the authenticated user is permitted to access.

Methods:

• Role-Based Access Control (RBAC): Users are assigned roles, and access is granted based on the role.

• Discretionary Access Control (DAC): The resource owner determines who has access and what permissions they have.

• Mandatory Access Control (MAC): Access is based on policies set by an administrator; users cannot modify them.

• Attribute-Based Access Control (ABAC): Access is based on user attributes such as job role, location, or time of access.

• Access Control Lists (ACLs): Lists that define which users or groups have access to specific resources and what operations they can perform.

Whistleblower:

An individual who reports unethical, illegal, or corrupt practices within an organization, typically to authorities or external bodies, to expose wrongdoing.

Industrial Espionage:

The act of using unethical or illegal methods to gather confidential information or trade secrets from competitors or other organizations for competitive advantage.

Prevention:

The act of implementing measures, strategies, or controls to avoid or reduce the likelihood of a security breach, crime, or undesirable event from occurring.

Social Ideology:

A set of beliefs, values, or principles held by an individual or group that influences their behavior, actions, and decisions, often in the context of politics, culture, or society.

Financial Gain:

The acquisition of money or financial assets as a result of actions or activities, often used as a motivation for committing crimes or unethical actions.

Certified Digital Forensic (CDF):

A certification that verifies an individual's expertise in conducting digital forensic investigations, including the collection, preservation, analysis, and presentation of digital evidence. CDF professionals are trained to handle and analyze electronic data for use in legal cases, cybercrimes, or internal investigations.

Reporting (in Digital Forensics):

The process of documenting and presenting the findings of a digital forensic investigation. This includes the detailed analysis of evidence, methodologies used, and the conclusions drawn, often presented in a report format for use in legal proceedings or organizational reviews.

Advanced Persistent Threat (APT): a sophisticated, possibly long-running computer hack that is perpetrated by large, well-funded organizations such as governments

DDOS: Hacker floods a server with numerous bogus requests through numerous zombies so that legitimate users can no longer access the server

IP address: A number that uniquely identifies each computer or device connected to the Internet.

worm: Is a self-replicating program that spreads across computer networks without the need for human interaction.

Discretionary Access Control (DAC): Allows owners of resources to control the access permissions of other users. It gives them the choice to decide who can access their resources and what level of access they have.

Plain text attack: This attack involves intercepting data that is being transmitted over a network without encryption, allowing attackers to access and manipulate sensitive information.

Off-set encryption: also known as asymmetric encryption, uses two different keys - a public key and a private key.