Project - Paradigm of Building Cyber-ops team from Square one

1. Disk Cleanup can help free up space on the disk, including deleting of the temporary files, emptying the Recycle Bin and removal of unused programs. User can free up disk space and maintain system properties by running Disk Cleanup on a regular basis. User can improve the performance of Disk Defragmenter by running Disk Cleanup in advance.

2. SSD (Solid State Drives) partition helps to organize files properly, making it easier for you and ensuring a logical separation. Moreover, SSD partitioning is also beneficial in streamlining the backup process and making it efficient.

3. FAT 32

4. ex FAT

5. Router is used in workstations of the organization that need to be connected via wired and wireless.

6. Non Volatile Memory Express hardware

7. NAS (Network Attached Storage) devices

8. RAID (Redudant Array of Independent Disks) feature can be enabled.

9. RAID level 1 is used to work and provides data redundancy and failover because it reads and writes the exact same data to each disk.

10. Servers are used in the infrastructure.

11. Next Generation Firewall (NGFW) devices to authenticate users using Windows system.

12. Dynamic Host Configuration Protocol (DHCP)

13. UAC (User Access Control) feature is enabled.

14. Admins can grant full administrator access or rights token to those application while starting up so that we don’t get the UAC prompt.

15. Msconfig command - startup utility tool can fix this issue.

16. BitLocker ensures that all the disk drives and their contents in organization are encrypted.

17. Trusted Platform Module (TPM) chip is used.

18. BitLocker To Go can be enabled for USB drive encryption.

19. PowerShell scripts can be used in a CLI mode itself.

20. sfc /scannow command is used to repair corrupt files.

21. systeminfo command

22. Ext4 file format will be compatible for installing the latest Linux OS.

23. mkdir Org

24. mv abc.txt /home/project/org

25. gzip SOW.txt

26. /opt is the default path where the applications will be installed.

27. In Kernel, installation of the third-party applications such as office suites, multimedia players and designing tools are done.

28. /var path is used to evaluate the logs which are generated by the servers.

29. Firewall device directs all the incoming traffic which will act as the first line of defense.

30. Packet Filtering Firewall devices should be purchased based on the size of the organization where it performs a simple check of the data packets coming through the router—inspecting information such as the destination and origination IP address, packet type, port number.

31. A Router serves two primary functions such as managing traffic between these networks by forwarding data packets to their intended IP addresses, and allowing multiple devices to use the same Internet connection.

32. Edge Router will be used for optimizing the bandwidth and designed to connect similar devices.

33. A network device called Switch uses the MAC address to identify which attached device outgoing packets are being sent from and where to deliver incoming packets

34. Unmanaged Switch will be suitable for basic fixed configuration and generally used as a plug and play device.

35. Wi-Fi technology enables the user to connect wireless to the network.

36. 2.4 GHz frequency band is applicable to utilize the network speed more than 50 Mbps.

37. An access point device is used.

38. Range Extender device is used.

39. Static IP address

40. ipconfig/all

41. IP Address and MAC Address should be configured initially on all the devices.

42. There are 5 classes in the IPv4 addressing system.

IPV4 Ranges:

Class A: 1.0.0.0 to 127.0.0.0

Class B: 128.0.0.0 to 191.255.0.0

Class C: 192.0.0.0 to 223.255.255.0

Class D: 224.0.0.0 to 239.255.255.255

Class E: 240.0.0.0 to 255.255.255.255

43. Class C IP Address is used in small organisations. Ranges between 192.0.0.0 to 223.255.255.0

44. Start IP Address: 192.168.10.0 End IP Address: 192.168.10.255

45. Subnet mask: 255.255.255.0

46. DCDIAG /TEST:DNS /V /E /S:domaincontroller. DCDIAG Command

47. ipconfig /all

48. tracert command

49. ifconfig command

50. dig rivera.com

51. Class B IP Address

52. Intrusion Prevention System devices can be used. Particularly NIPS (Network Prevention System) is used

53. Simple Network Management Protocol (SNMP) and Internet COntrol Message Protocol (ICMP) technology should be enabled in the organisation to monitor the network traffic at host level.

54. Intrusion Detection System can be implemented. Specifically NIDS (Network Intrusion Detection System) is used.

55. An IDS offers less help when you're under threat. You must figure out what to do, when to do it, and how to clean up the mess. An IPS does all of this for you.

56. Broadcast transmission will be used to reveal it’s MAC information to the entire network hierarchy.

57. 255.255.255.255 IP Address

58. Address Resolution Protocol (ARP)

59. Port numbers need to be enabled servers for SSH and RDP access are 22 and 3389.

60. Hardware-based firewalls can be used to block unwanted ports.

61. Network address translation (NAT) Technology allow multiple devices to access the Internet through a single public address.

62. Client-to-Server VPN technology ensures all the network traffic to be encrypted when the employees are working from home.

63. Microsoft Hyper-V Server

64. Cyber Attack

65. Chief Information Security Officer (CISO) is a person who defines the security operations of the organization and they need to communicate with management about security issues and oversee compliance tasks

66. Aim of the SOC team is to identify, analyse and react to cyber threats.

67. White Hat Hacker

68. Vulnerability Management

69. Black Hat Hackers

70. Cyber Warfare

71. Malware

72. Polymorphic Malware

73. Trojan Horse Virus

74. Backdoor Trojan

75. Malvertising - Adware

76. AntiVirus

77. Security Engineer

78. Distributed denial-of-service (DDoS) attack

79. DNS flood

80. Botnets

81. Keyloggers

82. Hardware based keylogger - Keyboard hardware connects the port and give access to malicious users to record the activity.

83. A secure website's URL should begin with “https” rather than “http”. The “s” at the end of “http” stands for secure and is using an SSL (Secure Sockets Layer) connection.

84. Port 443 is the SSL function for HTTPS, used to transmit web pages securely through encryption techniques.

85. TCP (Transmission Control Protocol) Protocol

86. List of HTTP Request methods are:

GET

HEAD

POST

PUT

DELETE

PATCH

OPTIONS

87. In GET Method, the information will be visible when the user is trying to access the website.

88. In PUT Method, the data can’t be cached.

89. HTTP status code: 200 OK

90. HTTP status code: 403 Forbidden

91. HTTP status code:

92. Web Application Firewall (WAF) security device will monitor all the web application-based attack and defend in the first place.

93. Security Engineer / Architect

94. XSS - Cross Site Scripting

95. Incident Response Manager

96. Application Security

97. Zero Day Attack

98. Software Upgrade

99. Remediation techniques in an organization are:

• Should be determined by the organisation's security team such as System Owners and System Administrators.
• Can be done by applying software patch or replacing physical servers.
• Run VM scans to find vunerabilities to get it fixed.
• Vulneraibility assessments should be conducted regularly to identify the risk factors.

100. Identity and Access Management Team