Project - Paradigm of Building Cyber-ops team from Square one
- If Alex wants to wipe the contents of the disk, first he needs to take a backup of the data.
- Disk partitioning is used to split a disk into 2 logical drives
- NTFS (New Technology File System)
- NTFS supports Windows 2000 and later versions.
- Network Interface Card can also be used to connect systems via wireless and wired.
- Solid State Drive (SSD) will be needed for faster file transfer and booting performance.
- Network Attached Storage (NAS)
- RAID (Redundant Array of Independent Disks) needs to be enabled here.
- Disk Mirroring
- Server
- Device that authenticates all users is Active Directory.
- DHCP ( Dynamic Host Configuration Protocol) assigns IP automatically to the new clients
- User Account Control
- Admin privileges are required to gain access like administrator credentials and password.
- If Alex chooses, selective startup in the general feature of windows, he can speed up computer startup by selecting which services need to be loaded.
- Bitlocker needs to be enabled to encrypt disk drive and its contents.
- TPM (Trusted Platform Module)
- Bitlocker To Go feature is used to provide encryption on USB Drives.
- Powershell is used to automate tasks using CLI.
- SFC (System File Checkup) is used to check corrupted files.
- SYSTEMINFO is used to display all processor information, OS details and BIOS details.
- EXT4 is compatible for installing latest Linux OS.
- New directory can be created using the command mkdir.
- First we should find out in which directory we are using command pwd. Then we can go into the required directory/home/project/org using the command cd and enter the filename abc.text.
- Gzip is used to compress a file.
- Third party applications are installed in /opt path.
- End user tools
- In /var path, log files are stored.
- Michael will suggest Firewall to monitor incoming traffic as first line of defence.
- Packet filtering firewall
- Routers
- Edge Router
- Switch
- Unmanaged Switch
- WiFi Technology
- 5GHz bandwidth
- Access points
- Range extenders
- MAC Address
- IPConfig command can be used to display MAC address, IP Address and other details.
- Network Interface Card must be installed on the devices so that the device can be connected to a network.
- Range of IP Addresses in IPV4 : Class A 0-127
Class B 128-191
Class C 192-223
Class D 224-239
Class E 240-225 Michael can use Class C for 50 workstations. 192.0.0.0 - 223.255.255.255 Subnet mask for 92.168.10.0 : 01011100.10101000.00001010.00000000 - NETSTAT to check if connection is established.
- IPCONFIG to display IP address information
- TRACERT to count the hops between 2 devices.
- Host to display IP Address info in Linux.
- nslookup
- Class A can support 16million hosts, so it can be used for Rivera.
- Intrusion Prevention System (IPS).
- Network IPS (NIPS) and Host IPS (HIPS)
- Intrusion Detection System (IDS)
- IPS is more protective than IDS because IPS detects the malicious traffic and takes actions to either prevent the malicious activity or terminate the connection itself. IDS only detects the malicious traffic and triggers an alarm, so that the engineer can work on it. this takes more time compared to IPS.
- Broadcast
- Limited broadcast is used to send messages on all nodes of network. 255.255.255.255
- ARP ( Address Resolution Protocol)
- Port 22 for SSH and Port 3389 for RDP
- The device used to block all unwanted ports is
- NAT (Network Address Translation)
- VPN (Virtual Private Network)
- In BIOS settings, Alex can enable virtualization.
- Sandbox
- Chief Information Security Officer (CISO)
- Aim of SOC team is to identify, analyse and react to cyber threats using a reliable set of processes and technology solutions.
- Ethical hacker (White hat hacker)
- Bug bounty
- Black hat hacker
- National states
- Cyber warfare
- Polymorphic virus
- Trojan horse virus
- Downloader Trojans
- Adware
- Antivirus
- Endpoint security team
- Bruteforce attack
- Botnet / Command and control
- Zombie computers
- Keyloggers
- Keystroke logging
- In every URL, the protocol is mentioned. If a website is secure the protocol is mentioned with an S which means secure. If customers can see S infront of the protocol in the URL, this means that the website is secure.
- Port 443
- HTTP (Hyper Text Transfer Protocol)
- HTTP Request methods : GET, HEAD, POST, PUT, DELETE, PATCH, OPTIONS
- GET
- POST
- 100
- 403
- Web Application Firewall (WAF)
- Web application security
- Cross site scripting
- Vulnerability Management team
- A type of malware
- SQL Injection
- Software update needs to be done to get latest CRM version.
- Any vulnerability must be treated once it is deemed as a risk. Remediation : Fully fixing or patching the vulnerability so that it cannot be exploited. Mitigation : Lessening the likelihood or an impact of this vulnerability being exploited. Used when a proper fix is not available. Acceptance : Taking tno action to mitigate the vulnerability. Used when the vulnerability is low risk or it costs a lot to treat it, more than when it affects the system.
- Identity and Access Management (IAM)