Scribd Logo
Upload

Welcome to Scribd!

  • 43 views

    CySA Notecards

    Uploaded by

    smm azad
    The document provides information on regulatory frameworks, security domains, cloud service models, incident response phases, regular expressions, data loss prevention modes, risk management concepts from NIST, error codes, threat and vulnerability responses, UDP and TCP ports, and security tools.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    CySA Notecards

    Uploaded by

    smm azad
    43 views14 pages
    The document provides information on regulatory frameworks, security domains, cloud service models, incident response phases, regular expressions, data loss prevention modes, risk management concepts from NIST, error codes, threat and vulnerability responses, UDP and TCP ports, and security tools.

    Original Title

    CySA__Notecards

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document provides information on regulatory frameworks, security domains, cloud service models, incident response phases, regular expressions, data loss prevention modes, risk management concepts from NIST, error codes, threat and vulnerability responses, UDP and TCP ports, and security tools.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    43 views14 pages

    CySA Notecards

    Uploaded by

    smm azad
    The document provides information on regulatory frameworks, security domains, cloud service models, incident response phases, regular expressions, data loss prevention modes, risk management concepts from NIST, error codes, threat and vulnerability responses, UDP and TCP ports, and security tools.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 14

    Study Notecards

    Frameworks

    Perspective: ESA, must deploy controls


    Regulatory: Externally verifiable statement
    Risk-Based: Internal assessment results
    Governance: Stakeholders make decisions

    © 2021 Proprietary and Confidential. All Rights Reserved.


    Regulatory Frameworks
    GDPR: EU requirements for Internet usage
    PCI DSS: Financial payment card regulation
    NIST: Cybersecurity best practices
    HIPAA: Healthcare-related regulations
    SOX: Prevents fraud in account practices
    FedRAMP: Government related
    CCPA: California data privacy rights
    COBIT: SACA creation for tech/business gaps

    © 2021 Proprietary and Confidential. All Rights Reserved.


    Domain Security

    SPF: Approved hosts on domain/anti-spoofing


    DKIM: Domain Authentication Mechanism
    DMARC: SPF and DKIM-enforced policies

    © 2021 Proprietary and Confidential. All Rights Reserved.


    Cloud Service Models
    IaaS: IT resources, servers, load balancers,
    SAN
    PaaS: Multi-tier and provides web app and
    database/storage
    SaaS: Virtual infrastructure, on-demand apps,
    CSP handles platform security
    FaaS: Containers

    © 2021 Proprietary and Confidential. All Rights Reserved.


    IR Phases
    Preparation: Hardening, writing policies, setup
    communications
    Detection/Analysis: Determine if attack took place
    and assess severity
    Containment: Limit scope and magnitude of incident
    Eradication/Recovery: Remove threat, secure
    systems
    Post-Incident Activity: Improve procedures, lessons
    learned

    © 2021 Proprietary and Confidential. All Rights Reserved.


    SIEM Regex

    ^ = match start of line


    $ = match end of line
    {} = match exact number of times
    ? = match exists once or not at all
    | = pipe, divides commands

    © 2021 Proprietary and Confidential. All Rights Reserved.


    DLP Mode Types
    Classification: Document labels
    Policy Template: Containing PII
    Statistical: Machine Learning
    Exact Data Match: String values
    Document Match: Fingerprint and document
    types

    © 2021 Proprietary and Confidential. All Rights Reserved.


    NIST Managing Risk
    Assess: Assess business workflows
    Frame: Eliminate negative change/degree of
    risk tolerated
    Respond: Managerial, operational, technical
    security
    Monitor: Effectiveness of response measures
    and ID changes that affect risk management

    © 2021 Proprietary and Confidential. All Rights Reserved.


    Service/Error Codes
    400 = Bad Request 1xx = Informational
    401 = Unauthorized 2xx = Success
    403 = Forbidden 3xx = Redirection
    404 = Not Found 4xx = Client Error
    500 = Internal Server Error 5xx = Server Error
    502 = Bad Gateway
    503 = Service Unavailable
    504 = Gateway Timeout

    © 2021 Proprietary and Confidential. All Rights Reserved.


    Threat & Vuln Responses
    False Negative: Exposed to threat but unaware
    False Positive: Reported threat when it shouldn't
    True Negative: Threat not reported, when it shouldn't be
    True Positive: Threat reported, when it should be

    Known Unknown: Known signature, but not detected


    Known Known: Previously known and have a solution
    Unknown Unknown: Completely new attack vector
    Unknown Known: Risk documented but disregarded

    © 2021 Proprietary and Confidential. All Rights Reserved.


    UDP Ports
    53 = DNS 162 = SNMP-Trap
    67 = DHCPS (server port) 445 = microsoft-ds (file sharing)
    68 = DHCPC (client port) 500 = isakmp (IPSEC)
    69 = TFTP (trivial) 514 = SYSLOG
    123 = NTP (Network time) 520 = RIP (routing into)
    135 = MSRPC 631 = IPP (printing)
    137 = Netbios-NS (name service) 1434 = MySQL
    138 = Netbios-dgm (datagram) 1900 = UPNP (plug 'n' play)
    139 = Netbios-SSN (session) 4500 = NAT-T-IKE (IPSEC)
    161 = SNMP (net mgmt) 49152 = dynamic ports

    © 2021 Proprietary and Confidential. All Rights Reserved.


    TCP Ports
    21 = FTP 143 = IMAP (internet mail)
    22 = SSH/SFTP 443 = HTTPS
    23 = Telnet 445 = Microsoftds (file sharing)
    25 = SMTP 993 = IMAPS (IMAP secure)
    53 = DNS 995 = POP3s (POP3 secure)
    80 = HTTP 1723 = PPTP (VPN)
    110 = POP3 (legacy mailbox) 3306 = MySQL (SQL DB)
    111 = RPCbind (unix port mapping) 3389 = RDP
    135 = MSRPC 5900 = VNC (remote virtual network)
    139 = Netbios-SSN (Windows file 8080 = HTTP-proxy
    sharing)

    © 2021 Proprietary and Confidential. All Rights Reserved.


    Tools
    Reaver: Cmdline brute force against WPS ModSecurity: WAF for Apache, Nginx and
    Wireshark: Packet analyzer IIS
    TCPdump: Cmdline packet sniffer; tcpdump -i eth Netcat: Read/write raw data over network
    Hashcat: Cmdline tool for brute force/dictionary connections
    attack against password hash Nikto: Vuln scanner for web apps
    Memoryze: Forensics imaging tool Nmap: Versatile port scanner
    Prowler: Open-source AWS vuln scanner OSSIM: Alien Vault SIEM
    Pacu: Open-source cloud pentesting framework Responder: Cmdline poison responses to
    Aircrack-ng: Suite of tools for testing wireless Netbios, LLMNR and MDNS
    networks Scoutsuite: Open-source vuln scanner for
    Arachni: Open-source web app scanner AWS, Azure & GCP clouds
    Autopsy: Open-source disk imaging and analysis Snort: Open-source NIDS
    Autoruns: Microsoft sysinternals suite/process Cellebrite UFED: Mobile extraction tool
    startup MPE+: AccessData for mobile forensics tool
    FTK: Forensics toolkit Awk: Modifying and extracting data
    Hping: Cmdline packet crafting prepared for analysis

    © 2021 Proprietary and Confidential. All Rights Reserved.

    You might also like