Cyber Security · Comprehensive Guide

Block 5 Study Guide

Every unit from the Block 5 Cyber Security course, explained in plain language — risks & threats (including the STRIDE model), network security, firewalls, security zones, incident response, cyber hygiene & disaster recovery, and security programs. Extra depth on STRIDE, Incident Response, and Disaster Recovery — each unit has its own quiz.

// The big idea

A threat exploits a vulnerability to carry out an attack

A threat is any circumstance or event that could adversely affect a system — through unauthorized access, destruction, disclosure, modification, or denial of service. A vulnerability is a flaw or weakness in a system's design or operation that a threat could exploit. Not every threat leads to a successful attack — that depends on the vulnerability's severity, the strength of the attack, and how effective your countermeasures are.

Threats can come from insiders (people already inside the security perimeter who misuse their authorized access) or outsiders (people with no authorization at all, sometimes organized into botnets — networks of compromised computers controlled remotely to launch automated attacks or spam).

⭐ Exam focus

STRIDE is a model used to categorize every threat a system might face during design. Each letter is a goal attackers pursue — and a goal defenders design against. Click each one open below.

Spoofing violates authenticity. An attacker impersonates a user, device, or system to gain access they shouldn't have — like forging a "From" address on an email, or a device pretending to be your default gateway.

// Think of it like...A stranger wearing a delivery uniform to walk past the front desk. The uniform (identity) is fake, but it's convincing enough to get them past the check.

Tampering violates integrity. An attacker changes data in a way it shouldn't be changed — editing a file in storage, altering a message in transit, or modifying values in a database. Hashing and digital signatures (covered in Unit 7) are the main defenses.

Repudiation violates non-repudiation — the ability to prove who did what. Without good logging and digital signatures, a user (or attacker) can deny sending a message, making a change, or performing an action, and there's no way to prove otherwise.

Information disclosure violates confidentiality. This is any leak of data to an unauthorized party — a misconfigured file share, an unencrypted transmission that gets intercepted, or an error message that reveals more than it should.

Denial of Service violates availability. Instead of stealing or altering data, the attacker just overwhelms a system so nobody can use it — see the DoS/DDoS section below.

Elevation of privilege violates authorization. A normal (or unauthenticated) user finds a way to gain administrator-level access — the difference between "read this file" and "control the whole system."

// Memory trickS-T-R-I-D-E maps almost 1:1 onto the opposite of six security goals: Authenticity, Integrity, Non-repudiation, Confidentiality, Availability, Authorization. Every STRIDE threat is an attack on one of those six.

Denial of Service (DoS)

One attacking machine floods a target with more requests than it can handle, so legitimate users can't get through.
Easy to launch, hard to fully prevent — timing makes it difficult to trace.

Distributed DoS (DDoS)

Same idea, but the flood comes from many computers at once — usually a botnet.
Countermeasures: don't run public servers near capacity, filter forged packets, keep hosts patched.

Unauthorized access & destructive behavior

Unauthorized access attacks try to reach a resource the attacker shouldn't be able to use — often by falsely identifying as a trusted host. Systems split users into user access (limited, everyday privileges) and administrator access (full control) to limit the blast radius.

Data diddling is quietly altering data (like fudging numbers in financial records) — dangerous because it's not obviously a break-in and can go unnoticed for months. Data destruction is the opposite: wiping data outright, through methods like degaussing, overwriting, or physical/electronic shredding. Even authorized disposal must fully sanitize data so nothing can be recovered.

Phishing broadcasts fraudulent messages (email, text, fake websites) to a wide audience, hoping someone bites — like a fisherman casting a baited line. Spear phishing targets a specific person or group using information gathered about them (like from social media) — aiming a spear instead of casting a line. Whaling is spear phishing aimed specifically at high-value targets like a CEO, where the payoff is much bigger.

Baiting dangles something tempting to trigger a bad decision — the classic example is leaving a malware-infected USB drive somewhere public, labeled to look legitimate, hoping someone plugs it in.

Mitigating social engineering

  • Don't open email/attachments from suspicious sources; treat unsigned email more cautiously.
  • Use multifactor authentication so a stolen password alone isn't enough.
  • Keep antivirus/antimalware signatures updated — an out-of-date signature database won't catch new threats.
  • If an offer looks too good to be true, research before acting.

Malware is software designed to infiltrate or damage a system without the owner's informed consent — judged by the creator's intent, not any specific feature. It's not the same as defective software, which has bugs but no malicious intent.

Virus typeWhat it does
Boot-sectorLives in a disk/USB's first sector and loads into memory every startup — extremely dangerous, spreads to every disk the system reads.
File infectorAttaches to a file or program and activates whenever that file runs; also called an executable or parasitic virus.
Macro virusWritten in a macro language, triggers automatically when a document is opened — infects files, not whole systems.
Logic bombSits dormant until a trigger condition (like a specific date) is met, then executes.
// Just like biologyComputer viruses reproduce and spread the way biological viruses do — one infected file passed around an office can infect every machine, and can lie dormant and re-infect systems months later.

A supply chain is the full network of entities — governments, companies, vendors — that gets a product from raw material to final destination. Supply chain security protects that chain (transport, logistics, manufacturing) against threats like tampering, counterfeiting, piracy, and theft, since a single compromised link (like a malicious hardware component or backdoored update) can compromise everything downstream of it.

// The big idea

NAC checks a device before letting it fully on the network

Network Access Control (NAC) is a wired/wireless security solution that only grants access if a system meets predefined conditions. Anything that fails gets shunted to a restricted network to become compliant first. Agent-based NAC installs software on the client to check it; agentless NAC checks from the authentication server instead. Agents can be permanent (continuously monitoring) or dissolvable (installed just to scan on connection, then removed or left until disconnect).

NAC can enforce host health checks (OS updates, antivirus status, host firewall status), require users to accept wireless terms of usage, and works alongside 802.1X, an IEEE standard requiring valid credentials before a switch allows a connection.

1

Something you know

Passwords, PINs — the most common factor.

2

Something you have

Swipe cards, physical tokens, an SMS code.

3

Something you are

Fingerprint, retina, face, voice — biometrics.

4

Somewhere you are

Determined by GPS or IP address.

5

Something you do

Typing rhythm, signature, gait.

Multifactor authentication (MFA) combines two or more different factor categories — a password plus a token is MFA; a username plus a password is not (both are "something you know"). Single sign-on (SSO) lets a user authenticate once and access multiple systems — convenient, but if that one account is compromised, so is everything it touches.

AAA protocolNotes
RADIUSClients connect via a RADIUS client, which sends the request over UDP to a RADIUS server for verification. Pairs with 802.1X on wireless/switches.
DiameterA newer, more reliable AAA protocol using TCP.
TACACS / XTACACSLegacy — TACACS for Unix, Extended TACACS (XTACACS) for Cisco devices.
TACACS+Replaced TACACS/XTACACS — the AAA protocol used in modern Cisco networks.
1

Requirements

Define what the app is supposed to do.

2

Design

Design the app to meet those requirements.

3

Implementation

Code gets written.

4

Testing

Check functionality; fuzz with invalid input to find crashes.

5

Deployment

Install onto production servers.

6

Maintenance

Fix issues users report.

Waterfall

Each phase must finish before the next begins — no backtracking.
Predictable, but expensive to change course mid-project.

Agile

Work is divided into ~4-week "sprints," each running all phases.
Backtracking is allowed as needed — more adaptable.

Common application vulnerabilities

  • Cross-Site Scripting (XSS) — attacker injects malicious JavaScript into a web app to steal session cookies or impersonate users.
  • Cookies — unencrypted HTTP traffic can expose stored logon/preference data to interception.
  • P2P file sharing & ActiveX controls — common paths for malicious code to reach a system.

Prevent these with regular patching, a secure configuration baseline, disabling unneeded features (hardening), and denying "remember me" cookies to reduce cross-site request forgery risk.

Boot & removable-media threats

An attacker can boot from an alternate disc/drive to bypass a system's normal OS security — mitigated by disabling alternate boot devices and using secure boot, which only runs digitally signed boot files. USB ports are a common malware vector (a worm can jump from a home PC to a work PC via flash drive), so DoD systems typically disable removable storage entirely.

FDE & TPM

Full Disk Encryption (FDE) encrypts an entire drive, OS included (e.g. BitLocker) — useless to a thief without the key.
A Trusted Platform Module (TPM) is a chip that stores the cryptographic keys FDE relies on.

HSM & IDS/IPS

A Hardware Security Module (HSM) is an add-on card dedicated to cryptographic processing.
IDS detects and alerts; IPS detects and takes corrective action — both come in host-based (HIDS/HIPS) and network-based (NIDS/NIPS) flavors.
// The big idea

Default deny, then open specific exceptions

A firewall monitors traffic crossing a boundary and allows or blocks it based on administrator-defined rules. Best practice is to block everything by default, then open only the specific ports/traffic actually needed (e.g. a web server exposes just TCP 80/443). Firewalls can be software, hardware, or both, and even block internal users from resources they don't have a "need to know" for.

Forward proxy

Sits between an internal client and the internet — the client's requests go out through it.
Hides the client's real IP from external sites, and can cache pages for faster repeat access.

Reverse proxy

Sits in front of internal servers — external requests come in through it after being checked.
Used when an outside system needs to reach something inside, like a web or mail server.

A transparent proxy needs no client configuration — you just point the default gateway at it. A nontransparent proxy requires installing a client/agent. Proxies acting as application/multipurpose firewalls can inspect the packet payload itself, not just headers — filtering by data type and content, not just source/destination.

NTFS permissionGrants
Read / Read & executeOpen and read file contents; view folder contents.
Write / ModifyRead contents and execute an executable file.
Full controlModify contents, or create a new file/folder.

Securing a Windows folder is two steps: set NTFS permissions on the folder itself, then set share permissions (Read / Change / Full Control) when you publish it to the network — share permissions apply to everything inside the folder.

Standard access list

Numbered 1–99; filters by source IP only.
First matching rule wins; implicit deny at the bottom.

Extended access list

Numbered 100+; filters by source and destination IP, plus protocol.
More precise, built and applied the same way as standard lists.
TypeHow it filters
Packet-filtering (stateless)Checks source/destination IP and port from the header only — an attacker can spoof the header to get past it.
Stateful packet inspectionSame header checks, plus tracks the conversation's context (e.g. was there a valid 3-way TCP handshake first?).
Application-layerCombines packet-filtering and stateful inspection with payload inspection — same idea as an application/multipurpose proxy.

Software-based (host-based) firewalls protect a single system — Windows Firewall is a built-in example. Hardware-based (network-based) firewalls sit at the network edge and protect everything behind them. On Linux, iptables uses policy chains (Input, Output, Forward) to control traffic into, out of, and through the system. Group Policy Objects (GPOs) in Active Directory can centrally configure the built-in Windows Firewall and other security settings across every machine on a domain.

// The big idea

Firewalls carve a network into zones of trust

A firewall plan typically defines three core zones, from most to least trusted:

🏠

Private zone

Your LAN/intranet. No traffic from any other network reaches it without passing a firewall first.

🚧

DMZ

Sits between an external and internal firewall — selected internet traffic is allowed in here, but not past it.

🌐

Public zone

Any network you don't control — the internet is the classic example.

Additional zones

  • Extranet — servers made accessible to specific outside organizations, not the whole public.
  • Wireless zone — its own segment so admins can restrict which other zones wireless clients can reach.
  • Guest zone — internet access for visitors, with no path to the private LAN or extranet.

The purpose of all this segmentation is control: the DMZ is where public-facing servers (web, SMTP, FTP, DNS) live, with only the specific ports they need opened on the external firewall — while the internal firewall blocks anything originating from the internet from ever reaching the private LAN.

⭐ Exam focus — Incident Response

This is one of the most heavily-tested units on the exam. An incident response policy exists so that when something goes wrong, everyone already knows their role — no one is improvising during a crisis.

Ensures every team member knows their role during an incident, and builds relationships with outside resources that may be needed in special circumstances.

Has the technical expertise to assess scale and correct the situation. A CIRT may have several — e.g. a Windows specialist, a Linux specialist, a Cisco specialist.

Documents the entire response, logging each incident in a database — including the cause and the solution — for future reference.

What the incident response plan should define

  • Incident categories — what types of incidents can occur (e.g. "social engineering attack," "denial of service attack").
  • Roles & responsibilities — each team member's job before, during, and after an incident.
  • Reporting & escalation — when/how users report, and who the first responder escalates to.
  • Exercise planning — practicing the full incident lifecycle before a real one happens.

The first responder — a CIRT member — is the first person notified and takes charge of the incident on arrival.

Event

Any observable occurrence in a system or network — may or may not indicate anything bad is happening.

Incident

An assessed occurrence that actually or potentially jeopardizes confidentiality, integrity, or availability — or violates security policy.
CategoryWhat it means
CAT 1Root-Level Intrusion — unauthorized admin-level access or control.
CAT 2User-Level Intrusion — unauthorized non-privileged access.
CAT 3Unsuccessful Activity Attempt — access attempt defeated by normal defenses.
CAT 4Denial of Service — activity that denies, degrades, or disrupts normal function.
CAT 5Non-Compliance Activity — risk created by an authorized user's action or inaction (e.g. missed patches).
CAT 6Reconnaissance — gathering info to characterize a target for a future attack.
CAT 7Malicious Logic — installed malware without remote interactive control (with control, it's CAT 1/2).
CAT 8Investigating — suspicious activity under review, not yet categorized elsewhere.
CAT 9Explained Anomaly — investigated and found non-malicious (e.g. a false alarm).
1

Detection & Reporting

Spot the event (IDS/IPS, user reports, trend analysis) and report it in near-real-time — speed here drives everything after it.

2

Preliminary Analysis & ID

Assign an initial category. As more info comes in, the category can change (e.g. CAT 8 → CAT 1).

3

Preliminary Response

Contain the threat, preserve evidence integrity, and begin chain-of-custody documentation.

4

Incident Analysis

Dig into technical details, root cause, and potential impact to decide next steps and who else needs to be involved.

5

Response & Recovery

Restore affected systems and implement a plan of action to prevent recurrence.

6

Post-Incident Analysis

Postmortem review of what happened and how well the response worked — lessons learned get documented and shared.

// The first responder's #1 jobActivate the CIRT and contain the incident — e.g. if a virus is found, unplug the network cable before doing anything else. Stop the bleeding first, investigate second.
1

Gather Information

Collect all relevant data — logs, accounts, intel, technical details, current operational context.

2

Validate the Incident

Continuously review and corroborate the report to confirm accuracy.

3

Determine Operational Impact

How badly does this hurt the mission — data loss, downed systems, degraded capability?

4

Coordinate

Loop in the system owner and relevant security centers to determine criticality.

5

Determine Reporting

Decide within the required window whether formal operational reporting thresholds are met.

Root cause analysis happens while the incident is still active — it's not just a paperwork exercise afterward. The post-incident report captures lessons learned, the initial root cause, and anything that went wrong with the response itself (missing policies, failed courses of action) so the same mistake isn't repeated.

// The big idea

~90% of attacks are stopped by basic cyber hygiene

Cyber hygiene is the routine of everyday practices that keep a system healthy and secure — much like physical hygiene wards off everyday illness. It's mostly about consistency: let firewalls, antivirus, and updates do their job without interference, and follow good password habits.

Strong passwords

  • Minimum 18 characters — longer is better.
  • Mix numbers, symbols, upper and lower case.
  • Avoid dictionary words and obvious substitutions (like "P@ssw0rd").
  • Never reuse the same password across services — one breach shouldn't compromise everything.

A baseline is your system's starting reference point — how it's supposed to be configured. You measure it, fix issues, and declare that state the baseline. Later, re-measuring reveals deviations (positive, like lowered risk, or negative, like new vulnerabilities) so you know exactly what changed.

Configuration management is the discipline of tracking every hardware/software change so nothing goes undocumented — undocumented changes cause instability, downtime, and security gaps. Good config management delivers three benefits: disaster recovery (assets are easily restored to a known-good state), uptime/site reliability, and scalability (provisioning becomes a non-event instead of a scramble).

Backup typeWhat it backs upClears archive bit?
FullEverything, every time.Yes
DifferentialEverything changed since the last full backup — slower to run, faster to restore.No
IncrementalEverything changed since the last backup of any kind — fastest to run, slowest to restore (must replay every increment in order).Yes
RAID levelMin. disksHow it works
RAID 02Striping only — boosts speed, but one failed drive loses everything. No redundancy.
RAID 12Mirroring — every drive is a full duplicate. Great for data retention (e.g. auth servers).
RAID 10 (1+0)4Striping + mirroring combined. Common for application servers/databases.
RAID 53Striping with one parity bit — survives one drive failure. Common for email archives.
RAID 64Striping with double parity — survives two drive failures. Common for IAM servers.
⭐ Exam focus — Disaster Recovery Plan

Every department should have an IT disaster recovery plan (DRP) — a documented strategy to inventory critical assets, back them up, and get the mission running again after a disaster.

1

Assemble the team

Core members from every department, including top management, own the DR operation end-to-end.

2

Risk assessment

Analyze possible disasters — natural and man-made — and their potential impact.

3

Prioritize

Rank data, processes, and resources as critical, essential, important, or non-essential.

4

Data collection

Inventory everything — equipment, forms, contacts, backup locations, retention policies.

5

Create the plan

Step-by-step instructions for what to do when disaster strikes, reviewed regularly.

6

Test the plan

A DRP that's never been tested is just a guess — see the four test types below.

A DRP should always define...

  • The critical systems that matter most to the mission.
  • DR team contacts and a Recovery Time Objective (RTO) — how fast systems must come back online.
  • Communication methods to use during the disaster, and an alternative facility if the primary site is unusable.

Walk-throughs / Orientation

Basic awareness training on the plan's contents and each person's role — no simulated conditions.

Tabletop exercise

Staff talk through the procedures in a conference room — simple to run, but no practical evidence of what actually works.

Functional exercise

Action-based, scenario-driven — validates the plan in a simulated environment.

Full-scale exercise

The real thing — real equipment, real personnel, onsite, reflecting an actual disaster.

Confidentiality

Only authorized people can read it.
Tools: permissions/ACLs, encryption, steganography.

Integrity

It hasn't been altered in transit or storage.
Tools: hashing, digital signatures/certificates, nonrepudiation.

Availability

It's there when a legitimate user needs it.
Tools: permissions, backups, RAID (fault tolerance), clustering, patching.

Computer Security (COMPUSEC) protects information system resources — endpoint security, ports/protocols/services — against sabotage, tampering, denial of service, espionage, fraud, and misuse. Threats fall into three buckets: unauthorized access (remote hacking or physical intrusion), malicious logic (viruses, spyware, and other malware), and Fraud, Waste & Abuse (FW&A) — misusing organizational resources for personal benefit.

TEMPEST addresses compromising emanations — every electronic device unintentionally radiates signals (electromagnetic interference) that, with the right equipment, can be intercepted and reconstructed into intelligible information, even from a device with no network connection. Countermeasures include proper installation, grounding, shielding, and using a Protected Distribution System (PDS) — a wireline/fiber system with safeguards that let it safely carry unencrypted data.

Information Security (INFOSEC) is the umbrella program that implements the CIA Triad. Its tools span encryption (confidentiality), hashing and digital signatures (integrity), and RAID/clustering/patching (availability) — everything covered above, applied as a coordinated program rather than isolated techniques.

Operations Security (OPSEC) reduces the chance that an adversary can piece together critical information (facts about friendly capabilities/intentions) from indicators — small, individually-unclassified details that add up to something sensitive when combined. OPSEC is everyone's responsibility, not just leadership's.

  • Social media — avoid posting operational details, locations, or images of sensitive activity.
  • Open conversations — don't discuss work specifics in public; you never know who's listening.
  • Private messaging / SMS — still interceptable; don't assume "private" means secure.
  • Family & friends — don't share deployment details or job specifics without a clear need-to-know.
🔐

Cryptosecurity

Using cryptographic systems properly so intercepted messages stay unreadable to the enemy.

📡

Transmission Security (TRANSEC)

Choosing the right secured transmission method — protects against interception by means other than cryptanalysis.

🔒

Physical Security

Locking down COMSEC material and equipment — approved safes, restricted access lists, secure areas.

Encryption converts data into an unreadable form; decryption restores it. Cryptography is the practice of building those coding systems; cryptanalysis is the practice of breaking them.

STRIDESpoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege — Microsoft's threat-categorization model.
DoS / DDoSDenial of Service / Distributed Denial of Service — overwhelming a system so legitimate users can't use it.
CIRTComputer Incident Response Team — the group responsible for handling security incidents.
CATCategory — the severity/type classification (0–9) assigned to a cyber event or incident.
RCARoot Cause Analysis — the 5-step process to find what actually caused an incident.
DRPDisaster Recovery Plan — the documented strategy for recovering critical systems after a disaster.
RTORecovery Time Objective — the target time to restore a system after a disruption.
RAIDRedundant Array of Independent Disks — combining physical drives for speed and/or fault tolerance.
NACNetwork Access Control — checks a device against required conditions before granting network access.
AAAAuthentication, Authorization, and Accounting — centralized access control services.
RADIUSRemote Authentication Dial-In User Service — an AAA protocol using UDP.
TACACS+The AAA protocol used in modern Cisco networks, replacing TACACS/XTACACS.
MFA / SSOMultifactor Authentication (2+ factor categories) / Single Sign-On (one login for multiple systems).
SDLCSoftware Development Life Cycle — the phased process of building an application.
XSSCross-Site Scripting — injecting malicious JavaScript into a web application.
IDS / IPSIntrusion Detection System (detects & alerts) / Intrusion Prevention System (detects & acts).
FDEFull Disk Encryption — encrypting an entire drive, including the OS.
TPMTrusted Platform Module — a chip that stores the cryptographic keys used by FDE.
HSMHardware Security Module — an add-on device dedicated to cryptographic processing.
DMZDemilitarized Zone — the network segment between an external and internal firewall for public-facing servers.
ACLAccess Control List — permissions rules controlling who/what can access a resource.
GPOGroup Policy Object — a set of configurations pushed out via Active Directory.
CIA TriadConfidentiality, Integrity, Availability — the three fundamental goals of information security.
COMPUSECComputer Security — protecting information system resources from sabotage, tampering, and misuse.
TEMPESTA program addressing compromising electromagnetic emanations from electronic equipment.
OPSECOperations Security — preventing adversaries from piecing together critical information from indicators.
COMSECCommunications Security — cryptosecurity, transmission security (TRANSEC), and physical security combined.
TRANSECTransmission Security — choosing the right secured transmission method for communications.
CIILCritical Information and Indicators List — the record of an organization's critical information under OPSEC.
BaselineThe reference configuration a system is measured against to detect deviations over time.