Every unit from the Block 5 Cyber Security course, explained in plain language — risks & threats (including the STRIDE model), network security, firewalls, security zones, incident response, cyber hygiene & disaster recovery, and security programs. Extra depth on STRIDE, Incident Response, and Disaster Recovery — each unit has its own quiz.
// Objective 1a · Threats, vulnerabilities, and attacks
A threat is any circumstance or event that could adversely affect a system — through unauthorized access, destruction, disclosure, modification, or denial of service. A vulnerability is a flaw or weakness in a system's design or operation that a threat could exploit. Not every threat leads to a successful attack — that depends on the vulnerability's severity, the strength of the attack, and how effective your countermeasures are.
Threats can come from insiders (people already inside the security perimeter who misuse their authorized access) or outsiders (people with no authorization at all, sometimes organized into botnets — networks of compromised computers controlled remotely to launch automated attacks or spam).
// STRIDE — Microsoft's threat model
STRIDE is a model used to categorize every threat a system might face during design. Each letter is a goal attackers pursue — and a goal defenders design against. Click each one open below.
// Objective 1a · Network attacks
Unauthorized access attacks try to reach a resource the attacker shouldn't be able to use — often by falsely identifying as a trusted host. Systems split users into user access (limited, everyday privileges) and administrator access (full control) to limit the blast radius.
Data diddling is quietly altering data (like fudging numbers in financial records) — dangerous because it's not obviously a break-in and can go unnoticed for months. Data destruction is the opposite: wiping data outright, through methods like degaussing, overwriting, or physical/electronic shredding. Even authorized disposal must fully sanitize data so nothing can be recovered.
// Objective 1b · Social engineering — "hacking the human"
// Objective 1c · Malicious code (malware)
Malware is software designed to infiltrate or damage a system without the owner's informed consent — judged by the creator's intent, not any specific feature. It's not the same as defective software, which has bugs but no malicious intent.
| Virus type | What it does |
|---|---|
| Boot-sector | Lives in a disk/USB's first sector and loads into memory every startup — extremely dangerous, spreads to every disk the system reads. |
| File infector | Attaches to a file or program and activates whenever that file runs; also called an executable or parasitic virus. |
| Macro virus | Written in a macro language, triggers automatically when a document is opened — infects files, not whole systems. |
| Logic bomb | Sits dormant until a trigger condition (like a specific date) is met, then executes. |
// Objective 1d · Supply chain
A supply chain is the full network of entities — governments, companies, vendors — that gets a product from raw material to final destination. Supply chain security protects that chain (transport, logistics, manufacturing) against threats like tampering, counterfeiting, piracy, and theft, since a single compromised link (like a malicious hardware component or backdoored update) can compromise everything downstream of it.
// Quiz yourself · Unit 1
// Objective 2a · Network Access Control (NAC)
Network Access Control (NAC) is a wired/wireless security solution that only grants access if a system meets predefined conditions. Anything that fails gets shunted to a restricted network to become compliant first. Agent-based NAC installs software on the client to check it; agentless NAC checks from the authentication server instead. Agents can be permanent (continuously monitoring) or dissolvable (installed just to scan on connection, then removed or left until disconnect).
NAC can enforce host health checks (OS updates, antivirus status, host firewall status), require users to accept wireless terms of usage, and works alongside 802.1X, an IEEE standard requiring valid credentials before a switch allows a connection.
// Objective 2b · Authentication, Authorization & Accounting (AAA)
Passwords, PINs — the most common factor.
Swipe cards, physical tokens, an SMS code.
Fingerprint, retina, face, voice — biometrics.
Determined by GPS or IP address.
Typing rhythm, signature, gait.
Multifactor authentication (MFA) combines two or more different factor categories — a password plus a token is MFA; a username plus a password is not (both are "something you know"). Single sign-on (SSO) lets a user authenticate once and access multiple systems — convenient, but if that one account is compromised, so is everything it touches.
| AAA protocol | Notes |
|---|---|
| RADIUS | Clients connect via a RADIUS client, which sends the request over UDP to a RADIUS server for verification. Pairs with 802.1X on wireless/switches. |
| Diameter | A newer, more reliable AAA protocol using TCP. |
| TACACS / XTACACS | Legacy — TACACS for Unix, Extended TACACS (XTACACS) for Cisco devices. |
| TACACS+ | Replaced TACACS/XTACACS — the AAA protocol used in modern Cisco networks. |
// Objective 2c · Application security
Define what the app is supposed to do.
Design the app to meet those requirements.
Code gets written.
Check functionality; fuzz with invalid input to find crashes.
Install onto production servers.
Fix issues users report.
Prevent these with regular patching, a secure configuration baseline, disabling unneeded features (hardening), and denying "remember me" cookies to reduce cross-site request forgery risk.
// Objective 2d · Hardware security
An attacker can boot from an alternate disc/drive to bypass a system's normal OS security — mitigated by disabling alternate boot devices and using secure boot, which only runs digitally signed boot files. USB ports are a common malware vector (a worm can jump from a home PC to a work PC via flash drive), so DoD systems typically disable removable storage entirely.
// Quiz yourself · Unit 2
// Objective 3a · What a firewall does
A firewall monitors traffic crossing a boundary and allows or blocks it based on administrator-defined rules. Best practice is to block everything by default, then open only the specific ports/traffic actually needed (e.g. a web server exposes just TCP 80/443). Firewalls can be software, hardware, or both, and even block internal users from resources they don't have a "need to know" for.
// Proxy servers
A transparent proxy needs no client configuration — you just point the default gateway at it. A nontransparent proxy requires installing a client/agent. Proxies acting as application/multipurpose firewalls can inspect the packet payload itself, not just headers — filtering by data type and content, not just source/destination.
// Access Control Lists (ACLs)
| NTFS permission | Grants |
|---|---|
| Read / Read & execute | Open and read file contents; view folder contents. |
| Write / Modify | Read contents and execute an executable file. |
| Full control | Modify contents, or create a new file/folder. |
Securing a Windows folder is two steps: set NTFS permissions on the folder itself, then set share permissions (Read / Change / Full Control) when you publish it to the network — share permissions apply to everything inside the folder.
// Firewall types
| Type | How it filters |
|---|---|
| Packet-filtering (stateless) | Checks source/destination IP and port from the header only — an attacker can spoof the header to get past it. |
| Stateful packet inspection | Same header checks, plus tracks the conversation's context (e.g. was there a valid 3-way TCP handshake first?). |
| Application-layer | Combines packet-filtering and stateful inspection with payload inspection — same idea as an application/multipurpose proxy. |
Software-based (host-based) firewalls protect a single system — Windows Firewall is a built-in example. Hardware-based (network-based) firewalls sit at the network edge and protect everything behind them. On Linux, iptables uses policy chains (Input, Output, Forward) to control traffic into, out of, and through the system. Group Policy Objects (GPOs) in Active Directory can centrally configure the built-in Windows Firewall and other security settings across every machine on a domain.
// Quiz yourself · Unit 3
// Objective 4a · Demilitarized Zone (DMZ) & friends
A firewall plan typically defines three core zones, from most to least trusted:
Your LAN/intranet. No traffic from any other network reaches it without passing a firewall first.
Sits between an external and internal firewall — selected internet traffic is allowed in here, but not past it.
Any network you don't control — the internet is the classic example.
The purpose of all this segmentation is control: the DMZ is where public-facing servers (web, SMTP, FTP, DNS) live, with only the specific ports they need opened on the external firewall — while the internal firewall blocks anything originating from the internet from ever reaching the private LAN.
// Quiz yourself · Unit 4
This is one of the most heavily-tested units on the exam. An incident response policy exists so that when something goes wrong, everyone already knows their role — no one is improvising during a crisis.
// Objective 5a · The incident response team (CIRT)
The first responder — a CIRT member — is the first person notified and takes charge of the incident on arrival.
// Event vs. Incident
| Category | What it means |
|---|---|
| CAT 1 | Root-Level Intrusion — unauthorized admin-level access or control. |
| CAT 2 | User-Level Intrusion — unauthorized non-privileged access. |
| CAT 3 | Unsuccessful Activity Attempt — access attempt defeated by normal defenses. |
| CAT 4 | Denial of Service — activity that denies, degrades, or disrupts normal function. |
| CAT 5 | Non-Compliance Activity — risk created by an authorized user's action or inaction (e.g. missed patches). |
| CAT 6 | Reconnaissance — gathering info to characterize a target for a future attack. |
| CAT 7 | Malicious Logic — installed malware without remote interactive control (with control, it's CAT 1/2). |
| CAT 8 | Investigating — suspicious activity under review, not yet categorized elsewhere. |
| CAT 9 | Explained Anomaly — investigated and found non-malicious (e.g. a false alarm). |
// Objective 5b · The six phases of incident response
Spot the event (IDS/IPS, user reports, trend analysis) and report it in near-real-time — speed here drives everything after it.
Assign an initial category. As more info comes in, the category can change (e.g. CAT 8 → CAT 1).
Contain the threat, preserve evidence integrity, and begin chain-of-custody documentation.
Dig into technical details, root cause, and potential impact to decide next steps and who else needs to be involved.
Restore affected systems and implement a plan of action to prevent recurrence.
Postmortem review of what happened and how well the response worked — lessons learned get documented and shared.
// Objective 5c · Root cause analysis — 5 steps
Collect all relevant data — logs, accounts, intel, technical details, current operational context.
Continuously review and corroborate the report to confirm accuracy.
How badly does this hurt the mission — data loss, downed systems, degraded capability?
Loop in the system owner and relevant security centers to determine criticality.
Decide within the required window whether formal operational reporting thresholds are met.
Root cause analysis happens while the incident is still active — it's not just a paperwork exercise afterward. The post-incident report captures lessons learned, the initial root cause, and anything that went wrong with the response itself (missing policies, failed courses of action) so the same mistake isn't repeated.
// Quiz yourself · Unit 5
// Objective 6a · Cyber hygiene basics
Cyber hygiene is the routine of everyday practices that keep a system healthy and secure — much like physical hygiene wards off everyday illness. It's mostly about consistency: let firewalls, antivirus, and updates do their job without interference, and follow good password habits.
// Objective 6c & 6d · Baselines & configuration management
A baseline is your system's starting reference point — how it's supposed to be configured. You measure it, fix issues, and declare that state the baseline. Later, re-measuring reveals deviations (positive, like lowered risk, or negative, like new vulnerabilities) so you know exactly what changed.
Configuration management is the discipline of tracking every hardware/software change so nothing goes undocumented — undocumented changes cause instability, downtime, and security gaps. Good config management delivers three benefits: disaster recovery (assets are easily restored to a known-good state), uptime/site reliability, and scalability (provisioning becomes a non-event instead of a scramble).
// Objective 6e · Backup & recovery
| Backup type | What it backs up | Clears archive bit? |
|---|---|---|
| Full | Everything, every time. | Yes |
| Differential | Everything changed since the last full backup — slower to run, faster to restore. | No |
| Incremental | Everything changed since the last backup of any kind — fastest to run, slowest to restore (must replay every increment in order). | Yes |
| RAID level | Min. disks | How it works |
|---|---|---|
| RAID 0 | 2 | Striping only — boosts speed, but one failed drive loses everything. No redundancy. |
| RAID 1 | 2 | Mirroring — every drive is a full duplicate. Great for data retention (e.g. auth servers). |
| RAID 10 (1+0) | 4 | Striping + mirroring combined. Common for application servers/databases. |
| RAID 5 | 3 | Striping with one parity bit — survives one drive failure. Common for email archives. |
| RAID 6 | 4 | Striping with double parity — survives two drive failures. Common for IAM servers. |
Every department should have an IT disaster recovery plan (DRP) — a documented strategy to inventory critical assets, back them up, and get the mission running again after a disaster.
Core members from every department, including top management, own the DR operation end-to-end.
Analyze possible disasters — natural and man-made — and their potential impact.
Rank data, processes, and resources as critical, essential, important, or non-essential.
Inventory everything — equipment, forms, contacts, backup locations, retention policies.
Step-by-step instructions for what to do when disaster strikes, reviewed regularly.
A DRP that's never been tested is just a guess — see the four test types below.
// Quiz yourself · Unit 6
// The CIA Triad — the three goals every security program serves
// Objective 7a · COMPUSEC
Computer Security (COMPUSEC) protects information system resources — endpoint security, ports/protocols/services — against sabotage, tampering, denial of service, espionage, fraud, and misuse. Threats fall into three buckets: unauthorized access (remote hacking or physical intrusion), malicious logic (viruses, spyware, and other malware), and Fraud, Waste & Abuse (FW&A) — misusing organizational resources for personal benefit.
// Objective 7b · TEMPEST
TEMPEST addresses compromising emanations — every electronic device unintentionally radiates signals (electromagnetic interference) that, with the right equipment, can be intercepted and reconstructed into intelligible information, even from a device with no network connection. Countermeasures include proper installation, grounding, shielding, and using a Protected Distribution System (PDS) — a wireline/fiber system with safeguards that let it safely carry unencrypted data.
// Objective 7c · INFOSEC — CIA in practice
Information Security (INFOSEC) is the umbrella program that implements the CIA Triad. Its tools span encryption (confidentiality), hashing and digital signatures (integrity), and RAID/clustering/patching (availability) — everything covered above, applied as a coordinated program rather than isolated techniques.
// Objective 7d · OPSEC
Operations Security (OPSEC) reduces the chance that an adversary can piece together critical information (facts about friendly capabilities/intentions) from indicators — small, individually-unclassified details that add up to something sensitive when combined. OPSEC is everyone's responsibility, not just leadership's.
// Objective 7e · COMSEC
Using cryptographic systems properly so intercepted messages stay unreadable to the enemy.
Choosing the right secured transmission method — protects against interception by means other than cryptanalysis.
Locking down COMSEC material and equipment — approved safes, restricted access lists, secure areas.
Encryption converts data into an unreadable form; decryption restores it. Cryptography is the practice of building those coding systems; cryptanalysis is the practice of breaking them.
// Quiz yourself · Unit 7
// Block 5 term reference