SEC-HQ KNOWLEDGE BASE
RETURN TO PORTAL

Module Reference Knowledge Base

Comprehensive architectural frameworks, protocols, threat vectors, and standard operating procedures.

Networking & Cloud Architecture

OSI Model Data Units (PDU)

  • Bits: Layer 1 Physical physical signal transmission
  • Frames: Layer 2 Data Link MAC addressing and switching
  • Packets: Layer 3 Network IP routing across networks
  • Segments: Layer 4 Transport TCP/UDP port multiplexing
  • Data: Layers 5-7 Application session payload execution

DNS Resolution Hierarchy

  • Recursive Resolver: Client ISP or public DNS receiver (1.1.1.1)
  • Root Name Server: Directs query to top-level domain servers
  • TLD Name Server: Handles .com, .org, .gov domain routing
  • Authoritative Server: Holds actual IP resource records (A, AAAA)

Common Ports & Protocols (Part 2)

  • Port 21 (FTP): Unencrypted File Transfer Protocol
  • Port 25 (SMTP): Simple Mail Transfer Protocol mail routing
  • Port 88 (Kerberos): Active Directory authentication tickets
  • Port 389/636 (LDAP/S): Directory service querying & auth

Cloud Deployment Models

  • Public Cloud: Multi-tenant shared infrastructure (AWS, Azure)
  • Private Cloud: Dedicated single-tenant enterprise infrastructure
  • Hybrid Cloud: Integrated public and private cloud environments
  • Multi-Cloud: Combining independent services across vendors

Virtualization vs Containers

  • Type-1 Hypervisor: Bare-metal OS host (VMware ESXi, Proxmox)
  • Type-2 Hypervisor: Hosted virtualization layer (VirtualBox)
  • Containers: Shared kernel process isolation (Docker, Podman)
  • Orchestration: Automated container scaling (Kubernetes)

Wi-Fi Security Evolution

  • WEP: Deprecated RC4 stream cipher with broken IVs
  • WPA: Temporary fix utilizing TKIP hashing wrapper
  • WPA2: Enterprise standard using CCMP and AES-128
  • WPA3: Modern standard using SAE handshake & 192-bit CNSA

Cryptography & Encryption

Symmetric Encryption Algorithms

  • AES-256: Industry standard block cipher (Rijndael)
  • ChaCha20: Fast stream cipher optimized for mobile devices
  • 3DES: Legacy triple-DES block cipher (Deprecated)
  • Blowfish/Twofish: Flexible key length public block ciphers

Asymmetric Encryption Algorithms

  • RSA: Prime factorization-based key exchange & signatures
  • ECC: Elliptic Curve Cryptography offering smaller key sizes
  • Diffie-Hellman: Secure shared secret negotiation over untrusted channels
  • Ed25519: High-speed Edwards-curve digital signature algorithm

Hashing & Integrity Functions

  • SHA-256 / SHA-3: Collision-resistant cryptographic hash standards
  • MD5 / SHA-1: Obsolete algorithms vulnerable to collisions
  • HMAC: Keyed-hash message authentication code for payloads
  • Salt & Pepper: Cryptographic randomness appended to passwords

Password Hashing Algorithms

  • Bcrypt: Adaptive blowfish-based key derivation function
  • Argon2id: Password Hashing Competition winner resistant to GPU attacks
  • PBKDF2: NIST-recommended iterative HMAC function
  • Scrypt: Memory-hard key derivation function

Digital Certificates (X.509)

  • SAN: Subject Alternative Name mapping multiple domains
  • Public Key: Included in certificate for client encryption
  • Digital Signature: CA private-key sign validating legitimacy
  • Validity Period: Expiry window requiring automated renewal

SSL/TLS Handshake Flow (TLS 1.3)

  • Client Hello: Supported ciphers and key share proposal
  • Server Hello: Chosen cipher, server certificate, and key exchange
  • Encrypted Extensions: Parameters configured under encryption
  • Finished Messages: Authenticated handshake complete for data

Application & Software Security

OWASP Top 10 Critical Flaws

  • A01: Broken Access Control: Unauthorized privilege escalation
  • A02: Cryptographic Failures: Weak algorithms or cleartext
  • A03: Injection: Untrusted input executed in database/shell
  • A04: Insecure Design: Lack of threat modeling in design

API Security Best Practices

  • OAuth 2.0: Authorization framework using access tokens
  • OIDC: Identity verification layer built on top of OAuth 2.0
  • Rate Limiting: Throttling API endpoints against brute-force
  • Input Schema Validation: Rejecting malformed JSON payloads

Static vs Dynamic Testing (AppSec)

  • SAST: Inside-out static source code scanning without execution
  • DAST: Outside-in black-box scanning during active runtime
  • IAST: Agent-based hybrid testing inside the application
  • RASP: Real-time application self-protection runtime agent

Software Supply Chain Security

  • SBOM: Software Bill of Materials inventorying dependencies
  • Dependency Confusion: Executing code from public registries
  • Typosquatting: Publishing packages with near-identical names
  • Code Signing: Cryptographically validating release integrity

Buffer Overflow Defense

  • DEP / NX Bit: Marking memory stacks non-executable
  • ASLR: Randomizing memory layout positions of program components
  • Stack Canaries: Placing secret values to detect buffer overruns
  • Memory Safe Languages: Migrating execution code to Rust or Go

Browser Security Controls

  • CSP: Restricting origins where scripts and content load
  • CORS: Regulating cross-origin API data requests
  • SameSite Attribute: Mitigating cross-site request forgery
  • HSTS: Forcing browsers to enforce HTTPS-only connections

Identity, Access & Authentication

Active Directory Structure

  • Domain Controller: Server hosting Active Directory services
  • Forest & Domain: Boundaries isolating enterprise resources
  • GPO: Centralized OS and security configuration policies
  • Kerberos Tickets: TGT and TGS authentication ticket workflows

Active Directory Attacks

  • Kerberoasting: Extracting service hashes for offline cracking
  • AS-REP Roasting: Targeting accounts without pre-auth
  • Pass-the-Hash: Reusing NTLM hashes for lateral movement
  • Golden Ticket: Forging TGT tickets via krbtgt hash

Privileged Access Management (PAM)

  • Vaulting: Encrypting and rotating admin passwords
  • Just-In-Time Access: Granting temporary admin rights on demand
  • Session Recording: Auditing interactive shell sessions
  • Break-Glass Accounts: Emergency admin credentials in reserve

SSO Protocols

  • SAML 2.0: XML-based enterprise single sign-on exchange
  • OAuth 2.0: Token-based authorization delegation framework
  • OIDC: JSON Web Token (JWT) identity layer extending OAuth
  • WS-Federation: Legacy enterprise identity federation standard

Threats, Malware & Attack Vectors

Social Engineering Taxonomy

  • Phishing: Broad email deception targeting credentials
  • Spear Phishing: Customized attack targeting specific individuals
  • Whaling: Executive-level social engineering extortion
  • Vishing / Smishing: Voice call and SMS text deception

Denial of Service Techniques

  • SYN Flood: Exhausting TCP tables with uncompleted handshakes
  • UDP Amplification: Exploiting resolvers to reflect magnified payloads
  • HTTP Flood: Saturating web servers with resource GET/POST requests
  • Slowloris: Holding sockets open with incomplete HTTP headers

Man-in-the-Middle (MitM) Attacks

  • ARP Spoofing: Mapping attacker MAC address to gateway IP
  • DNS Cache Poisoning: Injecting false IP records into local DNS
  • SSL Stripping: Downgrading HTTPS connections to HTTP
  • Rogue Access Point: Deploying evil twin Wi-Fi networks

Advanced Persistent Threat (APT) Phases

  • Initial Access: Spear phishing or zero-day exploitation
  • Establish Foothold: Deploying web shells and C2 beacons
  • Lateral Movement: Pivoting across subnets using stolen credentials
  • Exfiltration: Compress, encrypt, and staging data for transfer

Insider Threat Types

  • Malicious Insider: Intentional theft or sabotaging of assets
  • Negligent Insider: Unintentional policy bypass causing exposure
  • Compromised Insider: Employee whose credentials were stolen
  • Third-Party Vendor: External contractor with excessive access

Security Operations & Incident Response

SIEM Architecture

  • Log Collector: Forwarding event logs from hosts and firewalls
  • Indexer: Normalizing and parsing raw log formats
  • Correlation Engine: Matching events against detection logic
  • Dashboard & Alerting: Displaying actionable alerts to SOC

Indicator Types (Pyramid of Pain)

  • Hash Values: Easy to alter (MD5, SHA256)
  • IP & Domains: Simple for attackers to rotate
  • Network/Host Artifacts: C2 URI structures, registry keys
  • Tools & TTPs: Advanced tactics, techniques, and procedures

Digital Forensics Artifacts (Windows)

  • Prefetch Files: Executable execution history and paths
  • Registry Hives: User persistence, USB mounts, auto-runs
  • Event Logs: Security Log ID 4624 (Logon) and 4688 (Process)
  • MFT & USN Journal: File creation, modification, and deletion

Volatile Memory Analysis (RAM)

  • Process Tree Analysis: Spotting rogue parent-child processes
  • Injected Code: Detecting unbacked executable memory regions
  • Network Connections: Reviewing active socket connections
  • Loaded DLLs: Identifying malicious dynamic libraries

Threat Intelligence Types

  • Strategic: High-level threat trends for executive leadership
  • Tactical: Attacker TTPs analyzed by SOC defenders
  • Operational: Details on specific upcoming threat campaigns
  • Technical: IOCs including IPs, domain lists, and file hashes

YARA Rules Components

  • Meta: Rule description, author, reference links, and date
  • Strings: Byte sequences, hex patterns, or text strings to detect
  • Condition: Logical statements triggering rule execution match

Governance, Risk & Compliance

ISO/IEC 27001 ISMS Lifecycle (PDCA)

  • Plan: Context evaluation, risk assessment, and policy creation
  • Do: Implementing technical security controls and risk treatment
  • Check: Auditing controls, monitoring effectiveness, review
  • Act: Continuous improvement updates to security posture

Data Classification Levels

  • Public: Unrestricted data freely distributable externally
  • Internal: Information restricted to internal enterprise staff
  • Confidential: Sensitive assets requiring authorization
  • Restricted / Top Secret: Critical assets with severe impact

Data Privacy Roles (GDPR)

  • Data Subject: Individual owner of personal information
  • Data Controller: Entity determining purpose & processing
  • Data Processor: Third-party executing processing
  • DPO: Designated officer enforcing data protection compliance

Disaster Recovery Site Types

  • Hot Site: Fully configured operational mirror site running live
  • Warm Site: Pre-configured site missing current live data feeds
  • Cold Site: Facility space available without hardware setup
  • Mobile Site: Portable self-contained recovery facility

Third-Party Risk Management (TPRM)

  • Vendor Onboarding: Security questionnaire evaluation
  • SOC 2 Type II: Independent audit evaluating operational controls
  • SLA Monitoring: Enforcing vendor uptime & response times
  • Offboarding: Revoking access permissions upon termination

Cyber Insurance Policy Coverage

  • First-Party Coverage: Direct response, extortion, downtime costs
  • Third-Party Coverage: Regulatory fines & legal costs
  • Ransomware Endorsement: Terms governing extortion payout
  • Cyber Crime: Coverage against wire fraud and social engineering

System Hardening & Infrastructure

Linux Hardening Measures

  • SSH Hardening: Disabling root login and password auth
  • PAM Config: Enforcing strict password quality rules
  • SELinux / AppArmor: Mandatory access control policies
  • Firewall Rules: Restricting traffic using nftables or ufw

Windows Hardening Measures

  • Disable SMBv1: Eliminating legacy protocol vulnerability
  • LSA Protection: Preventing credential dumping from memory
  • AppLocker / WDAC: Executable whitelisting policy execution
  • Credential Guard: Isolating NTLM/Kerberos secrets in VBS

Database Security Controls

  • Parameterized Queries: Blocking SQL injection at code level
  • TDE: Transparent Data Encryption protecting database files
  • Database Auditing: Logging DDL/DML queries executed
  • Least Privilege: Restricting DB users from schema edits

Docker Security Hardening

  • Non-Root User: Running container processes as non-root UID
  • Read-Only Root FS: Preventing runtime file modifications
  • Resource Limits: Setting CPU/RAM caps to prevent DoS
  • Minimal Base Images: Utilizing Distroless or Alpine layers

Active Directory Controls

  • Tiered Admin Model: Separating Domain, Server, Workstation admins
  • Protected Users Group: Strict credential caching rules
  • PAWs: Dedicated Privileged Access Workstations
  • LAPS: Automating local admin password rotation

IoT, Mobile & Hardware Security

IoT Threat Vectors

  • Hardcoded Credentials: Unchangeable factory default passwords
  • Unencrypted Telemetry: Cleartext transmission over MQTT/HTTP
  • Lack of Patching: Inability to deliver signed firmware OTA
  • Insecure Debug Interfaces: Accessible UART/JTAG pinouts

Mobile Application Hardening

  • Certificate Pinning: Hardcoding expected SSL certificates
  • Root/Jailbreak Detection: Detecting compromised device states
  • Code Obfuscation: Scrambling binaries to block reverse engineering
  • Secure Enclave / Keystore: Hardware storage for keys

Hardware Security Anchors

  • TPM 2.0: Secure crypto-processor for platform measurement
  • HSM: Dedicated hardware handling cryptographic operations
  • eFuses: One-time programmable memory preventing downgrades
  • Secure Boot Chain: Validating each bootloader stage

Industrial Control Systems (ICS / SCADA)

  • Purdue Model: Hierarchical isolation for OT networks
  • Air-Gapping: Physically isolating OT networks from IT
  • Legacy Protocols: Securing unauthenticated Modbus/DNP3
  • Unidirectional Gateways: Data diodes permitting one-way data

Hardware Attack Techniques

  • Side-Channel Attacks: Analyzing power or acoustic leakage
  • Fault Injection: Glitching voltage to bypass security checks
  • JTAG Interception: Sniffing hardware buses to dump memory
  • Rowhammer: Repeatedly accessing memory rows to flip bits