CySA+
  • CySA+ CS0-002 Exam Objectives
  • Threat Intelligence Cycle
  • Intelligence Sources
  • Security Intelligence Sharing
  • Threat Classification and Threat Actors
  • Threat Research and Indicators of Compromise
  • Attack Frameworks and The Cyber Kill Chain
  • Defining Threat Modeling and Threat Hunting
  • Vulnerability Identification and Validation
  • Vulnerability Scan Results and CVSS Scores
  • Nmap and Enumeration
  • Security Controls
  • Defense in Depth Security Baselines
  • Security Trend Analysis
  • Remediation Issues
  • Asset, Change, and Configuration Management
  • Software Development Lifecycle & Development Models
  • Software Assessment and Code Review
  • Mitigating Attack Types Part 1
  • Mitigating Attack Types Part 2
  • Mitigating Attack Types Part 3
  • Password Cracking and Hashing
  • Privilege Escalation & Man-in-the-Middle
  • Network Based IoCs
  • Host Based IoCs
  • Network Architecture and Segmentation
  • Network Traffic, Packet, and Protocol Analysis
  • Pentesting and Active Defense
  • Firewalls
  • URL Analysis & DNS in Malware
  • Network Access Control and Port Security
  • Identity and Access Management (IAM)
  • Web Application Scanners
  • SSL/TLS Digital Certificate Management
  • Mobile Threats
  • Email Threats and Mitigation
  • Data Loss Prevention (DLP)
  • Endpoint Security and Behavior Analysis
  • Hardware Assurance
  • Blackholes and Sinkholes
  • IoT, Embedded Systems & ICS/SCADA Threats
  • Log Analysis & Continuous Security Monitoring
  • SIEM and Event Correlation
  • Malware Analysis
  • Cloud Models and Service Threats
  • Cloud Automation and Other Cloud Threats
  • VDI, Containers, and Microservices
  • CI/CD, IaC, DevOps
  • AI and Machine Learning
  • Digital Forensics
  • Technical Controls for Securing Data
  • Non-Technical Controls for Securing Data
  • Security Policies and Procedures
  • Continuity Planning and Risk Assessment
  • Incident Response Phases and Communication
Powered by GitBook
On this page

Defining Threat Modeling and Threat Hunting

  • Questions

    • What would an attack look like?

    • What is the risk of losing confidentiality, integrity, or availability?

    • How likely is a specific threat?

    • What defenses do we have?

    • What is missing?

  • Adversary Capabilities: Develop and execute attacks

    • From MITRE:

      • Acquired

      • Augmented

      • Developed

      • Advanced

      • Integrated

  • Total Attack Surface: What you own and can be attacked

    • Corporate network

    • Cloud

    • Online Presence

    • Internal Apps

    • Building and People

  • Attack vector: how is the attack delivered

    • According to MITRE

      • Cyber

        • IT systems

        • Social media

        • Email

        • USB drives

        • Open ports

      • Physical

        • Doors

        • Locks

        • Access Cards

        • Surveillance

      • Human

        • Impersonation

        • Phishing

        • Coercion

        • Blackmail

  • Likelihood – How likely is the attack to happen?

    • Real threat or just a probable one?

    • Happened to use before? Happened to anyone else before?

    • Just an educated guess

  • Final Threat Modeling Questions

    • What’s the motivation behind an attack?

    • How do other companies defend themselves?

    • How frequent are attacks in your industry?

  • Cyber Threat Hunting

    • According to inforsec institute: “Cyber threat hunting is very similar to real-world hunting: it requires skill, patience, creativity, and a keen eye for spotting the prey”.

    • Be proactive

    • Act before you have proof

    • Don’t wait for a breach

    • This is not incident response

  • Threat hunting methodology

    • Start from scratch.

    • Establish a hypothesis

    • Look for threat actors

    • Look for IoCs

  • Justifying Threat Hunting

    • Have you been compromised?

    • Discovers new attack surface

    • Improves threat detection

    • Provides security intelligence

    • Identifies critical assets

PreviousAttack Frameworks and The Cyber Kill ChainNextVulnerability Identification and Validation

Last updated 2 years ago