In this section and we're going to cover some security terms they should be familiar with for the CCN
a cyber ops exam
threat actors are the individuals responsible for an attack.
So an individual hacker or a group of people that attack in network would be considered to be threat
actors.
Run book automation is the ability to define build orchestrate manage and report on workflows that support
system and network operational processes.
OK so in layman's terms a run book is simply documentation for tasks that an I.T. administrator carries
out.
So if a server needs to be added to the network and an administrator can reference the procedure to
do so in a run book by following a run book you can be consistent with your operations eliminate room
for error and improve the time it takes to complete tasks to take this concept a step further.
If Iran book is automated with software tools then processes can be even more efficient.
A chain of custody refers to the paper trail or physical and electronic evidence in a cyber forensics
investigation.
If you or your company is compromised then it is important to preserve and copy evidence properly to
maintain its integrity.
Reverse engineering can be used to identify the details of a breach and how an attacker entered the
system.
Tools are available to debug disassemble and decompile data for reverse engineering things like encryption
algorithms and malware programs.
This can be a helpful cybersecurity technique for analyzing malware to identify its behavior and possibly
the author of the program
traffic anomalies are abnormal changes to the network traffic flows.
This can be a major red flag in an enterprise network.
Imagine that you had a web server that for years only communicated with Web protocols like HTP and HGT.
Yes and then all of a sudden it was sending large amounts of data using S-sh.
That would be a traffic anomaly.
One of the main goals of cybersecurity is protecting sensitive data like personal identifiable information
and protected health information.
This information includes but is not limited to credit card numbers.
Social Security numbers and medical records due to the importance of PIII and P.H. by specific government
and Hippel regulations must be followed to secure sensitive information.
The last security term I want to cover in this section is the principle of least privilege the principle
of least privilege enforces differentiated access to networks meaning that users should only have access
to the bare minimum resources that are required to perform their job duties when a network is designed.
Groups should be defined to segment users so that Access can be regulated.
Just like users.
Programs should also only have the privileges needed to function.
For example you would not want all the programs on a device to have root access.
If you've ever heard of a device being routed or jail broken that means that all the apps have root
access which can leave a device vulnerable to threats such as malware.