Bachelor of Science in CybersecurityUniversity of South Florida
Certifications
Microsoft Certified: Security Operations Analyst Associate (SC-200) · In Progress HTB Certified Penetration Testing Specialist (CPTS) · In Progress
Study notes
OSI modelSelect a layer, then hover or tap any protocol or device to learn what it does and why it belongs there.Private IPv4 & NATA private IP identifies a device inside a network. NAT lets devices using private addresses communicate through an internet-facing address.SubnettingSubnetting divides an IP address range into smaller networks. The subnet mask tells a device which addresses are local and which need a router.VLSMVariable Length Subnet Masking gives each subnet a size that fits its needs, instead of giving every department the same-sized block.VLANsA VLAN makes one physical switch behave like several separate local networks. Devices share a local broadcast network only when their ports belong to the same VLAN.ARPARP finds the MAC address needed to deliver IPv4 traffic to the next device on a local network. For a remote destination, that device is usually your gateway.DNSDNS translates names such as portal.example.com into information computers can use, often an IP address. It helps find a destination; it does not establish the connection.DHCPDHCP automatically gives a device an IP address and the network settings it needs. The address is borrowed for a lease period, rather than manually typed into every computer.SyslogSyslog is a common way for devices and applications to send event messages to a central place. Instead of opening every firewall or server, an analyst can review their messages together.EDR, MDR, and XDREDR watches devices. XDR brings signals from several security areas together. MDR provides people and processes to investigate and respond using those tools.SIEMA SIEM collects searchable security data from different systems and applies detection rules. It helps an analyst investigate a sequence of events across the environment.ZTNA / SASEZTNA checks who is requesting access and the conditions of that request before allowing a path to a resource. SASE combines secure access with wider networking and security services.Email authenticationSPF, DKIM, and DMARC help check whether a message is authorized to use a domain. They do not prove that the sender is honest or that the request is safe.Business email compromiseBusiness email compromise is a scam that uses a believable business conversation to trick someone into sending money, sharing information, or changing an important process.Risky sign-insA risky sign-in is an authentication event with signals that deserve investigation. The signal helps prioritize work; the surrounding evidence determines whether an account is compromised.Active DirectoryActive Directory Domain Services keeps a shared directory of users, computers, and groups. Domain controllers use it to support domain authentication and centralized administration.File sharesA file share lets other computers access a folder over the network. The network path finds the server and share; the user’s permissions decide what they can do there.Windows eventsWindows event logs record activity on a computer. Event IDs tell you what kind of event was recorded; the event’s fields explain who, where, when, and how.TLSTLS protects data in transit by encrypting it and checking that it has not been changed. In a normal HTTPS connection, it also helps the browser verify the server’s identity.TCPTCP carries an ordered stream of bytes between two endpoints. It tracks delivery and retransmits missing data so applications do not have to handle ordinary packet loss themselves.FTPFTP transfers files using one connection for instructions and another for the actual data. That separation explains many FTP connection problems.TelnetTelnet provides a remote text terminal. Ordinary Telnet does not encrypt the session, so SSH is the usual secure choice for remote administration.IMAP / IMAPSIMAP lets a mail client work with messages and folders stored on a server. IMAPS protects that same mailbox conversation with TLS from the start.POP3 / POP3SPOP3 retrieves messages from a mailbox, commonly into a local mail client. Whether the server keeps a copy depends on the client’s deletion settings.SNMPSNMP lets a monitoring system ask devices for structured information and receive notifications. It can report switch health without someone opening every device’s console.SMTP / SMTPSSMTP moves outgoing mail from a sender to mail servers and between servers. It does not read your inbox; IMAP and POP3 handle mailbox access.RPC / NetBIOSRPC asks another computer to perform a software operation. NetBIOS provides older naming and communication services. They often appear in Windows troubleshooting, but they are different technologies.HTTP / HTTPSHTTP is the request-and-response language of the web. HTTPS carries HTTP through a protected connection, helping keep the exchanged content private and intact.SSHSSH provides protected remote access, commonly to a command line. It checks the server’s identity and then authenticates the user; those are two different checks.RDPRDP lets you interact with a remote computer’s graphical desktop. The applications run on the remote host while your device sends input and receives the display.SMBSMB lets a client work with files and other shared resources on a server. A mapped drive is a convenient view of that service, not a copy of the entire server folder.LDAP / LDAPSLDAP lets applications query and update a directory of objects such as users, groups, and computers. LDAPS protects the directory conversation with TLS from the start.Alert triageTriage means deciding what an alert shows, how urgent it is, and who needs to act next. An alert starts a question; it does not finish an investigation.Incident responseIncident response is the coordinated work of understanding a security incident, limiting harm, restoring trustworthy service, and learning from what happened.PhishingPhishing uses a deceptive message to persuade someone to reveal information or take an unsafe action. The important question is what the message is trying to make the recipient do.MalwareMalware is software used to cause harm or gain unauthorized access. Investigating it means understanding what ran and what changed, not just recognizing a threatening filename.Vulnerability managementVulnerability management is the repeated work of finding weaknesses, deciding which matter most, fixing or reducing them, and verifying the result.RiskRisk describes how a possible event could harm something important and how likely that harm is. It helps a team decide where to spend attention and effort.RMFRMF guides a system from understanding its risks to choosing safeguards, checking them, accepting remaining risk, and keeping the evidence current.Security controlsA security control is a safeguard intended to reduce risk. To know whether it works, you need a clear objective and evidence from the systems and people it covers.Security awarenessSecurity awareness helps people recognize risky situations and know what to do next. Its value is safer behavior and faster reporting, not just completed training slides.FirewallsA firewall decides which network traffic is permitted across a boundary. A useful rule describes who can reach what service, in which direction, and why.RoutingRouting chooses the next hop for an IP packet. Each router uses its own routing information to move the packet toward its destination.SwitchingAn Ethernet switch learns where devices are connected and forwards frames within a VLAN. It learns from source MAC addresses and looks up destination MAC addresses.VPNsA VPN creates a logical connection across another network. In a typical remote-access VPN, an authenticated, encrypted tunnel carries selected traffic between a device and an organization.