Class 1

Hackers

• who is a hacker? https://www.techtarget.com/searchsecurity/definition/hacker

Threatmaps

• https://threatmap.checkpoint.com/
• https://www.imperva.com/cyber-threat-attack-map/
• https://www.fireeye.com/cyber-map/threat-map.html
• https://threatmap.fortiguard.com/
• https://talosintelligence.com/
• https://cybermap.kaspersky.com/

Your Password does not matter

• https://techcommunity.microsoft.com/t5/azure-active-directory-identity/your-pa-word-doesn-t-matter/ba-p/731984

Zero Day Reports

• https://talosintelligence.com/vulnerability_info

Certification Roadmap

• https://pauljerimy.com/security-certification-roadmap/
• https://www.shodan.io/

Various malwares, with common terms

• https://www.malwarefox.com/malware-types/
• WannaCry: https://en.wikipedia.org/wiki/WannaCry_ransomware_attack
• Bad Rabbit - https://www.youtube.com/watch?v=i22DkwT0zAU
• EternalBlue: https://www.cisecurity.org/wp-content/uploads/2019/01/Security-Primer-EternalBlue.pdf

WannaCry (exploiting stolen EternalBlue by NSA - SMB)

• https://www.youtube.com/watch?v=cZ543_0bjbw

Ashley Madison Data Breach / Hactivism?

• CNN: https://www.youtube.com/watch?v=P2o8NdkelCs
• Wired: https://www.youtube.com/watch?v=U_pzHXfn8dE

STUXNET

• https://www.youtube.com/watch?v=7g0pi4J8auQ

SONY Attack

• https://www.youtube.com/watch?v=_SDCV00ErEs

Probability vs Impact

• https://www.theprojectmanagementblueprint.com/blog/risk-management/risk-exposure-equals-probability-times-impact

What do we Protect?

• CIA
• DDOS (A)
• Encryption (C)
• Hashning (I)

SOC - Tier 1,2,3

Risk Management

Threat Intelligence

IoC

How to ensure security when working with 3rd party vendor?

Software Development

• Dependency management
• open source software/libraries

Cyber Kill Chain

• https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html

ATT&CK

• https://attack.mitre.org/

PEN test methodologies

• Pentest execution standard - http://www.pentest-standard.org/index.php/Main_Page
• NIST 800-115: Technical Guide to Information Security Testing and Assessment - https://csrc.nist.gov/publications/detail/sp/800-115/final
• OWASP security testing guide: https://owasp.org/www-project-websecurity-testing-guide/
• The Open Source Security Testing Methodology Manual - https://www.isecom.org/research.html

Pre-Engagement

• http://www.pentest-standard.org/index.php/Pre-engagement

Laws and Standards

• Computer Fraud and Abuse Act - https://www.justice.gov/jm/jm-9-48000-computer-fraud
• https://www.ncsl.org/research.aspx
• https://gdpr-info.eu/