Episode Details
Back to Episodes
Course 46 - CompTIA Cybersecurity Analyst | Episode 1: Fundamentals, Risk & the CIA Triad
Published 3 weeks ago
Description
Cybersecurity Threat Management: Reconnaissance, the CIA Triad, and Risk FundamentalsEpisode OverviewThis episode introduces the foundational concepts of cybersecurity threat management associated with CySA+ Domain 1.The lesson begins with threat identification and reconnaissance, examining how security professionals collect information about systems, organizations, and potential attack surfaces through active and passive open-source intelligence (OSINT) techniques.From there, the episode moves into the CIA Triad, one of the fundamental models used to understand information security: Confidentiality, Integrity, and Availability.Finally, we establish the foundation for cybersecurity risk analysis by examining the relationship between assets, vulnerabilities, and threats. Understanding these three elements provides the basis for identifying risk, prioritizing security controls, and determining where defensive resources should be applied.1. Understanding Cybersecurity Threat ManagementEffective security begins with understanding what must be protected and what could potentially threaten it.Threat management involves identifying and analyzing:
- Potential threats.
- Vulnerabilities.
- Valuable organizational assets.
- Existing security controls.
- Attack surfaces.
- Potential consequences of security incidents.
Rather than treating cybersecurity as a collection of isolated tools, this approach establishes a structured process for understanding the environment before determining how it should be protected.2. Threat Identification and ReconnaissanceA security team needs visibility into the environment before it can effectively assess threats.Reconnaissance is the process of gathering information that can help establish an understanding of a target environment.This can include information about:
- Network infrastructure.
- Internet-facing systems.
- Domain names.
- Public services.
- Technologies in use.
- Employees and organizational structures.
- Potential attack surfaces.
Reconnaissance can be divided broadly into two categories: passive and active.3. Passive Open-Source IntelligencePassive reconnaissance gathers information without directly interacting with the target systems in a way that would normally generate direct network activity against them.Security professionals may examine publicly available information such as:
- Public websites.
- DNS information.
- Search engine results.
- Public documentation.
- Certificate information.
- Job postings.
- Publicly exposed technical information.
- Other legitimate OSINT sources.
The objective is to build an understanding of the organization's external footprint while minimizing direct interaction with the target environment.4. Active ReconnaissanceActive reconnaissance involves directly interacting with systems or network infrastructure to gather additional information.Examples can include authorized:
- Network scanning.
- Service discovery.
- Port identification.
- Host enumeration.
- Banner collection.
- Connectivity testing.
Because active reconnaissance generates traffic, it can be detected by firewalls, intrusion detection systems, security monitoring platforms, and other defensive technologies.For professional security assessments, active reconnaissance should therefore be conducted only within an authorized scope and according to defined testing rules.5. Evaluating Network Security ControlsThreat management also requires understanding how defensive controls protect different parts of the infrastructure.Network infrastructure can include:
- Routers.
- Switc
- Potential threats.
- Vulnerabilities.
- Valuable organizational assets.
- Existing security controls.
- Attack surfaces.
- Potential consequences of security incidents.
Rather than treating cybersecurity as a collection of isolated tools, this approach establishes a structured process for understanding the environment before determining how it should be protected.2. Threat Identification and ReconnaissanceA security team needs visibility into the environment before it can effectively assess threats.Reconnaissance is the process of gathering information that can help establish an understanding of a target environment.This can include information about:
- Network infrastructure.
- Internet-facing systems.
- Domain names.
- Public services.
- Technologies in use.
- Employees and organizational structures.
- Potential attack surfaces.
Reconnaissance can be divided broadly into two categories: passive and active.3. Passive Open-Source IntelligencePassive reconnaissance gathers information without directly interacting with the target systems in a way that would normally generate direct network activity against them.Security professionals may examine publicly available information such as:
- Public websites.
- DNS information.
- Search engine results.
- Public documentation.
- Certificate information.
- Job postings.
- Publicly exposed technical information.
- Other legitimate OSINT sources.
The objective is to build an understanding of the organization's external footprint while minimizing direct interaction with the target environment.4. Active ReconnaissanceActive reconnaissance involves directly interacting with systems or network infrastructure to gather additional information.Examples can include authorized:
- Network scanning.
- Service discovery.
- Port identification.
- Host enumeration.
- Banner collection.
- Connectivity testing.
Because active reconnaissance generates traffic, it can be detected by firewalls, intrusion detection systems, security monitoring platforms, and other defensive technologies.For professional security assessments, active reconnaissance should therefore be conducted only within an authorized scope and according to defined testing rules.5. Evaluating Network Security ControlsThreat management also requires understanding how defensive controls protect different parts of the infrastructure.Network infrastructure can include:
- Routers.
- Switc