Cisco Certified Support Technician: Cybersecurity (CCST Cybersecurity) — knowledge map
The 50 core concepts of Cisco Certified Support Technician: Cybersecurity (CCST Cybersecurity) and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (50)
Threat and vulnerability
A threat is a potential cause of harm to information assets—such as unauthorized access, disaster, or human error—while a vulnerability is a weakness on the asset side that a threat can exploit, such as misconfiguration, unpatched software, or weak management. Risk is understood as the combination of the two: the possibility that a threat exploits a vulnerability to cause damage. Eliminating vulnerabilities makes risk less likely to materialize even when threats exist.
Risk
The likelihood that a threat will exploit a vulnerability and actually cause harm. It is generally framed as probability times impact; a vulnerability alone does not create risk, only its combination with a threat capable of exploiting it.
Prerequisites: Exploit
Related: Threat and vulnerability
Firewall
A mechanism that controls traffic according to allow/deny rules. On Linux it is implemented via iptables / firewalld, and in cloud environments it is offered as constructs like security groups.
Malware
A collective term for malicious software created to harm users, including viruses, worms, trojan horses, and ransomware. Infection routes are varied, including email attachments, visiting malicious sites, and USB drives.
Related: Ransomware
Man-in-the-middle (MITM) attack
A general term for an attack in which the attacker inserts themselves between two communicating parties, making each believe it is communicating directly with the other, while eavesdropping on or tampering with the traffic. Techniques used to set it up include ARP spoofing, gateway impersonation via a rogue DHCP server, and DNS cache poisoning. Countermeasures include mutual authentication (e.g., verifying digital certificates) and encrypting/integrity-protecting the communication path.
Prerequisites: Digital certificate、CIA triad、DNS cache poisoning
Related: ARP spoofing and countermeasures
Exploit
The specific means or code that actually leverages a vulnerability to cause an unintended effect, such as unauthorized access, privilege takeover, or a denial of service. Where a vulnerability is the weakness, an exploit is the means of actually attacking it.
Related: Threat and vulnerability
Vulnerability management
The ongoing process of continually identifying and assessing the vulnerabilities present in an organization's systems, then prioritizing and remediating or mitigating them by severity. It cycles through scanning to identify issues, scoring them (e.g., with CVSS), applying patches or hardening, and reverifying.
Prerequisites: Hardening、Threat and vulnerability、CVSS (severity)
Windows Defender and host-based firewalls
Windows Defender (now renamed Microsoft Defender Antivirus) is the malware-protection and threat-detection software built into Windows by default. A host-based firewall is a firewall installed on an individual device (host) rather than at the network perimeter, allowing or denying traffic for that device alone (e.g., Windows Firewall).
Prerequisites: Threat and vulnerability、Malware、Firewall
CVSS (severity)
Common Vulnerability Scoring System—a standard scoring vulnerability severity. For prioritization, combine with EPSS (exploit probability), reachability, and asset criticality.
Prerequisites: Exploit、Threat and vulnerability
Botnet
A network of many devices infected with malware (bots) that are controlled together under the command of a C&C server. It is abused as a platform for DDoS attacks, spam distribution, and data theft; infected devices await commands via connect-back communication.
Prerequisites: Malware
Asset management
Accurately tracking and managing the hardware and software an organization owns, typically via an inventory. Without knowing what you own, patching and vulnerability response inevitably have gaps, so this is a foundational activity underpinning security measures.
Prerequisites: Threat and vulnerability
Backup
Saving copies of data to a separate location or medium in preparation for data corruption or loss or for equipment failure. Even if trouble occurs, the system can be recovered (restored) from the saved copies. It is considered important to take backups regularly and keep them in a location separate from the originals.
Phishing
A fraud technique that lures victims to fake emails or websites impersonating real companies or financial institutions, in order to steal IDs, passwords, or credit card information. Carefully checking the URL and domain is a basic countermeasure.
Threat protection and threat intelligence
Capabilities for detecting, analyzing, and responding to attacks. Microsoft Defender XDR unifies signals across domains to deliver extended detection and response (XDR).
Prerequisites: Threat and vulnerability
Attack vector
The path or method an attacker uses to intrude on or attack a system or network — a phishing email, a weak password, unpatched software, or a USB drive — the "entry point" for an attack.
Prerequisites: Phishing
BYOD
The practice of letting employees use their own personal smartphones or laptops for work (Bring Your Own Device). It cuts costs and adds convenience, but creates the risk of devices the organization cannot fully control accessing internal data, so organizations often impose MDM management, app-distribution, and encryption requirements.
Prerequisites: Risk
DHCP starvation
A DoS attack in which an attacker exhausts a DHCP server's address pool by requesting addresses with a flood of spoofed MAC addresses, leaving none available for legitimate clients. Countermeasures include limiting DHCP requests per switch port and using DHCP snooping.
Prerequisites: DoS/DDoS attacks and SYN flood attacks
Hardening
The work of reducing a system's attack surface and making it harder to attack, by disabling unnecessary services, changing default passwords, applying the latest patches, and enforcing least privilege.
Malware removal
The response to a suspected infection: first isolating the device from the network to contain the spread, then running a full antivirus scan and quarantining or deleting any malware found. The scan log confirms what was found and how it was handled, and after removal you verify there is no reinfection. In serious cases a stronger remedy such as reinstalling the OS or restoring from a trusted backup is considered.
Privilege escalation
The act of an attacker or malicious process illegitimately gaining more privilege than it was granted, such as escalating from a normal user to an administrator. It typically exploits an OS or application vulnerability or a misconfiguration, and is high severity because it grants control over the whole system afterward.
Prerequisites: Threat and vulnerability
Active and passive reconnaissance
Reconnaissance to gather information about a target. Active reconnaissance sends traffic directly at the target (e.g., port scanning) and infers information from the responses, and so can be detected; passive reconnaissance only collects publicly available information (company sites, social media, DNS records, and the like) and is much less likely to alert the target.
Prerequisites: Port scan
Digital certificate
An electronic certificate issued by a certificate authority (CA) that binds a public key to its owner and vouches for that binding. A web server's certificate is what a browser verifies during an HTTPS connection to confirm the site is not impersonated.
Prerequisites: Public-key cryptography (asymmetric)
Related: PKI and certificate authority
CIA triad
The three pillars of information security: Confidentiality, Integrity, Availability.
DNS cache poisoning
An attack that injects forged name-resolution results into a caching DNS server so users are directed to an attacker-controlled fake site. It works by racing a forged response — guessing the query's transaction ID and source port — to the resolver before the legitimate authoritative server's real reply arrives, so the forged answer gets cached. Countermeasures include randomizing the source port and transaction ID, and DNSSEC, which cryptographically signs and validates responses.
Port scan
A reconnaissance technique that sends packets to a target host's ports and infers, from the presence or content of the responses, which ports are open (have a running service). Attackers use it to survey targets and identify vulnerable running services; techniques such as TCP SYN scans that never complete a full connection are harder to detect. IDS/IPS and log monitoring detect it as an anomalous spike in connection attempts per unit time.
Prerequisites: Threat and vulnerability
Ransomware
Malware that encrypts files on an infected PC or server, rendering them unusable, and demands payment in exchange for decryption. In recent years, the dominant tactic is "double extortion" — threatening to leak exfiltrated data in addition to withholding the decryption key. Taking backups and keeping them isolated (offline) is an effective countermeasure.
Related: Malware
Diamond Model
A forensic analysis model for examining a single intrusion event in terms of four vertices — adversary, capability, infrastructure, and victim — and the relationships among them. Where the cyber kill chain tracks a chronological sequence of stages, the Diamond Model instead focuses on the relationships among the elements of one attack event.
Prerequisites: Cyber kill chain
IoT vulnerability
Weaknesses characteristic of IoT devices: they are often left on default passwords, firmware updates may not be provided or applied, and limited processing power leads to minimal security features — all of which make them easy to compromise, frequently for recruitment into botnets.
Prerequisites: Threat and vulnerability、Botnet
Network segmentation
A design that divides a network into multiple smaller zones and controls traffic between them with firewalls or VLANs. If one zone is compromised, the design limits how far the damage can spread into other zones.
Prerequisites: Firewall
PKI and certificate authority
PKI (public key infrastructure) is the overall framework that binds a public key to its owner to prevent impersonation. A certificate authority (CA) issues a digital certificate for a public key and vouches for its validity, allowing keys to be exchanged securely even between parties meeting for the first time.
Prerequisites: Public-key cryptography (asymmetric)
Related: Digital certificate
CVE
Common Vulnerabilities and Exposures—a unique ID for an individual vulnerability in a specific product/version (e.g., CVE-2024-XXXXX). It denotes a vulnerability "instance."
Prerequisites: Threat and vulnerability
Socket and port inspection (ss/netstat/netcat)
Inspecting sockets and ports: ss lists sockets (netstat successor; ss -tlnp shows TCP LISTEN with the process), and netcat (nc) tests connections to any port (nc -zv host 443)—separating firewall drops from missing services.
Prerequisites: Firewall
CIDR notation
A notation expressing an IP address range by prefix length, like “/24” (256 addresses) or “/16” (65,536 addresses)—the smaller the number, the larger the range. It underlies network design across every cloud: sizing VPCs/VNets and subnets, longest-prefix-match routing, and scoping firewall-rule allows.
Prerequisites: Firewall
ARP spoofing and countermeasures
An attack that sends forged ARP replies on the LAN to register a wrong IP-to-attacker-MAC mapping in victims' ARP tables, relaying traffic through the attacker (a foothold for man-in-the-middle). The countermeasure is Dynamic ARP Inspection (DAI), which uses a legitimate IP-MAC table built by DHCP snooping to block forged ARP packets.
Related: Man-in-the-middle (MITM) attack
DoS/DDoS attacks and SYN flood attacks
A DoS attack overwhelms a service by flooding it with excessive requests or malformed packets from a single source. A DDoS attack is a distributed DoS carried out simultaneously from many compromised hosts (e.g., a botnet), making it hard to block since sources are spread out. A SYN flood attack is a representative DoS technique that abuses the TCP three-way handshake, sending a flood of SYN packets without completing the handshake, leaving the server with many half-open connections and exhausting its resources; SYN cookies are a common countermeasure.
Related: Botnet
Public-key cryptography (asymmetric)
Encrypt with a public key and decrypt with a private key (or sign with the private key and verify with the public key). It solves key distribution and underpins TLS, SSH, code signing, and certificates; slower than symmetric, so data is encrypted with a symmetric key that is itself protected by the public key (envelope).
Security patch management
The organized process of managing patches issued for an OS, middleware, or applications, spanning vulnerability-information gathering, testing, deployment planning, rollout, and confirmation. Delayed application is a direct cause of exploitation via known vulnerabilities, so tight integration with the asset inventory is essential.
Prerequisites: Asset management、Threat and vulnerability
SIEM
Security Information and Event Management: centrally collects logs and events from many sources (servers, network gear, apps) and correlates them to detect threats. Products like Microsoft Sentinel, Google SecOps, and Splunk fill this role.
AAA (Authentication, Authorization, Accounting)
A collective term for three access-control functions. Authentication verifies who the user is, authorization decides what an authenticated user is permitted to do, and accounting records what was actually done. Cisco devices centralize these functions using RADIUS or TACACS+ as the AAA server.
Prerequisites: RADIUS
ACL (Access Control List)
An ordered list of rules on a router or firewall that permit or deny traffic based on conditions such as source/destination IP address and port number. Rules are matched top to bottom, with an implicit deny applied at the end by default.
Prerequisites: Firewall
APT (Advanced Persistent Threat)
An Advanced Persistent Threat: a sophisticated, long-running campaign against a specific target that stays hidden while continuing to exfiltrate information over an extended period. It often involves state-sponsored actor groups, and is characterized by persistence and advanced technical capability, unlike a one-off attack.
Prerequisites: Threat and vulnerability
RPO (Recovery Point Objective)
A target indicating how far back in time data must be recoverable after a failure, determined by backup frequency; a smaller RPO means less tolerable data loss. Distinct from RTO, which is about recovery time.
Prerequisites: Backup
Syslog and Syslog Aggregation
Syslog is a protocol for sending device event and error logs, typically over UDP/TCP port 514, in a standardized format that includes facility and severity level. Aggregating logs from many devices onto a single syslog server enables cross-device correlation, chronological cross-referencing during incident investigation, and long-term retention for compliance; note that UDP delivery offers no retransmission guarantee, risking log loss.
Prerequisites: Risk
Cyber kill chain
A model that organizes the stages of a targeted attack as reconnaissance, weaponization, delivery, exploitation, installation, command-and-control, and actions on objectives. It is used to consider effective defenses at each stage and analyze where the attack chain can be broken.
RADIUS
A protocol for centralized authentication, authorization, and accounting (AAA). Used as an authentication server in wireless LAN, VPN, and IEEE 802.1X environments, it centrally manages per-user credentials to control network access.
Insider threat
Deliberate misconduct by someone inside the organization — an employee or contractor — who abuses legitimate access to exfiltrate or tamper with information or disrupt systems. It is harder to detect than external attacks and is often explained by the fraud triangle: motive (grievance, money), opportunity (excessive privilege), and rationalization. Access-log monitoring and separation of duties are the main countermeasures.
Prerequisites: Threat and vulnerability
Risk treatment (reduction, avoidance, transfer, acceptance)
Four response strategies chosen based on risk assessment results. Reduction lowers likelihood or impact through controls; avoidance stops the activity causing the risk; transfer shifts the risk to a third party via insurance or outsourcing; acceptance tolerates the risk without further action when it falls within an acceptable range. The choice balances cost against effect.
Prerequisites: Risk
SOAR
Security Orchestration, Automation and Response: automates and orchestrates the post-detection response (investigation, containment, notification) to alerts from a SIEM via playbooks, cutting analyst repetitive work and response time.
Prerequisites: SIEM