Cisco Certified Support Technician: Cybersecurity (CCST Cybersecurity)Study guide

Building on the distinction among a weakness (vulnerability), a danger that could exploit it (threat), the means of abuse (exploit), and the probability-times-impact measure (risk), this section covers the attack vector as an entry point, hardening that shrinks the attack surface, layered defense in depth, the three properties to protect (CIA), and the types of attackers and code of ethics, as the foundation for telling "is this a threat or a risk."

Covers the kinds of malware including ransom-demanding ransomware, service-halting DoS and the zombie army of a botnet, the human-deceiving social engineering family (phishing/spear phishing/vishing/smishing/tailgating), the traffic-intercepting man-in-the-middle attack, and IoT weaknesses, insider threats, and the advanced persistent APT, as the foundation for telling "what attack this email or symptom is."

Covers the three pillars of AAA—who you are (authentication), what you may do (authorization), and what you did (accounting)—the centralized authentication of RADIUS, strengthening identity with multi-factor authentication (MFA) across knowledge/possession/inherence, and the password policy that resists guessing and reuse, as the foundation for judging "is this access legitimate."

Covers the difference between fast same-key symmetric encryption and key-distribution-solving asymmetric encryption, the one-way hash that protects integrity rather than encrypts, the certificate and PKI that assure a public key's authenticity, strong vs. weak algorithms, and protecting data by its state—in transit / at rest / in use—as the foundation for choosing "which encryption for which data state."

Each protocol in the TCP/IP suite that underpins the internet has weaknesses because security was not a design goal at the outset. This section covers ARP spoofing (a MITM that hijacks traffic with forged MAC replies), DNS poisoning that corrupts name resolution, DHCP attacks involving address exhaustion or a rogue server, ICMP used for reconnaissance and floods, the TCP SYN flood that overflows connections, and eavesdropped plaintext HTTP—all through the lens of identifying "what attack a packet anomaly represents."

Covers the addresses used in networking—the L3 IPv4/IPv6 address and the device-specific L2 MAC address—along with CIDR notation that expresses a range like /24, NAT that translates private IPs to a shared global IP, and the difference between freely assignable private addresses and globally unique public addresses, and it teaches network segmentation as a basic defense that confines damage to an island.

Covers the idea of a security architecture built in layers, along with the DMZ buffer zone that isolates public servers from the internal network, virtualization that creates multiple environments on one physical device, the cloud managed by another company, the decoy honeypot that lures attackers, the proxy server that relays and inspects traffic, and the difference between "detection-only IDS" and "detection-plus-blocking IPS"—so you can identify each one's role.

Covers secure-access technologies—the ACL that permits/denies traffic, the firewall that controls ingress/egress by tracking state, the VPN that encrypts the path, and NAC that checks a device's posture before connection—and the essentials of securing small-office (SoHo) wireless: the encryption standard (WPA2/WPA3) that is the real defense versus MAC filtering and a hidden SSID that are only supplementary—learned by telling "primary defense or supplement" for each.

Covers the defenses common to the major operating systems—Windows/macOS/Linux—namely Windows Defender and the host-based firewall, the CLI and PowerShell, file/directory permissions, and the privilege escalation attackers aim for, as the foundation for judging "is this endpoint properly protected?"

Covers three staple tools for examining an endpoint's state—netstat to see connections and listening ports, nslookup to check name resolution, and tcpdump to capture actual packets—as the foundation for telling "which tool confirms this suspicious symptom."

Covers the operations that keep endpoints "as agreed"—asset management (hardware/software inventory), program distribution, data backup, regulatory compliance (PCI DSS/HIPAA/GDPR), and BYOD for personal devices—as the foundation for judging "does this device meet the standard?"

Covers the operations that keep an endpoint healthy and notice anomalies—applying patches via Windows Update and to apps/drivers/firmware, interpreting logs with Event Viewer and syslog to spot anomalies, and the removal procedure when malware is found (scan, check logs, remediate)—as the foundation for judging "are updates applied?" and "what in this log is abnormal?"

Covers vulnerability management, the continuous cycle of finding and fixing weaknesses (identify -> manage -> mitigate); the difference between active reconnaissance (touching the target directly) and passive reconnaissance (using only public information and observation); and port scanning to list open ports plus automation for repetitive work—as the foundation for working out "where the holes are and how to close them."

Covers CVE, which references known weaknesses by a common name, and CVSS, which scores their severity; the uses and limits of a vulnerability database that collects weaknesses; and information sources such as security reports, news, subscription services, and crowdsourced intelligence—the basics of gathering and using them to judge "which threats deserve attention right now."

Covers the difference between a vulnerability (the weakness itself) and risk (measured as likelihood times impact); the idea of ranking risk into low/medium/high/critical; choosing among the four risk responses—accept, reduce, transfer, avoid; and the relationship whereby a higher data classification brings greater risk—learned as the judgment of deciding "what to protect, and how far."

Covers the difference between a DRP (disaster recovery plan), focused on procedures to restore IT systems, and a BCP (business continuity plan), the broader plan to keep the whole business running; RTO (how fast to recover) and RPO (how much data loss is tolerable); the role of backups; and the three kinds of DR controls—detective, preventive, and corrective—as the foundation for designing "how to recover after a stoppage."

Covers the difference in roles between SIEM (collecting logs in one place and correlating them) and SOAR (automating and orchestrating the response after detection), the targets of network data monitoring such as packet capture and various logs, and how to identify a suspicious event ("this is not normal") and judge when to escalate, as the entry point to monitoring.

Covers frameworks for attribution—the Cyber Kill Chain (viewing an attack as time-ordered stages), MITRE ATT&CK (a catalog of attacker techniques), and the Diamond Model (organizing an event into four elements)—plus TTP (an attacker's tactics, techniques, and procedures), artifacts as evidence sources, and the evidence preservation and chain of custody that protect the authenticity of evidence, at an introductory level.

Covers the correspondence of "which data each major regulation protects"—PCI-DSS (card data), HIPAA (health information), GDPR (EU personal data), FERPA (education records), and FISMA (US federal systems)—and how the reporting/notification requirements (whom to inform, and by when, in a breach) shape incident-response procedures, at an introductory level.

Covers the differing roles of three document elements—policy (the intended stance), plan (how to prepare and act), and procedure (concretely what to do)—and the stages and order of the incident-response lifecycle from NIST SP 800-61: preparation -> detection/analysis -> containment/eradication/recovery -> post-incident (lessons learned), at an introductory level.