Connected systems
Follow the packet. Understand the systems that connect and protect us.
Application Layer Protocol
Application-layer command traffic uses protocols already common in the environment.
ARP and local address resolution
Understand IPv4 local address resolution, the gateway’s role, and why an ARP entry is a forwarding clue rather than authenticated identity.
Automated Exfiltration
Automated exfiltration repeatedly transfers collected information without requiring manual action for each item.
Cloud computing
Understand cloud services through their operating model, resource lifecycle, and the identity, data, and recovery decisions that remain with customers.
Cloud identity and permissions
Review effective cloud permissions, delegation, workload credentials, and permission-changing actions rather than trusting role names or network location.
Cloud security architecture
Map cloud data paths and management authority together, then design identity boundaries, logging, keys, and recovery around the critical workflows.
Cloud shared responsibility
Assign ownership for each cloud control using the specific service boundary, then verify customer configuration instead of relying solely on provider assurance.
Cloud storage security
Verify storage access through identities, resource policies, delegated links, encryption keys, logging, and recovery rather than equating encryption with privacy.
Communication Through Removable Media
Removable-media communication relays commands or results through physical storage between compromised systems.
Computer networking
Follow a browser request to understand network paths, switches, routers, and the difference between connectivity and permission.
Container security
Review image provenance and runtime authority together, including capabilities, host mounts, secrets, resource limits, and the shared host boundary.
Cross-Origin Resource Sharing (CORS)
Understand cross-origin browser response access, preflights, and credential behavior without confusing CORS with API authorization or CSRF protection.
Data Encoding
Data encoding transforms command traffic into another representation.
Data Obfuscation
Data obfuscation disguises command traffic so simple content signatures are less useful.
Data Transfer Size Limits
Transfer size limits split or constrain outgoing data to avoid simple volume thresholds.
Database hardening
Reduce database exposure through narrowly scoped application identities, protected administration, maintained configuration, and tested data recovery.
DHCP
Learn how DHCP assigns IPv4 configuration, how leases affect investigations, and why obtaining an address does not authenticate a network.
Domain Name System
Follow a DNS lookup through resolvers, authoritative servers, and caches, and learn why a resolved name is not proof that a service is trustworthy.
Dynamic Resolution
Dynamic resolution changes how command destinations are found over time.
Email protocols and authentication
Separate email submission, relay, mailbox access, and sender-domain authentication while assessing message content and business requests independently.
Encrypted Channel
Encrypted command channels conceal instruction content from network observers.
Exfiltration Over Alternative Protocol
Exfiltration over an alternative protocol transfers collected data through a route separate from the main control channel.
Exfiltration Over C2 Channel
Exfiltration over a command channel sends collected data through the same communications used for remote control.
Exfiltration Over Other Network Medium
Exfiltration over another network medium uses a path different from the primary managed network.
Exfiltration Over Physical Medium
Physical-medium exfiltration moves information out through storage or another physical device.
Exfiltration Over Web Service
Web-service exfiltration transfers data through a legitimate online provider.
Fallback Channels
Fallback channels let command traffic move to an alternate communication path when the preferred route fails.
Firewalls
Understand traffic-policy enforcement, stateful inspection, rule ownership, and why permitting a connection does not authorize its application actions.
FTP, FTPS, and SFTP
Compare FTP, FTPS, and SFTP by their protocols, identity verification, protected paths, and automation requirements before migrating a file-transfer workflow.
HTTP and HTTPS
Understand HTTP requests, methods, responses, and status codes while separating web semantics from encryption and application authorization.
HTTP security headers
Verify browser security policy on delivered responses, choosing appropriate headers and testing CDN, error-page, and content-type behavior.
HTTP status codes
Interpret HTTP status classes with response content, permission context, and actual state changes instead of treating success codes as security verdicts.
HTTP Strict Transport Security (HSTS)
Explain how browsers learn HTTPS-only policy, why redirects differ, and how subdomain coverage and preload choices affect deployment and recovery.
IaaS, PaaS, and SaaS
Compare IaaS, PaaS, and SaaS through concrete maintenance, identity, application, and data responsibilities rather than treating the labels as complete contracts.
ICMP, ping, and traceroute
Interpret ping and traceroute as limited observations, accounting for filtering, response behavior, and differences between reachability and service health.
Identity and access management
Coordinate human and workload identities through creation, authentication, permission review, role changes, and complete removal of obsolete access.
Identity federation and SSO
Understand identity-provider trust, validated assertions, relying-party audiences, and the application permissions that remain after single sign-on.
IDS and IPS
Distinguish detection from inline prevention, assess sensor visibility, and turn a network alert into a testable investigation rather than an automatic verdict.
Infrastructure as code security
Review infrastructure definitions, rendered plans, deployment authority, sensitive state, and runtime drift as parts of one controlled change workflow.
Ingress Tool Transfer
Ingress tool transfer brings additional files into an already-accessed environment.
IP addresses
Learn what IPv4 and IPv6 addresses identify, how private addressing works, and why an address in a log is not a person's identity.
IPv4
Read IPv4 addresses with their actual prefixes, allocation context, and translation history rather than relying on historical address classes.
IPv6
Understand IPv6 address scope and neighbor behavior, and review dual-stack exposure without assuming IPv4 controls cover every path.
Kerberos
Follow Kerberos ticket-based authentication, protect service identities and keys, and distinguish valid authentication evidence from resource authorization.
Kubernetes security
Assess orchestration authority, workload identities, admission rules, secrets, and enforced network controls rather than treating namespaces as complete isolation.
LANs, WANs, and other network scopes
Use LAN, WAN, campus, and wireless network labels to explain scope while drawing the actual trust and access boundaries separately.
LDAP and directory services
Understand directory access, protected queries, narrowly scoped service accounts, and how membership changes can affect authorization across applications.
MAC addresses
Understand local-link MAC addressing and switch learning while avoiding permanent-device or human-identity claims from a single address.
Showing 48 of 90 matching notes