CIA Triad

Clear Explanation

What it is: CIA Triad is a core cybersecurity concept. Understand confidentiality, integrity, and availability as the base model for explaining security goals.

Why it matters: These basics help you explain security decisions to technical teams, managers, auditors, and business users.

How to Understand / Apply It

1. Define the asset or process clearly.
2. Identify what could go wrong.
3. Map the problem to confidentiality, integrity, availability, risk, and control concepts.
4. Choose layered controls instead of depending on one protection.
5. Review whether the control can be monitored and improved.

Example

Example:
Asset: Customer database
Confidentiality risk: unauthorized user reads records
Integrity risk: attacker changes account details
Availability risk: ransomware blocks access
Controls:
- MFA and least privilege
- Database backups
- Logging and alerting
- Patch management
- Incident response plan

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain CIA Triad in simple words.
• What risk does CIA Triad reduce?
• What evidence would prove this is working?
• What is one common mistake with CIA Triad?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for CIA Triad.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Threat, Vulnerability, Risk

Clear Explanation

What it is: Threat, Vulnerability, Risk is a core cybersecurity concept. Understand the difference between what can attack you, what weakness exists, and what business impact can happen.

Why it matters: These basics help you explain security decisions to technical teams, managers, auditors, and business users.

How to Understand / Apply It

1. Define the asset or process clearly.
2. Identify what could go wrong.
3. Map the problem to confidentiality, integrity, availability, risk, and control concepts.
4. Choose layered controls instead of depending on one protection.
5. Review whether the control can be monitored and improved.

Example

Example:
Asset: Customer database
Confidentiality risk: unauthorized user reads records
Integrity risk: attacker changes account details
Availability risk: ransomware blocks access
Controls:
- MFA and least privilege
- Database backups
- Logging and alerting
- Patch management
- Incident response plan

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Threat, Vulnerability, Risk in simple words.
• What risk does Threat, Vulnerability, Risk reduce?
• What evidence would prove this is working?
• What is one common mistake with Threat, Vulnerability, Risk?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Threat, Vulnerability, Risk.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Security Controls

Clear Explanation

What it is: Security Controls is a core cybersecurity concept. Understand preventive, detective, corrective, deterrent, administrative, technical, and physical controls.

Why it matters: These basics help you explain security decisions to technical teams, managers, auditors, and business users.

How to Understand / Apply It

1. Define the asset or process clearly.
2. Identify what could go wrong.
3. Map the problem to confidentiality, integrity, availability, risk, and control concepts.
4. Choose layered controls instead of depending on one protection.
5. Review whether the control can be monitored and improved.

Example

Example:
Asset: Customer database
Confidentiality risk: unauthorized user reads records
Integrity risk: attacker changes account details
Availability risk: ransomware blocks access
Controls:
- MFA and least privilege
- Database backups
- Logging and alerting
- Patch management
- Incident response plan

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Security Controls in simple words.
• What risk does Security Controls reduce?
• What evidence would prove this is working?
• What is one common mistake with Security Controls?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Security Controls.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Attack Surface

Clear Explanation

What it is: Attack Surface is a core cybersecurity concept. Identify all places where attackers could interact with systems, users, apps, APIs, networks, or cloud resources.

Why it matters: These basics help you explain security decisions to technical teams, managers, auditors, and business users.

How to Understand / Apply It

1. Define the asset or process clearly.
2. Identify what could go wrong.
3. Map the problem to confidentiality, integrity, availability, risk, and control concepts.
4. Choose layered controls instead of depending on one protection.
5. Review whether the control can be monitored and improved.

Example

Example:
Asset: Customer database
Confidentiality risk: unauthorized user reads records
Integrity risk: attacker changes account details
Availability risk: ransomware blocks access
Controls:
- MFA and least privilege
- Database backups
- Logging and alerting
- Patch management
- Incident response plan

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Attack Surface in simple words.
• What risk does Attack Surface reduce?
• What evidence would prove this is working?
• What is one common mistake with Attack Surface?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Attack Surface.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Security Mindset

Clear Explanation

What it is: Security Mindset is a core cybersecurity concept. Learn how defenders think: assume failure, verify trust, reduce exposure, monitor behavior, and prepare response.

Why it matters: These basics help you explain security decisions to technical teams, managers, auditors, and business users.

How to Understand / Apply It

1. Define the asset or process clearly.
2. Identify what could go wrong.
3. Map the problem to confidentiality, integrity, availability, risk, and control concepts.
4. Choose layered controls instead of depending on one protection.
5. Review whether the control can be monitored and improved.

Example

Example:
Asset: Customer database
Confidentiality risk: unauthorized user reads records
Integrity risk: attacker changes account details
Availability risk: ransomware blocks access
Controls:
- MFA and least privilege
- Database backups
- Logging and alerting
- Patch management
- Incident response plan

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Security Mindset in simple words.
• What risk does Security Mindset reduce?
• What evidence would prove this is working?
• What is one common mistake with Security Mindset?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Security Mindset.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Common Attack Lifecycle

Clear Explanation

What it is: Common Attack Lifecycle helps defenders understand attacker behavior and user-focused threats. Understand reconnaissance, initial access, execution, persistence, privilege escalation, lateral movement, exfiltration, and impact.

Why it matters: Security is not only technical. Attackers often target people, credentials, business process weaknesses, and trust relationships.

How to Understand / Apply It

1. Identify attacker goal and likely entry method.
2. Train users and define reporting paths.
3. Monitor identity, email, endpoint, DNS, and network indicators.
4. Use controls such as MFA, filtering, EDR, backups, and payment verification.
5. Practice response steps with tabletop exercises.

Example

Phishing response example:
1. User reports suspicious email.
2. SOC reviews headers, links, attachments, and sender.
3. Search mailboxes for same message.
4. Remove message if malicious.
5. Reset credentials if user clicked and submitted password.
6. Add detection/block rule.
7. Document timeline and lesson learned.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Common Attack Lifecycle in simple words.
• What risk does Common Attack Lifecycle reduce?
• What evidence would prove this is working?
• What is one common mistake with Common Attack Lifecycle?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Common Attack Lifecycle.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Defense in Depth

Clear Explanation

What it is: Defense in Depth is a core cybersecurity concept. Use multiple layers of protection so one failed control does not create a full breach.

Why it matters: These basics help you explain security decisions to technical teams, managers, auditors, and business users.

How to Understand / Apply It

1. Define the asset or process clearly.
2. Identify what could go wrong.
3. Map the problem to confidentiality, integrity, availability, risk, and control concepts.
4. Choose layered controls instead of depending on one protection.
5. Review whether the control can be monitored and improved.

Example

Example:
Asset: Customer database
Confidentiality risk: unauthorized user reads records
Integrity risk: attacker changes account details
Availability risk: ransomware blocks access
Controls:
- MFA and least privilege
- Database backups
- Logging and alerting
- Patch management
- Incident response plan

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Defense in Depth in simple words.
• What risk does Defense in Depth reduce?
• What evidence would prove this is working?
• What is one common mistake with Defense in Depth?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Defense in Depth.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Least Privilege

Clear Explanation

What it is: Least Privilege protects users, administrators, service accounts, and application access. Grant users, applications, and services only the access they need to perform their job.

Why it matters: Identity is often the main attack path. Stolen credentials can bypass network defenses unless MFA, least privilege, monitoring, and access reviews are in place.

How to Understand / Apply It

1. Inventory users, administrators, service accounts, groups, and applications.
2. Require MFA for sensitive access.
3. Use least privilege and role-based access.
4. Rotate or remove unused accounts and secrets.
5. Monitor failed logins, impossible travel, privilege changes, and unusual token use.

Example

Identity review example:
User: contractor@example.com
Checks:
- Is the account still needed?
- Is MFA enabled?
- Which groups provide access?
- Does access match the contract role?
- When was last login?
Action:
- Remove unnecessary groups
- Set review date
- Disable account after contract end

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using shared admin accounts.
• Not enforcing MFA for privileged access.
• Leaving inactive users or service accounts enabled.
• Granting broad access through large groups.
• Not reviewing access after role changes.

Interview Questions

• Explain Least Privilege in simple words.
• What risk does Least Privilege reduce?
• What evidence would prove this is working?
• What is one common mistake with Least Privilege?
• How would you apply least privilege?
• How would you investigate a suspicious login?

Hands-on Practice

• Create an access review table for five users.
• Identify which accounts need MFA.
• Write a service account ownership checklist.
• Document removal steps for a terminated user.

Portfolio Evidence

Zero Trust Basics

Clear Explanation

What it is: Zero Trust Basics is a core cybersecurity concept. Never automatically trust a user, device, network, or workload; verify continuously and limit access.

Why it matters: These basics help you explain security decisions to technical teams, managers, auditors, and business users.

How to Understand / Apply It

1. Define the asset or process clearly.
2. Identify what could go wrong.
3. Map the problem to confidentiality, integrity, availability, risk, and control concepts.
4. Choose layered controls instead of depending on one protection.
5. Review whether the control can be monitored and improved.

Example

Example:
Asset: Customer database
Confidentiality risk: unauthorized user reads records
Integrity risk: attacker changes account details
Availability risk: ransomware blocks access
Controls:
- MFA and least privilege
- Database backups
- Logging and alerting
- Patch management
- Incident response plan

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Zero Trust Basics in simple words.
• What risk does Zero Trust Basics reduce?
• What evidence would prove this is working?
• What is one common mistake with Zero Trust Basics?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Zero Trust Basics.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Security Roles

Clear Explanation

What it is: Security Roles turns learning into proof of practical ability. Understand SOC analyst, security engineer, penetration tester, cloud security engineer, GRC analyst, incident responder, and architect roles.

Why it matters: A good portfolio shows that you can explain a problem, build or review a control safely, collect evidence, and communicate findings clearly.

How to Understand / Apply It

1. Define the scenario and scope.
2. Use only legal, safe lab systems or training apps.
3. Create diagrams, screenshots, logs, and checklists.
4. Write findings with risk and remediation.
5. Prepare a short demo explanation for interviews.

Example

Portfolio report structure:
1. Objective
2. Scope and lab environment
3. Tools used
4. Steps performed
5. Evidence screenshots/logs
6. Findings
7. Risk rating
8. Recommendations
9. Lessons learned

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Security Roles in simple words.
• What risk does Security Roles reduce?
• What evidence would prove this is working?
• What is one common mistake with Security Roles?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Security Roles.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Cybersecurity Learning Roadmap

Clear Explanation

What it is: Cybersecurity Learning Roadmap turns learning into proof of practical ability. Follow a path from networking and OS basics to security operations, cloud, application security, incident response, and governance.

Why it matters: A good portfolio shows that you can explain a problem, build or review a control safely, collect evidence, and communicate findings clearly.

How to Understand / Apply It

1. Define the scenario and scope.
2. Use only legal, safe lab systems or training apps.
3. Create diagrams, screenshots, logs, and checklists.
4. Write findings with risk and remediation.
5. Prepare a short demo explanation for interviews.

Example

Portfolio report structure:
1. Objective
2. Scope and lab environment
3. Tools used
4. Steps performed
5. Evidence screenshots/logs
6. Findings
7. Risk rating
8. Recommendations
9. Lessons learned

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Cybersecurity Learning Roadmap in simple words.
• What risk does Cybersecurity Learning Roadmap reduce?
• What evidence would prove this is working?
• What is one common mistake with Cybersecurity Learning Roadmap?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Cybersecurity Learning Roadmap.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

OSI Model for Security

Clear Explanation

What it is: OSI Model for Security protects communication between systems. Understand security risks and controls at physical, data link, network, transport, session, presentation, and application layers.

Why it matters: Most attacks rely on network access at some point. Good network security reduces exposure, limits movement, and gives defenders useful evidence.

How to Understand / Apply It

1. Identify required traffic: source, destination, port, protocol, and business purpose.
2. Block unnecessary inbound and outbound traffic.
3. Segment sensitive systems away from general user networks.
4. Log firewall, DNS, VPN, proxy, and network detection events.
5. Review alerts and packet evidence during investigations.

Example

Safe network review example:
Goal: Verify only required ports are open.
Steps:
1. Review firewall rules.
2. Confirm business owner for each allowed service.
3. Remove unused rules.
4. Check VPN access groups.
5. Review DNS/firewall logs for unusual destinations.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Leaving management ports open to the internet.
• Allowing broad rules without business justification.
• Creating VLANs but not enforcing firewall rules.
• Not logging DNS, VPN, and firewall activity.
• Assuming encryption means traffic is automatically safe.

Interview Questions

• Explain OSI Model for Security in simple words.
• What risk does OSI Model for Security reduce?
• What evidence would prove this is working?
• What is one common mistake with OSI Model for Security?
• Which logs would you check first?
• How would you separate normal traffic from suspicious traffic?

Hands-on Practice

• Draw a small network diagram.
• List allowed ports and business purpose.
• Write three suspicious traffic examples and investigation steps.
• Create a firewall review checklist.

Portfolio Evidence

TCP/IP Security Basics

Clear Explanation

What it is: TCP/IP Security Basics protects communication between systems. Understand IP, TCP, UDP, ports, sessions, and how attackers abuse open services.

Why it matters: Most attacks rely on network access at some point. Good network security reduces exposure, limits movement, and gives defenders useful evidence.

How to Understand / Apply It

1. Identify required traffic: source, destination, port, protocol, and business purpose.
2. Block unnecessary inbound and outbound traffic.
3. Segment sensitive systems away from general user networks.
4. Log firewall, DNS, VPN, proxy, and network detection events.
5. Review alerts and packet evidence during investigations.

Example

Safe network review example:
Goal: Verify only required ports are open.
Steps:
1. Review firewall rules.
2. Confirm business owner for each allowed service.
3. Remove unused rules.
4. Check VPN access groups.
5. Review DNS/firewall logs for unusual destinations.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Leaving management ports open to the internet.
• Allowing broad rules without business justification.
• Creating VLANs but not enforcing firewall rules.
• Not logging DNS, VPN, and firewall activity.
• Assuming encryption means traffic is automatically safe.

Interview Questions

• Explain TCP/IP Security Basics in simple words.
• What risk does TCP/IP Security Basics reduce?
• What evidence would prove this is working?
• What is one common mistake with TCP/IP Security Basics?
• Which logs would you check first?
• How would you separate normal traffic from suspicious traffic?

Hands-on Practice

• Draw a small network diagram.
• List allowed ports and business purpose.
• Write three suspicious traffic examples and investigation steps.
• Create a firewall review checklist.

Portfolio Evidence

Ports and Services

Clear Explanation

What it is: Ports and Services protects communication between systems. Recognize common ports such as 22, 53, 80, 443, 3389 and why unnecessary open ports increase risk.

Why it matters: Most attacks rely on network access at some point. Good network security reduces exposure, limits movement, and gives defenders useful evidence.

How to Understand / Apply It

1. Identify required traffic: source, destination, port, protocol, and business purpose.
2. Block unnecessary inbound and outbound traffic.
3. Segment sensitive systems away from general user networks.
4. Log firewall, DNS, VPN, proxy, and network detection events.
5. Review alerts and packet evidence during investigations.

Example

Safe network review example:
Goal: Verify only required ports are open.
Steps:
1. Review firewall rules.
2. Confirm business owner for each allowed service.
3. Remove unused rules.
4. Check VPN access groups.
5. Review DNS/firewall logs for unusual destinations.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Leaving management ports open to the internet.
• Allowing broad rules without business justification.
• Creating VLANs but not enforcing firewall rules.
• Not logging DNS, VPN, and firewall activity.
• Assuming encryption means traffic is automatically safe.

Interview Questions

• Explain Ports and Services in simple words.
• What risk does Ports and Services reduce?
• What evidence would prove this is working?
• What is one common mistake with Ports and Services?
• Which logs would you check first?
• How would you separate normal traffic from suspicious traffic?

Hands-on Practice

• Draw a small network diagram.
• List allowed ports and business purpose.
• Write three suspicious traffic examples and investigation steps.
• Create a firewall review checklist.

Portfolio Evidence

DNS Security

Clear Explanation

What it is: DNS Security protects communication between systems. Understand DNS spoofing, tunneling, malicious domains, DNS filtering, DNSSEC concepts, and logging.

Why it matters: Most attacks rely on network access at some point. Good network security reduces exposure, limits movement, and gives defenders useful evidence.

How to Understand / Apply It

1. Identify required traffic: source, destination, port, protocol, and business purpose.
2. Block unnecessary inbound and outbound traffic.
3. Segment sensitive systems away from general user networks.
4. Log firewall, DNS, VPN, proxy, and network detection events.
5. Review alerts and packet evidence during investigations.

Example

Safe network review example:
Goal: Verify only required ports are open.
Steps:
1. Review firewall rules.
2. Confirm business owner for each allowed service.
3. Remove unused rules.
4. Check VPN access groups.
5. Review DNS/firewall logs for unusual destinations.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Leaving management ports open to the internet.
• Allowing broad rules without business justification.
• Creating VLANs but not enforcing firewall rules.
• Not logging DNS, VPN, and firewall activity.
• Assuming encryption means traffic is automatically safe.

Interview Questions

• Explain DNS Security in simple words.
• What risk does DNS Security reduce?
• What evidence would prove this is working?
• What is one common mistake with DNS Security?
• Which logs would you check first?
• How would you separate normal traffic from suspicious traffic?

Hands-on Practice

• Draw a small network diagram.
• List allowed ports and business purpose.
• Write three suspicious traffic examples and investigation steps.
• Create a firewall review checklist.

Portfolio Evidence

DHCP and ARP Risks

Clear Explanation

What it is: DHCP and ARP Risks protects communication between systems. Understand rogue DHCP, ARP spoofing, and local network attacks.

Why it matters: Most attacks rely on network access at some point. Good network security reduces exposure, limits movement, and gives defenders useful evidence.

How to Understand / Apply It

1. Identify required traffic: source, destination, port, protocol, and business purpose.
2. Block unnecessary inbound and outbound traffic.
3. Segment sensitive systems away from general user networks.
4. Log firewall, DNS, VPN, proxy, and network detection events.
5. Review alerts and packet evidence during investigations.

Example

Safe network review example:
Goal: Verify only required ports are open.
Steps:
1. Review firewall rules.
2. Confirm business owner for each allowed service.
3. Remove unused rules.
4. Check VPN access groups.
5. Review DNS/firewall logs for unusual destinations.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Leaving management ports open to the internet.
• Allowing broad rules without business justification.
• Creating VLANs but not enforcing firewall rules.
• Not logging DNS, VPN, and firewall activity.
• Assuming encryption means traffic is automatically safe.

Interview Questions

• Explain DHCP and ARP Risks in simple words.
• What risk does DHCP and ARP Risks reduce?
• What evidence would prove this is working?
• What is one common mistake with DHCP and ARP Risks?
• Which logs would you check first?
• How would you separate normal traffic from suspicious traffic?

Hands-on Practice

• Draw a small network diagram.
• List allowed ports and business purpose.
• Write three suspicious traffic examples and investigation steps.
• Create a firewall review checklist.

Portfolio Evidence

Firewalls

Clear Explanation

What it is: Firewalls protects communication between systems. Control inbound and outbound traffic using source, destination, port, protocol, and application context.

Why it matters: Most attacks rely on network access at some point. Good network security reduces exposure, limits movement, and gives defenders useful evidence.

How to Understand / Apply It

1. Identify required traffic: source, destination, port, protocol, and business purpose.
2. Block unnecessary inbound and outbound traffic.
3. Segment sensitive systems away from general user networks.
4. Log firewall, DNS, VPN, proxy, and network detection events.
5. Review alerts and packet evidence during investigations.

Example

Safe network review example:
Goal: Verify only required ports are open.
Steps:
1. Review firewall rules.
2. Confirm business owner for each allowed service.
3. Remove unused rules.
4. Check VPN access groups.
5. Review DNS/firewall logs for unusual destinations.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Leaving management ports open to the internet.
• Allowing broad rules without business justification.
• Creating VLANs but not enforcing firewall rules.
• Not logging DNS, VPN, and firewall activity.
• Assuming encryption means traffic is automatically safe.

Interview Questions

• Explain Firewalls in simple words.
• What risk does Firewalls reduce?
• What evidence would prove this is working?
• What is one common mistake with Firewalls?
• Which logs would you check first?
• How would you separate normal traffic from suspicious traffic?

Hands-on Practice

• Draw a small network diagram.
• List allowed ports and business purpose.
• Write three suspicious traffic examples and investigation steps.
• Create a firewall review checklist.

Portfolio Evidence

Next-Generation Firewalls

Clear Explanation

What it is: Next-Generation Firewalls protects communication between systems. Understand application-aware filtering, IPS, URL filtering, threat intelligence, and identity-based rules.

Why it matters: Most attacks rely on network access at some point. Good network security reduces exposure, limits movement, and gives defenders useful evidence.

How to Understand / Apply It

1. Identify required traffic: source, destination, port, protocol, and business purpose.
2. Block unnecessary inbound and outbound traffic.
3. Segment sensitive systems away from general user networks.
4. Log firewall, DNS, VPN, proxy, and network detection events.
5. Review alerts and packet evidence during investigations.

Example

Safe network review example:
Goal: Verify only required ports are open.
Steps:
1. Review firewall rules.
2. Confirm business owner for each allowed service.
3. Remove unused rules.
4. Check VPN access groups.
5. Review DNS/firewall logs for unusual destinations.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Leaving management ports open to the internet.
• Allowing broad rules without business justification.
• Creating VLANs but not enforcing firewall rules.
• Not logging DNS, VPN, and firewall activity.
• Assuming encryption means traffic is automatically safe.

Interview Questions

• Explain Next-Generation Firewalls in simple words.
• What risk does Next-Generation Firewalls reduce?
• What evidence would prove this is working?
• What is one common mistake with Next-Generation Firewalls?
• Which logs would you check first?
• How would you separate normal traffic from suspicious traffic?

Hands-on Practice

• Draw a small network diagram.
• List allowed ports and business purpose.
• Write three suspicious traffic examples and investigation steps.
• Create a firewall review checklist.

Portfolio Evidence

Network Segmentation

Clear Explanation

What it is: Network Segmentation protects communication between systems. Separate systems into zones so compromise in one area does not expose the whole network.

Why it matters: Most attacks rely on network access at some point. Good network security reduces exposure, limits movement, and gives defenders useful evidence.

How to Understand / Apply It

1. Identify required traffic: source, destination, port, protocol, and business purpose.
2. Block unnecessary inbound and outbound traffic.
3. Segment sensitive systems away from general user networks.
4. Log firewall, DNS, VPN, proxy, and network detection events.
5. Review alerts and packet evidence during investigations.

Example

Safe network review example:
Goal: Verify only required ports are open.
Steps:
1. Review firewall rules.
2. Confirm business owner for each allowed service.
3. Remove unused rules.
4. Check VPN access groups.
5. Review DNS/firewall logs for unusual destinations.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Leaving management ports open to the internet.
• Allowing broad rules without business justification.
• Creating VLANs but not enforcing firewall rules.
• Not logging DNS, VPN, and firewall activity.
• Assuming encryption means traffic is automatically safe.

Interview Questions

• Explain Network Segmentation in simple words.
• What risk does Network Segmentation reduce?
• What evidence would prove this is working?
• What is one common mistake with Network Segmentation?
• Which logs would you check first?
• How would you separate normal traffic from suspicious traffic?

Hands-on Practice

• Draw a small network diagram.
• List allowed ports and business purpose.
• Write three suspicious traffic examples and investigation steps.
• Create a firewall review checklist.

Portfolio Evidence

VLAN Security

Clear Explanation

What it is: VLAN Security protects communication between systems. Use VLANs to separate broadcast domains while still enforcing routing and firewall controls.

Why it matters: Most attacks rely on network access at some point. Good network security reduces exposure, limits movement, and gives defenders useful evidence.

How to Understand / Apply It

1. Identify required traffic: source, destination, port, protocol, and business purpose.
2. Block unnecessary inbound and outbound traffic.
3. Segment sensitive systems away from general user networks.
4. Log firewall, DNS, VPN, proxy, and network detection events.
5. Review alerts and packet evidence during investigations.

Example

Safe network review example:
Goal: Verify only required ports are open.
Steps:
1. Review firewall rules.
2. Confirm business owner for each allowed service.
3. Remove unused rules.
4. Check VPN access groups.
5. Review DNS/firewall logs for unusual destinations.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Leaving management ports open to the internet.
• Allowing broad rules without business justification.
• Creating VLANs but not enforcing firewall rules.
• Not logging DNS, VPN, and firewall activity.
• Assuming encryption means traffic is automatically safe.

Interview Questions

• Explain VLAN Security in simple words.
• What risk does VLAN Security reduce?
• What evidence would prove this is working?
• What is one common mistake with VLAN Security?
• Which logs would you check first?
• How would you separate normal traffic from suspicious traffic?

Hands-on Practice

• Draw a small network diagram.
• List allowed ports and business purpose.
• Write three suspicious traffic examples and investigation steps.
• Create a firewall review checklist.

Portfolio Evidence

VPN Security

Clear Explanation

What it is: VPN Security protects communication between systems. Secure remote access using encrypted tunnels, strong authentication, device checks, and limited access.

Why it matters: Most attacks rely on network access at some point. Good network security reduces exposure, limits movement, and gives defenders useful evidence.

How to Understand / Apply It

1. Identify required traffic: source, destination, port, protocol, and business purpose.
2. Block unnecessary inbound and outbound traffic.
3. Segment sensitive systems away from general user networks.
4. Log firewall, DNS, VPN, proxy, and network detection events.
5. Review alerts and packet evidence during investigations.

Example

Safe network review example:
Goal: Verify only required ports are open.
Steps:
1. Review firewall rules.
2. Confirm business owner for each allowed service.
3. Remove unused rules.
4. Check VPN access groups.
5. Review DNS/firewall logs for unusual destinations.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Leaving management ports open to the internet.
• Allowing broad rules without business justification.
• Creating VLANs but not enforcing firewall rules.
• Not logging DNS, VPN, and firewall activity.
• Assuming encryption means traffic is automatically safe.

Interview Questions

• Explain VPN Security in simple words.
• What risk does VPN Security reduce?
• What evidence would prove this is working?
• What is one common mistake with VPN Security?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for VPN Security.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

IDS and IPS

Clear Explanation

What it is: IDS and IPS protects communication between systems. Detect or block suspicious traffic using signatures, anomaly detection, and tuned rules.

Why it matters: Most attacks rely on network access at some point. Good network security reduces exposure, limits movement, and gives defenders useful evidence.

How to Understand / Apply It

1. Identify required traffic: source, destination, port, protocol, and business purpose.
2. Block unnecessary inbound and outbound traffic.
3. Segment sensitive systems away from general user networks.
4. Log firewall, DNS, VPN, proxy, and network detection events.
5. Review alerts and packet evidence during investigations.

Example

Safe network review example:
Goal: Verify only required ports are open.
Steps:
1. Review firewall rules.
2. Confirm business owner for each allowed service.
3. Remove unused rules.
4. Check VPN access groups.
5. Review DNS/firewall logs for unusual destinations.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Leaving management ports open to the internet.
• Allowing broad rules without business justification.
• Creating VLANs but not enforcing firewall rules.
• Not logging DNS, VPN, and firewall activity.
• Assuming encryption means traffic is automatically safe.

Interview Questions

• Explain IDS and IPS in simple words.
• What risk does IDS and IPS reduce?
• What evidence would prove this is working?
• What is one common mistake with IDS and IPS?
• Which logs would you check first?
• How would you separate normal traffic from suspicious traffic?

Hands-on Practice

• Draw a small network diagram.
• List allowed ports and business purpose.
• Write three suspicious traffic examples and investigation steps.
• Create a firewall review checklist.

Portfolio Evidence

Packet Capture Basics

Clear Explanation

What it is: Packet Capture Basics protects communication between systems. Use packet captures to inspect network behavior, confirm alerts, and troubleshoot suspicious activity.

Why it matters: Most attacks rely on network access at some point. Good network security reduces exposure, limits movement, and gives defenders useful evidence.

How to Understand / Apply It

1. Identify required traffic: source, destination, port, protocol, and business purpose.
2. Block unnecessary inbound and outbound traffic.
3. Segment sensitive systems away from general user networks.
4. Log firewall, DNS, VPN, proxy, and network detection events.
5. Review alerts and packet evidence during investigations.

Example

Safe network review example:
Goal: Verify only required ports are open.
Steps:
1. Review firewall rules.
2. Confirm business owner for each allowed service.
3. Remove unused rules.
4. Check VPN access groups.
5. Review DNS/firewall logs for unusual destinations.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Leaving management ports open to the internet.
• Allowing broad rules without business justification.
• Creating VLANs but not enforcing firewall rules.
• Not logging DNS, VPN, and firewall activity.
• Assuming encryption means traffic is automatically safe.

Interview Questions

• Explain Packet Capture Basics in simple words.
• What risk does Packet Capture Basics reduce?
• What evidence would prove this is working?
• What is one common mistake with Packet Capture Basics?
• Which logs would you check first?
• How would you separate normal traffic from suspicious traffic?

Hands-on Practice

• Draw a small network diagram.
• List allowed ports and business purpose.
• Write three suspicious traffic examples and investigation steps.
• Create a firewall review checklist.

Portfolio Evidence

Wireshark Basics

Clear Explanation

What it is: Wireshark Basics protects communication between systems. Analyze protocols, conversations, DNS queries, TCP handshakes, TLS metadata, and suspicious traffic patterns.

Why it matters: Most attacks rely on network access at some point. Good network security reduces exposure, limits movement, and gives defenders useful evidence.

How to Understand / Apply It

1. Identify required traffic: source, destination, port, protocol, and business purpose.
2. Block unnecessary inbound and outbound traffic.
3. Segment sensitive systems away from general user networks.
4. Log firewall, DNS, VPN, proxy, and network detection events.
5. Review alerts and packet evidence during investigations.

Example

Safe network review example:
Goal: Verify only required ports are open.
Steps:
1. Review firewall rules.
2. Confirm business owner for each allowed service.
3. Remove unused rules.
4. Check VPN access groups.
5. Review DNS/firewall logs for unusual destinations.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Leaving management ports open to the internet.
• Allowing broad rules without business justification.
• Creating VLANs but not enforcing firewall rules.
• Not logging DNS, VPN, and firewall activity.
• Assuming encryption means traffic is automatically safe.

Interview Questions

• Explain Wireshark Basics in simple words.
• What risk does Wireshark Basics reduce?
• What evidence would prove this is working?
• What is one common mistake with Wireshark Basics?
• Which logs would you check first?
• How would you separate normal traffic from suspicious traffic?

Hands-on Practice

• Draw a small network diagram.
• List allowed ports and business purpose.
• Write three suspicious traffic examples and investigation steps.
• Create a firewall review checklist.

Portfolio Evidence

Network Hardening

Clear Explanation

What it is: Network Hardening protects communication between systems. Disable unnecessary services, restrict management access, log network events, and patch network devices.

Why it matters: Most attacks rely on network access at some point. Good network security reduces exposure, limits movement, and gives defenders useful evidence.

How to Understand / Apply It

1. Identify required traffic: source, destination, port, protocol, and business purpose.
2. Block unnecessary inbound and outbound traffic.
3. Segment sensitive systems away from general user networks.
4. Log firewall, DNS, VPN, proxy, and network detection events.
5. Review alerts and packet evidence during investigations.

Example

Safe network review example:
Goal: Verify only required ports are open.
Steps:
1. Review firewall rules.
2. Confirm business owner for each allowed service.
3. Remove unused rules.
4. Check VPN access groups.
5. Review DNS/firewall logs for unusual destinations.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Leaving management ports open to the internet.
• Allowing broad rules without business justification.
• Creating VLANs but not enforcing firewall rules.
• Not logging DNS, VPN, and firewall activity.
• Assuming encryption means traffic is automatically safe.

Interview Questions

• Explain Network Hardening in simple words.
• What risk does Network Hardening reduce?
• What evidence would prove this is working?
• What is one common mistake with Network Hardening?
• Which logs would you check first?
• How would you separate normal traffic from suspicious traffic?

Hands-on Practice

• Draw a small network diagram.
• List allowed ports and business purpose.
• Write three suspicious traffic examples and investigation steps.
• Create a firewall review checklist.

Portfolio Evidence

Linux Security Basics

Clear Explanation

What it is: Linux Security Basics protects laptops, servers, and workstations. Understand Linux users, groups, permissions, sudo, services, logs, SSH, and package updates.

Why it matters: Endpoints are where users work and where many attacks start. Hardening, patching, logging, and EDR reduce compromise and improve response.

How to Understand / Apply It

1. Apply secure configuration baselines.
2. Patch operating systems and applications.
3. Restrict admin rights and remote access.
4. Enable host firewall, antivirus/EDR, and logging.
5. Review suspicious processes, services, accounts, and login activity.

Example

Endpoint hardening checklist:
- OS patched
- Local admin access limited
- Disk encryption enabled
- Host firewall enabled
- EDR/antivirus active
- Unused services disabled
- Logs forwarded to monitoring

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Giving users local admin access by default.
• Delaying critical patches without a documented exception.
• Not forwarding important logs to central monitoring.
• Installing EDR but not tuning response.
• Hardening manually without a repeatable baseline.

Interview Questions

• Explain Linux Security Basics in simple words.
• What risk does Linux Security Basics reduce?
• What evidence would prove this is working?
• What is one common mistake with Linux Security Basics?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a secure workstation/server checklist.
• Identify five useful logs.
• Write patch review steps.
• Document before/after hardening evidence.

Portfolio Evidence

Linux File Permissions

Clear Explanation

What it is: Linux File Permissions protects laptops, servers, and workstations. Read and set owner, group, permission bits, and secure sensitive files.

Why it matters: Endpoints are where users work and where many attacks start. Hardening, patching, logging, and EDR reduce compromise and improve response.

How to Understand / Apply It

1. Apply secure configuration baselines.
2. Patch operating systems and applications.
3. Restrict admin rights and remote access.
4. Enable host firewall, antivirus/EDR, and logging.
5. Review suspicious processes, services, accounts, and login activity.

Example

Endpoint hardening checklist:
- OS patched
- Local admin access limited
- Disk encryption enabled
- Host firewall enabled
- EDR/antivirus active
- Unused services disabled
- Logs forwarded to monitoring

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Giving users local admin access by default.
• Delaying critical patches without a documented exception.
• Not forwarding important logs to central monitoring.
• Installing EDR but not tuning response.
• Hardening manually without a repeatable baseline.

Interview Questions

• Explain Linux File Permissions in simple words.
• What risk does Linux File Permissions reduce?
• What evidence would prove this is working?
• What is one common mistake with Linux File Permissions?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a secure workstation/server checklist.
• Identify five useful logs.
• Write patch review steps.
• Document before/after hardening evidence.

Portfolio Evidence

Linux Logs

Clear Explanation

What it is: Linux Logs means: Review auth logs, system logs, service logs, and audit logs for security events.

Why it matters: It matters because weak security design, missing controls, poor monitoring, or unclear ownership can turn a small weakness into a business incident.

How to Understand / Apply It

1. Identify the asset, data, user, network, app, or cloud service being protected.
2. Identify likely threats and weaknesses.
3. Choose controls that reduce risk without breaking business operations.
4. Collect logs or evidence so the control can be tested.
5. Document owner, frequency, exceptions, and response steps.

Example

Example: If remote access is required, use MFA, device checks, least privilege, logging, and clear offboarding instead of simply opening a public port.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Linux Logs in simple words.
• What risk does Linux Logs reduce?
• What evidence would prove this is working?
• What is one common mistake with Linux Logs?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Linux Logs.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

SSH Hardening

Clear Explanation

What it is: SSH Hardening protects laptops, servers, and workstations. Secure SSH using key-based login, disabled root login, limited users, and logging.

Why it matters: Endpoints are where users work and where many attacks start. Hardening, patching, logging, and EDR reduce compromise and improve response.

How to Understand / Apply It

1. Apply secure configuration baselines.
2. Patch operating systems and applications.
3. Restrict admin rights and remote access.
4. Enable host firewall, antivirus/EDR, and logging.
5. Review suspicious processes, services, accounts, and login activity.

Example

Endpoint hardening checklist:
- OS patched
- Local admin access limited
- Disk encryption enabled
- Host firewall enabled
- EDR/antivirus active
- Unused services disabled
- Logs forwarded to monitoring

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Giving users local admin access by default.
• Delaying critical patches without a documented exception.
• Not forwarding important logs to central monitoring.
• Installing EDR but not tuning response.
• Hardening manually without a repeatable baseline.

Interview Questions

• Explain SSH Hardening in simple words.
• What risk does SSH Hardening reduce?
• What evidence would prove this is working?
• What is one common mistake with SSH Hardening?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a secure workstation/server checklist.
• Identify five useful logs.
• Write patch review steps.
• Document before/after hardening evidence.

Portfolio Evidence

Linux Firewall

Clear Explanation

What it is: Linux Firewall protects laptops, servers, and workstations. Use host firewall rules to restrict inbound and outbound traffic.

Why it matters: Endpoints are where users work and where many attacks start. Hardening, patching, logging, and EDR reduce compromise and improve response.

How to Understand / Apply It

1. Apply secure configuration baselines.
2. Patch operating systems and applications.
3. Restrict admin rights and remote access.
4. Enable host firewall, antivirus/EDR, and logging.
5. Review suspicious processes, services, accounts, and login activity.

Example

Endpoint hardening checklist:
- OS patched
- Local admin access limited
- Disk encryption enabled
- Host firewall enabled
- EDR/antivirus active
- Unused services disabled
- Logs forwarded to monitoring

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Giving users local admin access by default.
• Delaying critical patches without a documented exception.
• Not forwarding important logs to central monitoring.
• Installing EDR but not tuning response.
• Hardening manually without a repeatable baseline.

Interview Questions

• Explain Linux Firewall in simple words.
• What risk does Linux Firewall reduce?
• What evidence would prove this is working?
• What is one common mistake with Linux Firewall?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a secure workstation/server checklist.
• Identify five useful logs.
• Write patch review steps.
• Document before/after hardening evidence.

Portfolio Evidence

Windows Security Basics

Clear Explanation

What it is: Windows Security Basics protects laptops, servers, and workstations. Understand users, groups, services, registry, event logs, Defender, firewall, and update management.

Why it matters: Endpoints are where users work and where many attacks start. Hardening, patching, logging, and EDR reduce compromise and improve response.

How to Understand / Apply It

1. Apply secure configuration baselines.
2. Patch operating systems and applications.
3. Restrict admin rights and remote access.
4. Enable host firewall, antivirus/EDR, and logging.
5. Review suspicious processes, services, accounts, and login activity.

Example

Endpoint hardening checklist:
- OS patched
- Local admin access limited
- Disk encryption enabled
- Host firewall enabled
- EDR/antivirus active
- Unused services disabled
- Logs forwarded to monitoring

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Giving users local admin access by default.
• Delaying critical patches without a documented exception.
• Not forwarding important logs to central monitoring.
• Installing EDR but not tuning response.
• Hardening manually without a repeatable baseline.

Interview Questions

• Explain Windows Security Basics in simple words.
• What risk does Windows Security Basics reduce?
• What evidence would prove this is working?
• What is one common mistake with Windows Security Basics?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a secure workstation/server checklist.
• Identify five useful logs.
• Write patch review steps.
• Document before/after hardening evidence.

Portfolio Evidence

Windows Event Logs

Clear Explanation

What it is: Windows Event Logs means: Review Security, System, Application, PowerShell, and Defender logs for suspicious activity.

Why it matters: It matters because weak security design, missing controls, poor monitoring, or unclear ownership can turn a small weakness into a business incident.

How to Understand / Apply It

1. Identify the asset, data, user, network, app, or cloud service being protected.
2. Identify likely threats and weaknesses.
3. Choose controls that reduce risk without breaking business operations.
4. Collect logs or evidence so the control can be tested.
5. Document owner, frequency, exceptions, and response steps.

Example

Example: If remote access is required, use MFA, device checks, least privilege, logging, and clear offboarding instead of simply opening a public port.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Windows Event Logs in simple words.
• What risk does Windows Event Logs reduce?
• What evidence would prove this is working?
• What is one common mistake with Windows Event Logs?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Windows Event Logs.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Active Directory Basics

Clear Explanation

What it is: Active Directory Basics protects users, administrators, service accounts, and application access. Understand domains, domain controllers, users, groups, computers, Kerberos, LDAP, and Group Policy.

Why it matters: Identity is often the main attack path. Stolen credentials can bypass network defenses unless MFA, least privilege, monitoring, and access reviews are in place.

How to Understand / Apply It

1. Inventory users, administrators, service accounts, groups, and applications.
2. Require MFA for sensitive access.
3. Use least privilege and role-based access.
4. Rotate or remove unused accounts and secrets.
5. Monitor failed logins, impossible travel, privilege changes, and unusual token use.

Example

Identity review example:
User: contractor@example.com
Checks:
- Is the account still needed?
- Is MFA enabled?
- Which groups provide access?
- Does access match the contract role?
- When was last login?
Action:
- Remove unnecessary groups
- Set review date
- Disable account after contract end

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using shared admin accounts.
• Not enforcing MFA for privileged access.
• Leaving inactive users or service accounts enabled.
• Granting broad access through large groups.
• Not reviewing access after role changes.

Interview Questions

• Explain Active Directory Basics in simple words.
• What risk does Active Directory Basics reduce?
• What evidence would prove this is working?
• What is one common mistake with Active Directory Basics?
• How would you apply least privilege?
• How would you investigate a suspicious login?

Hands-on Practice

• Create an access review table for five users.
• Identify which accounts need MFA.
• Write a service account ownership checklist.
• Document removal steps for a terminated user.

Portfolio Evidence

Group Policy Security

Clear Explanation

What it is: Group Policy Security protects laptops, servers, and workstations. Use Group Policy to enforce password policy, audit policy, firewall settings, software restrictions, and endpoint controls.

Why it matters: Endpoints are where users work and where many attacks start. Hardening, patching, logging, and EDR reduce compromise and improve response.

How to Understand / Apply It

1. Apply secure configuration baselines.
2. Patch operating systems and applications.
3. Restrict admin rights and remote access.
4. Enable host firewall, antivirus/EDR, and logging.
5. Review suspicious processes, services, accounts, and login activity.

Example

Endpoint hardening checklist:
- OS patched
- Local admin access limited
- Disk encryption enabled
- Host firewall enabled
- EDR/antivirus active
- Unused services disabled
- Logs forwarded to monitoring

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Giving users local admin access by default.
• Delaying critical patches without a documented exception.
• Not forwarding important logs to central monitoring.
• Installing EDR but not tuning response.
• Hardening manually without a repeatable baseline.

Interview Questions

• Explain Group Policy Security in simple words.
• What risk does Group Policy Security reduce?
• What evidence would prove this is working?
• What is one common mistake with Group Policy Security?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a secure workstation/server checklist.
• Identify five useful logs.
• Write patch review steps.
• Document before/after hardening evidence.

Portfolio Evidence

Endpoint Detection and Response

Clear Explanation

What it is: Endpoint Detection and Response protects laptops, servers, and workstations. Use EDR tools to detect malicious behavior, isolate endpoints, collect evidence, and support investigation.

Why it matters: Endpoints are where users work and where many attacks start. Hardening, patching, logging, and EDR reduce compromise and improve response.

How to Understand / Apply It

1. Apply secure configuration baselines.
2. Patch operating systems and applications.
3. Restrict admin rights and remote access.
4. Enable host firewall, antivirus/EDR, and logging.
5. Review suspicious processes, services, accounts, and login activity.

Example

Endpoint hardening checklist:
- OS patched
- Local admin access limited
- Disk encryption enabled
- Host firewall enabled
- EDR/antivirus active
- Unused services disabled
- Logs forwarded to monitoring

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Giving users local admin access by default.
• Delaying critical patches without a documented exception.
• Not forwarding important logs to central monitoring.
• Installing EDR but not tuning response.
• Hardening manually without a repeatable baseline.

Interview Questions

• Explain Endpoint Detection and Response in simple words.
• What risk does Endpoint Detection and Response reduce?
• What evidence would prove this is working?
• What is one common mistake with Endpoint Detection and Response?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a secure workstation/server checklist.
• Identify five useful logs.
• Write patch review steps.
• Document before/after hardening evidence.

Portfolio Evidence

Patch Management

Clear Explanation

What it is: Patch Management protects laptops, servers, and workstations. Keep operating systems, applications, libraries, and firmware updated to reduce exploitable weaknesses.

Why it matters: Endpoints are where users work and where many attacks start. Hardening, patching, logging, and EDR reduce compromise and improve response.

How to Understand / Apply It

1. Apply secure configuration baselines.
2. Patch operating systems and applications.
3. Restrict admin rights and remote access.
4. Enable host firewall, antivirus/EDR, and logging.
5. Review suspicious processes, services, accounts, and login activity.

Example

Endpoint hardening checklist:
- OS patched
- Local admin access limited
- Disk encryption enabled
- Host firewall enabled
- EDR/antivirus active
- Unused services disabled
- Logs forwarded to monitoring

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Giving users local admin access by default.
• Delaying critical patches without a documented exception.
• Not forwarding important logs to central monitoring.
• Installing EDR but not tuning response.
• Hardening manually without a repeatable baseline.

Interview Questions

• Explain Patch Management in simple words.
• What risk does Patch Management reduce?
• What evidence would prove this is working?
• What is one common mistake with Patch Management?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a secure workstation/server checklist.
• Identify five useful logs.
• Write patch review steps.
• Document before/after hardening evidence.

Portfolio Evidence

Secure Configuration Baselines

Clear Explanation

What it is: Secure Configuration Baselines protects laptops, servers, and workstations. Use standard secure baselines so servers, endpoints, and cloud resources are configured consistently.

Why it matters: Endpoints are where users work and where many attacks start. Hardening, patching, logging, and EDR reduce compromise and improve response.

How to Understand / Apply It

1. Apply secure configuration baselines.
2. Patch operating systems and applications.
3. Restrict admin rights and remote access.
4. Enable host firewall, antivirus/EDR, and logging.
5. Review suspicious processes, services, accounts, and login activity.

Example

Endpoint hardening checklist:
- OS patched
- Local admin access limited
- Disk encryption enabled
- Host firewall enabled
- EDR/antivirus active
- Unused services disabled
- Logs forwarded to monitoring

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Giving users local admin access by default.
• Delaying critical patches without a documented exception.
• Not forwarding important logs to central monitoring.
• Installing EDR but not tuning response.
• Hardening manually without a repeatable baseline.

Interview Questions

• Explain Secure Configuration Baselines in simple words.
• What risk does Secure Configuration Baselines reduce?
• What evidence would prove this is working?
• What is one common mistake with Secure Configuration Baselines?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a secure workstation/server checklist.
• Identify five useful logs.
• Write patch review steps.
• Document before/after hardening evidence.

Portfolio Evidence

Authentication vs Authorization

Clear Explanation

What it is: Authentication vs Authorization protects users, administrators, service accounts, and application access. Understand proving who you are versus what you are allowed to do.

Why it matters: Identity is often the main attack path. Stolen credentials can bypass network defenses unless MFA, least privilege, monitoring, and access reviews are in place.

How to Understand / Apply It

1. Inventory users, administrators, service accounts, groups, and applications.
2. Require MFA for sensitive access.
3. Use least privilege and role-based access.
4. Rotate or remove unused accounts and secrets.
5. Monitor failed logins, impossible travel, privilege changes, and unusual token use.

Example

Identity review example:
User: contractor@example.com
Checks:
- Is the account still needed?
- Is MFA enabled?
- Which groups provide access?
- Does access match the contract role?
- When was last login?
Action:
- Remove unnecessary groups
- Set review date
- Disable account after contract end

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using shared admin accounts.
• Not enforcing MFA for privileged access.
• Leaving inactive users or service accounts enabled.
• Granting broad access through large groups.
• Not reviewing access after role changes.

Interview Questions

• Explain Authentication vs Authorization in simple words.
• What risk does Authentication vs Authorization reduce?
• What evidence would prove this is working?
• What is one common mistake with Authentication vs Authorization?
• How would you apply least privilege?
• How would you investigate a suspicious login?

Hands-on Practice

• Create an access review table for five users.
• Identify which accounts need MFA.
• Write a service account ownership checklist.
• Document removal steps for a terminated user.

Portfolio Evidence

Password Security

Clear Explanation

What it is: Password Security protects users, administrators, service accounts, and application access. Use strong password policies, password managers, breach checks, and user education.

Why it matters: Identity is often the main attack path. Stolen credentials can bypass network defenses unless MFA, least privilege, monitoring, and access reviews are in place.

How to Understand / Apply It

1. Inventory users, administrators, service accounts, groups, and applications.
2. Require MFA for sensitive access.
3. Use least privilege and role-based access.
4. Rotate or remove unused accounts and secrets.
5. Monitor failed logins, impossible travel, privilege changes, and unusual token use.

Example

Identity review example:
User: contractor@example.com
Checks:
- Is the account still needed?
- Is MFA enabled?
- Which groups provide access?
- Does access match the contract role?
- When was last login?
Action:
- Remove unnecessary groups
- Set review date
- Disable account after contract end

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using shared admin accounts.
• Not enforcing MFA for privileged access.
• Leaving inactive users or service accounts enabled.
• Granting broad access through large groups.
• Not reviewing access after role changes.

Interview Questions

• Explain Password Security in simple words.
• What risk does Password Security reduce?
• What evidence would prove this is working?
• What is one common mistake with Password Security?
• How would you apply least privilege?
• How would you investigate a suspicious login?

Hands-on Practice

• Create an access review table for five users.
• Identify which accounts need MFA.
• Write a service account ownership checklist.
• Document removal steps for a terminated user.

Portfolio Evidence

Multi-Factor Authentication

Clear Explanation

What it is: Multi-Factor Authentication protects users, administrators, service accounts, and application access. Add another verification factor to reduce risk from stolen passwords.

Why it matters: Identity is often the main attack path. Stolen credentials can bypass network defenses unless MFA, least privilege, monitoring, and access reviews are in place.

How to Understand / Apply It

1. Inventory users, administrators, service accounts, groups, and applications.
2. Require MFA for sensitive access.
3. Use least privilege and role-based access.
4. Rotate or remove unused accounts and secrets.
5. Monitor failed logins, impossible travel, privilege changes, and unusual token use.

Example

Identity review example:
User: contractor@example.com
Checks:
- Is the account still needed?
- Is MFA enabled?
- Which groups provide access?
- Does access match the contract role?
- When was last login?
Action:
- Remove unnecessary groups
- Set review date
- Disable account after contract end

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using shared admin accounts.
• Not enforcing MFA for privileged access.
• Leaving inactive users or service accounts enabled.
• Granting broad access through large groups.
• Not reviewing access after role changes.

Interview Questions

• Explain Multi-Factor Authentication in simple words.
• What risk does Multi-Factor Authentication reduce?
• What evidence would prove this is working?
• What is one common mistake with Multi-Factor Authentication?
• How would you apply least privilege?
• How would you investigate a suspicious login?

Hands-on Practice

• Create an access review table for five users.
• Identify which accounts need MFA.
• Write a service account ownership checklist.
• Document removal steps for a terminated user.

Portfolio Evidence

Single Sign-On

Clear Explanation

What it is: Single Sign-On protects users, administrators, service accounts, and application access. Use centralized login with SAML, OAuth, or OIDC patterns to reduce password sprawl.

Why it matters: Identity is often the main attack path. Stolen credentials can bypass network defenses unless MFA, least privilege, monitoring, and access reviews are in place.

How to Understand / Apply It

1. Inventory users, administrators, service accounts, groups, and applications.
2. Require MFA for sensitive access.
3. Use least privilege and role-based access.
4. Rotate or remove unused accounts and secrets.
5. Monitor failed logins, impossible travel, privilege changes, and unusual token use.

Example

Identity review example:
User: contractor@example.com
Checks:
- Is the account still needed?
- Is MFA enabled?
- Which groups provide access?
- Does access match the contract role?
- When was last login?
Action:
- Remove unnecessary groups
- Set review date
- Disable account after contract end

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using shared admin accounts.
• Not enforcing MFA for privileged access.
• Leaving inactive users or service accounts enabled.
• Granting broad access through large groups.
• Not reviewing access after role changes.

Interview Questions

• Explain Single Sign-On in simple words.
• What risk does Single Sign-On reduce?
• What evidence would prove this is working?
• What is one common mistake with Single Sign-On?
• How would you apply least privilege?
• How would you investigate a suspicious login?

Hands-on Practice

• Create an access review table for five users.
• Identify which accounts need MFA.
• Write a service account ownership checklist.
• Document removal steps for a terminated user.

Portfolio Evidence

OAuth Basics

Clear Explanation

What it is: OAuth Basics protects users, administrators, service accounts, and application access. Understand delegated authorization, scopes, tokens, consent, and application access.

Why it matters: Identity is often the main attack path. Stolen credentials can bypass network defenses unless MFA, least privilege, monitoring, and access reviews are in place.

How to Understand / Apply It

1. Inventory users, administrators, service accounts, groups, and applications.
2. Require MFA for sensitive access.
3. Use least privilege and role-based access.
4. Rotate or remove unused accounts and secrets.
5. Monitor failed logins, impossible travel, privilege changes, and unusual token use.

Example

Identity review example:
User: contractor@example.com
Checks:
- Is the account still needed?
- Is MFA enabled?
- Which groups provide access?
- Does access match the contract role?
- When was last login?
Action:
- Remove unnecessary groups
- Set review date
- Disable account after contract end

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using shared admin accounts.
• Not enforcing MFA for privileged access.
• Leaving inactive users or service accounts enabled.
• Granting broad access through large groups.
• Not reviewing access after role changes.

Interview Questions

• Explain OAuth Basics in simple words.
• What risk does OAuth Basics reduce?
• What evidence would prove this is working?
• What is one common mistake with OAuth Basics?
• How would you apply least privilege?
• How would you investigate a suspicious login?

Hands-on Practice

• Create an access review table for five users.
• Identify which accounts need MFA.
• Write a service account ownership checklist.
• Document removal steps for a terminated user.

Portfolio Evidence

SAML Basics

Clear Explanation

What it is: SAML Basics protects users, administrators, service accounts, and application access. Understand enterprise web SSO using identity provider, service provider, assertions, and certificates.

Why it matters: Identity is often the main attack path. Stolen credentials can bypass network defenses unless MFA, least privilege, monitoring, and access reviews are in place.

How to Understand / Apply It

1. Inventory users, administrators, service accounts, groups, and applications.
2. Require MFA for sensitive access.
3. Use least privilege and role-based access.
4. Rotate or remove unused accounts and secrets.
5. Monitor failed logins, impossible travel, privilege changes, and unusual token use.

Example

Identity review example:
User: contractor@example.com
Checks:
- Is the account still needed?
- Is MFA enabled?
- Which groups provide access?
- Does access match the contract role?
- When was last login?
Action:
- Remove unnecessary groups
- Set review date
- Disable account after contract end

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using shared admin accounts.
• Not enforcing MFA for privileged access.
• Leaving inactive users or service accounts enabled.
• Granting broad access through large groups.
• Not reviewing access after role changes.

Interview Questions

• Explain SAML Basics in simple words.
• What risk does SAML Basics reduce?
• What evidence would prove this is working?
• What is one common mistake with SAML Basics?
• How would you apply least privilege?
• How would you investigate a suspicious login?

Hands-on Practice

• Create an access review table for five users.
• Identify which accounts need MFA.
• Write a service account ownership checklist.
• Document removal steps for a terminated user.

Portfolio Evidence

Privileged Access Management

Clear Explanation

What it is: Privileged Access Management protects users, administrators, service accounts, and application access. Control administrator accounts with approval, vaulting, rotation, session recording, and just-in-time access.

Why it matters: Identity is often the main attack path. Stolen credentials can bypass network defenses unless MFA, least privilege, monitoring, and access reviews are in place.

How to Understand / Apply It

1. Inventory users, administrators, service accounts, groups, and applications.
2. Require MFA for sensitive access.
3. Use least privilege and role-based access.
4. Rotate or remove unused accounts and secrets.
5. Monitor failed logins, impossible travel, privilege changes, and unusual token use.

Example

Identity review example:
User: contractor@example.com
Checks:
- Is the account still needed?
- Is MFA enabled?
- Which groups provide access?
- Does access match the contract role?
- When was last login?
Action:
- Remove unnecessary groups
- Set review date
- Disable account after contract end

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using shared admin accounts.
• Not enforcing MFA for privileged access.
• Leaving inactive users or service accounts enabled.
• Granting broad access through large groups.
• Not reviewing access after role changes.

Interview Questions

• Explain Privileged Access Management in simple words.
• What risk does Privileged Access Management reduce?
• What evidence would prove this is working?
• What is one common mistake with Privileged Access Management?
• How would you apply least privilege?
• How would you investigate a suspicious login?

Hands-on Practice

• Create an access review table for five users.
• Identify which accounts need MFA.
• Write a service account ownership checklist.
• Document removal steps for a terminated user.

Portfolio Evidence

Service Account Security

Clear Explanation

What it is: Service Account Security protects users, administrators, service accounts, and application access. Secure non-human accounts with least privilege, rotation, monitoring, and ownership.

Why it matters: Identity is often the main attack path. Stolen credentials can bypass network defenses unless MFA, least privilege, monitoring, and access reviews are in place.

How to Understand / Apply It

1. Inventory users, administrators, service accounts, groups, and applications.
2. Require MFA for sensitive access.
3. Use least privilege and role-based access.
4. Rotate or remove unused accounts and secrets.
5. Monitor failed logins, impossible travel, privilege changes, and unusual token use.

Example

Identity review example:
User: contractor@example.com
Checks:
- Is the account still needed?
- Is MFA enabled?
- Which groups provide access?
- Does access match the contract role?
- When was last login?
Action:
- Remove unnecessary groups
- Set review date
- Disable account after contract end

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using shared admin accounts.
• Not enforcing MFA for privileged access.
• Leaving inactive users or service accounts enabled.
• Granting broad access through large groups.
• Not reviewing access after role changes.

Interview Questions

• Explain Service Account Security in simple words.
• What risk does Service Account Security reduce?
• What evidence would prove this is working?
• What is one common mistake with Service Account Security?
• How would you apply least privilege?
• How would you investigate a suspicious login?

Hands-on Practice

• Create an access review table for five users.
• Identify which accounts need MFA.
• Write a service account ownership checklist.
• Document removal steps for a terminated user.

Portfolio Evidence

Access Reviews

Clear Explanation

What it is: Access Reviews connects security work to business accountability, policies, controls, audits, and risk decisions. Periodically verify that user and service access is still required and appropriate.

Why it matters: Security programs need governance so risks are visible, owners are assigned, and controls are tested instead of assumed.

How to Understand / Apply It

1. Define policy or control requirement.
2. Map assets, owners, risks, and applicable obligations.
3. Collect evidence that the control exists and works.
4. Track exceptions and remediation plans.
5. Report risk to the right decision-makers.

Example

Risk register example:
Risk: Public exposure of sensitive cloud storage
Likelihood: Medium
Impact: High
Controls:
- Block public access
- IAM review
- Encryption
- Cloud monitoring
Treatment: Mitigate
Owner: Cloud platform team
Review: Monthly

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Writing policies nobody follows.
• Collecting evidence only during audits.
• Accepting risk without owner approval.
• Treating compliance as the same thing as security.
• Not tracking remediation owners and dates.

Interview Questions

• Explain Access Reviews in simple words.
• What risk does Access Reviews reduce?
• What evidence would prove this is working?
• What is one common mistake with Access Reviews?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Access Reviews.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Identity Attack Techniques

Clear Explanation

What it is: Identity Attack Techniques helps defenders understand attacker behavior and user-focused threats. Understand credential theft, phishing, password spraying, token theft, privilege escalation, and lateral movement.

Why it matters: Security is not only technical. Attackers often target people, credentials, business process weaknesses, and trust relationships.

How to Understand / Apply It

1. Identify attacker goal and likely entry method.
2. Train users and define reporting paths.
3. Monitor identity, email, endpoint, DNS, and network indicators.
4. Use controls such as MFA, filtering, EDR, backups, and payment verification.
5. Practice response steps with tabletop exercises.

Example

Phishing response example:
1. User reports suspicious email.
2. SOC reviews headers, links, attachments, and sender.
3. Search mailboxes for same message.
4. Remove message if malicious.
5. Reset credentials if user clicked and submitted password.
6. Add detection/block rule.
7. Document timeline and lesson learned.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Identity Attack Techniques in simple words.
• What risk does Identity Attack Techniques reduce?
• What evidence would prove this is working?
• What is one common mistake with Identity Attack Techniques?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Identity Attack Techniques.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Cryptography Basics

Clear Explanation

What it is: Cryptography Basics protects sensitive information and business continuity. Understand encryption, hashing, keys, certificates, digital signatures, and secure protocols.

Why it matters: Data is usually the business asset attackers want. Data protection reduces breach impact, supports privacy, and improves recovery from incidents.

How to Understand / Apply It

1. Classify data by sensitivity.
2. Encrypt data at rest and in transit where appropriate.
3. Restrict access using least privilege.
4. Monitor data movement and unusual downloads.
5. Test backups and restore procedures.

Example

Data protection example:
Data type: Employee personal data
Classification: Confidential
Controls:
- Role-based access
- MFA for HR systems
- Encryption at rest
- TLS in transit
- DLP monitoring
- Retention and deletion policy
- Tested backups

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Cryptography Basics in simple words.
• What risk does Cryptography Basics reduce?
• What evidence would prove this is working?
• What is one common mistake with Cryptography Basics?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Cryptography Basics.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Symmetric Encryption

Clear Explanation

What it is: Symmetric Encryption protects sensitive information and business continuity. Use one shared key for encryption and decryption, commonly for fast bulk data protection.

Why it matters: Data is usually the business asset attackers want. Data protection reduces breach impact, supports privacy, and improves recovery from incidents.

How to Understand / Apply It

1. Classify data by sensitivity.
2. Encrypt data at rest and in transit where appropriate.
3. Restrict access using least privilege.
4. Monitor data movement and unusual downloads.
5. Test backups and restore procedures.

Example

Data protection example:
Data type: Employee personal data
Classification: Confidential
Controls:
- Role-based access
- MFA for HR systems
- Encryption at rest
- TLS in transit
- DLP monitoring
- Retention and deletion policy
- Tested backups

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Symmetric Encryption in simple words.
• What risk does Symmetric Encryption reduce?
• What evidence would prove this is working?
• What is one common mistake with Symmetric Encryption?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Symmetric Encryption.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Asymmetric Encryption

Clear Explanation

What it is: Asymmetric Encryption protects sensitive information and business continuity. Use public/private key pairs for secure exchange, signatures, and certificates.

Why it matters: Data is usually the business asset attackers want. Data protection reduces breach impact, supports privacy, and improves recovery from incidents.

How to Understand / Apply It

1. Classify data by sensitivity.
2. Encrypt data at rest and in transit where appropriate.
3. Restrict access using least privilege.
4. Monitor data movement and unusual downloads.
5. Test backups and restore procedures.

Example

Data protection example:
Data type: Employee personal data
Classification: Confidential
Controls:
- Role-based access
- MFA for HR systems
- Encryption at rest
- TLS in transit
- DLP monitoring
- Retention and deletion policy
- Tested backups

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Asymmetric Encryption in simple words.
• What risk does Asymmetric Encryption reduce?
• What evidence would prove this is working?
• What is one common mistake with Asymmetric Encryption?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Asymmetric Encryption.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Hashing

Clear Explanation

What it is: Hashing protects sensitive information and business continuity. Use one-way hashing to verify integrity and store password representations safely with salts.

Why it matters: Data is usually the business asset attackers want. Data protection reduces breach impact, supports privacy, and improves recovery from incidents.

How to Understand / Apply It

1. Classify data by sensitivity.
2. Encrypt data at rest and in transit where appropriate.
3. Restrict access using least privilege.
4. Monitor data movement and unusual downloads.
5. Test backups and restore procedures.

Example

Data protection example:
Data type: Employee personal data
Classification: Confidential
Controls:
- Role-based access
- MFA for HR systems
- Encryption at rest
- TLS in transit
- DLP monitoring
- Retention and deletion policy
- Tested backups

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Hashing in simple words.
• What risk does Hashing reduce?
• What evidence would prove this is working?
• What is one common mistake with Hashing?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Hashing.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Digital Signatures

Clear Explanation

What it is: Digital Signatures protects sensitive information and business continuity. Verify authenticity and integrity using private signing keys and public verification keys.

Why it matters: Data is usually the business asset attackers want. Data protection reduces breach impact, supports privacy, and improves recovery from incidents.

How to Understand / Apply It

1. Classify data by sensitivity.
2. Encrypt data at rest and in transit where appropriate.
3. Restrict access using least privilege.
4. Monitor data movement and unusual downloads.
5. Test backups and restore procedures.

Example

Data protection example:
Data type: Employee personal data
Classification: Confidential
Controls:
- Role-based access
- MFA for HR systems
- Encryption at rest
- TLS in transit
- DLP monitoring
- Retention and deletion policy
- Tested backups

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Digital Signatures in simple words.
• What risk does Digital Signatures reduce?
• What evidence would prove this is working?
• What is one common mistake with Digital Signatures?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Digital Signatures.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

TLS and HTTPS

Clear Explanation

What it is: TLS and HTTPS protects sensitive information and business continuity. Protect data in transit using certificates, negotiation, encryption, and integrity checks.

Why it matters: Data is usually the business asset attackers want. Data protection reduces breach impact, supports privacy, and improves recovery from incidents.

How to Understand / Apply It

1. Classify data by sensitivity.
2. Encrypt data at rest and in transit where appropriate.
3. Restrict access using least privilege.
4. Monitor data movement and unusual downloads.
5. Test backups and restore procedures.

Example

Data protection example:
Data type: Employee personal data
Classification: Confidential
Controls:
- Role-based access
- MFA for HR systems
- Encryption at rest
- TLS in transit
- DLP monitoring
- Retention and deletion policy
- Tested backups

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain TLS and HTTPS in simple words.
• What risk does TLS and HTTPS reduce?
• What evidence would prove this is working?
• What is one common mistake with TLS and HTTPS?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for TLS and HTTPS.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Certificate Management

Clear Explanation

What it is: Certificate Management protects sensitive information and business continuity. Manage certificate issuance, renewal, trust chains, expiration, and private key protection.

Why it matters: Data is usually the business asset attackers want. Data protection reduces breach impact, supports privacy, and improves recovery from incidents.

How to Understand / Apply It

1. Classify data by sensitivity.
2. Encrypt data at rest and in transit where appropriate.
3. Restrict access using least privilege.
4. Monitor data movement and unusual downloads.
5. Test backups and restore procedures.

Example

Data protection example:
Data type: Employee personal data
Classification: Confidential
Controls:
- Role-based access
- MFA for HR systems
- Encryption at rest
- TLS in transit
- DLP monitoring
- Retention and deletion policy
- Tested backups

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Certificate Management in simple words.
• What risk does Certificate Management reduce?
• What evidence would prove this is working?
• What is one common mistake with Certificate Management?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Certificate Management.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Data Classification

Clear Explanation

What it is: Data Classification protects sensitive information and business continuity. Classify data by sensitivity so controls match business and regulatory impact.

Why it matters: Data is usually the business asset attackers want. Data protection reduces breach impact, supports privacy, and improves recovery from incidents.

How to Understand / Apply It

1. Classify data by sensitivity.
2. Encrypt data at rest and in transit where appropriate.
3. Restrict access using least privilege.
4. Monitor data movement and unusual downloads.
5. Test backups and restore procedures.

Example

Data protection example:
Data type: Employee personal data
Classification: Confidential
Controls:
- Role-based access
- MFA for HR systems
- Encryption at rest
- TLS in transit
- DLP monitoring
- Retention and deletion policy
- Tested backups

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Data Classification in simple words.
• What risk does Data Classification reduce?
• What evidence would prove this is working?
• What is one common mistake with Data Classification?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Data Classification.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Data Loss Prevention

Clear Explanation

What it is: Data Loss Prevention protects sensitive information and business continuity. Detect or block sensitive data leaving approved locations through email, web, endpoint, or cloud channels.

Why it matters: Data is usually the business asset attackers want. Data protection reduces breach impact, supports privacy, and improves recovery from incidents.

How to Understand / Apply It

1. Classify data by sensitivity.
2. Encrypt data at rest and in transit where appropriate.
3. Restrict access using least privilege.
4. Monitor data movement and unusual downloads.
5. Test backups and restore procedures.

Example

Data protection example:
Data type: Employee personal data
Classification: Confidential
Controls:
- Role-based access
- MFA for HR systems
- Encryption at rest
- TLS in transit
- DLP monitoring
- Retention and deletion policy
- Tested backups

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Data Loss Prevention in simple words.
• What risk does Data Loss Prevention reduce?
• What evidence would prove this is working?
• What is one common mistake with Data Loss Prevention?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Data Loss Prevention.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Backup and Recovery

Clear Explanation

What it is: Backup and Recovery protects sensitive information and business continuity. Protect data and operations with tested backups, restore procedures, and recovery objectives.

Why it matters: Data is usually the business asset attackers want. Data protection reduces breach impact, supports privacy, and improves recovery from incidents.

How to Understand / Apply It

1. Classify data by sensitivity.
2. Encrypt data at rest and in transit where appropriate.
3. Restrict access using least privilege.
4. Monitor data movement and unusual downloads.
5. Test backups and restore procedures.

Example

Data protection example:
Data type: Employee personal data
Classification: Confidential
Controls:
- Role-based access
- MFA for HR systems
- Encryption at rest
- TLS in transit
- DLP monitoring
- Retention and deletion policy
- Tested backups

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Backup and Recovery in simple words.
• What risk does Backup and Recovery reduce?
• What evidence would prove this is working?
• What is one common mistake with Backup and Recovery?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Backup and Recovery.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Web Security Basics

Clear Explanation

What it is: Web Security Basics protects software and APIs from design, coding, authentication, authorization, and data-handling weaknesses. Understand how browsers, servers, sessions, cookies, forms, APIs, and databases interact.

Why it matters: Applications are exposed to users and attackers. A single broken access control or injection bug can expose sensitive records or allow system takeover.

How to Understand / Apply It

1. Map users, roles, data flows, trust boundaries, and entry points.
2. Validate input and encode output.
3. Enforce authentication and authorization on the server side.
4. Use secure session, token, and error handling.
5. Test with code review, SAST, DAST, SCA, and manual abuse cases.

Example

Secure API checklist:
Endpoint: GET /customers/{id}
Controls:
- User must be authenticated
- User can access only assigned customer records
- id parameter is validated
- Response excludes sensitive fields
- Rate limiting is enabled
- Access is logged
- Tests cover unauthorized access

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Checking authorization only in the UI.
• Trusting user input without validation.
• Returning sensitive fields in API responses.
• Using verbose errors that reveal system details.
• Ignoring dependency vulnerabilities.

Interview Questions

• Explain Web Security Basics in simple words.
• What risk does Web Security Basics reduce?
• What evidence would prove this is working?
• What is one common mistake with Web Security Basics?
• How would you test authorization safely?
• How would you explain the issue to a developer?

Hands-on Practice

• Use a safe training app or local demo app.
• Write expected roles and access rules.
• Document one safe test for broken access control.
• Write remediation guidance for developers.

Portfolio Evidence

OWASP Top 10 Overview

Clear Explanation

What it is: OWASP Top 10 Overview protects software and APIs from design, coding, authentication, authorization, and data-handling weaknesses. Use common web application risk categories to guide secure design and testing.

Why it matters: Applications are exposed to users and attackers. A single broken access control or injection bug can expose sensitive records or allow system takeover.

How to Understand / Apply It

1. Map users, roles, data flows, trust boundaries, and entry points.
2. Validate input and encode output.
3. Enforce authentication and authorization on the server side.
4. Use secure session, token, and error handling.
5. Test with code review, SAST, DAST, SCA, and manual abuse cases.

Example

Secure API checklist:
Endpoint: GET /customers/{id}
Controls:
- User must be authenticated
- User can access only assigned customer records
- id parameter is validated
- Response excludes sensitive fields
- Rate limiting is enabled
- Access is logged
- Tests cover unauthorized access

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Checking authorization only in the UI.
• Trusting user input without validation.
• Returning sensitive fields in API responses.
• Using verbose errors that reveal system details.
• Ignoring dependency vulnerabilities.

Interview Questions

• Explain OWASP Top 10 Overview in simple words.
• What risk does OWASP Top 10 Overview reduce?
• What evidence would prove this is working?
• What is one common mistake with OWASP Top 10 Overview?
• How would you test authorization safely?
• How would you explain the issue to a developer?

Hands-on Practice

• Use a safe training app or local demo app.
• Write expected roles and access rules.
• Document one safe test for broken access control.
• Write remediation guidance for developers.

Portfolio Evidence

Injection Attacks

Clear Explanation

What it is: Injection Attacks protects software and APIs from design, coding, authentication, authorization, and data-handling weaknesses. Understand SQL injection, command injection, LDAP injection, and how input reaches interpreters.

Why it matters: Applications are exposed to users and attackers. A single broken access control or injection bug can expose sensitive records or allow system takeover.

How to Understand / Apply It

1. Map users, roles, data flows, trust boundaries, and entry points.
2. Validate input and encode output.
3. Enforce authentication and authorization on the server side.
4. Use secure session, token, and error handling.
5. Test with code review, SAST, DAST, SCA, and manual abuse cases.

Example

Secure API checklist:
Endpoint: GET /customers/{id}
Controls:
- User must be authenticated
- User can access only assigned customer records
- id parameter is validated
- Response excludes sensitive fields
- Rate limiting is enabled
- Access is logged
- Tests cover unauthorized access

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Checking authorization only in the UI.
• Trusting user input without validation.
• Returning sensitive fields in API responses.
• Using verbose errors that reveal system details.
• Ignoring dependency vulnerabilities.

Interview Questions

• Explain Injection Attacks in simple words.
• What risk does Injection Attacks reduce?
• What evidence would prove this is working?
• What is one common mistake with Injection Attacks?
• How would you test authorization safely?
• How would you explain the issue to a developer?

Hands-on Practice

• Use a safe training app or local demo app.
• Write expected roles and access rules.
• Document one safe test for broken access control.
• Write remediation guidance for developers.

Portfolio Evidence

Cross-Site Scripting

Clear Explanation

What it is: Cross-Site Scripting protects software and APIs from design, coding, authentication, authorization, and data-handling weaknesses. Understand reflected, stored, and DOM XSS and how output encoding and sanitization reduce risk.

Why it matters: Applications are exposed to users and attackers. A single broken access control or injection bug can expose sensitive records or allow system takeover.

How to Understand / Apply It

1. Map users, roles, data flows, trust boundaries, and entry points.
2. Validate input and encode output.
3. Enforce authentication and authorization on the server side.
4. Use secure session, token, and error handling.
5. Test with code review, SAST, DAST, SCA, and manual abuse cases.

Example

Secure API checklist:
Endpoint: GET /customers/{id}
Controls:
- User must be authenticated
- User can access only assigned customer records
- id parameter is validated
- Response excludes sensitive fields
- Rate limiting is enabled
- Access is logged
- Tests cover unauthorized access

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Checking authorization only in the UI.
• Trusting user input without validation.
• Returning sensitive fields in API responses.
• Using verbose errors that reveal system details.
• Ignoring dependency vulnerabilities.

Interview Questions

• Explain Cross-Site Scripting in simple words.
• What risk does Cross-Site Scripting reduce?
• What evidence would prove this is working?
• What is one common mistake with Cross-Site Scripting?
• How would you test authorization safely?
• How would you explain the issue to a developer?

Hands-on Practice

• Use a safe training app or local demo app.
• Write expected roles and access rules.
• Document one safe test for broken access control.
• Write remediation guidance for developers.

Portfolio Evidence

Broken Authentication

Clear Explanation

What it is: Broken Authentication protects software and APIs from design, coding, authentication, authorization, and data-handling weaknesses. Identify weak login, session, reset, token, and credential handling patterns.

Why it matters: Applications are exposed to users and attackers. A single broken access control or injection bug can expose sensitive records or allow system takeover.

How to Understand / Apply It

1. Map users, roles, data flows, trust boundaries, and entry points.
2. Validate input and encode output.
3. Enforce authentication and authorization on the server side.
4. Use secure session, token, and error handling.
5. Test with code review, SAST, DAST, SCA, and manual abuse cases.

Example

Secure API checklist:
Endpoint: GET /customers/{id}
Controls:
- User must be authenticated
- User can access only assigned customer records
- id parameter is validated
- Response excludes sensitive fields
- Rate limiting is enabled
- Access is logged
- Tests cover unauthorized access

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Checking authorization only in the UI.
• Trusting user input without validation.
• Returning sensitive fields in API responses.
• Using verbose errors that reveal system details.
• Ignoring dependency vulnerabilities.

Interview Questions

• Explain Broken Authentication in simple words.
• What risk does Broken Authentication reduce?
• What evidence would prove this is working?
• What is one common mistake with Broken Authentication?
• How would you test authorization safely?
• How would you explain the issue to a developer?

Hands-on Practice

• Use a safe training app or local demo app.
• Write expected roles and access rules.
• Document one safe test for broken access control.
• Write remediation guidance for developers.

Portfolio Evidence

Broken Access Control

Clear Explanation

What it is: Broken Access Control protects software and APIs from design, coding, authentication, authorization, and data-handling weaknesses. Prevent users from accessing records, functions, APIs, or files they are not allowed to use.

Why it matters: Applications are exposed to users and attackers. A single broken access control or injection bug can expose sensitive records or allow system takeover.

How to Understand / Apply It

1. Map users, roles, data flows, trust boundaries, and entry points.
2. Validate input and encode output.
3. Enforce authentication and authorization on the server side.
4. Use secure session, token, and error handling.
5. Test with code review, SAST, DAST, SCA, and manual abuse cases.

Example

Secure API checklist:
Endpoint: GET /customers/{id}
Controls:
- User must be authenticated
- User can access only assigned customer records
- id parameter is validated
- Response excludes sensitive fields
- Rate limiting is enabled
- Access is logged
- Tests cover unauthorized access

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Checking authorization only in the UI.
• Trusting user input without validation.
• Returning sensitive fields in API responses.
• Using verbose errors that reveal system details.
• Ignoring dependency vulnerabilities.

Interview Questions

• Explain Broken Access Control in simple words.
• What risk does Broken Access Control reduce?
• What evidence would prove this is working?
• What is one common mistake with Broken Access Control?
• How would you test authorization safely?
• How would you explain the issue to a developer?

Hands-on Practice

• Use a safe training app or local demo app.
• Write expected roles and access rules.
• Document one safe test for broken access control.
• Write remediation guidance for developers.

Portfolio Evidence

Security Misconfiguration

Clear Explanation

What it is: Security Misconfiguration protects software and APIs from design, coding, authentication, authorization, and data-handling weaknesses. Avoid insecure defaults, exposed admin panels, verbose errors, weak headers, and unnecessary services.

Why it matters: Applications are exposed to users and attackers. A single broken access control or injection bug can expose sensitive records or allow system takeover.

How to Understand / Apply It

1. Map users, roles, data flows, trust boundaries, and entry points.
2. Validate input and encode output.
3. Enforce authentication and authorization on the server side.
4. Use secure session, token, and error handling.
5. Test with code review, SAST, DAST, SCA, and manual abuse cases.

Example

Secure API checklist:
Endpoint: GET /customers/{id}
Controls:
- User must be authenticated
- User can access only assigned customer records
- id parameter is validated
- Response excludes sensitive fields
- Rate limiting is enabled
- Access is logged
- Tests cover unauthorized access

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Checking authorization only in the UI.
• Trusting user input without validation.
• Returning sensitive fields in API responses.
• Using verbose errors that reveal system details.
• Ignoring dependency vulnerabilities.

Interview Questions

• Explain Security Misconfiguration in simple words.
• What risk does Security Misconfiguration reduce?
• What evidence would prove this is working?
• What is one common mistake with Security Misconfiguration?
• How would you test authorization safely?
• How would you explain the issue to a developer?

Hands-on Practice

• Use a safe training app or local demo app.
• Write expected roles and access rules.
• Document one safe test for broken access control.
• Write remediation guidance for developers.

Portfolio Evidence

Vulnerable Components

Clear Explanation

What it is: Vulnerable Components protects software and APIs from design, coding, authentication, authorization, and data-handling weaknesses. Manage dependency risk from outdated libraries, frameworks, containers, and plugins.

Why it matters: Applications are exposed to users and attackers. A single broken access control or injection bug can expose sensitive records or allow system takeover.

How to Understand / Apply It

1. Map users, roles, data flows, trust boundaries, and entry points.
2. Validate input and encode output.
3. Enforce authentication and authorization on the server side.
4. Use secure session, token, and error handling.
5. Test with code review, SAST, DAST, SCA, and manual abuse cases.

Example

Secure API checklist:
Endpoint: GET /customers/{id}
Controls:
- User must be authenticated
- User can access only assigned customer records
- id parameter is validated
- Response excludes sensitive fields
- Rate limiting is enabled
- Access is logged
- Tests cover unauthorized access

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Checking authorization only in the UI.
• Trusting user input without validation.
• Returning sensitive fields in API responses.
• Using verbose errors that reveal system details.
• Ignoring dependency vulnerabilities.

Interview Questions

• Explain Vulnerable Components in simple words.
• What risk does Vulnerable Components reduce?
• What evidence would prove this is working?
• What is one common mistake with Vulnerable Components?
• How would you test authorization safely?
• How would you explain the issue to a developer?

Hands-on Practice

• Use a safe training app or local demo app.
• Write expected roles and access rules.
• Document one safe test for broken access control.
• Write remediation guidance for developers.

Portfolio Evidence

API Security Basics

Clear Explanation

What it is: API Security Basics protects software and APIs from design, coding, authentication, authorization, and data-handling weaknesses. Protect APIs using authentication, authorization, input validation, rate limiting, logging, and schema validation.

Why it matters: Applications are exposed to users and attackers. A single broken access control or injection bug can expose sensitive records or allow system takeover.

How to Understand / Apply It

1. Map users, roles, data flows, trust boundaries, and entry points.
2. Validate input and encode output.
3. Enforce authentication and authorization on the server side.
4. Use secure session, token, and error handling.
5. Test with code review, SAST, DAST, SCA, and manual abuse cases.

Example

Secure API checklist:
Endpoint: GET /customers/{id}
Controls:
- User must be authenticated
- User can access only assigned customer records
- id parameter is validated
- Response excludes sensitive fields
- Rate limiting is enabled
- Access is logged
- Tests cover unauthorized access

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Checking authorization only in the UI.
• Trusting user input without validation.
• Returning sensitive fields in API responses.
• Using verbose errors that reveal system details.
• Ignoring dependency vulnerabilities.

Interview Questions

• Explain API Security Basics in simple words.
• What risk does API Security Basics reduce?
• What evidence would prove this is working?
• What is one common mistake with API Security Basics?
• How would you test authorization safely?
• How would you explain the issue to a developer?

Hands-on Practice

• Use a safe training app or local demo app.
• Write expected roles and access rules.
• Document one safe test for broken access control.
• Write remediation guidance for developers.

Portfolio Evidence

JWT Security

Clear Explanation

What it is: JWT Security protects software and APIs from design, coding, authentication, authorization, and data-handling weaknesses. Handle JSON Web Tokens safely, including signing, validation, expiration, issuer, audience, and key rotation.

Why it matters: Applications are exposed to users and attackers. A single broken access control or injection bug can expose sensitive records or allow system takeover.

How to Understand / Apply It

1. Map users, roles, data flows, trust boundaries, and entry points.
2. Validate input and encode output.
3. Enforce authentication and authorization on the server side.
4. Use secure session, token, and error handling.
5. Test with code review, SAST, DAST, SCA, and manual abuse cases.

Example

Secure API checklist:
Endpoint: GET /customers/{id}
Controls:
- User must be authenticated
- User can access only assigned customer records
- id parameter is validated
- Response excludes sensitive fields
- Rate limiting is enabled
- Access is logged
- Tests cover unauthorized access

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Checking authorization only in the UI.
• Trusting user input without validation.
• Returning sensitive fields in API responses.
• Using verbose errors that reveal system details.
• Ignoring dependency vulnerabilities.

Interview Questions

• Explain JWT Security in simple words.
• What risk does JWT Security reduce?
• What evidence would prove this is working?
• What is one common mistake with JWT Security?
• How would you test authorization safely?
• How would you explain the issue to a developer?

Hands-on Practice

• Use a safe training app or local demo app.
• Write expected roles and access rules.
• Document one safe test for broken access control.
• Write remediation guidance for developers.

Portfolio Evidence

Secure SDLC

Clear Explanation

What it is: Secure SDLC protects software and APIs from design, coding, authentication, authorization, and data-handling weaknesses. Add security into requirements, design, coding, testing, release, and maintenance.

Why it matters: Applications are exposed to users and attackers. A single broken access control or injection bug can expose sensitive records or allow system takeover.

How to Understand / Apply It

1. Map users, roles, data flows, trust boundaries, and entry points.
2. Validate input and encode output.
3. Enforce authentication and authorization on the server side.
4. Use secure session, token, and error handling.
5. Test with code review, SAST, DAST, SCA, and manual abuse cases.

Example

Secure API checklist:
Endpoint: GET /customers/{id}
Controls:
- User must be authenticated
- User can access only assigned customer records
- id parameter is validated
- Response excludes sensitive fields
- Rate limiting is enabled
- Access is logged
- Tests cover unauthorized access

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Checking authorization only in the UI.
• Trusting user input without validation.
• Returning sensitive fields in API responses.
• Using verbose errors that reveal system details.
• Ignoring dependency vulnerabilities.

Interview Questions

• Explain Secure SDLC in simple words.
• What risk does Secure SDLC reduce?
• What evidence would prove this is working?
• What is one common mistake with Secure SDLC?
• How would you test authorization safely?
• How would you explain the issue to a developer?

Hands-on Practice

• Use a safe training app or local demo app.
• Write expected roles and access rules.
• Document one safe test for broken access control.
• Write remediation guidance for developers.

Portfolio Evidence

Threat Modeling

Clear Explanation

What it is: Threat Modeling protects software and APIs from design, coding, authentication, authorization, and data-handling weaknesses. Identify threats early by mapping assets, trust boundaries, data flows, attackers, and mitigations.

Why it matters: Applications are exposed to users and attackers. A single broken access control or injection bug can expose sensitive records or allow system takeover.

How to Understand / Apply It

1. Map users, roles, data flows, trust boundaries, and entry points.
2. Validate input and encode output.
3. Enforce authentication and authorization on the server side.
4. Use secure session, token, and error handling.
5. Test with code review, SAST, DAST, SCA, and manual abuse cases.

Example

Secure API checklist:
Endpoint: GET /customers/{id}
Controls:
- User must be authenticated
- User can access only assigned customer records
- id parameter is validated
- Response excludes sensitive fields
- Rate limiting is enabled
- Access is logged
- Tests cover unauthorized access

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Checking authorization only in the UI.
• Trusting user input without validation.
• Returning sensitive fields in API responses.
• Using verbose errors that reveal system details.
• Ignoring dependency vulnerabilities.

Interview Questions

• Explain Threat Modeling in simple words.
• What risk does Threat Modeling reduce?
• What evidence would prove this is working?
• What is one common mistake with Threat Modeling?
• How would you test authorization safely?
• How would you explain the issue to a developer?

Hands-on Practice

• Use a safe training app or local demo app.
• Write expected roles and access rules.
• Document one safe test for broken access control.
• Write remediation guidance for developers.

Portfolio Evidence

Secure Code Review

Clear Explanation

What it is: Secure Code Review protects software and APIs from design, coding, authentication, authorization, and data-handling weaknesses. Review code for authorization, validation, secrets, crypto use, error handling, and business logic flaws.

Why it matters: Applications are exposed to users and attackers. A single broken access control or injection bug can expose sensitive records or allow system takeover.

How to Understand / Apply It

1. Map users, roles, data flows, trust boundaries, and entry points.
2. Validate input and encode output.
3. Enforce authentication and authorization on the server side.
4. Use secure session, token, and error handling.
5. Test with code review, SAST, DAST, SCA, and manual abuse cases.

Example

Secure API checklist:
Endpoint: GET /customers/{id}
Controls:
- User must be authenticated
- User can access only assigned customer records
- id parameter is validated
- Response excludes sensitive fields
- Rate limiting is enabled
- Access is logged
- Tests cover unauthorized access

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Checking authorization only in the UI.
• Trusting user input without validation.
• Returning sensitive fields in API responses.
• Using verbose errors that reveal system details.
• Ignoring dependency vulnerabilities.

Interview Questions

• Explain Secure Code Review in simple words.
• What risk does Secure Code Review reduce?
• What evidence would prove this is working?
• What is one common mistake with Secure Code Review?
• How would you test authorization safely?
• How would you explain the issue to a developer?

Hands-on Practice

• Use a safe training app or local demo app.
• Write expected roles and access rules.
• Document one safe test for broken access control.
• Write remediation guidance for developers.

Portfolio Evidence

SAST DAST and SCA

Clear Explanation

What it is: SAST DAST and SCA protects software and APIs from design, coding, authentication, authorization, and data-handling weaknesses. Use static analysis, dynamic testing, and software composition analysis to find application risks.

Why it matters: Applications are exposed to users and attackers. A single broken access control or injection bug can expose sensitive records or allow system takeover.

How to Understand / Apply It

1. Map users, roles, data flows, trust boundaries, and entry points.
2. Validate input and encode output.
3. Enforce authentication and authorization on the server side.
4. Use secure session, token, and error handling.
5. Test with code review, SAST, DAST, SCA, and manual abuse cases.

Example

Secure API checklist:
Endpoint: GET /customers/{id}
Controls:
- User must be authenticated
- User can access only assigned customer records
- id parameter is validated
- Response excludes sensitive fields
- Rate limiting is enabled
- Access is logged
- Tests cover unauthorized access

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Checking authorization only in the UI.
• Trusting user input without validation.
• Returning sensitive fields in API responses.
• Using verbose errors that reveal system details.
• Ignoring dependency vulnerabilities.

Interview Questions

• Explain SAST DAST and SCA in simple words.
• What risk does SAST DAST and SCA reduce?
• What evidence would prove this is working?
• What is one common mistake with SAST DAST and SCA?
• How would you test authorization safely?
• How would you explain the issue to a developer?

Hands-on Practice

• Use a safe training app or local demo app.
• Write expected roles and access rules.
• Document one safe test for broken access control.
• Write remediation guidance for developers.

Portfolio Evidence

Cloud Security Basics

Clear Explanation

What it is: Cloud Security Basics protects cloud resources, identities, networks, data, and services. Understand shared responsibility, identity, network controls, encryption, logging, and configuration management in cloud.

Why it matters: Cloud incidents often come from misconfiguration, excessive permissions, exposed storage, weak logging, or public network exposure.

How to Understand / Apply It

1. Apply least privilege IAM.
2. Keep storage private unless public access is required and approved.
3. Use encryption, key management, and logging.
4. Restrict network exposure using security groups, NACLs, private subnets, and endpoints.
5. Continuously monitor configuration drift and suspicious activity.

Example

Cloud baseline example:
- MFA for administrators
- No public storage by default
- Cloud audit logs enabled
- Security findings reviewed
- Encryption enabled for sensitive data
- Network access restricted
- IAM policies reviewed quarterly

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Public storage by mistake.
• Overly broad IAM permissions.
• Missing audit logs or short log retention.
• Exposing SSH/RDP to the internet.
• No alerting for risky configuration changes.

Interview Questions

• Explain Cloud Security Basics in simple words.
• What risk does Cloud Security Basics reduce?
• What evidence would prove this is working?
• What is one common mistake with Cloud Security Basics?
• Which misconfiguration would you check first?
• How would you prevent recurrence in CI/CD?

Hands-on Practice

• Create a cloud baseline checklist.
• Review IAM, network, storage, logging, and encryption.
• Write a sample finding with risk and remediation.
• Add a prevention step for CI/CD or policy-as-code.

Portfolio Evidence

AWS Security Basics

Clear Explanation

What it is: AWS Security Basics protects cloud resources, identities, networks, data, and services. Understand IAM, VPC, Security Groups, NACLs, KMS, CloudTrail, CloudWatch, Config, GuardDuty, and S3 security.

Why it matters: Cloud incidents often come from misconfiguration, excessive permissions, exposed storage, weak logging, or public network exposure.

How to Understand / Apply It

1. Apply least privilege IAM.
2. Keep storage private unless public access is required and approved.
3. Use encryption, key management, and logging.
4. Restrict network exposure using security groups, NACLs, private subnets, and endpoints.
5. Continuously monitor configuration drift and suspicious activity.

Example

Cloud baseline example:
- MFA for administrators
- No public storage by default
- Cloud audit logs enabled
- Security findings reviewed
- Encryption enabled for sensitive data
- Network access restricted
- IAM policies reviewed quarterly

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Public storage by mistake.
• Overly broad IAM permissions.
• Missing audit logs or short log retention.
• Exposing SSH/RDP to the internet.
• No alerting for risky configuration changes.

Interview Questions

• Explain AWS Security Basics in simple words.
• What risk does AWS Security Basics reduce?
• What evidence would prove this is working?
• What is one common mistake with AWS Security Basics?
• Which misconfiguration would you check first?
• How would you prevent recurrence in CI/CD?

Hands-on Practice

• Create a cloud baseline checklist.
• Review IAM, network, storage, logging, and encryption.
• Write a sample finding with risk and remediation.
• Add a prevention step for CI/CD or policy-as-code.

Portfolio Evidence

IAM Policies

Clear Explanation

What it is: IAM Policies protects cloud resources, identities, networks, data, and services. Write least-privilege permissions using actions, resources, conditions, and explicit deny logic.

Why it matters: Cloud incidents often come from misconfiguration, excessive permissions, exposed storage, weak logging, or public network exposure.

How to Understand / Apply It

1. Apply least privilege IAM.
2. Keep storage private unless public access is required and approved.
3. Use encryption, key management, and logging.
4. Restrict network exposure using security groups, NACLs, private subnets, and endpoints.
5. Continuously monitor configuration drift and suspicious activity.

Example

Cloud baseline example:
- MFA for administrators
- No public storage by default
- Cloud audit logs enabled
- Security findings reviewed
- Encryption enabled for sensitive data
- Network access restricted
- IAM policies reviewed quarterly

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Public storage by mistake.
• Overly broad IAM permissions.
• Missing audit logs or short log retention.
• Exposing SSH/RDP to the internet.
• No alerting for risky configuration changes.

Interview Questions

• Explain IAM Policies in simple words.
• What risk does IAM Policies reduce?
• What evidence would prove this is working?
• What is one common mistake with IAM Policies?
• Which misconfiguration would you check first?
• How would you prevent recurrence in CI/CD?

Hands-on Practice

• Create a cloud baseline checklist.
• Review IAM, network, storage, logging, and encryption.
• Write a sample finding with risk and remediation.
• Add a prevention step for CI/CD or policy-as-code.

Portfolio Evidence

S3 Security

Clear Explanation

What it is: S3 Security protects cloud resources, identities, networks, data, and services. Secure buckets with block public access, bucket policies, encryption, versioning, logging, and access review.

Why it matters: Cloud incidents often come from misconfiguration, excessive permissions, exposed storage, weak logging, or public network exposure.

How to Understand / Apply It

1. Apply least privilege IAM.
2. Keep storage private unless public access is required and approved.
3. Use encryption, key management, and logging.
4. Restrict network exposure using security groups, NACLs, private subnets, and endpoints.
5. Continuously monitor configuration drift and suspicious activity.

Example

Cloud baseline example:
- MFA for administrators
- No public storage by default
- Cloud audit logs enabled
- Security findings reviewed
- Encryption enabled for sensitive data
- Network access restricted
- IAM policies reviewed quarterly

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Public storage by mistake.
• Overly broad IAM permissions.
• Missing audit logs or short log retention.
• Exposing SSH/RDP to the internet.
• No alerting for risky configuration changes.

Interview Questions

• Explain S3 Security in simple words.
• What risk does S3 Security reduce?
• What evidence would prove this is working?
• What is one common mistake with S3 Security?
• Which misconfiguration would you check first?
• How would you prevent recurrence in CI/CD?

Hands-on Practice

• Create a cloud baseline checklist.
• Review IAM, network, storage, logging, and encryption.
• Write a sample finding with risk and remediation.
• Add a prevention step for CI/CD or policy-as-code.

Portfolio Evidence

VPC Security

Clear Explanation

What it is: VPC Security protects cloud resources, identities, networks, data, and services. Use subnets, route tables, security groups, NACLs, NAT, endpoints, and flow logs to control network access.

Why it matters: Cloud incidents often come from misconfiguration, excessive permissions, exposed storage, weak logging, or public network exposure.

How to Understand / Apply It

1. Apply least privilege IAM.
2. Keep storage private unless public access is required and approved.
3. Use encryption, key management, and logging.
4. Restrict network exposure using security groups, NACLs, private subnets, and endpoints.
5. Continuously monitor configuration drift and suspicious activity.

Example

Cloud baseline example:
- MFA for administrators
- No public storage by default
- Cloud audit logs enabled
- Security findings reviewed
- Encryption enabled for sensitive data
- Network access restricted
- IAM policies reviewed quarterly

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Public storage by mistake.
• Overly broad IAM permissions.
• Missing audit logs or short log retention.
• Exposing SSH/RDP to the internet.
• No alerting for risky configuration changes.

Interview Questions

• Explain VPC Security in simple words.
• What risk does VPC Security reduce?
• What evidence would prove this is working?
• What is one common mistake with VPC Security?
• Which misconfiguration would you check first?
• How would you prevent recurrence in CI/CD?

Hands-on Practice

• Create a cloud baseline checklist.
• Review IAM, network, storage, logging, and encryption.
• Write a sample finding with risk and remediation.
• Add a prevention step for CI/CD or policy-as-code.

Portfolio Evidence

Cloud Logging and Monitoring

Clear Explanation

What it is: Cloud Logging and Monitoring protects cloud resources, identities, networks, data, and services. Collect and review cloud audit logs, service logs, metrics, alerts, and detection findings.

Why it matters: Cloud incidents often come from misconfiguration, excessive permissions, exposed storage, weak logging, or public network exposure.

How to Understand / Apply It

1. Apply least privilege IAM.
2. Keep storage private unless public access is required and approved.
3. Use encryption, key management, and logging.
4. Restrict network exposure using security groups, NACLs, private subnets, and endpoints.
5. Continuously monitor configuration drift and suspicious activity.

Example

Cloud baseline example:
- MFA for administrators
- No public storage by default
- Cloud audit logs enabled
- Security findings reviewed
- Encryption enabled for sensitive data
- Network access restricted
- IAM policies reviewed quarterly

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Public storage by mistake.
• Overly broad IAM permissions.
• Missing audit logs or short log retention.
• Exposing SSH/RDP to the internet.
• No alerting for risky configuration changes.

Interview Questions

• Explain Cloud Logging and Monitoring in simple words.
• What risk does Cloud Logging and Monitoring reduce?
• What evidence would prove this is working?
• What is one common mistake with Cloud Logging and Monitoring?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Cloud Logging and Monitoring.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Cloud Misconfiguration

Clear Explanation

What it is: Cloud Misconfiguration protects cloud resources, identities, networks, data, and services. Detect and fix public storage, excessive IAM, exposed management ports, missing encryption, and weak logging.

Why it matters: Cloud incidents often come from misconfiguration, excessive permissions, exposed storage, weak logging, or public network exposure.

How to Understand / Apply It

1. Apply least privilege IAM.
2. Keep storage private unless public access is required and approved.
3. Use encryption, key management, and logging.
4. Restrict network exposure using security groups, NACLs, private subnets, and endpoints.
5. Continuously monitor configuration drift and suspicious activity.

Example

Cloud baseline example:
- MFA for administrators
- No public storage by default
- Cloud audit logs enabled
- Security findings reviewed
- Encryption enabled for sensitive data
- Network access restricted
- IAM policies reviewed quarterly

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Public storage by mistake.
• Overly broad IAM permissions.
• Missing audit logs or short log retention.
• Exposing SSH/RDP to the internet.
• No alerting for risky configuration changes.

Interview Questions

• Explain Cloud Misconfiguration in simple words.
• What risk does Cloud Misconfiguration reduce?
• What evidence would prove this is working?
• What is one common mistake with Cloud Misconfiguration?
• Which misconfiguration would you check first?
• How would you prevent recurrence in CI/CD?

Hands-on Practice

• Create a cloud baseline checklist.
• Review IAM, network, storage, logging, and encryption.
• Write a sample finding with risk and remediation.
• Add a prevention step for CI/CD or policy-as-code.

Portfolio Evidence

Container Security

Clear Explanation

What it is: Container Security adds security into development, build, deployment, and infrastructure workflows. Secure images, registries, runtime, secrets, base images, vulnerabilities, and Kubernetes workloads.

Why it matters: Finding issues before production is cheaper and safer than reacting after deployment.

How to Understand / Apply It

1. Scan code, dependencies, containers, and infrastructure templates.
2. Protect CI/CD secrets and deployment credentials.
3. Require code review and approval for risky changes.
4. Use least-privilege pipeline permissions.
5. Fail builds for critical security issues where policy requires it.

Example

CI/CD security example:
Pipeline checks:
- Secret scan
- Dependency scan
- Static code scan
- IaC misconfiguration scan
- Container image scan
- Approval for production deploy
- Artifact signing or integrity check

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Container Security in simple words.
• What risk does Container Security reduce?
• What evidence would prove this is working?
• What is one common mistake with Container Security?
• Which misconfiguration would you check first?
• How would you prevent recurrence in CI/CD?

Hands-on Practice

• Create a cloud baseline checklist.
• Review IAM, network, storage, logging, and encryption.
• Write a sample finding with risk and remediation.
• Add a prevention step for CI/CD or policy-as-code.

Portfolio Evidence

Kubernetes Security

Clear Explanation

What it is: Kubernetes Security adds security into development, build, deployment, and infrastructure workflows. Control RBAC, namespaces, network policies, secrets, admission controls, and cluster logging.

Why it matters: Finding issues before production is cheaper and safer than reacting after deployment.

How to Understand / Apply It

1. Scan code, dependencies, containers, and infrastructure templates.
2. Protect CI/CD secrets and deployment credentials.
3. Require code review and approval for risky changes.
4. Use least-privilege pipeline permissions.
5. Fail builds for critical security issues where policy requires it.

Example

CI/CD security example:
Pipeline checks:
- Secret scan
- Dependency scan
- Static code scan
- IaC misconfiguration scan
- Container image scan
- Approval for production deploy
- Artifact signing or integrity check

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Kubernetes Security in simple words.
• What risk does Kubernetes Security reduce?
• What evidence would prove this is working?
• What is one common mistake with Kubernetes Security?
• Which misconfiguration would you check first?
• How would you prevent recurrence in CI/CD?

Hands-on Practice

• Create a cloud baseline checklist.
• Review IAM, network, storage, logging, and encryption.
• Write a sample finding with risk and remediation.
• Add a prevention step for CI/CD or policy-as-code.

Portfolio Evidence

CI/CD Security

Clear Explanation

What it is: CI/CD Security adds security into development, build, deployment, and infrastructure workflows. Protect source code, build pipelines, secrets, artifacts, approvals, and deployment credentials.

Why it matters: Finding issues before production is cheaper and safer than reacting after deployment.

How to Understand / Apply It

1. Scan code, dependencies, containers, and infrastructure templates.
2. Protect CI/CD secrets and deployment credentials.
3. Require code review and approval for risky changes.
4. Use least-privilege pipeline permissions.
5. Fail builds for critical security issues where policy requires it.

Example

CI/CD security example:
Pipeline checks:
- Secret scan
- Dependency scan
- Static code scan
- IaC misconfiguration scan
- Container image scan
- Approval for production deploy
- Artifact signing or integrity check

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain CI/CD Security in simple words.
• What risk does CI/CD Security reduce?
• What evidence would prove this is working?
• What is one common mistake with CI/CD Security?
• Which misconfiguration would you check first?
• How would you prevent recurrence in CI/CD?

Hands-on Practice

• Create a cloud baseline checklist.
• Review IAM, network, storage, logging, and encryption.
• Write a sample finding with risk and remediation.
• Add a prevention step for CI/CD or policy-as-code.

Portfolio Evidence

Secrets Management

Clear Explanation

What it is: Secrets Management adds security into development, build, deployment, and infrastructure workflows. Store credentials in secure secret managers instead of code, config files, tickets, or chat messages.

Why it matters: Finding issues before production is cheaper and safer than reacting after deployment.

How to Understand / Apply It

1. Scan code, dependencies, containers, and infrastructure templates.
2. Protect CI/CD secrets and deployment credentials.
3. Require code review and approval for risky changes.
4. Use least-privilege pipeline permissions.
5. Fail builds for critical security issues where policy requires it.

Example

CI/CD security example:
Pipeline checks:
- Secret scan
- Dependency scan
- Static code scan
- IaC misconfiguration scan
- Container image scan
- Approval for production deploy
- Artifact signing or integrity check

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Secrets Management in simple words.
• What risk does Secrets Management reduce?
• What evidence would prove this is working?
• What is one common mistake with Secrets Management?
• Which misconfiguration would you check first?
• How would you prevent recurrence in CI/CD?

Hands-on Practice

• Create a cloud baseline checklist.
• Review IAM, network, storage, logging, and encryption.
• Write a sample finding with risk and remediation.
• Add a prevention step for CI/CD or policy-as-code.

Portfolio Evidence

Infrastructure as Code Security

Clear Explanation

What it is: Infrastructure as Code Security adds security into development, build, deployment, and infrastructure workflows. Scan Terraform, CloudFormation, Kubernetes YAML, and pipeline templates before deployment.

Why it matters: Finding issues before production is cheaper and safer than reacting after deployment.

How to Understand / Apply It

1. Scan code, dependencies, containers, and infrastructure templates.
2. Protect CI/CD secrets and deployment credentials.
3. Require code review and approval for risky changes.
4. Use least-privilege pipeline permissions.
5. Fail builds for critical security issues where policy requires it.

Example

CI/CD security example:
Pipeline checks:
- Secret scan
- Dependency scan
- Static code scan
- IaC misconfiguration scan
- Container image scan
- Approval for production deploy
- Artifact signing or integrity check

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Infrastructure as Code Security in simple words.
• What risk does Infrastructure as Code Security reduce?
• What evidence would prove this is working?
• What is one common mistake with Infrastructure as Code Security?
• Which misconfiguration would you check first?
• How would you prevent recurrence in CI/CD?

Hands-on Practice

• Create a cloud baseline checklist.
• Review IAM, network, storage, logging, and encryption.
• Write a sample finding with risk and remediation.
• Add a prevention step for CI/CD or policy-as-code.

Portfolio Evidence

Malware Basics

Clear Explanation

What it is: Malware Basics helps defenders understand attacker behavior and user-focused threats. Understand viruses, worms, trojans, ransomware, spyware, rootkits, loaders, and backdoors.

Why it matters: Security is not only technical. Attackers often target people, credentials, business process weaknesses, and trust relationships.

How to Understand / Apply It

1. Identify attacker goal and likely entry method.
2. Train users and define reporting paths.
3. Monitor identity, email, endpoint, DNS, and network indicators.
4. Use controls such as MFA, filtering, EDR, backups, and payment verification.
5. Practice response steps with tabletop exercises.

Example

Phishing response example:
1. User reports suspicious email.
2. SOC reviews headers, links, attachments, and sender.
3. Search mailboxes for same message.
4. Remove message if malicious.
5. Reset credentials if user clicked and submitted password.
6. Add detection/block rule.
7. Document timeline and lesson learned.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Malware Basics in simple words.
• What risk does Malware Basics reduce?
• What evidence would prove this is working?
• What is one common mistake with Malware Basics?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Malware Basics.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Ransomware

Clear Explanation

What it is: Ransomware helps defenders understand attacker behavior and user-focused threats. Understand ransomware entry, lateral movement, encryption, data theft, extortion, backup impact, and recovery planning.

Why it matters: Security is not only technical. Attackers often target people, credentials, business process weaknesses, and trust relationships.

How to Understand / Apply It

1. Identify attacker goal and likely entry method.
2. Train users and define reporting paths.
3. Monitor identity, email, endpoint, DNS, and network indicators.
4. Use controls such as MFA, filtering, EDR, backups, and payment verification.
5. Practice response steps with tabletop exercises.

Example

Phishing response example:
1. User reports suspicious email.
2. SOC reviews headers, links, attachments, and sender.
3. Search mailboxes for same message.
4. Remove message if malicious.
5. Reset credentials if user clicked and submitted password.
6. Add detection/block rule.
7. Document timeline and lesson learned.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Ransomware in simple words.
• What risk does Ransomware reduce?
• What evidence would prove this is working?
• What is one common mistake with Ransomware?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Ransomware.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Phishing

Clear Explanation

What it is: Phishing helps defenders understand attacker behavior and user-focused threats. Identify fraudulent messages designed to steal credentials, money, or sensitive information.

Why it matters: Security is not only technical. Attackers often target people, credentials, business process weaknesses, and trust relationships.

How to Understand / Apply It

1. Identify attacker goal and likely entry method.
2. Train users and define reporting paths.
3. Monitor identity, email, endpoint, DNS, and network indicators.
4. Use controls such as MFA, filtering, EDR, backups, and payment verification.
5. Practice response steps with tabletop exercises.

Example

Phishing response example:
1. User reports suspicious email.
2. SOC reviews headers, links, attachments, and sender.
3. Search mailboxes for same message.
4. Remove message if malicious.
5. Reset credentials if user clicked and submitted password.
6. Add detection/block rule.
7. Document timeline and lesson learned.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Phishing in simple words.
• What risk does Phishing reduce?
• What evidence would prove this is working?
• What is one common mistake with Phishing?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Phishing.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Business Email Compromise

Clear Explanation

What it is: Business Email Compromise helps defenders understand attacker behavior and user-focused threats. Understand invoice fraud, executive impersonation, vendor payment changes, and mailbox compromise.

Why it matters: Security is not only technical. Attackers often target people, credentials, business process weaknesses, and trust relationships.

How to Understand / Apply It

1. Identify attacker goal and likely entry method.
2. Train users and define reporting paths.
3. Monitor identity, email, endpoint, DNS, and network indicators.
4. Use controls such as MFA, filtering, EDR, backups, and payment verification.
5. Practice response steps with tabletop exercises.

Example

Phishing response example:
1. User reports suspicious email.
2. SOC reviews headers, links, attachments, and sender.
3. Search mailboxes for same message.
4. Remove message if malicious.
5. Reset credentials if user clicked and submitted password.
6. Add detection/block rule.
7. Document timeline and lesson learned.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Business Email Compromise in simple words.
• What risk does Business Email Compromise reduce?
• What evidence would prove this is working?
• What is one common mistake with Business Email Compromise?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Business Email Compromise.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Social Engineering

Clear Explanation

What it is: Social Engineering helps defenders understand attacker behavior and user-focused threats. Understand manipulation techniques such as urgency, authority, fear, reward, curiosity, and trust abuse.

Why it matters: Security is not only technical. Attackers often target people, credentials, business process weaknesses, and trust relationships.

How to Understand / Apply It

1. Identify attacker goal and likely entry method.
2. Train users and define reporting paths.
3. Monitor identity, email, endpoint, DNS, and network indicators.
4. Use controls such as MFA, filtering, EDR, backups, and payment verification.
5. Practice response steps with tabletop exercises.

Example

Phishing response example:
1. User reports suspicious email.
2. SOC reviews headers, links, attachments, and sender.
3. Search mailboxes for same message.
4. Remove message if malicious.
5. Reset credentials if user clicked and submitted password.
6. Add detection/block rule.
7. Document timeline and lesson learned.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Social Engineering in simple words.
• What risk does Social Engineering reduce?
• What evidence would prove this is working?
• What is one common mistake with Social Engineering?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Social Engineering.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Insider Threat

Clear Explanation

What it is: Insider Threat helps defenders understand attacker behavior and user-focused threats. Detect and reduce risk from negligent, compromised, or malicious insiders.

Why it matters: Security is not only technical. Attackers often target people, credentials, business process weaknesses, and trust relationships.

How to Understand / Apply It

1. Identify attacker goal and likely entry method.
2. Train users and define reporting paths.
3. Monitor identity, email, endpoint, DNS, and network indicators.
4. Use controls such as MFA, filtering, EDR, backups, and payment verification.
5. Practice response steps with tabletop exercises.

Example

Phishing response example:
1. User reports suspicious email.
2. SOC reviews headers, links, attachments, and sender.
3. Search mailboxes for same message.
4. Remove message if malicious.
5. Reset credentials if user clicked and submitted password.
6. Add detection/block rule.
7. Document timeline and lesson learned.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Insider Threat in simple words.
• What risk does Insider Threat reduce?
• What evidence would prove this is working?
• What is one common mistake with Insider Threat?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Insider Threat.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Threat Intelligence

Clear Explanation

What it is: Threat Intelligence helps defenders understand attacker behavior and user-focused threats. Use indicators, tactics, techniques, procedures, actor behavior, and context to improve defense.

Why it matters: Security is not only technical. Attackers often target people, credentials, business process weaknesses, and trust relationships.

How to Understand / Apply It

1. Identify attacker goal and likely entry method.
2. Train users and define reporting paths.
3. Monitor identity, email, endpoint, DNS, and network indicators.
4. Use controls such as MFA, filtering, EDR, backups, and payment verification.
5. Practice response steps with tabletop exercises.

Example

Phishing response example:
1. User reports suspicious email.
2. SOC reviews headers, links, attachments, and sender.
3. Search mailboxes for same message.
4. Remove message if malicious.
5. Reset credentials if user clicked and submitted password.
6. Add detection/block rule.
7. Document timeline and lesson learned.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Threat Intelligence in simple words.
• What risk does Threat Intelligence reduce?
• What evidence would prove this is working?
• What is one common mistake with Threat Intelligence?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Threat Intelligence.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

MITRE ATT&CK Basics

Clear Explanation

What it is: MITRE ATT&CK Basics helps defenders understand attacker behavior and user-focused threats. Use attacker tactics and techniques as a map for detection engineering and control assessment.

Why it matters: Security is not only technical. Attackers often target people, credentials, business process weaknesses, and trust relationships.

How to Understand / Apply It

1. Identify attacker goal and likely entry method.
2. Train users and define reporting paths.
3. Monitor identity, email, endpoint, DNS, and network indicators.
4. Use controls such as MFA, filtering, EDR, backups, and payment verification.
5. Practice response steps with tabletop exercises.

Example

Phishing response example:
1. User reports suspicious email.
2. SOC reviews headers, links, attachments, and sender.
3. Search mailboxes for same message.
4. Remove message if malicious.
5. Reset credentials if user clicked and submitted password.
6. Add detection/block rule.
7. Document timeline and lesson learned.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain MITRE ATT&CK Basics in simple words.
• What risk does MITRE ATT&CK Basics reduce?
• What evidence would prove this is working?
• What is one common mistake with MITRE ATT&CK Basics?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for MITRE ATT&CK Basics.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Indicators of Compromise

Clear Explanation

What it is: Indicators of Compromise helps defenders understand attacker behavior and user-focused threats. Recognize suspicious IPs, domains, hashes, filenames, registry keys, processes, and behaviors.

Why it matters: Security is not only technical. Attackers often target people, credentials, business process weaknesses, and trust relationships.

How to Understand / Apply It

1. Identify attacker goal and likely entry method.
2. Train users and define reporting paths.
3. Monitor identity, email, endpoint, DNS, and network indicators.
4. Use controls such as MFA, filtering, EDR, backups, and payment verification.
5. Practice response steps with tabletop exercises.

Example

Phishing response example:
1. User reports suspicious email.
2. SOC reviews headers, links, attachments, and sender.
3. Search mailboxes for same message.
4. Remove message if malicious.
5. Reset credentials if user clicked and submitted password.
6. Add detection/block rule.
7. Document timeline and lesson learned.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.

Common Mistakes

• Using tools without understanding the security goal.
• Skipping documentation and evidence.
• Depending on one control only.
• Ignoring business process impact.
• Not testing recovery or response steps.

Interview Questions

• Explain Indicators of Compromise in simple words.
• What risk does Indicators of Compromise reduce?
• What evidence would prove this is working?
• What is one common mistake with Indicators of Compromise?
• How would you implement it in a small business?
• How would you document it for audit or handover?

Hands-on Practice

• Create a one-page note for Indicators of Compromise.
• Include definition, risk, control, evidence, mistakes, and response steps.
• Add one diagram, table, or checklist.
• Prepare a two-minute interview explanation.

Portfolio Evidence

Indicators of Attack

Clear Explanation

What it is: Indicators of Attack helps defenders understand attacker behavior and user-focused threats. Focus on behavior patterns such as credential abuse, privilege escalation, and lateral movement.

Why it matters: Security is not only technical. Attackers often target people, credentials, business process weaknesses, and trust relationships.

How to Understand / Apply It

1. Identify attacker goal and likely entry method.
2. Train users and define reporting paths.
3. Monitor identity, email, endpoint, DNS, and network indicators.
4. Use controls such as MFA, filtering, EDR, backups, and payment verification.
5. Practice response steps with tabletop exercises.

Example

Phishing response example:
1. User reports suspicious email.
2. SOC reviews headers, links, attachments, and sender.
3. Search mailboxes for same message.
4. Remove message if malicious.
5. Reset credentials if user clicked and submitted password.
6. Add detection/block rule.
7. Document timeline and lesson learned.

Real Project Checklist

• Asset is identified.
• Threat and weakness are clear.
• Control owner is assigned.
• Logs or evidence are available.
• Response process is documented.