Summary

This module is designed to provide a holistic understanding of cybersecurity and information security (InfoSec) practices, principles, and strategies. It is aimed at equipping professionals with the knowledge and skills required to safeguard organizational assets, mitigate risks, and respond to evolving cyber threats effectively. The module is organized into distinct topics that span the breadth of modern InfoSec challenges and solutions.

In this module, we will cover:

- Structure of InfoSec
- Security implementations
- Threats
- Security Teams
- Roles

This module is broken down into sections with accompanying hands-on exercises to practice each of the tactics and techniques we cover.

You can start and stop the module at any time and pick up where you left off. There is no time limit or "grading," but you must complete all of the exercises to receive the maximum number of cubes and have this module marked as complete in any paths you have chosen.

Structure of InfoSec

In this module, our goal is to provide you with a foundational understanding of information security: how it is structured, which roles are assumed by whom, the various domains/areas of expertise within cybersecurity, and what career opportunities are currently available. This module is fundamentally designed for complete newcomers, those who have found the motivation and made the decision to take the plunge into the vast ocean of cybersecurity.

To make the dive less daunting, we'll give you the necessary overview of how Information Security is broadly structured and organized. The goal here is to equip you with enough knowledge to help you decide where you want to swim, and to develop a sense of the direction you need to take.

Author's side note:
Since we assume you are "new" to this field, unfortunately, we won't be able to hand you practical exercises right away. Imagine you're sitting in a fighter jet, eager to take off. Without knowing what anything in the cockpit is or what it's for, you'll find it extremely challenging (and time consuming) to simply start the aircraft, let alone get the fighter jet airborne. Therefore, this module is purely "theoretical", while at the same time concise and packed with all the essential details. You will encounter and discover all further aspects along your journey in the future modules. Our goal is to help you to become a great and professional specialist in the field you desire. Therefore, we have to give you the necessary picture of the Information Security world first.

Nowadays, we heavily rely on digital platforms for almost everything; communicating with friends, banking, shopping, and running businesses. This means keeping our data safe from unauthorized access or damage is crucial. Information Security, often called InfoSec, is all about safeguarding information and systems from people who must not have access to them. This includes preventing unauthorized viewing, changing, or destroying of data.

Look closely at the following graphic and try to memorize it. It illustrates, in a very simplified manner, the approximate structure/landscape of the digital world. We will go through this piece by piece in the upcoming sections, and you will understand how all these elements are interconnected.

Client: This is a PC/Laptop through which you access resources and services "on the Internet".
Internet: This is a vast, interconnected network of servers that offer different services and applications, such as Hack The Box.
Servers: Servers provide various services and applications designed to perform specific tasks. For example, one type of server might be a "web server", allowing you and others to view the content of a website (such as this section you're reading currently) on your computer or smartphone.
Network: When multiple servers or computers are connected and can communicate with each other, it's called a network.
Cloud: Cloud refers to data centers that offer interconnected servers for companies and individuals to use.
Blue Team: This team is responsible for the internal security of the company and defends against cyber attacks.
Red Team: This team simulates an actual adversary/attack on the company.
Purple Team: This team consists of both Blue Team and Red Team members working together to enhance the company's security.

We'll delve more into these teams and other aspects in individual sections.

If you're looking to become a penetration tester - a professional who finds and fixes security weaknesses in systems - understanding InfoSec is essential. Your job is to identify potential vulnerabilities before malicious hackers can exploit them. By learning about strong security measures, you can help organizations protect their valuable information and prevent unauthorized access.

More services and systems are moving online in a trend known as digital transformation. While this shift offers many benefits like convenience and efficiency, it also creates more opportunities for cyber attacks. Hackers are getting smarter and more aggressive, aiming to steal sensitive data or disrupt services. These cyber attacks can lead to significant financial losses and damage a company's reputation and customer trust.

Imagine your information is like treasure stored in a castle. The castle's walls, drawbridges, and guards are the security measures protecting your treasure from thieves.

The Treasure: Your valuable data and information.
The Castle Walls: Firewalls, defensive mechanisms, and encryption that keep outsiders from getting in.
The Guards: Security protocols and access controls that monitor who enters and leaves.
Penetration Testers: Knights who test the castle's defenses by simulating attacks to find weak spots.
Digital Transformation: Expanding the castle to store more treasure, which attracts more thieves.
Cyber Threats: Thieves who are constantly looking for ways to breach the castle's defenses.

Just as a castle must strengthen its defenses as it grows and becomes a more valuable target, businesses must enhance their InfoSec measures as they move more services online. By thinking of InfoSec as a building or fortress to protect, it becomes easier to understand the importance of strong security in the digital age.

The necessity of InfoSec stems from the value of information in the digital age. Personal data, intellectual property, financial information, and government secrets are just a few examples of the critical data that needs protection. A breach can lead to severe consequences, including financial loss, reputational damage, legal ramifications, and national security threats.

Areas of Information Security

InfoSec plays an integral role in safeguarding an organization's data from various threats, ensuring the confidentiality, integrity, and availability of data. This wide-ranging field incorporates a variety of domains, and the list provided here captures some of the most general assets. However, it is essential to note that these examples merely scratch the surface of the broad spectrum that InfoSec covers.

The actual range of assets that fall under the umbrella of InfoSec is far more extensive and continues to evolve in tandem with advancements in technology and the ever-changing landscape of cyber threats, consisting of but not limited to:

Network Security
Application Security
Operational Security
Disaster Recovery and Business Continuity
Cloud Security
Physical Security
Mobile Security
Internet of Things (IoT) Security

Later on, we will also explore some of the most prevalent cyber threats, such as Distributed Denial of Service (DDoS) attacks, ransomware, advanced persistent threats (APTs), and insider threats. Additionally, we will examine the structure and function of cybersecurity teams, gaining an understanding of their areas of specialization and the key roles within these teams. This comprehensive overview will provide valuable insights into how cybersecurity professionals collaborate to mitigate and respond to these evolving threats.

Security Concepts

A risk in the context of information security refers to the potential for a malicious event to occur, which could cause damage to an organization's assets, such as its data or infrastructure. This potential for damage is typically quantified in terms of its likelihood and the severity of its impact. Risk is a broader concept that encapsulates both threats and vulnerabilities, and managing risk involves identifying and applying appropriate measures to mitigate threats and minimize vulnerabilities.

A threat, on the other hand, is a potential cause of an incident that could result in harm to a system or organization. It could be a person, like a cybercriminal or hacker, or it could be a natural event, like a fire or flood. Threats exploit vulnerabilities to compromise the security of a system.

A vulnerability is a weakness in a system that could be exploited by a threat. Vulnerabilities can exist in various forms, such as software bugs, misconfigurations, or weak passwords. The presence of a vulnerability doesn't necessarily mean a system will be compromised; there must also be a threat capable of exploiting that vulnerability, and the potential damage that could result constitutes the risk.

In essence, a risk represents the potential for damage, a threat is what can cause that damage, and a vulnerability is the weakness that allows the threat to cause damage. All three concepts are interconnected, and understanding the difference between them is essential for effective information security management.

Roles in Information Security

In the expansive world of Information Security (InfoSec), there are a plethora of different roles each carrying their unique set of responsibilities. These roles are integral parts of a robust InfoSec infrastructure, contributing to the secure operations of an organization:

Role	Description	Relevance to Penetration Testing
`Chief Information Security Officer` (`CISO`)	Oversees the entire information security program	Sets overall security strategy that pen testers will evaluate
`Security Architect`	Designs secure systems and networks	Creates the systems that pen testers will attempt to breach
`Penetration Tester`	Identifies vulnerabilities through simulated attacks	Actively looks for and exploits vulnerabilities within a system, legally and ethically. This is likely your target role.
`Incident Response Specialist`	Manages and responds to security incidents	Often works in tandem with pen testers by responding to their attacks, and sharing/collaborating with them afterwards to discuss lessons learned.
`Security Analyst`	Monitors systems for threats and analyzes security data	May use pen test results to improve monitoring
`Compliance Specialist`	Ensures adherence to security standards and regulations	Pen test reports often support compliance efforts

Sign Up / Log In to Unlock the Module

Please Sign Up or Log In to unlock the module and access the rest of the sections.

Sections

Structure of InfoSec PREVIEW
Principles of Information Security
Network Security
Application Security
Operational Security
Disaster Recovery and Business Continuity
Cloud Security
Physical Security
Mobile Security
Internet of Things Security
Distributed Denial of Service
Ransomware
Social Engineering
Insider Threat
Advanced Persistent Threats
Threat Actors
Red Team
Blue Team
Purple Team
Chief Information Security Officer
Penetration Testers
Security Operations Center
Bug Bounty Hunter
Recommendations

Relevant Paths

This module progresses you towards the following Paths

Junior Cybersecurity Analyst

The Junior Cybersecurity Analyst Job Role Path is the first step to enter and gain practical, hands-on experience in the cybersecurity field. This path covers essential cybersecurity concepts and builds a foundational understanding of operating systems, offensive and defensive tools, attack tactics, log analysis, and methodologies employed by penetration testers and security operations centers. Students will explore key principles while gaining practical experience in both offensive and defensive cybersecurity assessments, including the basics of penetration testing and security analysis. This job role path equips you with the skills and mindset needed to launch a career in cybersecurity, offering a well-rounded foundation in both offensive and defensive techniques that reflects the evolving demands of real-world cybersecurity operations.

Easy

315 Sections

Required: 810

Reward: +250

20 Modules included

Introduction to Information Security

Fundamental

24 Sections

Reward: +10

This theoretical module provides a comprehensive introduction to the foundational components of information security, focusing on the structure and operation of effective InfoSec frameworks. It explores the theoretical roles of security applications across networks, software, mobile devices, cloud environments, and operational systems, emphasizing their importance in protecting organizational assets. Students will gain an understanding of common threats, including malware and advanced persistent threats (APTs), alongside strategies for mitigating these risks. The module also introduces the roles and responsibilities of security teams and InfoSec professionals, equipping students with the confidence to advance their knowledge and explore specialized areas within the field.

Network Foundations

Fundamental

12 Sections

Reward: +10

This course introduces the basic concepts essential to understanding the world of networking. Students will learn about various network types such as LANs and WANs, discuss fundamental networking principles including the OSI and TCP/IP models, and explore key network components like routers and servers. The course also covers important topics such as IP addressing, network security, and internet architecture, providing a comprehensive overview of networking that is crucial for any IT professional.

Introduction to Networking

Fundamental

21 Sections

Reward: +10

As an information security professional, a firm grasp of networking fundamentals and the required components is necessary. Without a strong foundation in networking, it will be tough to progress in any area of information security. Understanding how a network is structured and how the communication between the individual hosts and servers takes place using the various protocols allows us to understand the entire network structure and its network traffic in detail and how different communication standards are handled. This knowledge is essential to create our tools and to interact with the protocols.

Linux Fundamentals

Fundamental

30 Sections

Reward: +10

This module covers the fundamentals required to work comfortably with the Linux operating system and shell.

Introduction to Bash Scripting

Easy

10 Sections

Reward: +10

This module covers the basics needed for working with Bash scripts to automate tasks on Linux systems. A strong grasp of Bash is a fundamental skill for anyone working in a technical information security role. Through the power of automation, we can unlock the Linux operating system's full potential and efficiently perform habitual tasks.

Windows Fundamentals

Fundamental

14 Sections

Reward: +10

This module covers the fundamentals required to work comfortably with the Windows operating system.

Introduction to Windows Command Line

Easy

23 Sections

Reward: +10

As administrators and Pentesters, we may not always be able to utilize a graphical user interface for the actions we need to perform. Introduction to Windows Command Line aims to introduce students to the wide range of uses for Command Prompt and PowerShell within a Windows environment. We will cover basic usage of both key executables for administration, useful PowerShell cmdlets and modules, and different ways to leverage these tools to our benefit.

Web Requests

Fundamental

8 Sections

Reward: +10

This module introduces the topic of HTTP web requests and how different web applications utilize them to communicate with their backends.

Introduction to Web Applications

Fundamental

17 Sections

Reward: +10

In the Introduction to Web Applications module, you will learn all of the basics of how web applications work and begin to look at them from an information security perspective.

Introduction to Penetration Testing

Fundamental

21 Sections

Reward: +10

In this module, we will get into the fundamentals of penetration testing, a critical aspect of cybersecurity theory that explains how professionals in the field operate and underscores the significance of penetration testing within cybersecurity practices.

Pentest in a Nutshell

Easy

24 Sections

Reward: +10

This module focuses on providing a detailed, guided simulation of a real penetration test, emphasizing the fine details of the penetration testing process. It guides you through each step, from reconnaissance to exploitation, mirroring the techniques and methodologies used by professional penetration testers. It offers hands-on experience in a controlled environment and aims to deepen understanding and sharpen skills essential for effective cybersecurity assessments.

Network Enumeration with Nmap

Easy

12 Sections

Reward: +10

Nmap is one of the most used networking mapping and discovery tools because of its accurate results and efficiency. The tool is widely used by both offensive and defensive security practitioners. This module covers fundamentals that will be needed to use the Nmap tool for performing effective network enumeration.

Footprinting

Medium

21 Sections

Reward: +20

This module covers techniques for footprinting the most commonly used services in almost all enterprise and business IT infrastructures. Footprinting is an essential phase of any penetration test or security audit to identify and prevent information disclosure. Using this process, we examine the individual services and attempt to obtain as much information from them as possible.

Hacking WordPress

Easy

16 Sections

Reward: +20

WordPress is an open-source Content Management System (CMS) that can be used for multiple purposes.

Using the Metasploit Framework

Easy

15 Sections

Reward: +10

The Metasploit Framework is an open-source set of tools used for network enumeration, attacks, testing security vulnerabilities, evading detection, performing privilege escalation attacks, and performing post-exploitation.

Intro to Network Traffic Analysis

Medium

15 Sections

Reward: +10

Network traffic analysis is used by security teams to monitor network activity and look for anomalies that could indicate security and operational issues. Offensive security practitioners can use network traffic analysis to search for sensitive data such as credentials, hidden applications, reachable network segments, or other potentially sensitive information "on the wire." Network traffic analysis has many uses for attackers and defenders alike.

Incident Handling Process

Fundamental

9 Sections

Reward: +10

Security Incident handling has become a vital part of each organization's defensive strategy, as attacks constantly evolve and successful compromises are becoming a daily occurrence. In this module, we will review the process of handling an incident from the very early stage of detecting a suspicious event, to confirming a compromise and responding to it.

Windows Event Logs & Finding Evil

Mini-Module

Medium

6 Sections

Reward: +20

This module covers the exploration of Windows Event Logs and their significance in uncovering suspicious activities. Throughout the course, we delve into the anatomy of Windows Event Logs and highlight the logs that hold the most valuable information for investigations. The module also focuses on utilizing Sysmon and Event Logs for detecting and analyzing malicious behavior. Additionally, we delve into Event Tracing for Windows (ETW), explaining its architecture and components, and provide ETW-based detection examples. To streamline the analysis process, we introduce the powerful Get-WinEvent cmdlet.

Security Monitoring & SIEM Fundamentals

Easy

11 Sections

Reward: +20

This module provides a concise yet comprehensive overview of Security Information and Event Management (SIEM) and the Elastic Stack. It demystifies the essential workings of a Security Operation Center (SOC), explores the application of the MITRE ATT&CK framework within SOCs, and introduces SIEM (KQL) query development. With a focus on practical skills, students will learn how to develop SIEM use cases and visualizations using the Elastic Stack.

Introduction to Threat Hunting & Hunting With Elastic

Mini-Module

Medium

6 Sections

Reward: +20

This module initially lays the groundwork for understanding Threat Hunting, ranging from its basic definition, to the structure of a threat hunting team. The module also dives into the threat hunting process, highlighting the interrelationships between threat hunting, risk assessment, and incident handling. Furthermore, the module elucidates the fundamentals of Cyber Threat Intelligence (CTI). It expands on the different types of threat intelligence and offers guidance on effectively interpreting a threat intelligence report. Finally, the module puts theory into practice, showcasing how to conduct threat hunting using the Elastic stack. This practical segment uses real-world logs to provide learners with hands-on experience.