Lessons · Cybersecurity · Quick reference
Cybersecurity quick reference
40 topics, one line each, in the order Hone teaches them.
Hone is a place to practise a career, one idea a day. This sheet is the whole Cybersecurity track at a glance: every idea it covers, in the order they are taught, one line each. It is a map rather than a lesson. Read opens the full explanation of an idea; Practise gives you a question on it. Both are free, and reading needs no account at all.
From a threat to a closed incident · The three words
the three words: confidentiality, integrity, availabilitySecurity protects three things: that data is seen only by the right people (confidentiality), that it is not changed without permission (integrity), and that it is there when needed (availability). Read: The three words: secret, unchanged, available · Practise the three words: confidentiality, integrity, availability
threat, vulnerability and riskA threat is something that could do harm, a vulnerability is a weakness it could use, and risk is how likely the harm is and how bad it would be, together. Read: Threat, vulnerability, risk: three words that are not the same · Practise threat, vulnerability and risk
an asset and its ownerAn asset is anything worth protecting, and every asset has an owner: the one person who decides how it is protected and who may use it. Read: An asset, and the person who owns it · Practise an asset and its owner
what an attacker is afterAttackers want one of a few plain things: money, data they can sell, access they can use later, or disruption; knowing which tells you what to protect first. Read: What the attacker is actually after · Practise what an attacker is after
defence in depthDefence in depth means several controls in layers, so that when one fails, the next one still holds. Read: More than one wall · Practise defence in depth
From a threat to a closed incident · The common threats, recognised
phishing, and what to checkPhishing is a message pretending to be from someone you trust, built to make you click, log in or pay before you think. Read: Phishing: the message that asks you to hurry · Practise phishing, and what to check
the kinds of malwareMalware is software written to do harm: a virus rides inside a file, a worm spreads by itself, a trojan pretends to be something useful, and ransomware locks your files and demands money. Read: Malware in four plain words · Practise the kinds of malware
social engineeringSocial engineering is getting somebody to do or reveal something by pretending, pressuring or being pleasant, and no software stops it. Read: Social engineering: attacking the person, not the machine · Practise social engineering
credential stuffing and reused passwordsWhen a password leaks from one site, attackers try the same email and password on every other site, automatically, and it works because people reuse them. Read: Credential stuffing: why one reused password is everybody's problem · Practise credential stuffing and reused passwords
denial of service, seen from insideA denial of service is a flood of traffic or requests that uses up a system's capacity so real users cannot get in; it breaks availability and nothing else. Read: Denial of service, seen from inside · Practise denial of service, seen from inside
insider riskAn insider risk is harm done by somebody who already has legitimate access, whether on purpose, by mistake, or because their account was taken over. Read: Insider risk: the threat with a badge · Practise insider risk
From a threat to a closed incident · The controls
passwords: length over complexityA password's strength is how many guesses it would take to find it, and every extra character multiplies that number, while swapping a letter for a symbol barely moves it. Read: Passwords: length beats cleverness · Practise passwords: length over complexity
multi-factor authenticationMulti-factor authentication asks for two different kinds of proof, something you know and something you have, so a stolen password on its own is not enough to get in. Read: Proving it is really you, twice · Practise multi-factor authentication
least privilegeEvery account, person and program gets the smallest set of rights that lets it do its job, and nothing more. Read: Least privilege: only what the job needs · Practise least privilege
patching and the windowA patch fixes a known weakness, and the window is the time between the fix being published and it being installed on your systems, which is when you are most exposed. Read: Patching, and the window you stand in · Practise patching and the window
encryption at rest and in transitEncryption scrambles data so only somebody with the key can read it; at rest means stored on a disk, in transit means crossing a network, and each needs its own protection. Read: Locked on the shelf, locked in the post · Practise encryption at rest and in transit
hashing versus encryptionEncryption is a lock you can open with the key; a hash is a one-way fingerprint that cannot be turned back into the data, and the same input always gives the same fingerprint. Read: Hashing is not encryption · Practise hashing versus encryption
reading a firewall rule setA firewall checks each packet against its rules in order from the top, applies the first rule that matches and stops there, and a final rule denies everything nothing else matched. Read: Reading a rule set from the top · Practise reading a firewall rule set
backups and the 3-2-1 ruleKeep three copies of the data, on two different kinds of storage, with one copy somewhere else, and treat a backup you have never restored from as a hope rather than a backup. Read: Backups and the 3-2-1 rule · Practise backups and the 3-2-1 rule
logging: what to keepA log is a record written at the time of who did what, from where, when, and whether it worked, kept long enough to investigate something you only notice months later. Read: Logging: what to keep, and for how long · Practise logging: what to keep
From a threat to a closed incident · Reading the evidence
reading a log lineEvery useful log line answers when it happened, where it came from, what was attempted, and whether it worked. Read: One log line, four questions · Practise reading a log line
failed logins in a rowA few failures from one person is somebody mistyping; many failures on one account is guessing; one failure each on many accounts is a stolen list being tried; and any run of failures followed by a success is the one you report. Read: Failed logins: what a count means · Practise failed logins in a row
an address and its network maskAn address is split by its mask into a network part and a host part; two addresses are on the same network when their network parts match, and the prefix length says how many bits that is. Read: Is that address one of ours? · Practise an address and its network mask
port numbers and what lives thereA port number says which service on a machine a connection is for, and a handful of numbers cover most of what you will see: 22 remote command line, 25 mail between servers, 53 name lookups, 80 web, 443 encrypted web, 3389 remote desktop. Read: Port numbers, and what usually lives there · Practise port numbers and what lives there
comparing a file hashA file's hash is its fingerprint, so comparing the hash you compute against the one the publisher states tells you whether you have the file they published or a different one. Read: Comparing a fingerprint · Practise comparing a file hash
checking a suspicious email, in orderCheck a suspicious message in a fixed order: the real sender, then where the links really go, then what is being asked for, then the pressure, then verify on a channel of your own, then report it. Read: The order to check a suspicious email · Practise checking a suspicious email, in order
a timeline from log linesA timeline is the events in time order with the times written next to them, and it is what turns a pile of log lines into a story somebody can act on. Read: A timeline from three log lines · Practise a timeline from log lines
From a threat to a closed incident · Responding
the incident-response phasesIncident response runs in a fixed order: prepare, identify, contain, eradicate, recover, and lessons learned. Read: The six phases, in order · Practise the incident-response phases
isolate before you investigateWhen a machine is doing harm, take it off the network first and study it afterwards, because every minute of investigation is another minute of spreading. Read: Isolate before you investigate · Practise isolate before you investigate
preserving evidenceEvidence is anything that shows what happened, and it has to be copied, timed and signed for, because evidence nobody can vouch for proves nothing later. Read: Preserving evidence · Practise preserving evidence
who to tell, and whenTelling people is part of the response, in order: the incident manager, then the asset owner, then legal and data protection if personal data is involved, then the regulator and the people affected within the deadline the law sets. Read: Who to tell, and when · Practise who to tell, and when
severity from impact and scopeSeverity comes from two numbers, how bad the effect is (impact) and how much of the organisation it touches (scope), and multiplying them gives a score everybody rates the same way. Read: Severity: how bad, times how wide · Practise severity from impact and scope
the after-action reportAfter an incident is closed, one short document says what happened with times, what was done, what worked, what did not, and what will change, with a name and a date on every change. Read: The after-action report · Practise the after-action report
From a threat to a closed incident · The arithmetic of risk
single loss expectancySingle loss expectancy is what you lose if it happens once: the value of the asset multiplied by the fraction of it you lose, called the exposure factor. Read: What one bad day costs: single loss expectancy · Practise single loss expectancy
annualised loss expectancyThe annualised rate of occurrence is how many times a year you expect it, and the annualised loss expectancy is the single loss expectancy multiplied by that rate. Read: What it costs a year: annualised loss expectancy · Practise annualised loss expectancy
is the control worth itA control is worth buying when the yearly loss it removes is bigger than what it costs: value = annualised loss expectancy before, minus annualised loss expectancy after, minus the yearly cost of the control. Read: Is the control worth it? · Practise is the control worth it
likelihood times impactOn a 5 by 5 matrix each risk gets a likelihood from 1 to 5 and an impact from 1 to 5, and the score is the two multiplied, which orders the risks against each other. Read: Likelihood times impact · Practise likelihood times impact
a patch deadline in hoursThe deadline is the publication time plus the number of hours the policy allows, and the hours left are that allowance minus the hours already gone. Read: Working out the patch deadline · Practise a patch deadline in hours
password entropy in bitsStrength in bits is the length multiplied by the bits each character carries, and the bits per character come from the alphabet size: an alphabet of 2 to the power n gives n bits per character. Read: Password strength as a number of bits · Practise password entropy in bits
time to guess a passwordThe number of guesses is 2 to the power of the strength in bits, and the time is that number divided by how many guesses a second the attacker can make. Read: How long would it take to guess? · Practise time to guess a password