Cybersecurity for Beginners

Application Security (AppSec) involves using various tools and methodologies to identify, mitigate, and prevent vulnerabilities in software applications. The key capabilities include:

• Static Application Security Testing (SAST): Analyzes source code, bytecode, or binaries to find vulnerabilities. (e.g., Fortify, Checkmarx, Veracode)
• Dynamic Application Security Testing (DAST): Scans running applications by sending input requests and analyzing responses. (e.g., ZAP, Burp Suite, Qualys Web Application Scanning)
• Interactive Application Security Testing (IAST): Combines SAST and DAST elements to analyze code during runtime, providing higher accuracy and fewer false positives. (e.g., Contrast Security, HCL AppScan)
• Runtime Application Self-Protection (RASP): Monitors and protects applications in real-time by detecting and responding to active threats. (e.g., Veracode Runtime Protection, F5 Advanced WAF with RASP)
• Web Application Firewalls (WAFs): Provides a protection layer between the application and the internet to filter traffic and block malicious requests. (e.g., ModSecurity, AWS WAF, Akamai Kona Site Defender)
• Dependency Scanning: Identifies vulnerabilities in third-party libraries and components used by the application. (e.g., OWASP Dependency-Check, Snyk)
• Penetration Testing (Pen Testing): Simulates real-world attacks to discover vulnerabilities. (e.g., Metasploit, Nmap)
• Security Scanning and Analysis: Scans for known vulnerabilities and misconfigurations. (e.g., Nessus, Qualys Vulnerability Management, OpenVAS)
• Container Security Tools: Focuses on protecting containerized applications and their environments. (e.g., Docker Security Scanning, Aqua Security)
• Security Development Training: Provides training and awareness programs to promote secure coding practices.
• Security Testing Frameworks: Comprehensive frameworks for various AppSec testing needs. (e.g., OWASP Amass, OWASP OWTF, FrAppSec)
• Secure Code Review Tools: Reviews source code for security vulnerabilities and best practices. (e.g., SonarQube, Checkmarx)
• Secure API and Microservices Tools: Focuses on protecting APIs and microservices, including authentication, authorization, and data protection. (e.g., Apigee, AWS API Gateway, Istio)

The Security-101 project provides a cybersecurity curriculum designed for beginners to learn fundamental security concepts in an AI-driven era. The course is vendor-neutral and structured into small modules that take approximately 30-60 minutes each. Each module includes quizzes and links for further reading.

Curriculum Topics

• Basic Concepts: CIA triad, differences between risk and threats.
• Security Controls: Understanding what they are and their various forms.
• Zero Trust: Importance and implementation in modern cybersecurity.
• Core Domains: Identity, Network, Security Operations, Infrastructure, and Data Security.
• Implementation Tools: Examples of tools used to implement security controls.

What is NOT covered

• Specific usage of security tools.
• Hacking, Red Teaming, or offensive security.
• Specific compliance standards.

Next Steps

After completing this curriculum, it is recommended to follow the Microsoft Security, Compliance, and Identity Fundamentals path on Microsoft Learn, which prepares you for the Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals exam.

A SIEM tool is used to analyze security alerts generated from an organization's IT environment. It collects, aggregates, correlates, and analyzes log data and security events from various sources such as network devices, servers, applications, and security systems.

Core functions and capabilities of SIEM include:

• Log Collection: Gathering logs and security event data from firewalls, intrusion detection systems, antivirus software, and other devices/applications.
• Data Normalization: Converting log data into a common format to facilitate analysis and correlation.
• Event Correlation: Identifying patterns and anomalies that indicate security incidents or threats by analyzing related events.
• Alerting and Notification: Generating real-time alerts and notifications when suspicious activities or security breaches are detected.
• Incident Detection: Assisting in the discovery of unauthorized access, data theft, malware infections, and insider threats.
• User and Entity Behavior Analytics (UEBA): Identifying unusual user and entity behavior that may indicate compromised accounts or insider threats.
• Threat Intelligence Integration: Comparing network activities against known threat indicators via intelligence feeds.
• Automation and Orchestration: Automating responses to common security incidents to reduce response times and manual effort.
• Dashboards and Visualization: Providing tools to monitor security data and create customized reports.
• Integration with other security tools: Providing a comprehensive view of the organization's security posture by integrating with other technologies.

A Security Information and Event Management (SIEM) tool is used to analyze security alerts generated within an organization's IT environment. It collects, aggregates, correlates, and analyzes log data and security events from various sources such as network devices, servers, applications, and security systems.

Key functions and capabilities of SIEM include:

• Log Collection: Gathering logs and security event data from firewalls, intrusion detection systems, antivirus software, and other devices.
• Data Normalization: Converting log data into a common format to facilitate analysis and correlation.
• Event Correlation: Relating events to identify patterns and anomalies that may indicate security incidents or threats.
• Alerting and Notification: Generating real-time alerts and notifications for suspicious activities or security breaches for immediate response.
• Incident Detection: Assisting in detecting unauthorized access, data breaches, malware infections, and insider threats.
• User and Entity Behavior Analytics (UEBA): Identifying anomalous user and entity behaviors.
• Threat Intelligence Integration: Integrating with threat intelligence feeds to improve threat detection.
• Automation and Orchestration: Utilizing automation features to respond to common security incidents.
• Dashboards and Visualization: Providing dashboards and visualization tools to monitor security data and create custom reports.
• Integration with other security tools: Integrating with other security solutions, such as Endpoint Detection and Response (EDR).

Infrastructure refers to the fundamental building blocks of any IT environment, including servers, cloud services, and containers. Because applications run on this infrastructure, it is a primary target for attackers. Key concepts include:

• Security Hygiene: The practices and behaviors individuals and organizations follow to maintain good cybersecurity habits (e.g., software updates, strong passwords, MFA, backups).
• Security Posture Management: The process of assessing, monitoring, and managing an organization's overall cybersecurity readiness and its ability to protect IT systems, networks, and data.
• Patching: Updating software, operating systems, applications, or hardware firmware to fix security vulnerabilities, bugs, and performance issues.
• Container Security: Protecting lightweight, isolated software packages (like Docker or Kubernetes) by addressing image vulnerabilities, runtime isolation, network segmentation, access control, and orchestration security.

The Security-101 curriculum is organized into modules covering fundamental cybersecurity concepts, specialized domains, and end-of-module assessments. The curriculum includes:

• Module 1: Basic Security Concepts (CIA triad, threats, risk management, security practices, Zero Trust, and shared responsibility model).
• Module 2: Identity and Access Management (IAM) (IAM principles, Zero Trust architecture, and IAM capabilities).
• Module 3: Network Security (Networking concepts, Zero Trust architecture, and network security capabilities like firewalls and WAF).
• Module 4: Security Operations (SecOps) (SecOps concepts, Zero Trust architecture, and tools like SIEM and XDR).
• Module 5: Application Security (AppSec) (AppSec concepts and capabilities like code scanning and secret scanning).
• Module 6: Infrastructure Security (Infrastructure concepts and capabilities like CSPM and container security).
• Module 7: Data Security (Data security concepts and capabilities like DLP and data management).
• Module 8: AI Security (AI security concepts, capabilities, and Responsible AI).