Tech Cert Prep/Guides/Security+/Domain 2
SY0-701Domain 2 of 522% of exam — highest weight156 concepts

Domain 2: Threats, Vulnerabilities, and Mitigations

This is the highest-weighted domain at 22% of the exam. It covers threat actor types and motivations, malware categories, social engineering techniques, vulnerability scanning, application security flaws, and attack indicators. Expect scenario-based questions asking you to identify the type of attack or recommend the correct mitigation.

← Domain 1Domain 3 →

Key Themes in Domain 2

  • • Threat actors: Nation-state (APT, sophisticated), hacktivist (ideological), organized crime (financial), insider (trusted access), unskilled attacker (script kiddie)
  • • Malware types: Ransomware (encrypts data), trojans (hidden payload), worms (self-replicating), rootkits (hide in OS), spyware, adware, fileless malware
  • • Social engineering: Phishing, spear phishing, whaling (C-suite), vishing (voice), smishing (SMS), BEC (business email compromise), pretexting, tailgating
  • • Application attacks: SQL injection, XSS (cross-site scripting), buffer overflow, race condition, directory traversal, CSRF
  • • Network attacks: DDoS, on-path (MITM), replay, DNS poisoning, ARP poisoning, evil twin, deauthentication
  • • Indicators of compromise: Unusual traffic, unexpected processes, modified files, failed logins, privilege escalation attempts

All Domain 2 Concepts

Volume Encryption

Explanation

Encryption applied to logical storage volumes, which can span multiple physical devices or portions of devices.

Examples

Encrypted network volumes, RAID volume encryption, virtual disk encryption

Enterprise Use Case

Use Case A large enterprise deploys volume encryption across their Storage Area Network (SAN) that contains multiple physical disk arrays. The IT team configures encrypted volumes for the development, staging, and production environments, each spanning across different RAID configurations. When developers access the development volume, the storage controller automatically decrypts the data in real-time using keys stored in the Key Management System. This approach allows the organization to protect sensitive application data and customer information across distributed storage infrastructure while maintaining performance and simplifying key management compared to encrypting individual files or databases.

Diagram

📚 LOGICAL VOLUME
    ├── 💽 Physical Disk 1 (part)
    ├── 💽 Physical Disk 2 (part)
    ├── 💽 Physical Disk 3 (part)
         ↓
    🔒 ENTIRE VOLUME ENCRYPTED

Database Encryption

Explanation

Protection of database contents through encryption at various levels - field, table, or entire database.

Examples

Transparent Data Encryption (TDE), column-level encryption, encrypted database files

Enterprise Use Case

Use Case A healthcare provider implements Transparent Data Encryption (TDE) on their SQL Server databases containing patient health records to comply with HIPAA requirements. The security team configures TDE to automatically encrypt the entire database at rest, while also applying column-level encryption to particularly sensitive fields like Social Security Numbers and medical diagnoses. When database backups are created nightly and sent to off-site storage, they remain encrypted without requiring additional encryption steps. This multi-layered approach ensures that even if an attacker gains access to the storage media or backup tapes, the data remains unreadable without the proper encryption keys stored in the Azure Key Vault.

Diagram

🗄️ DATABASE
    ├── 🔒 Customer_Table (Encrypted)
    │   ├── ID: 123
    │   ├── Name: John (🔒 encrypted)
    │   └── SSN: *** (🔒 encrypted)
    └── 📊 Analytics_Table (Plain)

Record Encryption

Explanation

Encryption applied to individual database records or rows, providing fine-grained data protection.

Examples

Patient records encryption, financial transaction encryption, individual customer data encryption

Enterprise Use Case

Use Case A financial services company implements record-level encryption for their customer transaction database to meet PCI-DSS compliance requirements. Each credit card transaction record is encrypted individually using a unique encryption key derived from the customer's account ID. When fraud analysts need to investigate suspicious activity, the system only decrypts the specific records related to that customer, while all other records remain encrypted. This granular approach minimizes the exposure of sensitive data and provides detailed audit trails showing exactly which records were accessed and by whom, supporting both security and regulatory compliance requirements.

Diagram

📋 DATABASE TABLE
    ├── 🔒 Record 1: Patient A (Encrypted)
    ├── 🔓 Record 2: Public Info (Plain)
    ├── 🔒 Record 3: Patient B (Encrypted)
    └── 🔓 Record 4: Reference Data (Plain)

Transport/Communication Encryption

Explanation

Protection of data while it travels across networks, ensuring confidentiality and integrity during transmission.

Examples

HTTPS/TLS, SSH, VPN encryption, email encryption (S/MIME), secure messaging

Enterprise Use Case

Use Case A multinational corporation requires all remote employees to connect to the corporate network through a VPN using IPsec encryption with AES-256. When employees access the company's web applications, the connections use TLS 1.3 to establish encrypted tunnels between their browsers and the application servers. The IT security team also enforces S/MIME encryption for all emails containing customer data or financial information, ensuring that messages remain confidential even if intercepted during transmission. This layered transport encryption strategy protects sensitive business communications from eavesdropping, man-in-the-middle attacks, and data interception across untrusted networks like public Wi-Fi.

Diagram

📱 DEVICE A
         ↓
    🔒 ENCRYPTED TUNNEL
    ~~~🛡️~~~🛡️~~~🛡️~~~
         ↓
    💻 DEVICE B

    🕵️ EAVESDROPPER: "Can't read this!"

Asymmetric Encryption

Explanation

Encryption method using two mathematically related keys - public and private - for secure communication without sharing secrets. The public key can be freely distributed for encryption, while the private key remains secret for decryption, eliminating the need to securely exchange secret keys.

Examples

Examples RSA (2048-bit or 4096-bit) for key exchange and digital signatures ECC (Elliptic Curve Cryptography) for mobile devices and IoT (smaller keys, faster) Diffie-Hellman for establishing shared secrets over insecure channels Digital signatures for email (S/MIME), code signing, and document authentication SSL/TLS handshake uses RSA or ECDHE for secure web connections (HTTPS)

Enterprise Use Case

Use Case A financial institution implements RSA 4096-bit asymmetric encryption for their online banking platform. When customers log in, the bank's public key encrypts the session key used for the transaction. Only the bank's private key (stored in a Hardware Security Module) can decrypt this session key. This allows thousands of customers to securely send encrypted data to the bank without the bank needing to share secret keys with each customer. The same system is used for digital signatures on wire transfers, where customers sign transactions with their private keys and the bank verifies authenticity using the customer's public key, ensuring non-repudiation.

Diagram

🎨 Visual
┌─────────────────────────────────────────────────┐
│           ASYMMETRIC ENCRYPTION                  │
├─────────────────────────────────────────────────┤
│                                                  │
│  👤 ALICE                    👤 BOB              │
│  🗝️  Public Key             🗝️  Public Key      │
│  🔐 Private Key (secret)    🔐 Private Key       │
│       │                           ▲              │
│       │ Encrypt with              │              │
│       │ Bob's Public Key          │              │
│       ↓                           │              │
│  📧 "Hello Bob"                   │              │
│       │                           │              │
│       ↓                           │              │
│  🔒 ENCRYPTED: "Xj8#mK9..."      │              │
│       │                           │              │
│       └───────────────────────────┘              │
│                                   │              │
│                    Bob decrypts with his         │
│                    Private Key                   │
│                                   ↓              │
│                              📄 "Hello Bob"      │
│                                                  │
│  KEY SIZES: RSA 2048/4096-bit, ECC 256-bit      │
│  SPEED: Slow (CPU intensive)                    │
│  USE: Key exchange, digital signatures, PKI     │
└─────────────────────────────────────────────────┘

Symmetric Encryption

Explanation

Encryption method using the same secret key for both encryption and decryption, providing fast and efficient data protection. The main challenge is securely distributing and managing the shared secret key between parties, which is why symmetric encryption is often combined with asymmetric encryption for key exchange.

Examples

Examples AES (Advanced Encryption Standard) 128/192/256-bit - industry standard for bulk encryption ChaCha20 - fast stream cipher used in TLS, mobile devices, and VPNs 3DES (Triple DES) - legacy, being phased out but still in some banking systems Blowfish/Twofish - used in some VPN software and password managers File encryption (BitLocker, FileVault) uses AES for full-disk encryption Database encryption uses AES to protect sensitive records at rest

Enterprise Use Case

Use Case A healthcare organization uses AES-256 symmetric encryption to protect patient medical records stored in their database. When a doctor accesses a patient file, the application uses the master encryption key (stored in a Hardware Security Module) to decrypt the record in memory for viewing. All database backups are encrypted with the same symmetric key before being sent to offsite storage. During data transmission between the hospital and insurance companies, the organization first uses Diffie-Hellman (asymmetric) to securely exchange a session key, then uses AES-256 (symmetric) to encrypt the actual patient data being transferred because symmetric encryption is 1000x faster than asymmetric for large files, ensuring HIPAA compliance while maintaining performance.

Diagram

🎨 Visual
┌─────────────────────────────────────────────────┐
│           SYMMETRIC ENCRYPTION                   │
├─────────────────────────────────────────────────┤
│                                                  │
│           🔑 SHARED SECRET KEY                   │
│                    ├──┬──┤                       │
│                    ↓  │  ↓                       │
│              ENCRYPT  │  DECRYPT                 │
│                    │  │  ▲                       │
│  👤 ALICE         │  │  │         👤 BOB         │
│  📄 "Secret"      │  │  │                        │
│       │           │  │  │                        │
│       ↓           ↓  │  │                        │
│  🔒 ENCRYPTED ────────┘  │                       │
│     "aF7$kL2..."         │                       │
│       │                  │                       │
│       └──────────────────┘                       │
│                          ↓                       │
│                     📄 "Secret"                  │
│                                                  │
│  KEY SIZES: AES 128/192/256-bit                 │
│  SPEED: Very Fast (1000x faster than asymmetric)│
│  USE: Bulk data, file encryption, disk encrypt  │
│  CHALLENGE: How to share the key securely?      │
└─────────────────────────────────────────────────┘

Key Exchange

Explanation

Process of securely sharing cryptographic keys between parties to establish secure communications.

Examples

Diffie-Hellman, ECDH (Elliptic Curve), RSA key exchange, TLS handshake

Enterprise Use Case

Use Case When two branch offices of a company need to establish a secure VPN tunnel over the internet, they use Diffie-Hellman Ephemeral (DHE) key exchange to negotiate a shared session key. Each office's VPN gateway generates a private value and exchanges public values over the unsecured internet connection. Both gateways independently compute the same shared secret without ever transmitting it, then use this shared secret to derive AES encryption keys for the VPN tunnel. This Perfect Forward Secrecy approach ensures that even if an attacker records all network traffic and later compromises one of the long-term authentication keys, they still cannot decrypt past VPN sessions.

Diagram

👤 ALICE                👤 BOB
    🔢 Private: a          🔢 Private: b
    📢 Public: A           📢 Public: B
         ↓ ↔ ↓
    🔑 SHARED SECRET = f(a,B) = f(b,A)
         ↓
    🔒 SECURE COMMUNICATION

Cryptographic Algorithms

Explanation

Mathematical procedures and rules used for encrypting, decrypting, and securing data.

Examples

AES, RSA, SHA-256, ECDSA, ChaCha20, HMAC, Argon2

Enterprise Use Case

Use Case An enterprise security team develops a cryptographic standard requiring AES-256 for data at rest, RSA-2048 or ECDSA for digital signatures, SHA-256 for integrity verification, and Argon2 for password hashing. When selecting a new cloud storage provider, the procurement team verifies that the vendor supports these approved algorithms and has deprecated weaker alternatives like DES, MD5, and SHA-1. The security team also implements automated scanning tools to detect any use of non-compliant algorithms in custom applications, ensuring consistent cryptographic standards across the organization and maintaining compliance with NIST and industry best practices.

Diagram

📄 PLAINTEXT
         ↓
    🧮 ALGORITHM + 🔑 KEY
         ↓
    🔒 CIPHERTEXT
         ↓
    🧮 ALGORITHM + 🔑 KEY
         ↓
    📄 PLAINTEXT

Cryptographic Key Length

Explanation

Size of cryptographic keys measured in bits, directly affecting the security strength and computational requirements.

Examples

AES-128/192/256, RSA-2048/3072/4096, ECC-256/384/521

Enterprise Use Case

Use Case A government contractor handling classified information must comply with NSA Suite B cryptography requirements, which mandate minimum key lengths of AES-256 for symmetric encryption and ECC-384 for asymmetric operations. When the security team discovers legacy systems still using RSA-1024 bit keys, they initiate a key length upgrade project to migrate all certificates to RSA-3072 or preferably ECC-384 to meet future quantum-resistance guidelines. The team balances security requirements with performance considerations, using ECC-256 for mobile devices due to lower computational overhead while maintaining equivalent security to RSA-3072, demonstrating how key length selection impacts both security posture and system performance.

Diagram

🔑 KEY LENGTH COMPARISON:
    ├── 🔒 128-bit: Good security
    ├── 🔒🔒 256-bit: Strong security
    ├── 🔒🔒🔒 2048-bit: Very strong
    └── 🔒🔒🔒🔒 4096-bit: Maximum strength

    ⏱️ More bits = More security + More time

Trusted Platform Module (TPM)

Explanation

Hardware security chip providing secure storage for cryptographic keys, passwords, and certificates.

Examples

BitLocker key storage, secure boot verification, hardware-based attestation, device encryption

Enterprise Use Case

Use Case A corporate laptop fleet requires Windows 11 with BitLocker full-disk encryption enabled on all devices to protect against data theft if laptops are lost or stolen. The IT department configures BitLocker to store encryption keys in each laptop's TPM 2.0 chip rather than on the hard drive. When a laptop boots, the TPM verifies the integrity of the boot process and only releases the encryption key if the system hasn't been tampered with, protecting against evil maid attacks. If an attacker removes the hard drive and attempts to read it in another machine, the data remains encrypted because the decryption key is sealed within the original laptop's TPM chip and cannot be extracted.

Diagram

💻 COMPUTER MOTHERBOARD
         ↓
    💎 TPM CHIP (Hardware)
    ├── 🔐 Secure key storage
    ├── 🛡️ Tamper resistance
    ├── 🔍 Attestation
    └── 🚫 Hardware-based security

Hardware Security Module (HSM)

Explanation

Dedicated, tamper-resistant hardware device designed to securely store and manage cryptographic keys.

Examples

Network-attached HSMs, PCIe card HSMs, USB token HSMs, cloud HSM services

Enterprise Use Case

Use Case A financial institution's payment processing system handles millions of credit card transactions daily and must comply with PCI-DSS Level 1 requirements. The security team deploys FIPS 140-2 Level 3 certified HSMs to generate, store, and manage the cryptographic keys used for encrypting cardholder data and creating digital signatures. The HSMs perform all encryption and decryption operations internally without ever exposing the master keys, and feature tamper-evident seals that trigger automatic key destruction if physical intrusion is detected. This hardware-based security provides superior protection compared to software-based key storage and satisfies auditor requirements for protecting high-value cryptographic material.

Diagram

🏰 HSM DEVICE
    ├── 🔐 Key generation
    ├── 🔑 Key storage
    ├── 🧮 Crypto operations
    ├── 🛡️ Tamper detection
    └── 🚨 Self-destruct on breach

Key Management System (KMS)

Explanation

Centralized system for creating, distributing, storing, and managing cryptographic keys throughout their lifecycle.

Examples

AWS KMS, Azure Key Vault, HashiCorp Vault, enterprise key management appliances

Enterprise Use Case

Use Case A cloud-native organization migrates to AWS and implements AWS KMS to centrally manage all encryption keys for their infrastructure. The DevOps team configures automatic key rotation every 90 days for all EBS volumes, S3 buckets, and RDS databases, ensuring compliance with their security policy. Applications authenticate to KMS using IAM roles to retrieve data encryption keys, and all key access requests are logged to CloudTrail for audit purposes. When a developer leaves the company, the security team can immediately revoke their access to specific keys without disrupting production services, demonstrating the value of centralized key lifecycle management for maintaining security and regulatory compliance.

Diagram

🏢 KEY MANAGEMENT SYSTEM
    ├── 🎲 Key Generation
    ├── 📤 Key Distribution
    ├── 🗄️ Key Storage
    ├── 🔄 Key Rotation
    ├── 📊 Key Auditing
    └── 🗑️ Key Destruction

Secure Enclave

Explanation

Isolated, secure area within a processor that provides hardware-level protection for sensitive operations and data.

Examples

Apple Secure Enclave, Intel SGX, ARM TrustZone, confidential computing

Enterprise Use Case

Use Case A mobile banking application on iPhones uses the Apple Secure Enclave to protect biometric authentication data and encryption keys. When users authenticate with Face ID or Touch ID, the biometric matching occurs entirely within the Secure Enclave, and the actual fingerprint or face data never leaves this isolated processor. The banking app's encryption keys for securing transaction data are also stored in the Secure Enclave, making them inaccessible even to the main operating system or other apps. This hardware-isolated approach ensures that even if the phone is compromised by malware, the attacker cannot access biometric data or extract cryptographic keys, providing defense-in-depth security for sensitive financial operations.

Diagram

💻 MAIN PROCESSOR
    ┌─────────────────┐
    │  Regular Apps   │
    │ ┌─────────────┐ │
    │ │🏛️ SECURE    │ │
    │ │  ENCLAVE    │ │
    │ │ 🔐 Protected│ │
    │ └─────────────┘ │
    └─────────────────┘

Steganography

Explanation

Art of hiding information within other non-secret data or physical objects, concealing the existence of the message.

Examples

Hidden messages in images, audio files, videos, or documents; watermarking

Enterprise Use Case

Use Case A security researcher discovers that an Advanced Persistent Threat (APT) group is using steganography to exfiltrate stolen data from a compromised network. The attackers embed confidential documents within innocuous-looking vacation photos that employees post to approved social media sites, bypassing Data Loss Prevention (DLP) systems that only scan for unencrypted sensitive data. The security team deploys specialized steganography detection tools to analyze all outbound image files for statistical anomalies that indicate hidden data. This incident highlights how threat actors use steganography for covert communication channels, and why security teams must implement layered defenses that include behavioral analysis and anomaly detection beyond traditional content filtering.

Diagram

🖼️ INNOCENT IMAGE
    ├── 👁️ Visible: Sunset photo
    ├── 🔍 Hidden: Secret message
    └── 📱 Viewer sees: Just a photo

    🔍 SPECIAL TOOL REVEALS:
    "Meeting at midnight"

Data Tokenization

Explanation

Process of replacing sensitive data with non-sensitive placeholder tokens that have no exploitable value.

Examples

Credit card tokenization, PII tokenization, database field tokenization, payment processing

Enterprise Use Case

Use Case An e-commerce company implements credit card tokenization to reduce PCI-DSS compliance scope and protect customer payment information. When customers enter credit card details during checkout, the payment gateway immediately replaces the card number with a random token and stores the actual card data in a secure, PCI-compliant vault operated by the payment processor. The company's application databases, order systems, and customer service platforms only store and process the tokens, not the real card numbers. If the e-commerce database is breached, attackers only obtain worthless tokens that cannot be used for fraudulent purchases, significantly reducing the company's liability and simplifying compliance audits since most systems no longer handle sensitive cardholder data.

Diagram

💳 REAL CREDIT CARD
    "4532-1234-5678-9012"
         ↓
    🎫 TOKEN
    "TOK_789ABC123XYZ"
         ↓
    💾 STORED SAFELY (Tokenized)
    🔐 REAL DATA (Secure vault)

Data Masking

Explanation

Process of obscuring specific data within a database to protect sensitive information while maintaining data usability.

Examples

Partial masking (***-**-1234), random substitution, format-preserving encryption

Enterprise Use Case

Use Case A software development company needs to provide realistic test data for developers and QA testers without exposing actual customer information from the production database. The database administrator implements dynamic data masking in SQL Server that automatically obscures sensitive fields when non-privileged users query the database. Developers see realistic but fake names, partially masked Social Security Numbers (***-**-1234), and scrambled email addresses that maintain the correct format for testing. Production support staff with elevated privileges can view the real data when troubleshooting customer issues. This approach enables effective application testing and development while maintaining GDPR and privacy compliance by preventing unauthorized access to genuine personal data.

Diagram

👤 ORIGINAL DATA:
    Name: John Smith
    SSN: 123-45-6789
    Email: john@email.com
         ↓
    🎭 MASKED DATA:
    Name: J*** S****
    SSN: ***-**-6789
    Email: j***@email.com

Cryptographic Hashing

Explanation

One-way mathematical function that converts data into a fixed-size string of characters, used for integrity verification.

Examples

SHA-256, SHA-3, MD5 (deprecated), password hashing, file integrity checks

Enterprise Use Case

Use Case An IT security team deploys File Integrity Monitoring (FIM) software across all critical servers to detect unauthorized changes to system files and configurations. The FIM system calculates SHA-256 hashes of important files like /etc/passwd, system binaries, and web application code during a known-good baseline. Every hour, the system recalculates hashes and compares them to the baseline. When an attacker compromises a web server and modifies a PHP file to create a backdoor, the FIM immediately alerts the security team because the file's hash changed. The security team also uses hashing to verify the integrity of software downloads by comparing the vendor's published SHA-256 hash with the calculated hash of the downloaded installer before running it.

Diagram

📄 INPUT DATA
    "Hello World"
         ↓
    🔨 HASH FUNCTION (SHA-256)
         ↓
    🔤 HASH OUTPUT
    "a591a6d40bf420404..."

    ✅ Always same input = same hash
    ❌ Cannot reverse to get original

Cryptographic Salting

Explanation

Adding random data to input before hashing to prevent rainbow table attacks and ensure unique hashes.

Examples

Password salting, unique salts per user, bcrypt, scrypt, Argon2

Enterprise Use Case

Use Case When a company's authentication system stores user passwords, it generates a unique random salt for each user account during registration. For a user choosing the password "Password123", the system appends a random 32-byte salt like "x7K9mP2qL5" before hashing with bcrypt. Even if two users choose the identical password, their stored hashes are completely different because of unique salts. When attackers breach the password database and obtain the hashed passwords, they cannot use precomputed rainbow tables to crack the passwords because each hash requires a separate brute-force attack accounting for the unique salt. This salting strategy forces attackers to spend significantly more computational resources to crack each individual password, making mass password compromise impractical.

Diagram

🔑 PASSWORD: "password123"
    +
    🧂 RANDOM SALT: "xy7#mK9$"
         ↓
    🔨 HASH FUNCTION
         ↓
    🔤 SALTED HASH
    "9f86d081884c7d659a..."

    🛡️ PREVENTS RAINBOW TABLES

Key Stretching

Explanation

Process of making cryptographic keys more secure by increasing the time required to test possible keys.

Examples

PBKDF2, bcrypt, scrypt, Argon2, iterative hashing

Enterprise Use Case

Use Case A web application uses Argon2id for password hashing with key stretching configured to require approximately 100 milliseconds of computation per password verification. When a legitimate user logs in, the 100ms delay is imperceptible and doesn't impact user experience. However, when attackers obtain the password database and attempt to crack passwords using brute force, each password guess takes 100ms instead of microseconds with unsalted SHA-256. This means an attacker with a powerful GPU that could test 10 billion SHA-256 hashes per second can only test about 10 passwords per second with Argon2id, reducing their cracking speed by a factor of one billion and making password cracking computationally infeasible even for weak passwords.

Diagram

🔑 WEAK KEY
    "password"
         ↓
    🔄 STRETCHING (1000s iterations)
    ├── Hash 1
    ├── Hash 2
    ├── Hash 3
    ├── ...
    └── Hash 10000
         ↓
    💪 STRONG KEY

Blockchain Technology

Explanation

Distributed ledger technology using cryptographic hashes to create immutable, transparent record chains.

Examples

Bitcoin, Ethereum, supply chain tracking, smart contracts, digital identity

Enterprise Use Case

Use Case A pharmaceutical company implements blockchain technology to track the supply chain of medications from manufacturer to patient, combating counterfeit drugs. Each time a medication package changes hands - from factory to distributor to pharmacy - a new block containing the transaction details and timestamp is added to the blockchain. Each block includes a cryptographic hash of the previous block, creating an immutable chain that cannot be altered retroactively. Pharmacists can scan a medication's QR code to verify its complete chain of custody on the blockchain, immediately detecting counterfeit products that lack valid blockchain records. This provides transparency, non-repudiation, and tamper-evident tracking without requiring a central authority to validate transactions.

Diagram

📦 BLOCK 1        📦 BLOCK 2        📦 BLOCK 3
    ├── Data          ├── Data          ├── Data
    ├── Hash          ├── Hash          ├── Hash
    └── Prev: NULL    └── Prev: Hash1   └── Prev: Hash2
         ↓                 ↓                 ↓
    ⛓️ IMMUTABLE CHAIN

Open Public Ledger

Explanation

Publicly accessible distributed database where all transactions are transparently recorded and verifiable.

Examples

Bitcoin blockchain, Ethereum network, public cryptocurrency transactions

Enterprise Use Case

Use Case A nonprofit organization accepts cryptocurrency donations and publishes their Bitcoin wallet address on their website to demonstrate transparency. All donations received are permanently recorded on Bitcoin's public blockchain ledger, allowing anyone to verify the total amount donated and how funds are transferred. When the organization uses donated funds to pay vendors, those transactions are also publicly visible on the blockchain. This transparency helps build donor trust as anyone can audit the organization's Bitcoin transactions without needing permission or special access. However, while transaction amounts and addresses are public, the identities behind the addresses remain pseudonymous unless explicitly disclosed, balancing transparency with privacy.

Diagram

🌐 PUBLIC LEDGER
    ├── 📝 Transaction 1 (Public)
    ├── 📝 Transaction 2 (Public)
    ├── 📝 Transaction 3 (Public)
    └── 👁️ Anyone can verify

    ✅ Transparent
    ✅ Immutable
    ✅ Decentralized

Nation-state Threat Actors

Explanation

Government-sponsored cyber attackers with substantial resources, advanced capabilities, and strategic objectives.

Examples

APT groups (Advanced Persistent Threats), foreign intelligence services, military cyber units, state-sponsored hackers

Enterprise Use Case

Use Case A defense contractor's security team detects sophisticated network intrusions targeting proprietary military technology designs. The attackers used zero-day exploits, custom malware with advanced evasion techniques, and demonstrated knowledge of the company's network architecture suggesting months of reconnaissance. The attack pattern matches known APT28 tactics, techniques, and procedures (TTPs), indicating a nation-state threat actor. Unlike typical cybercriminals seeking quick financial gain, these attackers maintained persistent access for over 18 months, exfiltrating intellectual property slowly to avoid detection. The company works with federal authorities and implements enhanced monitoring, network segmentation, and threat hunting specifically designed to detect and respond to advanced persistent threats with nation-state capabilities.

Diagram

🏛️ GOVERNMENT BACKING
    ├── 💰 Unlimited resources
    ├── 🎯 Strategic objectives
    ├── ⏰ Long-term persistence
    ├── 🛠️ Advanced tools/exploits
    └── 🕵️ Intelligence gathering

Unskilled Attacker (Script Kiddie)

Explanation

Inexperienced attackers who use pre-made tools and scripts created by others, lacking technical expertise.

Examples

Script kiddies, wannabe hackers using automated tools, social media attackers, basic DoS attacks

Enterprise Use Case

Use Case A small business's web server experiences a spike in failed login attempts detected by their intrusion detection system. The security logs show an unsophisticated brute-force attack using a common password list downloaded from the internet, with the attacker making no attempt to evade detection or throttle their requests. The attack originated from a residential IP address and used a well-known automated tool called Hydra with default settings. The company's basic security controls - account lockout after five failed attempts and rate limiting - easily thwarted the attack. This script kiddie represents the most common type of attacker that organizations face daily, emphasizing the importance of implementing fundamental security controls that effectively defend against low-skill opportunistic attacks.

Diagram

👶 UNSKILLED ATTACKER
    ├── 🔽 Downloads existing tools
    ├── 📋 Follows tutorials
    ├── ❌ Limited understanding
    ├── 🎯 Opportunistic attacks
    └── 📢 Often noisy/detectable

Hacktivist

Explanation

Activists who use hacking techniques to promote political or social causes, seeking publicity for their message.

Examples

Anonymous, defacing websites, DDoS against corporations, leaking sensitive information for causes

Enterprise Use Case

Use Case An energy company planning a controversial pipeline project becomes the target of hacktivist group Anonymous, who oppose the project on environmental grounds. The hacktivists launch coordinated DDoS attacks against the company's public website, deface their homepage with protest messages, and leak internal emails discussing environmental impact assessments to the media. Unlike financially motivated attackers, the hacktivists seek maximum publicity for their cause rather than monetary gain, timing their attacks to coincide with shareholder meetings and posting their actions on social media. The company's incident response team must balance restoring services with public relations concerns, implementing DDoS mitigation while engaging with stakeholders about the underlying environmental issues driving the attacks.

Diagram

✊ POLITICAL/SOCIAL CAUSE
         ↓
    💻 HACKING TECHNIQUES
    ├── Website defacement
    ├── Data leaks
    ├── DDoS attacks
         ↓
    📢 PUBLIC MESSAGE/AWARENESS

Insider Threat

Explanation

Security risk posed by people within the organization who have authorized access but may misuse it.

Examples

Malicious employees, compromised accounts, negligent users, contractors with access

Enterprise Use Case

Use Case A technology company discovers that a senior database administrator who recently resigned downloaded customer databases containing 10 million user records to a personal USB drive two weeks before their departure. The insider used legitimate credentials and database access permissions, bypassing perimeter security controls designed to stop external attackers. Security monitoring tools flagged the unusually large data export, but only after the fact. The company implements User and Entity Behavior Analytics (UEBA) to detect anomalous data access patterns, enforces mandatory two-person authorization for bulk data exports, and requires all employees to sign off on data handling policies during exit interviews. This incident demonstrates that insider threats are particularly dangerous because insiders bypass traditional security controls designed for external threats.

Diagram

🏢 TRUSTED ORGANIZATION
         ↓
    🆔 AUTHORIZED ACCESS
         ↓
    😈 MALICIOUS INTENT
    or
    😴 NEGLIGENT BEHAVIOR
         ↓
    💥 INTERNAL DAMAGE

Organized Crime

Explanation

Criminal organizations that use cyber attacks for financial gain, operating sophisticated business-like structures.

Examples

Ransomware gangs, credit card fraud rings, cryptocurrency theft, online banking fraud

Enterprise Use Case

Use Case A healthcare network falls victim to the REvil ransomware group, a sophisticated organized crime operation. The attackers gained initial access through a phishing email, escalated privileges, moved laterally across the network for two weeks conducting reconnaissance, then deployed ransomware simultaneously across 200 servers during a weekend. The criminals demand $5 million in Bitcoin and threaten to publish stolen patient records on their dark web leak site if payment isn't received within 72 hours. The ransomware gang operates like a legitimate business with customer support, payment portals, and even offers "Ransomware-as-a-Service" to affiliates. This professionalized approach demonstrates how organized cybercrime has evolved into a major industry with estimated annual revenues exceeding many Fortune 500 companies.

Diagram

🏴‍☠️ CRIMINAL ORGANIZATION
    ├── 💰 Profit motive
    ├── 🎯 Systematic operations
    ├── 🤝 Organized hierarchy
    ├── 🛠️ Professional tools
    └── 🌐 Global reach

Shadow IT

Explanation

Unauthorized IT systems, devices, software, applications, and services used without explicit IT department approval.

Examples

Personal cloud storage, unauthorized applications, BYOD violations, unapproved software installations

Enterprise Use Case

Use Case A financial services company's IT audit discovers that the marketing department has been using personal Dropbox accounts to share large presentation files with external advertising agencies, bypassing the company's approved Microsoft OneDrive for Business. The marketing team implemented this shadow IT solution because the official file transfer process was too slow for their deadlines. However, this creates significant security risks: confidential market research and customer data are stored on unapproved cloud services without encryption, compliance controls, or IT visibility. The IT department implements a Cloud Access Security Broker (CASB) to discover and monitor all cloud applications, works with marketing to understand their requirements, and provides approved alternatives that balance security with usability, addressing the root cause of shadow IT adoption.

Diagram

🏢 OFFICIAL IT INFRASTRUCTURE
         │
    👻 SHADOW IT (Hidden)
    ├── 📱 Personal devices
    ├── ☁️ Unauthorized cloud
    ├── 📲 Unapproved apps
    └── ❌ No security oversight

Internal/External Threat Classification

Explanation

Categorization of threat actors based on their relationship to the target organization - inside or outside.

Examples

Internal: employees, contractors, vendors; External: hackers, nation-states, competitors

Enterprise Use Case

Use Case A retail company's security team analyzes a data breach and determines it resulted from a combination of internal and external threats. An external attacker phished a contractor's credentials (external threat), then used those legitimate credentials to access the network (appearing as internal threat). The security team adjusts their defense strategy accordingly: implementing stronger perimeter controls against external threats like advanced email filtering and VPN multi-factor authentication, while also deploying internal threat controls including privileged access management, data loss prevention, and user behavior analytics to detect compromised insider accounts. This layered approach recognizes that modern attacks often blur the line between internal and external threats, requiring comprehensive security controls that address both threat vectors simultaneously.

Diagram

🏰 ORGANIZATION PERIMETER

    🔵 INTERNAL THREATS:
    ├── 👥 Employees
    ├── 🤝 Contractors
    └── 🔑 Authorized access

    🔴 EXTERNAL THREATS:
    ├── 🏴‍☠️ Hackers
    ├── 🏛️ Nation-states
    └── 🚫 No authorized access

Threat Actor Resources/Funding

Explanation

Available financial resources, tools, and capabilities that determine the sophistication and persistence of attacks.

Examples

Nation-state: unlimited; Organized crime: high; Hacktivists: moderate; Script kiddies: low

Enterprise Use Case

Use Case A threat intelligence analyst compares two attacks against their organization to assess resource levels and prioritize response. The first attack used publicly available penetration testing tools and showed no custom development, indicating a low-resource attacker like a script kiddie or individual hacker. The second attack deployed custom malware with previously unknown zero-day exploits worth hundreds of thousands of dollars on the black market, maintained persistent access for months, and showed coordination across multiple time zones - clear indicators of well-funded threat actors like nation-states or sophisticated organized crime groups. The analyst recommends allocating more security resources to defend against and investigate the high-resource threat while implementing basic controls to mitigate the low-resource attacks.

Diagram

💰 FUNDING LEVELS:

    🏛️ NATION-STATE: $$$$$
    ├── Custom exploits
    ├── Advanced persistent threats
    └── Long-term operations

    🏴‍☠️ ORGANIZED CRIME: $$$$
    ├── Professional tools
    ├── Ransomware-as-a-Service

    👶 SCRIPT KIDDIE: $
    └── Free/stolen tools

Level of Sophistication/Capability

Explanation

Technical skill level and advanced capabilities of threat actors, determining attack complexity and evasion techniques.

Examples

High: APT, zero-days, custom malware; Medium: modified tools; Low: off-the-shelf exploits

Enterprise Use Case

Use Case A security operations center (SOC) analyst investigates two malware infections to assess threat sophistication. The first malware was immediately detected by antivirus as a known variant of Emotet, used default communication ports, and exhibited basic obfuscation - indicating low sophistication. The second malware evaded all endpoint detection systems, used custom encryption for command-and-control traffic, exploited a zero-day vulnerability in the VPN appliance, and employed anti-forensics techniques to cover its tracks - indicating high sophistication. The SOC escalates the sophisticated threat to senior incident responders and threat intelligence teams, knowing that highly capable attackers likely have specific objectives and may have already compromised other systems, while the low-sophistication malware is handled through standard incident response procedures.

Diagram

🎯 SOPHISTICATION LEVELS:

    🥇 ADVANCED (Nation-state)
    ├── Zero-day exploits
    ├── Custom malware
    ├── Advanced evasion

    🥈 INTERMEDIATE (Organized crime)
    ├── Modified existing tools
    ├── Some evasion techniques

    🥉 BASIC (Script kiddie)
    └── Off-the-shelf tools

Data Exfiltration

Explanation

Unauthorized extraction and removal of sensitive data from systems, often for espionage or financial gain.

Examples

Stealing customer databases, intellectual property theft, medical records, financial data extraction

Enterprise Use Case

Use Case A technology company's Data Loss Prevention (DLP) system alerts security analysts to unusual outbound network traffic from a research and development server at 3 AM. Investigation reveals that an attacker compromised the server two months ago and has been slowly exfiltrating proprietary product designs and source code to an external server using encrypted DNS tunneling to evade firewall rules. The attacker carefully throttled the data transfer to avoid triggering bandwidth alerts, extracting only 10 MB per night over 60 days to steal 600 MB of intellectual property. The company implements enhanced egress filtering, deploys Network Traffic Analysis (NTA) tools to detect covert channels, and segments R&D networks with stricter access controls to prevent future data exfiltration attempts.

Diagram

🏢 TARGET ORGANIZATION
    ├── 💳 Customer data
    ├── 🔬 Trade secrets
    ├── 📊 Financial records
         ↓
    🕵️ ATTACKER INFILTRATES
         ↓
    📤 DATA EXTRACTED SECRETLY
         ↓
    💰 SOLD/USED MALICIOUSLY

Cyber Espionage

Explanation

Covert intelligence gathering through cyber means to obtain classified or confidential information.

Examples

State-sponsored hacking, industrial espionage, political intelligence gathering, military secrets

Enterprise Use Case

Use Case A defense contractor working on classified aerospace projects discovers that APT attackers have compromised email servers and are monitoring executive communications regarding contract negotiations with the Department of Defense. The espionage campaign showed no interest in deploying ransomware or causing disruption - the attackers' sole objective was intelligence gathering to benefit a competing nation's aerospace industry. The attackers maintained stealthy persistent access for 14 months, carefully exfiltrating emails, technical specifications, and pricing strategies. The company implements email encryption, deploys advanced threat detection focused on reconnaissance behaviors, and works with federal counterintelligence agencies. This case demonstrates how cyber espionage differs from financially motivated attacks by prioritizing long-term intelligence collection over immediate monetary gain.

Diagram

🎯 TARGET (Government/Corporation)
         ↓
    🕵️ COVERT INFILTRATION
    ├── 🔓 Access classified info
    ├── 👁️ Monitor communications
    ├── 📱 Steal technology
         ↓
    🏛️ FOREIGN INTELLIGENCE SERVICE

Service Disruption

Explanation

Attacks aimed at making services, systems, or networks unavailable to legitimate users.

Examples

DDoS attacks, system takedowns, infrastructure attacks, website defacement

Enterprise Use Case

Use Case An online retailer experiences a massive Distributed Denial of Service (DDoS) attack during Black Friday weekend, their highest revenue period of the year. Attackers flood the company's web servers with 500 Gbps of junk traffic from a botnet of 100,000 compromised IoT devices, overwhelming the network infrastructure and making the shopping website completely unavailable to legitimate customers. The attack was launched by a disgruntled competitor to cause financial damage and reputational harm. The company activates their DDoS mitigation service, which filters malicious traffic at the ISP level, restoring service within 2 hours. The incident costs an estimated $2 million in lost sales and demonstrates the business impact of service disruption attacks during critical operational periods.

Diagram

🌐 NORMAL SERVICE
    ├── ✅ Users connected
    ├── ✅ Systems running
         ↓
    💥 DISRUPTION ATTACK
         ↓
    🚫 SERVICE UNAVAILABLE
    ├── ❌ Users blocked
    ├── ❌ Systems down

Blackmail/Extortion

Explanation

Threatening to release sensitive information or cause harm unless payment or demands are met.

Examples

Ransomware, threatening to leak data, extortion emails, sextortion scams

Enterprise Use Case

Use Case A law firm specializing in high-profile celebrity divorces receives a threatening email from attackers who claim to have stolen confidential client files including financial records, emails, and settlement agreements. The criminals demand $500,000 in Bitcoin within 72 hours, threatening to publish the sensitive documents on their dark web leak site and notify media outlets if payment isn't received. The firm verifies that attackers did breach their document management system and exfiltrated client data. The firm faces a difficult decision: paying may encourage future attacks but not paying risks massive reputational damage and client lawsuits. They report to FBI, engage cyber insurance, notify affected clients, and implement enhanced security while negotiating with attackers, demonstrating the complex business and legal ramifications of blackmail attacks.

Diagram

🔒 ENCRYPTED/STOLEN DATA
         ↓
    📧 EXTORTION MESSAGE:
    "Pay $50,000 Bitcoin or
     we release your data"
         ↓
    💰 VICTIM PAYS
    or
    📰 DATA PUBLISHED

Financial Gain

Explanation

Cyber attacks motivated by direct monetary profit through theft, fraud, or monetizing stolen data.

Examples

Credit card fraud, banking theft, cryptocurrency mining, selling stolen data

Enterprise Use Case

Use Case Cybercriminals compromise a retail company's point-of-sale systems by installing custom malware that captures credit card data during transactions. Over six months, the attackers steal 3 million credit card numbers, which they sell on dark web marketplaces for $20-$50 per card, generating over $60 million in revenue. The criminals operate purely for financial gain, using the stolen cards themselves for fraud and selling them to other criminals. The retail company discovers the breach when banks report an unusual spike in fraudulent charges on cards used at their stores. This financially motivated attack contrasts sharply with espionage or hacktivist attacks, as the criminals' sole objective is maximizing profit through theft and sale of payment data.

Diagram

🎯 FINANCIAL TARGETS
    ├── 💳 Credit cards
    ├── 🏦 Bank accounts
    ├── ₿ Cryptocurrency
         ↓
    🏴‍☠️ CYBER THEFT
         ↓
    💰 DIRECT PROFIT

Philosophical/Political Beliefs

Explanation

Cyber attacks driven by ideological motivations to promote or oppose political/social causes.

Examples

Hacktivism, politically motivated defacements, attacks on opposing governments/organizations

Enterprise Use Case

Use Case During a controversial election, hacktivist groups aligned with opposing political ideologies target campaign websites and infrastructure. One group defaces the official party website with messages opposing their immigration policies, while another group launches DDoS attacks to disrupt fundraising efforts. Unlike financially motivated criminals or nation-state espionage, these attackers explicitly state their ideological motivations in manifestos posted to social media and are willing to face legal consequences to promote their political beliefs. The campaign's IT security team implements enhanced DDoS protection, hardens web application security, and coordinates with law enforcement, recognizing that ideologically motivated attackers often prioritize publicity and symbolic victories over stealth or financial gain, making them more likely to announce attacks publicly.

Diagram

✊ STRONG BELIEFS
    ├── 🏛️ Against government
    ├── 🏢 Against corporations
    ├── 🌍 Environmental causes
         ↓
    💻 CYBER ACTIVISM
         ↓
    📢 PUBLIC MESSAGE

Ethical Motivations

Explanation

Hacking activities driven by moral principles to expose wrongdoing or improve security.

Examples

White hat hacking, responsible disclosure, whistleblowing, security research

Enterprise Use Case

Use Case A cybersecurity researcher discovers a critical SQL injection vulnerability in a popular e-commerce platform used by thousands of businesses worldwide. Following responsible disclosure practices, the researcher privately notifies the vendor's security team with detailed vulnerability information and proof-of-concept code, giving them 90 days to develop and deploy a patch before public disclosure. The researcher's ethical motivation is improving overall security rather than financial gain or causing harm - they decline offers from criminal buyers who would pay $100,000 for the zero-day exploit. After the vendor patches the vulnerability, the researcher publishes the findings to help the security community learn. The vendor rewards the researcher through their bug bounty program, demonstrating how ethical hacking benefits both security and organizations.

Diagram

🔍 SECURITY RESEARCHER
         ↓
    🔓 FINDS VULNERABILITY
         ↓
    📧 RESPONSIBLE DISCLOSURE
         ↓
    🛡️ SECURITY IMPROVED

Revenge Motivation

Explanation

Cyber attacks motivated by personal vendettas, desire for retaliation against perceived wrongs.

Examples

Disgruntled employees, ex-partners, former business associates, personal disputes

Enterprise Use Case

Use Case A software company terminates a senior developer for poor performance. Two weeks later, the company discovers that production databases have been deleted and critical source code repositories corrupted. Investigation reveals the disgruntled former employee used credentials they retained after termination to access systems and cause maximum damage as revenge for being fired. The attack wasn't financially motivated - the attacker gained no money - but purely driven by anger and desire for retaliation. The company implements immediate offboarding procedures requiring IT to disable all access within one hour of termination, implements privileged access management requiring approval for sensitive operations, and deploys user behavior analytics to detect anomalous destructive actions. This incident highlights how revenge-motivated attackers can be particularly dangerous because they prioritize causing damage over personal benefit.

Diagram

💼 WORKPLACE CONFLICT
    or
    💔 PERSONAL DISPUTE
         ↓
    😡 DESIRE FOR REVENGE
         ↓
    💻 CYBER RETALIATION
         ↓
    💥 TARGETED DAMAGE

Disruption/Chaos

Explanation

Attacks motivated by desire to cause maximum disorder, confusion, and instability.

Examples

Random attacks, trolling, chaos-seeking hackers, destructive malware

Enterprise Use Case

Use Case An attacker releases self-propagating wiper malware called "ChaosWiper" that indiscriminately spreads across the internet, deleting files and corrupting boot sectors on infected systems. Unlike ransomware seeking money or espionage seeking data, the malware's sole purpose is causing widespread destruction and chaos. The attacker publishes a manifesto stating they "just want to watch the digital world burn" without any political message or financial demands. Security researchers struggle to attribute motive beyond pure malicious intent to cause disorder. Organizations respond by implementing offline backups, network segmentation to prevent wiper propagation, and enhanced endpoint detection to identify destructive behaviors. This represents the most unpredictable threat actor category because chaos-motivated attackers act irrationally and cannot be deterred through traditional security economics or threat modeling.

Diagram

😈 CHAOS MOTIVATION
         ↓
    🎯 RANDOM TARGETS
         ↓
    💥 MAXIMUM DISRUPTION
    ├── 🔥 System destruction
    ├── 📊 Data corruption
    └── 🌪️ General mayhem

Cyber Warfare

Explanation

State-sponsored cyber attacks as part of military operations or international conflicts.

Examples

Infrastructure attacks, military system targeting, election interference, critical service disruption

Enterprise Use Case

Use Case During a geopolitical conflict, Nation A launches coordinated cyber warfare attacks against Nation B's critical infrastructure. Military hackers disable power distribution systems across major cities, disrupt water treatment facilities, compromise hospital networks to interfere with emergency medical services, and conduct widespread disinformation campaigns through social media. These attacks are designed to weaken Nation B's ability to respond militarily and undermine civilian morale. Critical infrastructure operators implement air-gapped control systems, deploy military-grade encryption, establish emergency backup communication networks, and coordinate with national cybersecurity agencies. This scenario demonstrates how modern warfare extends beyond physical battlefields into cyberspace, with attacks on civilian infrastructure becoming legitimate military tactics causing real-world casualties and economic damage.

Diagram

🏛️ NATION A vs NATION B
       ↓
  ⚔️ CYBER WARFARE
  ├── ⚡ Power grid attacks
  ├── 💧 Water system targeting
  ├── 🏥 Hospital disruption
  ├── 🗳️ Election interference
       ↓
  🌍 GEOPOLITICAL IMPACT

Email-based Attacks

Explanation

Malicious activities delivered through email systems, exploiting trust and communication channels.

Examples

Phishing emails, malware attachments, business email compromise, spam, email spoofing

Enterprise Use Case

Use Case A company's finance department receives an email appearing to be from the CEO requesting an urgent wire transfer of $500,000 to complete an acquisition deal. The email uses the CEO's name and a similar email address with one character changed. The finance manager, trusting the apparent sender, initiates the transfer before verifying through another channel. This Business Email Compromise (BEC) attack succeeds because it exploits email as a trusted communication medium. The company implements email authentication protocols (SPF, DKIM, DMARC), deploys advanced email filtering to detect spoofing, requires dual approval for large wire transfers, and trains employees to verify unusual financial requests through out-of-band communication, recognizing that email remains the primary attack vector for social engineering and malware delivery.

Diagram

📧 MALICIOUS EMAIL
  ├── 👤 Spoofed sender
  ├── 🎣 Phishing content
  ├── 📎 Malware attachment
  ├── 🔗 Malicious links
       ↓
  😵 VICTIM INTERACTION
       ↓
  💥 COMPROMISE

SMS-based Attacks (Smishing)

Explanation

Text message-based attacks that trick users into clicking malicious links or revealing information.

Examples

Phishing text messages, fake delivery notifications, prize scams, banking alerts

Enterprise Use Case

Use Case Employees at a healthcare organization receive text messages claiming to be from their bank's fraud department, stating suspicious activity was detected on their account and they must click a link to verify their identity immediately. The SMS includes the company name and appears urgent. Several employees click the link and enter their banking credentials on a fake phishing site, which harvests their information. The attackers use stolen credentials to drain bank accounts within hours. The IT security team responds by conducting awareness training on SMS-based phishing (smishing), implementing mobile device management to warn users about malicious links, and establishing a policy to never click links in unexpected text messages, instead manually navigating to official websites or calling verified phone numbers.

Diagram

📱 TEXT MESSAGE:
  "Your package delivery failed.
   Click here to reschedule:
   suspicious-link.com"
       ↓
  👤 USER CLICKS
       ↓
  🎣 CREDENTIALS STOLEN

Instant Messaging Attacks

Explanation

Attacks delivered through chat platforms and instant messaging applications.

Examples

Malicious links in chat, file transfers with malware, social engineering in DMs

Enterprise Use Case

Use Case An attacker compromises an employee's Slack account and uses it to send malicious links to coworkers in various channels. Because the messages appear to come from a trusted colleague, multiple employees click the links without suspicion. The links redirect to a fake Microsoft Office 365 login page that harvests credentials. Within hours, the attacker has compromised 15 additional accounts and begins searching for sensitive company data. The security team detects unusual login patterns, forces password resets, enables multi-factor authentication on all communication platforms, and implements link scanning in instant messaging applications to detect and warn about malicious URLs before users click them.

Diagram

💬 CHAT MESSAGE:
  "Hey, check out this cool
   photo I found: malware.exe"
       ↓
  👤 TRUSTED CONTACT SENDS
       ↓
  🔽 USER DOWNLOADS
       ↓
  💀 MALWARE INFECTION

Embedded Malware in Images

Explanation

Malicious code hidden within image files that executes when the image is processed or viewed.

Examples

Steganography, malicious EXIF data, image exploits, infected media files

Enterprise Use Case

Use Case A marketing team downloads stock photos for a new advertising campaign from what appears to be a legitimate photography website. Unknown to them, attackers compromised the site and embedded exploit code within the EXIF metadata of image files. When designers open the images in an outdated version of Adobe Photoshop with unpatched vulnerabilities, the malicious code executes and installs a backdoor on their workstations. The company discovers the compromise when antivirus detects lateral movement attempts. The IT team implements image sanitization tools that strip potentially dangerous metadata from uploaded files, updates all image processing software, and deploys application whitelisting to prevent unauthorized executables from running.

Diagram

🖼️ INNOCENT IMAGE
  "vacation_photo.jpg"
  ├── 👁️ Visible: Beach scene
  ├── 💀 Hidden: Malware code
       ↓
  📱 USER OPENS IMAGE
       ↓
  💥 MALWARE EXECUTES

Steganographic Attacks

Explanation

Using steganography to hide malicious payloads or communications within innocent-looking files.

Examples

Hidden messages in images, covert channels, data exfiltration, command and control

Enterprise Use Case

Use Case Security analysts discover that malware on compromised systems is using steganography to hide command-and-control communications within innocent-looking meme images posted to social media. The malware downloads these images, extracts hidden commands from the pixel data, executes instructions, then posts results back to social media as comments with steganographically embedded data. This covert channel completely bypasses traditional network security controls that monitor for suspicious domains or IP addresses. The security team deploys specialized steganography detection tools, implements stricter application control to prevent unauthorized social media access from corporate systems, and uses machine learning to detect statistical anomalies in image files that indicate hidden data.

Diagram

📸 NORMAL PHOTO
       ↓
  🔍 STEGANOGRAPHY TOOL
       ↓
  💀 HIDDEN MALICIOUS CODE
       ↓
  📤 SENT UNDETECTED

Portable Executable Attacks

Explanation

Malicious executable files designed to run on target systems and compromise them.

Examples

Malware .exe files, trojans, virus-infected executables, backdoor programs

Enterprise Use Case

Use Case A company's email security gateway blocks an executable file named "invoice.exe" attached to an email claiming to be from a vendor. Analysis reveals the file is a trojan dropper that would download and install ransomware if executed. The security team implements application whitelisting that only allows approved executables to run, deploys endpoint detection and response (EDR) tools to detect malicious portable executable behavior, and trains users never to run executable files received via email. They also configure email gateways to block or quarantine all executable file types (.exe, .scr, .bat, .cmd) and require legitimate software distribution through approved IT channels.

Diagram

💾 MALICIOUS .EXE
  "game_installer.exe"
       ↓
  👤 USER EXECUTES
       ↓
  💻 SYSTEM COMPROMISE
  ├── 🔒 Backdoor installed
  ├── 📤 Data stolen
  └── 💀 Malware deployed

Office Document Attacks

Explanation

Malicious code embedded in office documents that exploits document processing vulnerabilities.

Examples

Macro viruses, malicious Word docs, infected Excel spreadsheets, PowerPoint malware

Enterprise Use Case

Use Case Employees receive phishing emails with malicious Excel spreadsheets containing macros that claim to display an important invoice. When users enable macros as prompted, the malicious code downloads and executes Emotet malware, establishing a beachhead for further attacks. The IT department responds by disabling macros by default across all Microsoft Office installations, implementing Protected View for documents from untrusted sources, deploying email sandboxing that detonates attachments in isolated environments before delivery, and training users to be suspicious of any document requesting macro enablement, recognizing that Office documents remain one of the most common malware delivery mechanisms.

Diagram

📄 OFFICE DOCUMENT
  "invoice.docx"
  ├── 📝 Normal content
  ├── 💀 Hidden macro
       ↓
  👤 USER OPENS DOCUMENT
       ↓
  ⚠️ "Enable macros?"
       ↓
  💥 MALWARE EXECUTES

PDF-based Attacks

Explanation

Malicious portable document format files that exploit PDF reader vulnerabilities.

Examples

Malicious JavaScript in PDFs, embedded executables, PDF exploits, form-based attacks

Enterprise Use Case

Use Case A law firm receives a PDF file claiming to be a court filing from an opposing counsel. When paralegals open the PDF in an outdated version of Adobe Reader, embedded JavaScript exploits a known vulnerability to download and execute malware that encrypts the firm's document management system. The attack succeeds because the PDF appeared legitimate and came through normal business channels. The firm implements PDF sanitization tools that remove active content before allowing PDFs to be opened, updates all PDF readers to the latest versions, configures readers to disable JavaScript execution by default, and trains staff to open unexpected PDFs in sandboxed environments first.

Diagram

📑 MALICIOUS PDF
  "report.pdf"
  ├── 📄 Normal content
  ├── ⚙️ Embedded JavaScript
       ↓
  👤 USER OPENS PDF
       ↓
  💀 EXPLOIT ACTIVATES
       ↓
  💻 SYSTEM COMPROMISED

Voice Call Threats

Explanation

Phone-based attacks using voice communication to manipulate victims or exploit telecommunications.

Examples

Vishing (voice phishing), phone impersonation, caller ID spoofing, SIM swapping attacks

Enterprise Use Case

Use Case Employees at a financial institution receive phone calls from someone claiming to be from the IT helpdesk, stating there is a critical security issue requiring immediate password verification. Using caller ID spoofing, the attacker's number appears to match the company's internal helpdesk extension. Several employees provide their credentials before the real IT department discovers the vishing campaign. The attackers use stolen credentials to access the company's financial systems and initiate fraudulent wire transfers. The company implements callback verification procedures requiring employees to hang up and call official numbers when receiving unexpected security-related requests, deploys voice authentication for sensitive operations, and trains staff to recognize social engineering tactics in voice communications.

Diagram

📞 MALICIOUS CALL
  "This is your bank..."
  ├── 🎭 IMPERSONATION
  ├── 🔊 URGENT TONE
  └── 📋 REQUEST INFO
       ↓
  👤 VICTIM SHARES DATA
       ↓
  💰 IDENTITY THEFT

Removable Device Attacks

Explanation

Malicious attacks delivered through USB drives, CDs, or other portable storage media.

Examples

USB drops, infected flash drives, malicious CDs/DVDs, rubber ducky attacks, BadUSB

Enterprise Use Case

Use Case Attackers scatter USB drives labeled "Executive Salary Information" in the parking lot of a corporate headquarters. Curious employees find the drives and plug them into work computers to see the contents. The USB devices contain malware that automatically executes using autorun functionality, installing keystroke loggers and creating backdoors into the corporate network. Within days, attackers have access to sensitive financial systems. The company responds by disabling autorun/autoplay features on all workstations, implementing USB device whitelisting that only allows approved devices, deploying endpoint protection that scans removable media before allowing access, and conducting security awareness training about the dangers of using unknown USB devices.

Diagram

🔌 INFECTED USB DRIVE
  "Found in parking lot"
  ├── 💾 AUTORUN.EXE
  ├── 🦠 MALWARE PAYLOAD
  └── 📂 FAKE DOCUMENTS
       ↓
  💻 PLUGGED INTO PC
       ↓
  🚨 SYSTEM INFECTED

Vulnerable Software Components

Explanation

Software with security flaws, outdated versions, or unpatched vulnerabilities that can be exploited.

Examples

Unpatched operating systems, outdated web browsers, vulnerable third-party libraries, legacy applications

Enterprise Use Case

Use Case A web application uses an outdated version of Apache Struts framework with a known remote code execution vulnerability (CVE-2017-5638). Attackers scan the internet for vulnerable Struts installations and exploit the flaw to gain shell access to the application server. From there, they pivot to database servers and exfiltrate customer credit card data. The Equifax breach followed this exact pattern. The company implements a robust vulnerability management program with automated scanning, patch management processes that prioritize critical security updates, software composition analysis tools to track third-party library versions, and a requirement that all internet-facing applications undergo security assessments before deployment.

Diagram

📦 VULNERABLE SOFTWARE
  ├── 🕳️ KNOWN CVE
  ├── ⏰ OUTDATED VERSION
  └── 🚫 NO PATCHES
       ↓
  🎯 ATTACKER TARGETS
       ↓
  💥 EXPLOITATION

Unsupported Systems and Applications

Explanation

End-of-life systems that no longer receive security updates, creating permanent security risks.

Examples

Windows XP/7, Internet Explorer, legacy databases, discontinued security products

Enterprise Use Case

Use Case A hospital continues running critical medical imaging equipment on Windows XP because the proprietary software is incompatible with newer operating systems and the vendor went out of business. When the WannaCry ransomware outbreak occurs, the unpatched Windows XP systems are immediately compromised, forcing the hospital to divert ambulances and cancel surgeries. The hospital implements network segmentation to isolate legacy systems from the main network, deploys virtual patching through intrusion prevention systems to protect unsupported software, establishes a formal end-of-life replacement program with budget allocation, and requires vendors to provide upgrade paths before purchasing equipment with embedded operating systems.

Diagram

⚰️ END-OF-LIFE SYSTEM
  ├── 🚫 NO MORE UPDATES
  ├── 🕳️ KNOWN VULNS
  └── 💀 PERMANENT RISK
       ↓
  🎯 EASY TARGET
       ↓
  🔓 COMPROMISE

Unsecure Networks

Explanation

Network connections without proper encryption or authentication that expose data to interception.

Examples

Open WiFi, unencrypted HTTP, weak WEP encryption, rogue access points

Enterprise Use Case

Use Case Employees traveling for business connect to free WiFi at hotels and coffee shops to access company email and cloud applications. Attackers set up rogue access points with names like "Hotel_Guest_WiFi" and "Starbucks_Free" to intercept traffic. When employees connect, attackers use packet sniffing tools to capture unencrypted HTTP traffic and session cookies, gaining access to company accounts. The company mandates VPN use for all connections from untrusted networks, implements certificate pinning to detect man-in-the-middle attacks, enforces HTTPS-only policies for all corporate applications, deploys mobile device management to prevent connections to open WiFi networks, and trains employees about the risks of using public networks without protection.

Diagram

📡 OPEN WIFI NETWORK
  "Free_WiFi"
  ├── 🚫 NO ENCRYPTION
  ├── 👥 PUBLIC ACCESS
  └── 👂 EASY SNIFFING
       ↓
  🕵️ ATTACKER LISTENS
       ↓
  🔓 DATA CAPTURED

Open Service Ports

Explanation

Network ports left open unnecessarily, providing potential entry points for attackers.

Examples

Unused FTP ports (21), Telnet (23), unnecessary web services (80/443), database ports (3306/1433)

Enterprise Use Case

Use Case A security audit of a company's web server reveals that MySQL port 3306 is exposed directly to the internet, allowing anyone to attempt database connections. Attackers discover this through port scanning and launch brute-force password attacks against the database. After compromising a weak password account, they extract the entire customer database. The company implements a strict firewall policy that only allows necessary ports to be accessible from the internet, moves database servers behind application servers without direct internet exposure, uses port knocking or VPN for administrative access, conducts regular port scans to identify and close unnecessary open ports, and implements intrusion detection systems to alert on port scanning activities.

Diagram

🖥️ SERVER
  ├── 🚪 Port 21 (FTP) OPEN
  ├── 🚪 Port 23 (Telnet) OPEN
  ├── 🚪 Port 80 (HTTP) OPEN
  └── 🚪 Port 3306 (MySQL) OPEN
       ↓
  🔍 PORT SCAN REVEALS ALL
       ↓
  🎯 ATTACK VECTORS

Default Credentials

Explanation

Factory-set usernames and passwords that are never changed, providing easy access to systems.

Examples

admin/admin, admin/password, root/toor, default router passwords (admin/1234)

Enterprise Use Case

Use Case A company deploys hundreds of IP security cameras throughout their facility without changing the default admin password. Attackers use automated tools like Shodan to identify internet-facing cameras and try default credentials from manufacturer documentation, gaining access to 80% of the cameras within hours. The attackers use the cameras to surveil the facility, identify security gaps, and plan a physical break-in. The company implements a mandatory password change policy during device provisioning, uses a privileged access management system to rotate credentials automatically, conducts regular audits for default credentials, and deploys network segmentation to isolate IoT devices from critical systems.

Diagram

📱 DEVICE SETUP
  Username: admin
  Password: admin
  ├── 📋 NEVER CHANGED
  ├── 🌐 PUBLICLY KNOWN
  └── 📖 IN MANUAL
       ↓
  🕵️ ATTACKER GOOGLES
       ↓
  🔓 INSTANT ACCESS

Supply Chain Attacks

Explanation

Attacks targeting the software or hardware supply chain to compromise end users through trusted sources.

Examples

SolarWinds hack, malicious npm packages, hardware tampering, compromised software updates

Enterprise Use Case

Use Case In the SolarWinds Orion attack, nation-state actors compromised the software development environment of a trusted IT management vendor and inserted a backdoor into legitimate software updates. When 18,000 customers including government agencies and Fortune 500 companies installed the trusted update, they unknowingly deployed the backdoor into their networks. This supply chain attack bypassed traditional security controls because the malware came through a trusted source with valid digital signatures. Organizations now implement software composition analysis, verify software hashes against multiple sources, use vendor security assessments, deploy behavioral detection for trusted applications, and maintain network segmentation to limit blast radius even from trusted software.

Diagram

🏭 SOFTWARE VENDOR
  ├── 💻 DEVELOPMENT
  ├── 🦠 MALWARE INSERTED
  └── 📦 PACKAGE RELEASED
       ↓
  🏢 CUSTOMERS INSTALL
       ↓
  🌐 WIDESPREAD COMPROMISE

Botnet

Explanation

Network of compromised computers controlled remotely to perform coordinated malicious activities.

Examples

Zeus botnet, Mirai IoT botnet, distributed denial of service attacks, cryptocurrency mining

Enterprise Use Case

Use Case Attackers exploit default credentials on IoT devices like security cameras, routers, and DVRs to build the Mirai botnet containing over 600,000 compromised devices. The botnet launches massive DDoS attacks reaching 1 Tbps against DNS provider Dyn, taking down major websites including Twitter, Netflix, and Reddit. Organizations implement IoT security policies requiring password changes, network segmentation to isolate IoT devices, traffic monitoring to detect botnet command-and-control communications, automated patching for IoT firmware, and DDoS mitigation services to withstand botnet attacks. The incident demonstrates how poorly secured IoT devices become weaponized as part of massive botnets.

Diagram

🤖 BOTNET
  Command & Control
       ↓
  🌐 INFECTED MACHINES
  ├── 💻 Bot 1
  ├── 💻 Bot 2
  ├── 💻 Bot 3
  └── 📱 Bot n
       ↓
  ⚡ COORDINATED ATTACKS

Adware

Explanation

Software that displays unwanted advertisements and may track user behavior for targeted ads.

Examples

Browser toolbar ads, pop-up generators, tracking cookies, bundled advertising software

Enterprise Use Case

Use Case Employees download free PDF conversion software that bundles adware into the installation. The adware modifies browser settings, injects advertisements into webpages, tracks browsing behavior, and redirects searches to advertising partners. Corporate productivity decreases as employees struggle with constant pop-ups, and the adware tracking raises privacy concerns for customer data. The IT department implements application whitelisting to prevent unauthorized software installation, deploys browser security extensions that block adware, uses endpoint protection that detects adware behaviors, educates users about risks of "free" software with bundled components, and establishes policies requiring IT approval for all software installations.

Diagram

📢 ADWARE
  ├── 🎯 POP-UP ADS
  ├── 🍪 TRACKING COOKIES
  ├── 📊 BEHAVIOR ANALYSIS
  └── 💰 AD REVENUE
       ↓
  😤 USER FRUSTRATION
       ↓
  🛒 UNWANTED PURCHASES

Physical Brute Force Attacks

Explanation

Physical attacks using repetitive force or attempts to bypass security measures.

Examples

Lock picking, breaking down doors, tailgating attempts, badge cloning trials

Enterprise Use Case

Use Case A penetration testing team is hired to assess physical security at a data center. They successfully tailgate through the main entrance by following authorized employees, use lock picking tools to bypass a mechanical lock on a server room door, and gain access to live production servers. The data center implements mantrap entries requiring individual authentication, replaces mechanical locks with electronic access controls that log all entries, deploys security cameras with real-time monitoring, trains employees to challenge unknown individuals, implements security guards at critical access points, and uses intrusion detection sensors that alert when doors are forced open.

Diagram

💪 PHYSICAL BRUTE FORCE
  ├── 🔐 LOCK PICKING
  ├── 🚪 DOOR RAMMING
  ├── 🏃 TAILGATING
  └── 🔄 REPEATED ATTEMPTS
       ↓
  🚨 SECURITY BREACH
       ↓
  🏢 FACILITY ACCESS

RFID Cloning

Explanation

Copying radio frequency identification tags to gain unauthorized access or impersonate legitimate users.

Examples

Badge cloning, key card duplication, access card skimming, proximity card copying

Enterprise Use Case

Use Case An attacker uses a concealed RFID reader disguised as a backpack to skim employee access badges while standing near them in an elevator or cafeteria line. The captured RFID data is cloned onto blank cards, allowing the attacker to bypass physical access controls and enter secure areas after hours. The company upgrades to multi-factor physical authentication requiring both RFID badge and PIN code, implements RFID-blocking sleeves for employee badges, deploys readers that use encrypted challenge-response authentication instead of simple badge cloning, enables real-time access monitoring to detect unusual access patterns, and requires security escort for after-hours facility access.

Diagram

📻 RFID CLONING
  Original card 💳
       ↓
  📡 RFID READER/WRITER
  ├── 📊 EXTRACTS DATA
  ├── 📝 COPIES TO BLANK
  └── 🎭 CREATES DUPLICATE
       ↓
  💳 CLONED CARD
       ↓
  🔓 UNAUTHORIZED ACCESS

Environmental Attacks

Explanation

Physical attacks targeting environmental systems to disrupt operations or gain access.

Examples

HVAC manipulation, power disruption, fire suppression tampering, water damage

Enterprise Use Case

Use Case Attackers gain access to a data center building management system through an unsecured vendor portal and manipulate HVAC settings to raise server room temperatures above safe operating limits. As servers begin overheating and triggering automatic shutdowns, critical business operations are disrupted. The facility also experiences a coordinated power disruption when attackers trip circuit breakers. The company segments building management systems from IT networks, implements strong authentication for all facility systems, deploys environmental monitoring with automated alerts, establishes redundant cooling and power systems, requires physical security for all HVAC and electrical panels, and maintains incident response procedures for environmental attacks.

Diagram

🌡️ ENVIRONMENTAL ATTACK
  ├── ❄️ HVAC MANIPULATION
  ├── ⚡ POWER DISRUPTION
  ├── 🔥 FIRE SYSTEMS
  └── 💧 WATER DAMAGE
       ↓
  🏢 FACILITY DISRUPTION
       ↓
  🚨 OPERATIONS DOWN

Distributed Denial of Service (DDoS)

Explanation

Coordinated attacks from multiple sources overwhelming a target system to deny legitimate access.

Examples

Botnet attacks, volumetric attacks, application layer attacks, protocol attacks

Enterprise Use Case

Use Case An e-commerce company experiences a DDoS attack during their Black Friday sale when attackers flood the website with traffic from a botnet of 500,000 compromised devices, reaching 300 Gbps. Legitimate customers cannot access the site, resulting in millions of dollars in lost revenue. The attack uses multiple vectors including SYN floods, HTTP floods, and DNS amplification. The company activates their DDoS mitigation service which filters malicious traffic at the edge, implements rate limiting and traffic shaping, uses Content Delivery Networks (CDN) to absorb volumetric attacks, deploys Web Application Firewalls with DDoS protection, and maintains incident response playbooks specifically for DDoS scenarios.

Diagram

🌊 DDOS ATTACK
  🤖 Botnet 1 ─┐
  🤖 Botnet 2 ─┤
  🤖 Botnet 3 ─┼─→ 🎯 TARGET SERVER
  🤖 Botnet 4 ─┤      ↓
  🤖 Botnet n ─┘   💀 OVERWHELMED
                     ↓
                🚫 SERVICE DOWN

Amplified DDoS Attacks

Explanation

DDoS attacks using amplification servers to multiply attack traffic volume significantly.

Examples

DNS amplification, NTP amplification, SNMP amplification, Memcached amplification

Enterprise Use Case

Use Case Attackers exploit misconfigured DNS servers to launch an amplified DDoS attack against a gaming company. By sending small DNS queries (64 bytes) with spoofed source IP addresses pointing to the victim, the attackers trigger large DNS responses (up to 4000 bytes) that flood the target, achieving a 60x amplification factor. With only 10 Gbps of attacker bandwidth, they generate 600 Gbps targeting the victim. The company implements BCP 38 ingress filtering to prevent IP spoofing, configures DNS servers to only respond to authorized recursive queries, deploys anti-DDoS scrubbing services that detect and filter amplification attacks, and works with ISPs to block reflection sources.

Diagram

📢 AMPLIFIED DDOS
  🤖 Small request (64 bytes)
       ↓
  🔊 DNS/NTP SERVER
  ├── 📊 PROCESSES REQUEST
  └── 📤 LARGE RESPONSE (4KB)
       ↓
  🎯 TARGET × 60 AMPLIFICATION
       ↓
  💀 MASSIVE OVERLOAD

Reflected DDoS Attacks

Explanation

DDoS attacks where attackers spoof victim IP addresses to redirect response traffic to the target.

Examples

DNS reflection, NTP reflection, SSDP reflection, UDP reflection attacks

Enterprise Use Case

Use Case Attackers launch a reflection attack against a financial institution by sending requests to thousands of misconfigured NTP servers with the victim spoofed IP address as the source. The NTP servers, believing the requests came from the victim, send large responses directly to the victim network, overwhelming their internet connection. The reflection attack hides the attacker true location and amplifies the volume. The financial institution implements anti-spoofing filters at their network edge using BCP 38, deploys DDoS protection services that identify and filter reflection attack patterns, coordinates with their ISP to block upstream reflection sources, and implements rate limiting on their public-facing services.

Diagram

🪞 REFLECTED DDOS
  🤖 ATTACKER
  (spoofs victim IP)
       ↓
  💻 REFLECTOR SERVER
  ├── 📨 SEES VICTIM IP
  └── 📤 SENDS TO "VICTIM"
       ↓
  🎯 VICTIM FLOODED
       ↓
  🚫 SERVICE DENIED

Injection Attacks

Explanation

Code injection attacks where malicious input is inserted into application queries or commands.

Examples

SQL injection, command injection, LDAP injection, NoSQL injection, XML injection

Enterprise Use Case

Use Case An attacker discovers a SQL injection vulnerability in a web application login form by entering a username of "admin OR 1=1--". The application fails to sanitize input and directly concatenates it into a SQL query, allowing the attacker to bypass authentication and gain administrative access. Once inside, they use additional SQL injection to extract the entire customer database including credit card numbers. The company implements parameterized queries and prepared statements to prevent SQL injection, deploys Web Application Firewalls that detect injection patterns, performs input validation and sanitization on all user-supplied data, conducts regular security code reviews and penetration testing, and implements least-privilege database permissions.

Diagram

💉 INJECTION ATTACK
  User input: "'; DROP TABLE users;--"
  ├── 📝 MALICIOUS PAYLOAD
  ├── 🗃️ DATABASE QUERY
  └── 💀 COMMAND EXECUTED
       ↓
  🗑️ DATA DESTROYED
       ↓
  🚨 SYSTEM COMPROMISED

Buffer Overflow

Explanation

Attack that overwrites memory buffers to execute malicious code or crash systems.

Examples

Stack overflow, heap overflow, integer overflow, format string attacks

Enterprise Use Case

Use Case A legacy C application running on company servers has a buffer overflow vulnerability where user input is not properly validated before being copied into a fixed-size memory buffer. Attackers send specially crafted input that exceeds the buffer size, overwriting adjacent memory including the return address on the stack. This allows them to hijack program execution flow and run shellcode that gives them remote command execution on the server. The company migrates to memory-safe languages like Rust for new development, enables Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP), implements stack canaries, uses static code analysis tools to detect buffer overflows, and deploys runtime protection like Control Flow Integrity.

Diagram

🪣 BUFFER OVERFLOW
  Buffer: [A][A][A][A][A]
  Input:  AAAAAAAAAAAAAAAA💀
  ├── 📊 BUFFER EXCEEDED
  ├── 💾 MEMORY OVERWRITTEN
  └── 🎯 EXECUTION HIJACKED
       ↓
  💀 MALICIOUS CODE RUNS
       ↓
  🔓 SYSTEM COMPROMISE

Replay Attacks

Explanation

Attacks that intercept and retransmit valid data transmissions to gain unauthorized access.

Examples

Session replay, authentication replay, transaction replay, wireless signal replay

Enterprise Use Case

Use Case An attacker uses a wireless packet sniffer to capture authentication tokens transmitted over an unencrypted WiFi network at a coffee shop. The attacker intercepts a valid session cookie from an employee accessing the corporate web portal and replays it to gain authenticated access to the portal without needing to know the employee password. The company implements timestamp-based nonces in authentication tokens so each token is only valid once, deploys mutual TLS authentication with certificate pinning, requires all network communications to use encrypted channels, implements short session timeouts that force re-authentication, and uses challenge-response protocols that prevent replay attacks.

Diagram

🔄 REPLAY ATTACK
  👤 USER → 🔐 AUTH TOKEN → 🏦 SERVER
            ↓
       📹 ATTACKER CAPTURES
            ↓
  🎭 ATTACKER → 🔐 SAME TOKEN → 🏦 SERVER
            ↓
       ✅ AUTHENTICATION SUCCESS
            ↓
  🔓 UNAUTHORIZED ACCESS

Privilege Escalation

Explanation

Gaining higher-level permissions than originally granted, often exploiting system vulnerabilities.

Examples

Vertical escalation (user to admin), horizontal escalation (user to user), kernel exploits

Enterprise Use Case

Use Case An attacker gains initial access to a web server as a low-privileged web application user account. They discover a Linux kernel vulnerability (Dirty COW) that allows privilege escalation to root. After exploiting the vulnerability, they have full administrative control over the server and can access all files, install backdoors, and pivot to other systems on the network. The company implements least privilege principles ensuring applications run with minimal necessary permissions, deploys regular security patching to close kernel vulnerabilities, uses SELinux or AppArmor to enforce mandatory access controls even if an attacker escalates privileges, implements privilege escalation detection through security monitoring, and segregates systems to limit lateral movement.

Diagram

⬆️ PRIVILEGE ESCALATION
  👤 LIMITED USER
       ↓
  🕳️ EXPLOIT VULNERABILITY
  ├── 🐛 SYSTEM BUG
  ├── 🔧 MISCONFIG
  └── 📂 WEAK PERMISSIONS
       ↓
  👑 ADMIN PRIVILEGES
       ↓
  🔓 FULL SYSTEM CONTROL

Forgery Attacks

Explanation

Attacks that create fake requests or credentials to impersonate legitimate users or systems.

Examples

Cross-site request forgery (CSRF), request forgery, credential forgery, token forgery

Enterprise Use Case

Use Case A user logged into their banking website visits a malicious forum that contains hidden CSRF attack code. The malicious page automatically submits a forged fund transfer request to the bank using the user authenticated session. Because the browser automatically includes the user valid session cookies, the bank server processes the fraudulent transfer as if the legitimate user initiated it. The bank implements anti-CSRF tokens that must be included with state-changing requests, validates the Origin and Referer headers, requires re-authentication for sensitive transactions, implements SameSite cookie attributes, and educates users about not clicking links or visiting untrusted sites while logged into sensitive applications.

Diagram

🎭 FORGERY ATTACK
  🌐 MALICIOUS WEBSITE
  ├── 📝 CRAFTS FAKE REQUEST
  ├── 👤 USER VISITS SITE
  └── 📤 SENDS TO BANK
       ↓
  🏦 BANK SEES "USER" REQUEST
       ↓
  💰 TRANSFERS MONEY

Directory Traversal

Explanation

Attack that accesses files and directories outside the web application root directory.

Examples

Path traversal, dot-dot-slash attacks, file inclusion vulnerabilities, directory climbing

Enterprise Use Case

Use Case A web application allows users to download files by specifying a filename parameter in the URL. An attacker manipulates the parameter to include "../../../etc/passwd" which causes the application to traverse up the directory tree and access system password files outside the intended web root directory. The attacker downloads sensitive configuration files, SSH keys, and application source code. The company implements proper input validation that rejects path traversal sequences, uses whitelist-based file access allowing only specific approved files, implements chroot jails to restrict file system access, deploys Web Application Firewalls that detect directory traversal patterns, and applies least privilege file permissions so the web server cannot access sensitive system files.

Diagram

📁 DIRECTORY TRAVERSAL
  Normal: /app/files/document.pdf
  Attack: /app/../../../etc/passwd
  ├── 📂 ESCAPES WEB ROOT
  ├── 🔍 ACCESSES SYSTEM FILES
  └── 👁️ READS SENSITIVE DATA
       ↓
  🔓 PASSWORD FILE EXPOSED
       ↓
  💀 SYSTEM COMPROMISED

Account Lockout Indicators

Explanation

Security indicators when user accounts are locked due to suspicious activity or policy violations.

Examples

Multiple failed login attempts, brute force detection, concurrent login attempts, policy violations

Enterprise Use Case

Use Case A company security monitoring system detects a spike in account lockouts across multiple user accounts within a short timeframe, indicating a potential password spraying attack where attackers try common passwords against many accounts. The security team investigates and discovers an automated bot systematically attempting to log in with "Password123" across hundreds of employee accounts. The account lockout policy successfully prevents brute force attacks by locking accounts after 5 failed attempts. The team implements additional defenses including CAPTCHA challenges after failed logins, IP-based rate limiting, multi-factor authentication requirements, and security awareness training about password strength to prevent successful password spraying campaigns.

Diagram

🔒 ACCOUNT LOCKOUT
  👤 USER LOGIN ATTEMPTS
  ❌ Wrong password (1)
  ❌ Wrong password (2)
  ❌ Wrong password (3)
       ↓
  🚨 THRESHOLD EXCEEDED
       ↓
  🔐 ACCOUNT LOCKED

Concurrent Session Usage

Explanation

Detecting when user accounts are being accessed simultaneously from multiple locations or devices.

Examples

Same user logged in from different countries, multiple device logins, impossible travel patterns

Enterprise Use Case

Use Case User behavior analytics detect that an employee account is logged in simultaneously from their office workstation in Chicago and from an IP address in Russia. The system flags this as suspicious concurrent session usage and automatically forces re-authentication on both sessions. Investigation reveals the employee credentials were compromised through a phishing attack and sold on the dark web. The company implements session management controls that limit users to one active session, deploys geolocation-based authentication requiring additional verification for logins from new countries, uses device fingerprinting to detect unauthorized devices, and implements real-time alerting for concurrent session anomalies.

Diagram

👥 CONCURRENT SESSIONS
  User: john.doe
  ├── 📍 Login: New York (2:30 PM)
  └── 📍 Login: Tokyo (3:30 AM)
       ↓
  🚨 IMPOSSIBLE TRAVEL
       ↓
  🔔 SECURITY ALERT

Blocked Content Indicators

Explanation

Security events indicating attempts to access malicious or restricted content.

Examples

Malware downloads blocked, phishing sites blocked, restricted website access, policy violations

Enterprise Use Case

Use Case A company web filtering solution blocks an employee attempt to download a file from a known malware distribution site. The security event is logged and triggers an automated investigation. The security team discovers the employee received a phishing email with a link to the malicious site. They review the employee recent web browsing history, find multiple blocked access attempts to suspicious sites, and conduct security awareness retraining. The organization maintains DNS filtering and web reputation services that block access to malicious domains, implements endpoint protection that prevents malware execution even if downloaded, logs all blocked content events for threat hunting, and uses these indicators to identify potentially compromised users.

Diagram

🚫 BLOCKED CONTENT
  👤 USER REQUEST
  "malicious-site.com"
       ↓
  🛡️ SECURITY FILTER
  ├── 🔍 CHECKS REPUTATION
  ├── ⚠️ MALICIOUS DETECTED
  └── 🚫 ACCESS DENIED
       ↓
  📝 SECURITY LOG ENTRY

Impossible Travel

Explanation

Detection of user login patterns that are physically impossible based on geographic locations and time.

Examples

Logins from different continents within hours, rapid geographic movement, simultaneous distant logins

Enterprise Use Case

Use Case A cloud access security broker detects impossible travel when an executive account logs into the company SaaS applications from New York at 9 AM, then from Beijing at 9:15 AM the same day - physically impossible given the 13-hour flight time. The system automatically locks the account and alerts the security team. Investigation confirms the executive credentials were stolen through a spear-phishing campaign targeting executives. The company implements adaptive authentication that requires step-up verification for logins from unusual locations, uses machine learning to build baseline travel patterns for each user, blocks logins that violate physical travel constraints, and requires password resets when impossible travel is detected.

Diagram

✈️ IMPOSSIBLE TRAVEL
  User: alice@company.com
  📍 9:00 AM: London, UK
  📍 9:30 AM: Sydney, Australia
       ↓
  🧮 PHYSICS CHECK
  Distance: 17,000 km in 30 min
       ↓
  🚨 IMPOSSIBLE = COMPROMISE

Resource Consumption Anomalies

Explanation

Unusual patterns of system resource usage that may indicate malicious activity or compromise.

Examples

CPU spikes, memory exhaustion, network bandwidth abuse, disk space consumption, crypto mining

Enterprise Use Case

Use Case System monitoring alerts show that several servers in a corporate data center are experiencing sustained 95% CPU utilization with minimal legitimate workload. Analysis reveals cryptocurrency mining malware was installed through a compromised third-party software update. The malware consumes computing resources to mine cryptocurrency for attackers while degrading performance for legitimate applications. The company implements baseline resource monitoring with anomaly detection, deploys endpoint detection and response tools that identify crypto mining behaviors, uses application whitelisting to prevent unauthorized processes, investigates unusual resource consumption patterns promptly, and implements proper vendor security assessments before allowing software installations.

Diagram

📊 RESOURCE CONSUMPTION
  Normal: CPU 10% | Memory 40%
  Alert:  CPU 95% | Memory 90%
  ├── 🔥 CRYPTO MINING
  ├── 🦠 MALWARE ACTIVITY
  └── 🌊 DDOS TRAFFIC
       ↓
  🚨 PERFORMANCE IMPACT

Cloud Architecture

Explanation

Computing model where services and resources are delivered over the internet through third-party providers.

Examples

AWS, Azure, Google Cloud, IaaS, PaaS, SaaS, public/private/hybrid clouds

Enterprise Use Case

Use Case A growing startup migrates from on-premises servers to AWS cloud infrastructure to gain scalability and reduce capital expenses. They use EC2 instances (IaaS) for custom applications, RDS (PaaS) for managed databases, and Salesforce (SaaS) for CRM. However, they initially misconfigure S3 buckets leaving customer data publicly accessible, demonstrating cloud security risks. The company implements cloud security posture management tools, applies least privilege IAM policies, enables encryption at rest and in transit, implements network segmentation using VPCs and security groups, establishes configuration management to prevent misconfigurations, and trains developers on cloud security best practices following the AWS Well-Architected Framework.

Diagram

☁️ CLOUD ARCHITECTURE
  🏢 ON-PREMISES → ☁️ CLOUD PROVIDER
  ├── 💾 IaaS (Infrastructure)
  ├── 🔧 PaaS (Platform)
  └── 📱 SaaS (Software)
       ↓
  🌐 INTERNET ACCESS
       ↓
  📈 SCALABILITY & FLEXIBILITY

Hybrid Cloud Considerations

Explanation

Combining on-premises infrastructure with cloud services, requiring careful integration and security planning.

Examples

Data residency requirements, network connectivity, identity federation, cost optimization

Enterprise Use Case

Use Case A healthcare organization maintains patient records in on-premises data centers to meet data residency requirements while using Azure cloud services for analytics and disaster recovery. They implement a hybrid cloud architecture with Azure ExpressRoute for dedicated connectivity, Active Directory Federation for single sign-on across on-premises and cloud systems, and data replication policies ensuring patient data remains in compliant regions. The security team addresses challenges including consistent policy enforcement across environments, secure connectivity between on-premises and cloud, identity management across hybrid infrastructure, and compliance with regulations like HIPAA in both environments.

Diagram

🔗 HYBRID CLOUD
  🏢 ON-PREMISES ↔️ ☁️ PUBLIC CLOUD
  ├── 🔐 SECURE CONNECTION
  ├── 🆔 IDENTITY SYNC
  ├── 📊 DATA FLOW
  └── 🔄 WORKLOAD BALANCING
       ↓
  🎯 BEST OF BOTH WORLDS

Third-party Cloud Vendors

Explanation

External organizations providing cloud infrastructure, platforms, or software services with specific security implications.

Examples

AWS, Microsoft Azure, Google Cloud, Salesforce, vendor risk assessment, SLA management

Enterprise Use Case

Use Case An enterprise relies on multiple third-party cloud vendors including AWS for infrastructure, Microsoft 365 for productivity, and Salesforce for CRM. When a critical vulnerability is discovered in a cloud provider infrastructure, the company must trust the vendor to patch systems they do not control. The organization implements a comprehensive vendor risk management program that includes security assessments before vendor selection, regular SOC 2 audit reviews, SLA requirements for security incident notification within 24 hours, contractual right-to-audit clauses, data portability requirements to avoid vendor lock-in, and understanding the shared responsibility model defining which security controls are vendor-managed versus customer-managed.

Diagram

🤝 THIRD-PARTY VENDOR
  🏢 YOUR COMPANY
       ↓
  📋 CONTRACT/SLA
       ↓
  🏭 VENDOR SERVICES
  ├── 🔒 VENDOR SECURITY
  ├── 📊 VENDOR COMPLIANCE
  └── 🎯 VENDOR RISKS
       ↓
  ⚖️ SHARED RESPONSIBILITY

Infrastructure as Code (IaC)

Explanation

Managing and provisioning computing infrastructure through machine-readable definition files.

Examples

Terraform, CloudFormation, Ansible, Puppet, version-controlled infrastructure templates

Enterprise Use Case

Use Case A DevOps team uses Terraform to define entire cloud infrastructure as code stored in Git repositories. Instead of manually clicking through cloud consoles to create resources, they write declarative configuration files specifying desired infrastructure state. When deploying to production, Terraform automatically creates VPCs, security groups, load balancers, and EC2 instances according to the code. This approach enables version control of infrastructure changes, code reviews before deployment, consistent environments across development and production, and rapid disaster recovery by re-running infrastructure code. The team implements security scanning of IaC templates to detect misconfigurations before deployment, uses automated compliance checks, and maintains immutable infrastructure principles.

Diagram

📝 INFRASTRUCTURE AS CODE
  💻 DEVELOPER WRITES
  ├── 🏗️ infrastructure.tf
  ├── 🔧 config.yaml
  └── 📋 deploy.json
       ↓
  🤖 AUTOMATION TOOL
       ↓
  🏢 INFRASTRUCTURE DEPLOYED

Serverless Architecture

Explanation

Cloud computing model where the provider manages server infrastructure and automatically allocates resources.

Examples

AWS Lambda, Azure Functions, Google Cloud Functions, event-driven computing, pay-per-execution

Enterprise Use Case

Use Case An e-commerce company uses AWS Lambda serverless functions to process order confirmations, resize product images, and send notification emails. Instead of maintaining always-on servers, functions execute only when triggered by events like new orders, automatically scaling from zero to thousands of concurrent executions. The company pays only for actual execution time, eliminating costs for idle servers. However, they must address serverless-specific security concerns including function timeout limits that could be exploited for denial of wallet attacks, over-privileged IAM roles assigned to functions, secrets management in stateless environments, and cold start performance impacts. They implement least privilege permissions per function, use AWS Secrets Manager for credentials, and deploy comprehensive logging for serverless security monitoring.

Diagram

⚡ SERVERLESS
  📝 CODE FUNCTION
       ↓
  📤 UPLOAD TO CLOUD
       ↓
  🎯 EVENT TRIGGERS
       ↓
  🏃 FUNCTION EXECUTES
       ↓
  💰 PAY PER EXECUTION

Air-gapped Physical Isolation

Explanation

Complete physical separation of systems from networks, providing the highest level of security isolation.

Examples

Classified systems, industrial control systems, secure enclaves, offline backup systems

Enterprise Use Case

Use Case A government agency processing classified information maintains air-gapped networks with no connection to the internet or unclassified systems. All data transfer between classification levels requires physical media that undergoes rigorous scanning and approval. The agency discovers attackers attempted to bridge the air gap using modified USB devices infected with malware designed to exfiltrate data via ultrasonic acoustic signals or electromagnetic emanations. The organization responds by banning all removable media, implementing Faraday cages to block electromagnetic signals, using acoustic noise generators to prevent data exfiltration through sound, deploying strict physical access controls, and performing regular security audits to verify air gap integrity.

Diagram

🌬️ AIR-GAPPED SYSTEM
  🏝️ ISOLATED NETWORK
  ├── 🚫 NO INTERNET
  ├── 🚫 NO WIRELESS
  ├── 🚫 NO USB PORTS
  └── 🔐 PHYSICAL SECURITY
       ↓
  💯 MAXIMUM ISOLATION
       ↓
  🛡️ HIGHEST SECURITY

Logical Network Segmentation

Explanation

Software-based division of networks to isolate resources and control traffic flow without physical separation.

Examples

VLANs, subnets, virtual firewalls, software-defined perimeters, network zones

Enterprise Use Case

Use Case A hospital implements VLANs to logically segment its network into separate security zones: medical devices (VLAN 10), patient records systems (VLAN 20), guest WiFi (VLAN 30), and administrative systems (VLAN 40). Each VLAN has firewall rules controlling inter-VLAN traffic, preventing compromised guest devices from accessing medical systems. When ransomware infects a computer on the guest network, logical segmentation contains the infection to that VLAN, preventing lateral movement to critical medical systems. The hospital implements micro-segmentation for additional protection, zero-trust network policies requiring authentication for all inter-VLAN communication, and network access control based on device type and health status.

Diagram

🧠 LOGICAL SEGMENTATION
  🌐 PHYSICAL NETWORK
  ├── 🟦 VLAN 10 (Sales)
  ├── 🟨 VLAN 20 (Finance)
  ├── 🟩 VLAN 30 (IT)
  └── 🟥 VLAN 99 (DMZ)
       ↓
  🛡️ TRAFFIC CONTROL
       ↓
  🔒 ISOLATED DOMAINS

Software-Defined Networking (SDN)

Explanation

Network architecture approach that enables centralized control of network behavior through software applications.

Examples

OpenFlow, network virtualization, centralized controllers, programmable networks

Enterprise Use Case

Use Case A large enterprise deploys SDN to gain centralized control over their global network infrastructure. Using an SDN controller, network administrators programmatically configure security policies, traffic routing, and quality of service rules across thousands of network devices from a single interface. When a DDoS attack targets a specific application, the security team uses the SDN controller to instantly reroute traffic through scrubbing centers and implement rate limiting across all edge routers simultaneously. The organization benefits from automated network provisioning for new applications, dynamic traffic optimization based on real-time conditions, simplified security policy enforcement, and rapid incident response through programmable network controls, though they must secure the SDN controller as a single point of control.

Diagram

🎛️ SDN ARCHITECTURE
  👨‍💻 NETWORK APPS
       ↓
  🧠 SDN CONTROLLER
  ├── 📋 NETWORK POLICIES
  ├── 🗺️ TOPOLOGY VIEW
  └── 🎯 TRAFFIC RULES
       ↓
  🌐 NETWORK DEVICES
       ↓
  🔄 DYNAMIC CONFIGURATION

On-premises Architecture

Explanation

Computing infrastructure owned and operated within an organization's own facilities and under their direct control.

Examples

Private data centers, company-owned servers, internal networks, local storage systems

Enterprise Use Case

Use Case A financial institution chooses on-premises infrastructure for their core banking systems due to strict regulatory requirements, need for complete data control, and concerns about cloud provider outages affecting critical services. They maintain private data centers with redundant systems, dedicated security staff, and full control over hardware and software. However, this approach requires significant capital investment in servers and facilities, ongoing operational expenses for power and cooling, specialized staff for maintenance, and longer deployment times for new services. The organization balances on-premises systems for regulated data with hybrid cloud adoption for non-critical applications, maintaining infrastructure expertise while gaining cloud scalability for appropriate workloads.

Diagram

🏢 ON-PREMISES
  🏭 COMPANY DATA CENTER
  ├── 🔒 FULL CONTROL
  ├── 💰 CAPITAL INVESTMENT
  ├── 👨‍🔧 INTERNAL STAFF
  └── 📊 PREDICTABLE COSTS
       ↓
  🛡️ COMPLETE OWNERSHIP
       ↓
  ⚖️ FULL RESPONSIBILITY

Centralized vs Decentralized Architecture

Explanation

Architectural approaches differing in how control, decision-making, and resources are distributed.

Examples

Centralized: single data center, unified management. Decentralized: edge computing, distributed systems

Enterprise Use Case

Use Case A retail company operates with centralized data centers where all processing occurs in one location, enabling consistent security policies but creating a single point of failure. After an outage takes down all stores nationwide, they transition to decentralized edge computing at each store. Stores can now continue operations when central connectivity fails, but the company must implement consistent security controls across hundreds of distributed nodes. They balance approaches using hybrid architecture with centralized policy management and decentralized execution for resilience.

Diagram

🎯 CENTRALIZED        🕸️ DECENTRALIZED
  👑 SINGLE CONTROL     👥 MULTIPLE NODES
  ├── 🏢 ONE LOCATION   ├── 🌐 MANY LOCATIONS
  ├── 📊 UNIFIED MGMT   ├── 🔗 PEER-TO-PEER
  └── 🎮 SINGLE POINT   └── 🛡️ FAULT TOLERANT
       ↓                     ↓
  ⚡ FAST DECISIONS     🔄 RESILIENT SYSTEM

Containerization

Explanation

Lightweight virtualization method that packages applications with their dependencies into portable containers.

Examples

Docker containers, Kubernetes orchestration, microservices deployment, container registries

Enterprise Use Case

Use Case A development team uses Docker containers to package their microservices application with all dependencies, ensuring consistent execution across development, testing, and production environments. Each microservice runs in an isolated container orchestrated by Kubernetes, enabling rapid scaling and deployment. However, containers introduce security challenges including vulnerable base images, privilege escalation risks, and container escape attacks. The team implements container security scanning in CI/CD pipelines, uses minimal base images, runs containers as non-root users, implements pod security policies in Kubernetes, and monitors runtime container behavior for anomalies.

Diagram

📦 CONTAINERIZATION
  💻 APPLICATION + DEPENDENCIES
       ↓
  📦 CONTAINER IMAGE
  ├── 🔧 RUNTIME
  ├── 📚 LIBRARIES
  └── ⚙️ CONFIG FILES
       ↓
  🚀 DEPLOY ANYWHERE
       ↓
  ⚡ CONSISTENT EXECUTION

Virtualization

Explanation

Technology that creates virtual versions of computing resources like servers, storage, and networks.

Examples

VMware, Hyper-V, virtual machines, hypervisors, virtual networks, resource pooling

Enterprise Use Case

Use Case A data center consolidates 50 physical servers into 10 physical hosts running VMware, with each host supporting multiple virtual machines. This reduces hardware costs, power consumption, and physical space requirements while improving resource utilization. However, virtualization introduces security concerns including VM escape attacks where compromised VMs break out to attack the hypervisor, and VM sprawl creating unmanaged security vulnerabilities. The company implements hypervisor hardening, VM isolation policies, regular patching of host systems, virtual machine encryption, and comprehensive VM inventory management to maintain security in the virtualized environment.

Diagram

🎭 VIRTUALIZATION
  🖥️ PHYSICAL SERVER
       ↓
  🔧 HYPERVISOR
  ├── 💻 VM 1 (Windows)
  ├── 🐧 VM 2 (Linux)
  ├── 🍎 VM 3 (macOS)
  └── 📊 RESOURCE SHARING
       ↓
  📈 MAXIMUM EFFICIENCY

Internet of Things (IoT)

Explanation

Network of interconnected physical devices embedded with sensors and software to collect and exchange data.

Examples

Smart home devices, industrial sensors, wearables, connected vehicles, smart city infrastructure

Enterprise Use Case

Use Case A manufacturing facility deploys IoT sensors throughout the production line to monitor equipment performance, temperature, and predictive maintenance needs. The sensors transmit data to cloud analytics platforms for real-time insights. However, many IoT devices have weak security including default credentials, lack of encryption, and inability to receive firmware updates. Attackers compromise IoT sensors to create botnets or pivot into the corporate network. The facility implements IoT network segmentation isolating sensors from critical systems, changes all default passwords, deploys IoT-specific firewalls, monitors for anomalous IoT behavior, and establishes vendor requirements for secure IoT device procurement.

Diagram

🌐 IOT ECOSYSTEM
  🏠 SMART HOME
  ├── 🌡️ TEMPERATURE SENSORS
  ├── 📱 SMART PHONES
  ├── 🚗 CONNECTED CARS
  └── ⌚ WEARABLES
       ↓
  ☁️ CLOUD PROCESSING
       ↓
  📊 DATA INSIGHTS

Industrial Control Systems (ICS/SCADA)

Explanation

Computer systems used to monitor and control industrial processes and critical infrastructure.

Examples

Power grid control, water treatment systems, manufacturing automation, oil refineries

Enterprise Use Case

Use Case A power utility operates SCADA systems controlling electrical grid distribution across multiple states. These industrial control systems were originally designed for isolated environments without internet connectivity or security controls. When the utility connects SCADA to corporate networks for remote monitoring, they create attack vectors exploited by nation-state actors attempting to disrupt critical infrastructure. The utility implements air-gapped SCADA networks, deploys industrial firewalls, uses unidirectional gateways for data extraction, conducts regular ICS security assessments, trains operators on cybersecurity awareness, and coordinates with federal agencies on critical infrastructure protection following NERC CIP compliance requirements.

Diagram

🏭 ICS/SCADA SYSTEM
  🎛️ CONTROL CENTER
       ↓
  📡 COMMUNICATION NETWORK
       ↓
  🏗️ INDUSTRIAL PROCESSES
  ├── ⚡ POWER GENERATION
  ├── 💧 WATER TREATMENT
  └── 🛢️ OIL REFINING
       ↓
  🔍 REAL-TIME MONITORING

Embedded Systems

Explanation

Specialized computer systems designed to perform dedicated functions within larger mechanical or electrical systems.

Examples

Medical devices, automotive systems, home appliances, industrial controllers, smart cards

Enterprise Use Case

Use Case A hospital uses medical devices with embedded systems including insulin pumps, pacemakers, and MRI machines that contain specialized computers running dedicated firmware. These embedded systems often cannot be patched or updated due to FDA approval requirements and vendor restrictions, leaving known vulnerabilities unaddressed. Attackers could potentially compromise medical devices to alter treatment parameters or steal patient data. The hospital implements network segmentation isolating medical devices, deploys medical device-specific security monitoring, restricts physical access to device configuration ports, works with vendors on secure procurement requirements, and uses compensating controls like intrusion detection when devices cannot be patched.

Diagram

⚙️ EMBEDDED SYSTEM
  📱 DEVICE (e.g., Smart TV)
  ├── 🧠 MICROPROCESSOR
  ├── 💾 MEMORY
  ├── 🔌 I/O INTERFACES
  └── 💻 FIRMWARE
       ↓
  🎯 SPECIFIC FUNCTION
       ↓
  ⚡ OPTIMIZED PERFORMANCE

Security Zones

Explanation

Logical or physical network segments with defined security requirements and access controls.

Examples

DMZ, internal network, guest network, management network, production vs development zones

Enterprise Use Case

Use Case A financial institution segments its network into multiple security zones: an internet-facing DMZ for web servers, a protected internal zone for employee workstations, a highly restricted database zone for customer financial data, and an isolated management zone for administrative access. Each zone has specific firewall rules, access controls, and monitoring requirements based on the sensitivity of assets and regulatory compliance needs. Traffic between zones is strictly controlled through firewalls and requires explicit authorization, implementing defense-in-depth and limiting lateral movement if one zone is compromised.

Diagram

🏰 SECURITY ZONES
  🌐 INTERNET
       ↓
  🔥 DMZ (Web Servers)
       ↓
  🛡️ FIREWALL
       ↓
  🏢 INTERNAL NETWORK
  ├── 💼 CORPORATE LAN
  ├── 🔧 MANAGEMENT ZONE
  └── 📊 DATABASE ZONE

Fail-open vs Fail-closed

Explanation

Security design philosophy determining system behavior when security controls encounter failures.

Examples

Fail-open: door unlocks on power loss. Fail-closed: door stays locked on power loss

Enterprise Use Case

Use Case A healthcare organization must decide fail-safe modes for different systems: electronic door locks are configured to fail-open during emergencies to allow patient evacuation, while the pharmacy vault is fail-closed to prevent unauthorized medication access during power outages. Their network firewall is fail-closed to block all traffic if the filtering engine crashes, prioritizing security over availability. However, their VPN concentrator is fail-open to maintain critical remote access for on-call physicians, accepting the security risk to preserve life-safety operations.

Diagram

🚪 FAIL-CLOSED          🔓 FAIL-OPEN
  ⚡ POWER FAILURE        ⚡ POWER FAILURE
       ↓                       ↓
  🔒 SYSTEM LOCKS         🚪 SYSTEM OPENS
  🛡️ SECURE (DENY)       ⚠️ ACCESSIBLE (ALLOW)
  📉 LOW AVAILABILITY     📈 HIGH AVAILABILITY
  🔐 HIGH SECURITY        ⚠️ SECURITY RISK

Active vs Passive Monitoring

Explanation

Different approaches to network monitoring based on how systems interact with network traffic.

Examples

Active: network probes, synthetic transactions. Passive: traffic analysis, packet capture

Enterprise Use Case

Use Case An e-commerce company uses active monitoring to send synthetic transactions every minute through their checkout process, testing API endpoints, database connectivity, and payment gateway availability to detect failures before customers experience them. They complement this with passive monitoring using NetFlow analysis and full packet capture on critical network segments to detect anomalous traffic patterns, data exfiltration attempts, and performance degradation without adding load to production systems. Active monitoring provides immediate service verification while passive monitoring reveals actual user behavior and security threats in real-world traffic.

Diagram

🎯 ACTIVE MONITORING     👁️ PASSIVE MONITORING
  🔍 SENDS TEST PACKETS    📡 CAPTURES TRAFFIC
       ↓                        ↓
  ⚡ GENERATES TRAFFIC     🕵️ ANALYZES PATTERNS
  🎯 PROACTIVE TESTING     📊 REACTIVE ANALYSIS
  ⚠️ NETWORK IMPACT       ✅ NO NETWORK IMPACT

Inline vs Tap/Monitor Deployment

Explanation

Different methods of deploying security devices in network infrastructure.

Examples

Inline: firewall blocking traffic. Tap: IDS monitoring copies of traffic

Enterprise Use Case

Use Case A telecommunications provider deploys next-generation firewalls inline between network segments to actively block malicious traffic and enforce security policies with the ability to drop packets in real-time. They also deploy network TAPs on high-speed backbone links to send traffic copies to IDS sensors and security analytics platforms without impacting production traffic or creating single points of failure. The inline deployment provides active protection but introduces latency and potential bottlenecks, while TAP deployment enables deep packet inspection and forensics without affecting network performance or availability.

Diagram

🛑 INLINE DEPLOYMENT     🕊️ TAP DEPLOYMENT
  📤 TRAFFIC → 🛡️ DEVICE   📤 TRAFFIC → 🌐 DESTINATION
       ↓                        ↗️
  ✅ SECURITY CHECK        📋 COPY TO TAP
       ↓                        ↓
  📥 ALLOWED TRAFFIC       🔍 SECURITY ANALYSIS
  🛡️ ACTIVE PROTECTION    📊 PASSIVE MONITORING

Jump Server

Explanation

Intermediary server that provides secure access to devices in different security zones.

Examples

Bastion host, secure gateway, privileged access workstation, administrative jump box

Enterprise Use Case

Use Case A cloud-based SaaS company deploys hardened jump servers as the only entry point for administrators to access production databases and application servers. System administrators must first authenticate with multi-factor authentication to the jump server, which logs all commands and session activity for audit purposes. The jump server is the only system with firewall rules allowing SSH or RDP to production systems, eliminating direct internet exposure of critical infrastructure. This architecture provides a centralized access control point, session recording for compliance, and reduces the attack surface by funneling all administrative access through monitored chokepoints.

Diagram

🦘 JUMP SERVER
  👨‍💻 ADMIN → 🏰 JUMP SERVER
                  ↓
             🔐 AUTHENTICATION
                  ↓
             🌐 SECURE TUNNEL
                  ↓
             🎯 TARGET SYSTEMS
  ├── 💻 Server 1
  ├── 💻 Server 2
  └── 💻 Server 3

Proxy Server

Explanation

Intermediary server that forwards requests between clients and other servers, providing security and caching.

Examples

Web proxy, reverse proxy, SOCKS proxy, content filtering proxy, load balancing proxy

Enterprise Use Case

Use Case A corporate enterprise requires all employee web traffic to pass through a web proxy server that performs SSL inspection, content filtering, and malware scanning before allowing access to external websites. The proxy blocks access to malicious domains based on threat intelligence feeds, prevents data exfiltration by inspecting outbound traffic, and caches frequently accessed content to improve performance. Additionally, a reverse proxy sits in front of their public web applications to hide internal server addresses, perform SSL termination, and distribute traffic across backend servers while providing DDoS protection and web application firewall capabilities.

Diagram

🎭 PROXY SERVER
  💻 CLIENT → 🎭 PROXY → 🌐 WEB SERVER
  ├── 🔍 CONTENT FILTERING
  ├── 💾 CACHING
  ├── 🚫 ACCESS CONTROL
  └── 📊 LOGGING
       ↓
  🛡️ SECURITY & PERFORMANCE

IPS/IDS Systems

Explanation

Intrusion Prevention/Detection Systems that monitor and respond to suspicious network activity.

Examples

Network IDS/IPS, host-based IDS/IPS, signature detection, anomaly detection

Enterprise Use Case

Use Case A financial services firm deploys network-based IPS devices inline at network perimeter and between security zones to automatically block exploit attempts, malware communications, and policy violations in real-time. They complement this with network IDS sensors deployed via TAPs to monitor encrypted traffic metadata and detect sophisticated threats without impacting network performance. Host-based IPS agents on servers provide application-layer protection and detect privilege escalation attempts. The security team tunes IPS signatures to prevent false positives in blocking mode while IDS sensors use machine learning anomaly detection to identify zero-day threats and generate alerts for investigation.

Diagram

🚨 IDS (DETECTION)       🛡️ IPS (PREVENTION)
  👁️ MONITORS TRAFFIC     🛑 BLOCKS ATTACKS
       ↓                        ↓
  📝 LOGS ALERTS          ⚡ IMMEDIATE ACTION
  👨‍💻 ADMIN RESPONSE       🤖 AUTOMATED RESPONSE
  📊 FORENSIC ANALYSIS     🔒 REAL-TIME PROTECTION

Physical Sensors

Explanation

Devices that detect and respond to physical changes in the environment for security monitoring.

Examples

Motion detectors, door sensors, glass break detectors, vibration sensors, temperature sensors

Enterprise Use Case

Use Case A data center deploys multiple physical sensors integrated with their security operations center: motion detectors monitor server room aisles during off-hours, magnetic door contacts alert when server rack doors open, temperature and humidity sensors detect environmental anomalies that could damage equipment, and vibration sensors on raised floors detect unauthorized access attempts through false flooring. When sensors trigger, the system sends immediate alerts to security personnel, activates video surveillance recording, and logs events for compliance auditing, creating a comprehensive physical security monitoring system that complements access control and video surveillance.

Diagram

👁️ PHYSICAL SENSORS
  🏢 SECURED FACILITY
  ├── 🚶 MOTION DETECTION
  ├── 🚪 DOOR MONITORING
  ├── 🔊 SOUND ANALYSIS
  └── 🌡️ ENVIRONMENTAL
       ↓
  🚨 ALERT GENERATION
       ↓
  👮 SECURITY RESPONSE

Updating Diagrams

Explanation

Maintaining current and accurate visual representations of systems, networks, and processes after changes.

Examples

Network topology diagrams, system architecture diagrams, data flow diagrams, security zone maps

Enterprise Use Case

Use Case After a network infrastructure upgrade that added new VLANs, firewall rules, and cloud connectivity, the IT team must update all network diagrams to reflect the changes. Outdated diagrams led to a security misconfiguration during the last incident response when responders blocked the wrong network segment. The organization now enforces a change management policy requiring diagram updates as part of every change request approval process. Updated diagrams are stored in version control, referenced during troubleshooting, used for security assessments, and critical for compliance audits and disaster recovery planning.

Diagram

📊 DIAGRAM UPDATE PROCESS
  🔧 SYSTEM CHANGE
       ↓
  📝 CHANGE REQUEST
       ↓
  🎨 UPDATE DIAGRAM
  ├── 📐 NETWORK TOPOLOGY
  ├── 🏗️ SYSTEM ARCHITECTURE
  └── 🔄 DATA FLOWS
       ↓
  ✅ DOCUMENTATION CURRENT

Updating Policies and Procedures

Explanation

Revising organizational policies and procedures to reflect system changes and maintain compliance.

Examples

Security policies, operational procedures, compliance documentation, user guides

Enterprise Use Case

Use Case When a healthcare organization migrated to cloud-based electronic health records, they had to update their security policies to address cloud-specific risks, data residency requirements, and shared responsibility models. The acceptable use policy was revised to include remote access protocols, the incident response procedure was updated with cloud vendor escalation contacts, and backup procedures were rewritten for cloud-native tools. Failure to update policies could result in HIPAA violations, audit failures, and employees following outdated procedures that don't align with current infrastructure, creating security gaps and compliance risks.

Diagram

📋 POLICY UPDATE
  🔄 SYSTEM CHANGE
       ↓
  📖 REVIEW POLICIES
  ├── 🛡️ SECURITY POLICIES
  ├── ⚙️ OPERATIONAL PROCEDURES
  └── 📜 COMPLIANCE DOCS
       ↓
  ✏️ REVISE & APPROVE
       ↓
  📤 DISTRIBUTE UPDATES

Version Control

Explanation

System for tracking and managing changes to code, documents, and configurations over time.

Examples

Git repositories, document versioning, configuration management, change tracking

Enterprise Use Case

Use Case A software development company uses Git for source code version control, allowing developers to track every code change, identify who made modifications, and roll back to previous versions if bugs are introduced. Their security team also uses version control for firewall configurations, IDS rules, and security policies, ensuring all changes are peer-reviewed, tested in non-production environments, and can be quickly reverted if issues arise. When a firewall misconfiguration caused an outage, version control enabled them to identify the exact change that caused the problem and roll back to the last known good configuration within minutes.

Diagram

🔢 VERSION CONTROL
  📝 DOCUMENT v1.0
       ↓
  ✏️ CHANGES MADE
       ↓
  📝 DOCUMENT v1.1
  ├── 📅 TIMESTAMP
  ├── 👤 AUTHOR INFO
  ├── 📝 CHANGE LOG
  └── 🔄 ROLLBACK OPTION
       ↓
  📚 VERSION HISTORY

Certificate Authorities (CAs)

Explanation

Trusted entities that issue, manage, and validate digital certificates in public key infrastructure.

Examples

VeriSign, DigiCert, Let's Encrypt, internal enterprise CAs, government CAs

Enterprise Use Case

Use Case A multinational corporation operates an internal Certificate Authority to issue digital certificates for employee authentication, email signing, VPN access, and internal web applications. The enterprise CA is trusted by all company devices through group policy, enabling seamless SSL/TLS for internal services without purchasing public certificates. For external-facing websites, they use commercial CAs like DigiCert that are trusted by all web browsers and provide extended validation certificates displaying the organization name in the browser. The organization maintains strict CA security controls including offline root CA storage, HSM protection of signing keys, and comprehensive audit logging of all certificate issuance.

Diagram

🏛️ CERTIFICATE AUTHORITY
  📝 CERTIFICATE REQUEST
       ↓
  🔍 IDENTITY VERIFICATION
       ↓
  🔐 CERTIFICATE ISSUANCE
  ├── 📜 DIGITAL CERTIFICATE
  ├── 🔑 PUBLIC KEY
  ├── 📅 EXPIRATION DATE
  └── ✍️ CA SIGNATURE
       ↓
  🌐 TRUSTED COMMUNICATION

Certificate Revocation Lists (CRLs)

Explanation

Lists of digital certificates that have been revoked before their expiration date.

Examples

Compromised certificates, employee terminations, certificate misuse, key compromise

Enterprise Use Case

Use Case When an employee with administrative access leaves a financial institution, their digital certificate for VPN access and email signing must be immediately revoked to prevent unauthorized access. The organization's Certificate Authority adds the certificate serial number to the CRL with a revocation reason of "cessation of operation." All systems configured to check CRL will refuse connections using that certificate. However, CRLs can grow large and introduce latency, so the organization also implements OCSP for real-time certificate validation and uses short-lived certificates where possible to minimize revocation checking overhead.

Diagram

📋 CERTIFICATE REVOCATION LIST
  🔐 VALID CERTIFICATE
       ↓
  ⚠️ COMPROMISE DETECTED
       ↓
  🚫 ADD TO CRL
  ├── 📜 CERTIFICATE SERIAL
  ├── 📅 REVOCATION DATE
  └── 🎯 REVOCATION REASON
       ↓
  🌐 CRL DISTRIBUTION
       ↓
  🛑 CERTIFICATE BLOCKED

Online Certificate Status Protocol (OCSP)

Explanation

Real-time protocol for checking the revocation status of digital certificates.

Examples

OCSP responders, certificate validation, real-time status checks, OCSP stapling

Enterprise Use Case

Use Case An e-commerce platform implements OCSP to verify the revocation status of customer SSL certificates in real-time during mutual TLS authentication. Unlike downloading entire CRLs that can be megabytes in size, OCSP queries return a simple "good, revoked, or unknown" response for individual certificates, reducing latency and bandwidth. The platform also implements OCSP stapling where their web server queries the OCSP responder and includes the signed response in the TLS handshake, improving performance and privacy by eliminating the need for clients to contact the CA's OCSP responder directly.

Diagram

🌐 OCSP PROTOCOL
  💻 CLIENT REQUEST
  "Is cert ABC123 valid?"
       ↓
  🏛️ OCSP RESPONDER
  ├── 🔍 CHECK CERTIFICATE
  ├── 📋 VERIFY STATUS
  └── 📅 CHECK EXPIRATION
       ↓
  ✅ RESPONSE: GOOD/REVOKED/UNKNOWN
       ↓
  🔐 SECURE CONNECTION

Self-signed Certificates

Explanation

Digital certificates signed by their own creators rather than trusted certificate authorities.

Examples

Internal development certificates, test environments, small organization certificates

Enterprise Use Case

Use Case A software development team uses self-signed certificates in their local development environment and CI/CD pipeline to enable HTTPS testing without the cost and administrative overhead of purchasing certificates from a commercial CA. While browsers display security warnings for self-signed certificates, the team adds them to their trusted root certificate stores on development machines. However, self-signed certificates are never used in production because they provide no identity assurance, generate browser warnings that train users to ignore security alerts, and cannot be validated through certificate revocation mechanisms, making them unsuitable for public-facing applications.

Diagram

✍️ SELF-SIGNED CERTIFICATE
  👤 CERTIFICATE CREATOR
       ↓
  📝 CREATE CERTIFICATE
  ├── 🔑 GENERATE KEY PAIR
  ├── 📜 CREATE CERTIFICATE
  └── ✍️ SIGN WITH OWN KEY
       ↓
  ⚠️ BROWSER WARNING
  "Untrusted Certificate"
       ↓
  🤔 USER DECISION

Third-party Certificates

Explanation

Digital certificates issued by external, trusted certificate authorities rather than internal systems.

Examples

Commercial SSL certificates, public CAs like DigiCert, cross-signed certificates

Enterprise Use Case

Use Case An e-commerce company purchases Extended Validation (EV) SSL certificates from DigiCert for their public-facing website to provide the highest level of trust to customers. The EV certificate displays the company name in the browser address bar and is trusted by all major browsers without security warnings. The third-party CA performs rigorous identity verification including business registration validation, domain ownership confirmation, and operational existence checks before issuing the certificate. This provides customers with cryptographic assurance they are connecting to the legitimate business and not a phishing site, critical for protecting payment transactions and customer data.

Diagram

🤝 THIRD-PARTY CERTIFICATE
  🏢 YOUR ORGANIZATION
       ↓
  📝 CERTIFICATE REQUEST
       ↓
  🏛️ EXTERNAL CA (DigiCert)
  ├── 🔍 IDENTITY VERIFICATION
  ├── 💰 PAYMENT PROCESSING
  └── ✅ VALIDATION COMPLETE
       ↓
  📜 TRUSTED CERTIFICATE
       ↓
  🌐 BROWSER ACCEPTANCE

Root of Trust

Explanation

Foundational security component that forms the basis for all other security functions in a system.

Examples

Hardware security modules, trusted platform modules, secure boot, hardware root of trust

Enterprise Use Case

Use Case A laptop manufacturer implements a hardware-based root of trust using a Trusted Platform Module (TPM) chip that stores cryptographic keys and performs boot integrity measurements. During system startup, the TPM measures the firmware, bootloader, and operating system to ensure no tampering has occurred before allowing the system to fully boot. This hardware root of trust is immutable and cannot be modified by malware, providing a secure foundation for BitLocker disk encryption, secure boot, and attestation services. If boot components are modified by rootkit malware, the TPM will detect the integrity violation and can refuse to release encryption keys or alert management systems.

Diagram

🌳 ROOT OF TRUST
  🔐 HARDWARE SECURITY
       ↓
  🛡️ TRUSTED FOUNDATION
  ├── 🔑 CRYPTOGRAPHIC KEYS
  ├── 🔒 SECURE STORAGE
  └── 🎯 IDENTITY ANCHOR
       ↓
  🏗️ SECURITY ARCHITECTURE
       ↓
  🌐 TRUSTED SYSTEM

Certificate Signing Request (CSR) Generation

Explanation

Process of creating a request for a digital certificate that includes public key and identifying information.

Examples

OpenSSL CSR creation, web server certificate requests, code signing CSRs

Enterprise Use Case

Use Case A web administrator needs to obtain an SSL certificate for a new e-commerce website. They use OpenSSL to generate a private key and CSR containing the organization's name, domain name, location, and public key. The CSR is submitted to DigiCert along with identity verification documents. The CA validates the information, signs the certificate with their trusted root key, and returns the signed certificate. The administrator installs the certificate on the web server, keeping the private key secure and never sharing it. The CSR process ensures the certificate binds the organization's verified identity to their public key, enabling trusted encrypted communications with customers.

Diagram

📝 CSR GENERATION
  🔑 GENERATE KEY PAIR
       ↓
  📋 CREATE CSR
  ├── 🏢 ORGANIZATION INFO
  ├── 🌐 DOMAIN NAME
  ├── 🔑 PUBLIC KEY
  └── 📧 CONTACT INFO
       ↓
  📤 SUBMIT TO CA
       ↓
  📜 RECEIVE CERTIFICATE

Wildcard Certificates

Explanation

SSL certificates that secure a domain and all its subdomains using a wildcard character (*).

Examples

*.example.com covers www.example.com, mail.example.com, ftp.example.com

Enterprise Use Case

Use Case A SaaS company with customer-specific subdomains (customer1.saas.com, customer2.saas.com, etc.) purchases a wildcard certificate for *.saas.com to secure all current and future customer portals with a single certificate. This is more cost-effective and operationally simpler than purchasing individual certificates for hundreds of subdomains. However, the security team acknowledges that wildcard certificates increase risk because if the private key is compromised, an attacker can impersonate any subdomain. They mitigate this by storing the private key in a hardware security module, implementing strict access controls, and using certificate pinning for their mobile applications.

Diagram

🌟 WILDCARD CERTIFICATE
  📜 *.example.com
       ↓
  🌐 COVERS ALL SUBDOMAINS
  ├── ✅ www.example.com
  ├── ✅ mail.example.com
  ├── ✅ shop.example.com
  └── ✅ api.example.com
       ↓
  💰 COST EFFECTIVE
       ↓
  🛡️ COMPREHENSIVE PROTECTION

Client-based vs Agentless

Explanation

Two approaches for deploying security solutions: installing software agents or using remote scanning methods.

Examples

Client-based: EDR agents, antivirus software. Agentless: network scanning, cloud-based assessment

Enterprise Use Case

Use Case A healthcare organization deploys client-based endpoint detection and response (EDR) agents on all workstations and servers to provide real-time threat protection, behavioral analysis, and forensic capabilities with deep visibility into process execution and memory. For their IoT medical devices that cannot support agent installation due to vendor restrictions or limited resources, they use agentless network traffic analysis and vulnerability scanning. Client-based agents provide comprehensive protection but require installation, updates, and consume system resources, while agentless monitoring has limited visibility but works with devices that cannot be modified, providing a complementary layered security approach.

Diagram

👨‍💻 CLIENT-BASED        🌐 AGENTLESS
  📥 INSTALL AGENT        📡 REMOTE SCANNING
  ├── 💾 LOCAL STORAGE    ├── ☁️ CLOUD-BASED
  ├── 🔄 REAL-TIME        ├── 📊 SCHEDULED SCANS
  └── 🎯 DEEP INSIGHT     └── 🌍 BROAD COVERAGE
       ↓                       ↓
  🛡️ COMPREHENSIVE        ⚡ EASY DEPLOYMENT

Wireless Network Threats

Explanation

Security vulnerabilities specific to wireless communication networks and protocols.

Examples

WiFi eavesdropping, rogue access points, evil twin attacks, WEP/WPA vulnerabilities

Enterprise Use Case

Use Case A corporate office discovers employees connecting to an "Office WiFi" network that appears legitimate but is actually an evil twin access point set up by an attacker in the parking lot. The rogue AP captures employee credentials and intercepts unencrypted traffic. The security team implements WPA3-Enterprise with certificate-based authentication, deploys wireless intrusion detection systems to identify unauthorized access points, and educates users about verifying network authenticity. They also implement wireless network segmentation isolating guest WiFi from corporate resources and requiring VPN for all wireless connections to protect against eavesdropping even on trusted networks.

Diagram

📶 WIRELESS THREATS
  📡 WIRELESS SIGNALS
  ├── 👂 EAVESDROPPING
  ├── 🎭 ROGUE AP
  ├── 👥 EVIL TWIN
  └── 🔓 WEAK ENCRYPTION
       ↓
  🕵️ ATTACKER INTERCEPTS
       ↓
  💀 DATA COMPROMISE

Wired Network Threats

Explanation

Security risks associated with physical network connections and infrastructure.

Examples

Network tapping, physical access to switches, cable interception, unauthorized connections

Enterprise Use Case

Use Case A financial institution secures their wired network infrastructure by implementing 802.1X port-based authentication requiring devices to authenticate before gaining network access, preventing unauthorized devices from connecting to available Ethernet jacks in conference rooms and public areas. They also deploy network access control (NAC) to ensure only compliant, managed devices can access sensitive network segments. Physical security measures include locked server rooms, cable management in secure pathways, and tamper-evident seals on network equipment to detect unauthorized physical access. Despite wired networks being more secure than wireless, physical access to network ports or cables still presents risks requiring layered security controls.

Diagram

🔌 WIRED NETWORK THREATS
  🌐 NETWORK CABLE
  ├── 🔍 PHYSICAL TAPPING
  ├── 🔌 UNAUTHORIZED ACCESS
  ├── 📡 SIGNAL INTERCEPTION
  └── 🏢 SWITCH COMPROMISE
       ↓
  👁️ DATA MONITORING
       ↓
  📊 TRAFFIC ANALYSIS

Bluetooth Threats

Explanation

Security vulnerabilities in Bluetooth wireless communication protocol.

Examples

Bluejacking, bluesnarfing, bluetooth sniffing, unauthorized pairing, proximity attacks

Enterprise Use Case

Use Case A corporate executive's smartphone is targeted by bluejacking attacks in an airport, receiving unsolicited messages and contact cards from attackers attempting to trick the user into accepting a pairing request. If successful, the attacker could perform bluesnarfing to steal contact lists, calendar entries, and emails from the device. The organization's mobile device management policy now requires Bluetooth to be disabled when not actively in use, set to non-discoverable mode, and reject all unauthorized pairing requests. Security awareness training educates employees about Bluetooth risks, and corporate-issued devices are configured to only allow pairing with approved peripherals.

Diagram

🔵 BLUETOOTH THREATS
  📱 BLUETOOTH DEVICE
  ├── 🎯 BLUEJACKING (spam)
  ├── 📂 BLUESNARFING (data theft)
  ├── 🔗 UNAUTHORIZED PAIRING
  └── 📡 PROXIMITY ATTACKS
       ↓
  👤 VICTIM IN RANGE
       ↓
  💀 DEVICE COMPROMISE

Managed Service Providers, Vendors, and Suppliers

Explanation

Third-party organizations in the supply chain that can introduce security risks through their services or products.

Examples

Cloud service providers, software vendors, hardware suppliers, IT outsourcing companies

Enterprise Use Case

Use Case A retail company contracts a managed service provider to handle their IT infrastructure, granting the MSP remote access to internal networks, servers, and customer data. When the MSP's credentials are compromised in a separate breach, attackers use the trusted access to infiltrate the retailer's network and exfiltrate customer payment card data. The organization now implements strict third-party risk management requiring MSPs to undergo security assessments, maintain cyber insurance, use dedicated access credentials with MFA, and limit access only to necessary systems. They also deploy continuous monitoring of MSP activities and require contractual security obligations including incident notification requirements.

Diagram

🤝 SUPPLY CHAIN PARTNERS
  🏢 YOUR ORGANIZATION
       ↓
  🌐 MSPs (IT Services)
  🏭 VENDORS (Software)
  📦 SUPPLIERS (Hardware)
       ↓
  ⚠️ THIRD-PARTY RISKS
  ├── 🔓 WEAK SECURITY
  ├── 🕵️ DATA ACCESS
  └── 🦠 COMPROMISED SUPPLY
       ↓
  🎯 SUPPLY CHAIN ATTACK

Resource Inaccessibility

Explanation

Security indicator when legitimate users cannot access systems or resources they should have access to.

Examples

Website downtime, service outages, denied access to files, application unavailability

Enterprise Use Case

Use Case A company's employees suddenly cannot access the shared file server during business hours, reporting "access denied" errors. The security team investigates and discovers ransomware has encrypted the file server and modified permissions, causing resource inaccessibility for legitimate users. The security operations center now monitors for unexpected access failures as a potential indicator of attack, distinguishing between normal outages (scheduled maintenance, network issues) and security incidents (ransomware, DDoS attacks, sabotage). Automated alerts trigger when multiple users report access problems simultaneously, enabling faster incident detection and response before widespread damage occurs.

Diagram

🚫 RESOURCE INACCESSIBILITY
  👤 LEGITIMATE USER
       ↓
  🔒 ACCESS ATTEMPT
       ↓
  ❌ ACCESS DENIED
  ├── 🌐 SERVICE DOWN
  ├── 🦠 MALWARE IMPACT
  ├── 🌊 DDOS ATTACK
  └── 🔧 SYSTEM FAILURE
       ↓
  😤 BUSINESS DISRUPTION

Out-of-cycle Logging

Explanation

Unexpected or unusual log entries that occur outside normal operational patterns.

Examples

After-hours access attempts, weekend system changes, holiday activities, unusual timestamps

Enterprise Use Case

Use Case A security analyst reviewing SIEM logs notices database access from a financial analyst's account at 3:00 AM on Sunday, well outside their normal 9-5 weekday schedule. This out-of-cycle logging triggers an automated alert for investigation. The analyst discovers the account was compromised and the attacker was exfiltrating customer financial data during off-hours to avoid detection. The organization now implements behavioral analytics to establish baseline activity patterns for each user and system, automatically flagging out-of-cycle access, weekend administrative changes, and holiday logins as high-priority alerts requiring immediate investigation before attackers can complete their objectives.

Diagram

⏰ OUT-OF-CYCLE LOGGING
  📅 NORMAL BUSINESS HOURS
  9 AM - 5 PM
       ↓
  🚨 UNUSUAL LOG ENTRY
  "Login at 2:30 AM"
       ↓
  🔍 SECURITY INVESTIGATION
  ├── 🕵️ WHO WAS IT?
  ├── 🎯 WHY THEN?
  └── ⚠️ LEGITIMATE?
       ↓
  🚨 POTENTIAL THREAT

Published/Documented Vulnerabilities

Explanation

Publicly disclosed security flaws that are documented in vulnerability databases.

Examples

CVE entries, security advisories, vendor bulletins, public exploit databases

Enterprise Use Case

Use Case When CVE-2021-44228 (Log4Shell) was published describing a critical remote code execution vulnerability in the widely-used Log4j logging library, organizations had mere hours to identify affected systems before mass exploitation began. A technology company's vulnerability management team immediately queried their asset inventory for all systems using Log4j, prioritized internet-facing applications, and deployed emergency patches within 24 hours. Published vulnerabilities create a race condition where defenders must patch faster than attackers can exploit. The organization now maintains a vulnerability management program that continuously monitors CVE databases, security advisories, and threat intelligence feeds to ensure rapid response to newly published vulnerabilities.

Diagram

📖 PUBLISHED VULNERABILITY
  🔍 SECURITY RESEARCHER
       ↓
  📋 CVE-2024-XXXX
  ├── 🎯 AFFECTED SYSTEMS
  ├── 📊 CVSS SCORE: 9.8
  ├── 🛠️ EXPLOIT AVAILABLE
  └── 🩹 PATCH RELEASED
       ↓
  🌐 PUBLIC KNOWLEDGE
       ↓
  ⚡ RACE TO PATCH

Missing Logs

Explanation

Absence of expected log entries that should normally be generated by systems, indicating potential tampering or evasion.

Examples

Deleted audit trails, log rotation issues, disabled logging, anti-forensics techniques

Enterprise Use Case

Use Case During a security investigation, forensic analysts notice a suspicious 2-hour gap in server access logs coinciding with when a data breach occurred. The missing logs indicate an attacker with administrative privileges deleted audit trails to cover their tracks using anti-forensics techniques. The organization now implements write-once audit logging to immutable storage, forwards logs to a centralized SIEM in real-time before they can be deleted locally, and monitors for gaps in log sequences or disabled logging services as indicators of compromise. File integrity monitoring alerts on any changes to log files or logging configurations, ensuring attackers cannot hide their activities by deleting evidence.

Diagram

🕳️ MISSING LOGS
  📊 EXPECTED LOG PATTERN
  ├── ✅ 09:00 - Login
  ├── ❌ 09:30 - MISSING
  ├── ❌ 10:00 - MISSING
  └── ✅ 10:30 - Activity
       ↓
  🚨 SUSPICIOUS GAP
  ├── 🦠 MALWARE CLEANUP
  ├── 👤 INSIDER THREAT
  └── 🛠️ SYSTEM MALFUNCTION
       ↓
  🔍 FORENSIC INVESTIGATION

Real-time Operating System (RTOS)

Explanation

Operating system designed to handle real-time applications with strict timing requirements and deterministic responses.

Examples

Industrial control systems, medical devices, automotive systems, aerospace applications

Enterprise Use Case

Use Case A medical device manufacturer uses a real-time operating system in implantable cardiac defibrillators that must detect life-threatening arrhythmias and deliver corrective shocks within milliseconds with zero tolerance for delays. Unlike general-purpose operating systems that prioritize tasks unpredictably, the RTOS provides deterministic response times ensuring critical functions always execute within guaranteed time windows. However, patching RTOS-based medical devices is extremely challenging due to FDA regulations, long certification cycles, and the critical nature of the devices, requiring network segmentation, compensating controls, and strict access restrictions to protect vulnerable embedded systems from cyber threats.

Diagram

⏱️ REAL-TIME OS
  🚗 AUTOMOTIVE SYSTEM
  ├── ⚡ IMMEDIATE RESPONSE
  ├── 🎯 DETERMINISTIC
  ├── 📊 LOW LATENCY
  └── ⏰ DEADLINE CRITICAL
       ↓
  🛡️ SAFETY CRITICAL
       ↓
  💀 NO DELAYS ALLOWED

Availability Consideration

Explanation

Architectural factor ensuring systems and services remain accessible and operational when needed.

Examples

High availability designs, redundancy planning, failover mechanisms, uptime requirements

Enterprise Use Case

Use Case An e-commerce platform requires 99.99% availability (less than 1 hour downtime per year) because every minute of outage costs thousands in lost revenue and damages customer trust. The architecture includes geographically distributed load balancers, redundant database clusters with automatic failover, multiple internet connections from different ISPs, and distributed denial-of-service protection. When the primary data center experiences a network outage, traffic automatically fails over to secondary data centers within seconds without customer impact. Availability considerations drive architectural decisions including multi-region deployment, eliminating single points of failure, and implementing comprehensive monitoring to detect and resolve issues before they affect users.

Diagram

🌟 AVAILABILITY
  👤 USER REQUEST
       ↓
  🔄 REDUNDANT SYSTEMS
  ├── 💻 PRIMARY SERVER
  ├── 🔄 BACKUP SERVER
  └── ⚡ LOAD BALANCER
       ↓
  ✅ SERVICE ACCESSIBLE
       ↓
  📈 99.9% UPTIME

Resilience Consideration

Explanation

System capability to maintain functionality and recover quickly from failures or attacks.

Examples

Fault tolerance, graceful degradation, disaster recovery, auto-healing systems

Enterprise Use Case

Use Case A cloud-based SaaS provider designs their application with resilience as a core architectural principle, implementing auto-scaling to handle traffic spikes, self-healing infrastructure that automatically replaces failed instances, and circuit breakers that isolate failing components to prevent cascading failures. When a ransomware attack encrypts several application servers, the system's resilience enables it to continue operating at reduced capacity through graceful degradation while automated recovery procedures restore encrypted systems from immutable backups. The resilient architecture minimizes business impact during incidents, reduces recovery time objectives, and maintains customer service even during attacks or infrastructure failures.

Diagram

💪 RESILIENCE
  ⚡ SYSTEM FAILURE
       ↓
  🔄 AUTO-RECOVERY
  ├── 🛠️ SELF-HEALING
  ├── 📊 GRACEFUL DEGRADATION
  └── 🔄 FAILOVER
       ↓
  🏃 QUICK RECOVERY
       ↓
  🌟 CONTINUED OPERATION

Cost Consideration

Explanation

Financial factors in architectural decisions including initial investment, operational costs, and maintenance expenses.

Examples

CAPEX vs OPEX, cloud vs on-premises costs, licensing fees, maintenance contracts

Enterprise Use Case

Use Case A startup evaluates security architecture options and chooses cloud-based security services (CASB, cloud SIEM, managed EDR) with operational expenditure pricing over building an on-premises security operations center requiring significant capital investment in hardware, software licenses, and dedicated staff. The cloud approach provides enterprise-grade security capabilities at predictable monthly costs that scale with the business, avoiding upfront capital expenditure of building a SOC. However, they must balance cost considerations with security requirements, as choosing the cheapest option could result in inadequate protection leading to breach costs far exceeding security investments.

Diagram

💰 COST ANALYSIS
  📊 ARCHITECTURE OPTIONS
  ├── 🏢 ON-PREMISES ($$$)
  ├── ☁️ CLOUD ($ per use)
  └── 🔄 HYBRID ($$ mixed)
       ↓
  ⚖️ COST VS BENEFIT
       ↓
  🎯 OPTIMAL CHOICE

Responsiveness Consideration

Explanation

System ability to react quickly to user requests and changing conditions.

Examples

Low latency networks, fast processing, real-time monitoring, quick incident response

Enterprise Use Case

Use Case A financial trading platform requires sub-millisecond responsiveness for executing stock trades, as even small delays can result in significant financial losses and competitive disadvantages. The architecture uses co-located servers near stock exchanges, in-memory databases, optimized network paths, and hardware acceleration to minimize latency. Security controls must be implemented without impacting responsiveness, using inline network security devices with hardware-accelerated inspection, streamlined authentication processes, and caching mechanisms. The organization accepts higher infrastructure costs to maintain responsiveness requirements while balancing security needs, demonstrating how performance requirements influence security architecture decisions.

Diagram

⚡ RESPONSIVENESS
  👤 USER ACTION
       ↓
  📈 FAST PROCESSING
  ├── 🚀 LOW LATENCY
  ├── 📊 REAL-TIME DATA
  └── ⏰ QUICK RESPONSE
       ↓
  😊 USER SATISFACTION
       ↓
  📈 BUSINESS SUCCESS

Scalability Consideration

Explanation

System capability to handle growing workloads by adding resources horizontally or vertically.

Examples

Auto-scaling cloud resources, load balancing, microservices architecture, elastic infrastructure

Enterprise Use Case

Use Case A video streaming service must scale from thousands to millions of concurrent users during major sporting events without performance degradation. Their architecture uses auto-scaling groups that automatically provision additional servers based on demand, content delivery networks to distribute load geographically, and microservices that can scale independently. Security architecture must scale proportionally, including auto-scaling web application firewalls, distributed DDoS protection with capacity to absorb large attacks, and security monitoring systems that can process massive log volumes during peak usage. Poor scalability planning could result in service outages during high-demand events or security gaps when systems are overwhelmed.

Diagram

📈 SCALABILITY
  📊 INCREASING DEMAND
       ↓
  🔄 AUTO-SCALING
  ├── ➡️ HORIZONTAL (more servers)
  ├── ⬆️ VERTICAL (more power)
  └── ⚡ ELASTIC RESOURCES
       ↓
  🌍 HANDLES GROWTH
       ↓
  💪 MAINTAINS PERFORMANCE

Ease of Deployment

Explanation

How simple and efficient it is to install, configure, and launch systems in production.

Examples

Automated deployment, containerization, infrastructure as code, CI/CD pipelines

Enterprise Use Case

Use Case A software company implements infrastructure as code using Terraform and containerization with Docker to enable rapid, consistent deployment of applications across development, staging, and production environments. Security policies are embedded in deployment pipelines, automatically scanning container images for vulnerabilities, enforcing configuration baselines, and validating security controls before production deployment. This ease-of-deployment approach reduces human error, enables rapid response to security incidents by quickly deploying patches, and allows developers to spin up secure test environments in minutes rather than weeks, but requires rigorous testing to ensure automated deployments don't introduce security misconfigurations.

Diagram

🚀 EASY DEPLOYMENT
  💻 DEVELOPER CODE
       ↓
  🤖 AUTOMATED PIPELINE
  ├── 🏗️ BUILD PROCESS
  ├── 🧪 AUTOMATED TESTING
  └── 📦 CONTAINERIZATION
       ↓
  🎯 ONE-CLICK DEPLOY
       ↓
  🌐 PRODUCTION READY

Risk Transference

Explanation

Shifting security and operational risks to third parties through contracts, insurance, or cloud services.

Examples

Cloud service providers, cyber insurance, managed security services, SLA agreements

Enterprise Use Case

Use Case A small business migrates their email system to Microsoft 365 cloud services and purchases a $2 million cyber insurance policy. By using Microsoft's cloud infrastructure, they transfer the risk of email server security, patch management, and physical security to Microsoft. The cyber insurance policy transfers financial risk from potential breaches to the insurance company. This risk transference strategy protects the business without requiring a large internal security team.

Diagram

🤝 RISK TRANSFERENCE
  🏢 YOUR ORGANIZATION
  ├── ⚠️ ORIGINAL RISK
  ├── 📋 CONTRACT/SLA
  └── 💰 PAYMENT
       ↓
  🏛️ THIRD PARTY
  ├── 🛡️ ACCEPTS RISK
  ├── 📋 PROVIDES SERVICE
  └── 🔒 SECURITY RESPONSIBILITY
       ↓
  📉 REDUCED RISK EXPOSURE

Ease of Recovery

Explanation

How quickly and simply systems can be restored after failures, disasters, or security incidents.

Examples

Backup restoration, disaster recovery procedures, automated recovery, rollback mechanisms

Enterprise Use Case

Use Case A web hosting company uses automated VM snapshots and infrastructure-as-code to ensure ease of recovery. When a ransomware attack encrypts a customer's website, the support team restores the entire environment from the previous night's snapshot in under 15 minutes with a single command. The automated recovery process minimizes downtime and eliminates manual errors, allowing the business to meet its 99.9% uptime SLA.

Diagram

🔄 RECOVERY PROCESS
  💥 SYSTEM FAILURE
       ↓
  📋 RECOVERY PLAN
  ├── 💾 RESTORE BACKUPS
  ├── 🔄 FAILOVER SYSTEMS
  └── 🧪 VERIFY OPERATIONS
       ↓
  ✅ SYSTEM RESTORED
       ↓
  📈 BUSINESS CONTINUITY

Patch Availability

Explanation

The accessibility and timeliness of security updates and fixes from vendors.

Examples

Regular vendor updates, automated patching, patch management systems, security bulletins

Enterprise Use Case

Use Case An enterprise IT team uses a patch management system (WSUS) to monitor patch availability from Microsoft for 2,000 Windows workstations. When Microsoft releases a critical security patch on Patch Tuesday, the system automatically downloads it, tests it in a staging environment, and schedules deployment to production systems within 48 hours. This rapid response to patch availability protects the organization from zero-day exploits before attackers can exploit vulnerabilities.

Diagram

🩹 PATCH AVAILABILITY
  🔍 VULNERABILITY DISCOVERED
       ↓
  🏭 VENDOR RESPONSE
  ├── 🛠️ DEVELOP FIX
  ├── 🧪 TEST PATCH
  └── 📤 RELEASE UPDATE
       ↓
  📥 AUTOMATIC DOWNLOAD
       ↓
  🛡️ SYSTEM PROTECTED

Inability to Patch

Explanation

Situations where systems cannot be updated due to technical, operational, or business constraints.

Examples

Legacy systems, embedded devices, critical operations, vendor discontinuation, compatibility issues

Enterprise Use Case

Use Case A hospital operates a critical MRI machine running on Windows XP that the manufacturer no longer supports and cannot be patched without voiding the warranty. The security team implements compensating controls including network segmentation to isolate the MRI system on a separate VLAN, configures firewall rules allowing only necessary medical device traffic, and deploys network monitoring to detect anomalies. These controls mitigate risk when patching is impossible.

Diagram

🚫 INABILITY TO PATCH
  🕰️ LEGACY SYSTEM
  ├── 📜 OUTDATED OS
  ├── 🏭 VENDOR DISCONTINUED
  ├── ⚙️ CUSTOM HARDWARE
  └── 💰 CRITICAL OPERATION
       ↓
  ⚠️ PERMANENT VULNERABILITY
       ↓
  🛡️ COMPENSATING CONTROLS

Power Consideration

Explanation

Electrical power requirements, availability, and backup systems for maintaining operations.

Examples

UPS systems, backup generators, power redundancy, energy efficiency, power monitoring

Enterprise Use Case

Use Case A data center designs power infrastructure with multiple redundancies to ensure continuous operations. They install dual power feeds from separate utility substations, battery-backed UPS systems providing 15 minutes of runtime, and diesel generators that automatically start during extended outages. Power monitoring systems track consumption and alert administrators to anomalies. This N+1 redundant power design ensures 99.999% uptime even during utility failures.

Diagram

⚡ POWER SYSTEMS
  🏢 DATA CENTER
  ├── 🔌 PRIMARY POWER
  ├── 🔋 UPS BACKUP
  ├── 🏭 GENERATOR
  └── 📊 POWER MONITORING
       ↓
  🌟 CONTINUOUS OPERATION
       ↓
  📈 BUSINESS CONTINUITY

Compute Consideration

Explanation

Processing power requirements including CPU, memory, and computational resources needed for operations.

Examples

CPU capacity planning, memory requirements, processing workloads, performance optimization

Enterprise Use Case

Use Case A security operations center (SOC) plans compute resources for their SIEM platform that processes 10TB of logs daily. They provision servers with 64 CPU cores and 256GB RAM to handle real-time log correlation and threat detection. During a security incident, the additional compute capacity allows analysts to run complex queries across months of historical data without performance degradation, enabling faster incident response.

Diagram

💻 COMPUTE RESOURCES
  📊 WORKLOAD DEMANDS
  ├── 🧠 CPU PROCESSING
  ├── 💾 MEMORY USAGE
  ├── 💽 STORAGE I/O
  └── 📡 NETWORK BANDWIDTH
       ↓
  ⚖️ CAPACITY PLANNING
       ↓
  🎯 OPTIMAL PERFORMANCE

Device Placement

Explanation

Strategic positioning of security devices to maximize protection and minimize security gaps.

Examples

DMZ placement, network chokepoints, perimeter positioning, internal segmentation points

Enterprise Use Case

Use Case A network architect designs security device placement for a corporate network. They position the firewall at the network perimeter between the internet and internal network, place an intrusion detection system (IDS) at the DMZ boundary monitoring traffic to web servers, deploy a web application firewall (WAF) directly in front of the application tier, and install network sensors at each VLAN junction point. This strategic placement ensures all traffic flows through appropriate security controls.

Diagram

📍 DEVICE PLACEMENT
  🌐 NETWORK TOPOLOGY
  ├── 🔥 FIREWALL (perimeter)
  ├── 🛡️ IDS (internal)
  ├── 🔒 WAF (web tier)
  └── 📊 SIEM (SOC)
       ↓
  🎯 STRATEGIC COVERAGE
       ↓
  🛡️ MAXIMUM PROTECTION

Attack Surface

Explanation

Total exposure points where an unauthorized user can try to enter or extract data from a system.

Examples

Open ports, web interfaces, API endpoints, network services, user access points

Enterprise Use Case

Use Case A security team conducts an attack surface assessment and discovers their web server exposes 47 open ports including unnecessary services like Telnet (port 23), FTP (port 21), and legacy protocols. They reduce the attack surface by closing all unnecessary ports, disabling unused services, implementing API rate limiting, removing default admin interfaces, and requiring VPN for remote management access. This reduction shrinks the attack surface from 47 to 3 ports (80, 443, 22), significantly decreasing vulnerability exposure.

Diagram

🎯 ATTACK SURFACE
  🏰 SYSTEM PERIMETER
  ├── 🌐 WEB INTERFACES
  ├── 📡 API ENDPOINTS
  ├── 🔌 NETWORK PORTS
  ├── 👤 USER ACCESS
  └── 📱 MOBILE APPS
       ↓
  ⚠️ POTENTIAL ENTRY POINTS
       ↓
  🛡️ SURFACE REDUCTION NEEDED

Connectivity

Explanation

Network connections and communication paths between systems, affecting security architecture.

Examples

Network topology, inter-system communication, external connections, internal routing

Enterprise Use Case

Use Case A global company designs connectivity architecture for offices in 30 countries. They establish MPLS circuits for reliable branch-to-headquarters connectivity, deploy SD-WAN overlay for intelligent path selection, implement encrypted IPSec tunnels for site-to-site VPN, and provide SSL VPN for remote workers. Network diagrams document all connectivity paths, helping security teams understand data flows and identify where to deploy security controls like firewalls and intrusion detection systems.

Diagram

🔗 CONNECTIVITY
  🏢 SYSTEMS NETWORK
  ├── 🌐 INTERNET LINKS
  ├── 🏢 INTERNAL ROUTING
  ├── ☁️ CLOUD CONNECTIONS
  └── 📱 REMOTE ACCESS
       ↓
  🛡️ SECURE CHANNELS
       ↓
  📊 MONITORED TRAFFIC

Load Balancer

Explanation

Network device that distributes incoming requests across multiple servers to optimize performance and availability.

Examples

Application load balancers, network load balancers, DNS load balancing, global load balancing

Enterprise Use Case

Use Case An e-commerce company deploys an application load balancer in front of their web server farm to distribute customer traffic across five web servers. During peak shopping periods, the load balancer automatically routes requests to the least busy server, ensuring no single server is overwhelmed and maintaining fast response times for all customers.

Diagram

⚖️ LOAD BALANCER
  👥 INCOMING REQUESTS
       ↓
  🎛️ LOAD BALANCER
  ├── 📊 TRAFFIC ANALYSIS
  ├── 🎯 SERVER SELECTION
  └── 🔄 DISTRIBUTION
       ↓
  💻 SERVER FARM
  ├── 💻 Server 1 (30%)
  ├── 💻 Server 2 (35%)
  └── 💻 Server 3 (35%)
       ↓
  📈 OPTIMAL PERFORMANCE

Network Sensors

Explanation

Monitoring devices that collect and analyze network traffic for security threats and performance issues.

Examples

Network TAPs, packet analyzers, flow collectors, intrusion detection sensors

Enterprise Use Case

Use Case A financial institution deploys network sensors at key points throughout their infrastructure including at the internet gateway, between network segments, and at the data center perimeter. These sensors feed traffic data to the SOC where analysts monitor for suspicious patterns, zero-day attacks, and policy violations in real-time.

Diagram

👁️ NETWORK SENSORS
  🌐 NETWORK TRAFFIC
       ↓
  📡 SENSOR DEPLOYMENT
  ├── 📊 PACKET CAPTURE
  ├── 🔍 TRAFFIC ANALYSIS
  ├── 🚨 THREAT DETECTION
  └── 📈 PERFORMANCE METRICS
       ↓
  🖥️ SOC MONITORING
       ↓
  🚨 SECURITY ALERTS

802.1X Port Security

Explanation

IEEE standard for network access control providing authentication for devices connecting to network ports.

Examples

Wired port authentication, wireless network access, certificate-based auth, RADIUS integration

Enterprise Use Case

Use Case A university implements 802.1X on all network switch ports to prevent unauthorized devices from accessing the campus network. When students plug in their laptops, they must authenticate via EAP-TLS using digital certificates before the port grants network access. This prevents rogue devices and ensures only registered students and staff can connect to the wired network.

Diagram

🔐 802.1X AUTHENTICATION
  💻 CLIENT DEVICE
       ↓
  🔌 NETWORK PORT
       ↓
  🏛️ AUTHENTICATION SERVER
  ├── 🔍 CREDENTIAL CHECK
  ├── 📋 POLICY LOOKUP
  └── ✅ ACCESS DECISION
       ↓
  🌐 NETWORK ACCESS GRANTED
       ↓
  🛡️ AUTHORIZED COMMUNICATION

Extensible Authentication Protocol (EAP)

Explanation

Authentication framework used in wireless and point-to-point connections supporting multiple authentication methods.

Examples

EAP-TLS, EAP-PEAP, EAP-TTLS, EAP-MD5, certificate authentication, token-based auth

Enterprise Use Case

Use Case A healthcare organization deploys enterprise Wi-Fi using EAP-PEAP for user authentication and EAP-TLS for medical devices. Doctors and nurses authenticate with username/password through PEAP, while critical medical equipment uses certificate-based EAP-TLS authentication. This provides flexible, secure authentication appropriate for different device types while ensuring HIPAA compliance.

Diagram

🔑 EAP FRAMEWORK
  👤 USER AUTHENTICATION
       ↓
  🔧 EAP METHOD SELECTION
  ├── 📜 EAP-TLS (certificates)
  ├── 🔒 EAP-PEAP (tunneled)
  ├── 🛡️ EAP-TTLS (secure tunnel)
  └── 🎫 EAP-TOKEN (tokens)
       ↓
  ✅ AUTHENTICATION SUCCESS
       ↓
  🌐 NETWORK ACCESS

Web Application Firewall (WAF)

Explanation

Security device that monitors, filters, and blocks HTTP traffic to protect web applications.

Examples

SQL injection protection, XSS filtering, DDoS mitigation, API protection, rate limiting

Enterprise Use Case

Use Case An online banking platform deploys a WAF in front of their customer portal to protect against web attacks. The WAF blocks SQL injection attempts, filters out cross-site scripting (XSS) payloads, and enforces rate limiting to prevent credential stuffing attacks. When attackers try to exploit vulnerabilities, the WAF logs and blocks the malicious requests before they reach the web application servers.

Diagram

🛡️ WEB APPLICATION FIREWALL
  🌐 WEB TRAFFIC
       ↓
  🔍 WAF INSPECTION
  ├── 🚫 SQL INJECTION BLOCK
  ├── 🛑 XSS FILTER
  ├── 📊 RATE LIMITING
  └── 🔒 MALICIOUS CONTENT
       ↓
  ✅ CLEAN TRAFFIC
       ↓
  🖥️ WEB APPLICATION

Unified Threat Management (UTM)

Explanation

Comprehensive security appliance combining multiple security functions in a single device.

Examples

Firewall + antivirus + IPS + content filtering, all-in-one security, SOHO protection

Enterprise Use Case

Use Case A small law firm with 25 employees deploys a UTM appliance as their primary security device. The single UTM provides firewall protection, antivirus scanning, intrusion prevention, web content filtering, and VPN capabilities. This all-in-one approach is cost-effective for the small business while providing comprehensive security without requiring separate appliances or extensive IT staff to manage multiple systems.

Diagram

🏢 UTM APPLIANCE
  🌐 NETWORK TRAFFIC
       ↓
  🛡️ MULTIPLE PROTECTION
  ├── 🔥 FIREWALL
  ├── 🦠 ANTIVIRUS
  ├── 🚨 IPS/IDS
  ├── 🔍 CONTENT FILTER
  └── 📊 VPN
       ↓
  🎯 SINGLE POINT SECURITY
       ↓
  🏢 PROTECTED NETWORK

Next-Generation Firewall (NGFW)

Explanation

Advanced firewall with deep packet inspection, application awareness, and integrated threat prevention.

Examples

Application control, user identification, SSL inspection, threat intelligence integration

Enterprise Use Case

Use Case A corporate enterprise deploys an NGFW at their network perimeter to enforce granular security policies. The NGFW identifies applications beyond just port numbers, blocks file sharing apps like Dropbox for specific user groups, inspects encrypted SSL traffic for malware, and automatically blocks connections to known malicious IP addresses using integrated threat intelligence feeds. This provides far more protection than traditional port-based firewalls.

Diagram

🚀 NEXT-GEN FIREWALL
  📦 NETWORK PACKET
       ↓
  🧠 DEEP INSPECTION
  ├── 📱 APPLICATION ID
  ├── 👤 USER AWARENESS
  ├── 🔒 SSL DECRYPT
  ├── 🛡️ THREAT INTEL
  └── 📊 BEHAVIOR ANALYSIS
       ↓
  🎯 INTELLIGENT BLOCKING
       ↓
  🛡️ ADVANCED PROTECTION

Layer 4/Layer 7 Firewalls

Explanation

Firewalls operating at transport layer (L4) for port-based filtering or application layer (L7) for content inspection.

Examples

L4: TCP/UDP port filtering. L7: HTTP content inspection, application protocols

Enterprise Use Case

Use Case A company uses both Layer 4 and Layer 7 firewalls for defense in depth. The Layer 4 firewall at the network perimeter performs fast, stateful packet filtering based on IP addresses and port numbers (e.g., block all traffic except ports 80, 443), providing high-performance basic protection. The Layer 7 firewall (WAF) sits in front of web servers and inspects HTTP/HTTPS application content, blocking SQL injection attempts and malicious payloads that pass through the L4 firewall.

Diagram

🏗️ FIREWALL LAYERS
  📦 NETWORK PACKET
       ↓
  🔢 LAYER 4 (TRANSPORT)     📱 LAYER 7 (APPLICATION)
  ├── 🔌 PORT NUMBERS       ├── 📝 CONTENT ANALYSIS
  ├── 🌐 IP ADDRESSES       ├── 🔍 PROTOCOL INSPECTION
  └── 🚫 BASIC BLOCKING     └── 🎯 APP-AWARE RULES
       ↓                         ↓
  ⚡ FAST FILTERING         🧠 INTELLIGENT CONTROL

Virtual Private Network (VPN)

Explanation

Secure tunnel that encrypts data transmission over public networks, creating private network connections.

Examples

Site-to-site VPN, remote access VPN, SSL VPN, IPSec VPN, client VPN software

Enterprise Use Case

Use Case A global corporation with offices in 15 countries establishes site-to-site VPN tunnels between all locations, creating a secure private network over the public internet. Remote employees use client VPN software to connect securely to corporate resources while traveling. All VPN traffic is encrypted with IPSec, ensuring that sensitive business data remains protected even when transmitted across untrusted networks.

Diagram

🔐 VPN CONNECTION
  💻 REMOTE USER
       ↓
  🌐 INTERNET (unsecure)
       ↓
  🔒 VPN TUNNEL
  ├── 🛡️ ENCRYPTION
  ├── 🔑 AUTHENTICATION
  └── 📊 DATA INTEGRITY
       ↓
  🏢 CORPORATE NETWORK
       ↓
  💻 SECURE ACCESS

Remote Access

Explanation

Methods and technologies that allow users to connect to networks and systems from distant locations.

Examples

VPN connections, RDP, SSH, web-based access, mobile device management, zero trust access

Enterprise Use Case

Use Case During the pandemic, a company enables remote access for 500 employees to work from home. IT deploys VPN client software with multi-factor authentication, implements Remote Desktop Gateway for accessing workstations, and uses zero-trust network access (ZTNA) for cloud applications. Security policies enforce device compliance checking and require all remote connections to use encrypted protocols, ensuring secure productivity from any location.

Diagram

📱 REMOTE ACCESS
  🏠 REMOTE LOCATION
       ↓
  🔐 AUTHENTICATION
  ├── 🔑 CREDENTIALS
  ├── 🎫 MFA TOKEN
  └── 📜 CERTIFICATES
       ↓
  🌐 SECURE CONNECTION
       ↓
  🏢 CORPORATE RESOURCES
       ↓
  💼 PRODUCTIVE WORK

Tunneling

Explanation

Encapsulating one network protocol within another to create secure communication channels.

Examples

VPN tunnels, SSH tunneling, GRE tunnels, MPLS tunnels, encrypted data channels

Enterprise Use Case

Use Case A system administrator needs to access a MySQL database server that only accepts connections from localhost for security. The admin creates an SSH tunnel from their workstation to the remote server, encapsulating the MySQL traffic inside the encrypted SSH connection. This allows secure remote database access without exposing the database port directly to the network.

Diagram

🚇 NETWORK TUNNELING
  📦 ORIGINAL PACKET
       ↓
  📋 TUNNEL HEADER ADDED
  ├── 🔒 ENCRYPTION
  ├── 🏷️ ROUTING INFO
  └── 🛡️ PROTECTION
       ↓
  🌐 TRANSPORT NETWORK
       ↓
  📦 ORIGINAL PACKET RESTORED

Transport Layer Security (TLS)

Explanation

Cryptographic protocol providing secure communication over networks, successor to SSL.

Examples

HTTPS websites, email encryption, VPN protocols, API security, certificate-based authentication

Enterprise Use Case

Use Case An e-commerce website implements TLS 1.3 to secure all customer transactions and login sessions. When customers access the site via HTTPS, their browser and the web server perform a TLS handshake to establish an encrypted channel. All credit card data, passwords, and personal information are encrypted in transit using TLS, protecting against eavesdropping and man-in-the-middle attacks.

Diagram

🔒 TLS PROTOCOL
  🤝 HANDSHAKE PROCESS
  ├── 📜 CERTIFICATE EXCHANGE
  ├── 🔑 KEY AGREEMENT
  └── 🛡️ CIPHER SELECTION
       ↓
  🔐 ENCRYPTED CHANNEL
       ↓
  📊 SECURE DATA TRANSFER
       ↓
  ✅ VERIFIED INTEGRITY

Internet Protocol Security (IPSec)

Explanation

Suite of protocols for securing Internet Protocol communications through authentication and encryption.

Examples

Site-to-site VPNs, network layer encryption, ESP protocol, AH protocol, tunnel mode

Enterprise Use Case

Use Case Two branch offices of a financial company establish a site-to-site VPN using IPSec tunnel mode to securely connect their networks over the internet. All traffic between the offices is automatically encrypted at the network layer using ESP (Encapsulating Security Payload), ensuring that sensitive financial data remains protected without requiring application-level encryption. The IPSec connection provides authentication, confidentiality, and integrity for all inter-office communications.

Diagram

🛡️ IPSEC PROTECTION
  📦 IP PACKET
       ↓
  🔐 IPSEC PROCESSING
  ├── 🔑 AUTHENTICATION
  ├── 🛡️ ENCRYPTION
  ├── 📊 INTEGRITY CHECK
  └── 🚫 REPLAY PROTECTION
       ↓
  📦 SECURED PACKET
       ↓
  🌐 NETWORK TRANSPORT

Software-Defined Wide Area Network (SD-WAN)

Explanation

Technology that uses software-defined networking to manage and optimize WAN connections across distributed locations.

Examples

Branch office connectivity, cloud access optimization, traffic steering, centralized policy management

Enterprise Use Case

Use Case A retail chain with 200 branch stores deploys SD-WAN to optimize connectivity to their cloud-based point-of-sale system. The SD-WAN controller intelligently routes traffic over multiple connections (MPLS, broadband, LTE), choosing the best path based on application priority and network conditions. Critical credit card transactions use the most reliable path while less important traffic like digital signage uses cheaper broadband, reducing WAN costs by 40% while improving application performance.

Diagram

🌐 SD-WAN ARCHITECTURE
  🏢 HEADQUARTERS
       ↓
  🧠 SD-WAN CONTROLLER
  ├── 📋 CENTRALIZED POLICIES
  ├── 🎯 TRAFFIC OPTIMIZATION
  └── 📊 PERFORMANCE MONITORING
       ↓
  🌍 DISTRIBUTED BRANCHES
  ├── 🏢 Branch 1
  ├── 🏢 Branch 2
  └── ☁️ CLOUD SERVICES
       ↓
  ⚡ OPTIMIZED CONNECTIVITY

Secure Access Service Edge (SASE)

Explanation

Cloud-based architecture combining network and security functions to provide secure access from anywhere.

Examples

Zero trust network access, cloud security, SD-WAN integration, unified security policies

Enterprise Use Case

Use Case A global enterprise with 10,000 remote workers adopts SASE to simplify security architecture. Instead of backhauling all remote traffic through a central data center, users connect directly to the nearest SASE cloud point-of-presence which provides firewall, zero-trust access, web filtering, and malware protection. This cloud-native approach delivers consistent security policies regardless of user location, dramatically improving performance for cloud applications while reducing infrastructure costs.

Diagram

☁️ SASE ARCHITECTURE
  👤 REMOTE USERS
  📱 MOBILE DEVICES
  🏢 BRANCH OFFICES
       ↓
  🌩️ SASE CLOUD
  ├── 🛡️ SECURITY SERVICES
  ├── 🌐 NETWORK SERVICES
  ├── 🔐 ZERO TRUST ACCESS
  └── 📊 POLICY ENGINE
       ↓
  🎯 APPLICATIONS & DATA
       ↓
  🛡️ SECURE CONNECTIVITY

Establish Secure Baselines

Explanation

Creating standardized security configurations that serve as the foundation for all systems.

Examples

CIS benchmarks, NIST frameworks, security configuration guides, hardening standards

Enterprise Use Case

Use Case A financial institution's security team establishes secure baselines for all Windows servers based on CIS Level 2 benchmarks. They document required settings including password complexity (14+ characters, complexity enabled), disabled unnecessary services (Telnet, FTP), enabled audit logging, configured Windows Firewall rules, and mandated BitLocker encryption. These documented baselines become the minimum security standard that all new servers must meet before going into production.

Diagram

📏 SECURE BASELINE
  📋 SECURITY STANDARDS
  ├── 🔐 PASSWORD POLICIES
  ├── 🛡️ FIREWALL RULES
  ├── 🔄 UPDATE SCHEDULES
  └── 📊 MONITORING CONFIG
       ↓
  🎯 CONSISTENT SECURITY
       ↓
  📈 COMPLIANCE READY

Deploy Secure Baselines

Explanation

Implementing and rolling out standardized security configurations across all systems.

Examples

Automated deployment tools, configuration management, group policy, infrastructure as code

Enterprise Use Case

Use Case After establishing secure baselines, an IT department uses Microsoft Group Policy to deploy the configurations to 1,000 Windows workstations automatically. The deployment includes disabling SMBv1, enabling Windows Firewall, enforcing screen lock after 10 minutes, and installing mandatory security software. Ansible scripts deploy equivalent baselines to 200 Linux servers. This automated approach ensures consistent security across the enterprise within 24 hours.

Diagram

🚀 BASELINE DEPLOYMENT
  📋 APPROVED BASELINE
       ↓
  🤖 AUTOMATION TOOLS
  ├── 📦 CONFIG PACKAGES
  ├── 🔄 MASS DEPLOYMENT
  └── ✅ VERIFICATION
       ↓
  🌐 ORGANIZATION-WIDE
       ↓
  🛡️ UNIFORM SECURITY

Maintain Secure Baselines

Explanation

Ongoing management and updates of security baselines to address new threats and requirements.

Examples

Regular reviews, threat intelligence updates, compliance changes, security patches

Enterprise Use Case

Use Case A security team conducts quarterly reviews of their server baseline configurations. When a new critical vulnerability (CVE) is announced affecting TLS 1.0/1.1, they update the baseline to disable these protocols and require TLS 1.2 or higher. The revised baseline is tested in a staging environment, approved by change management, and then redeployed to all servers. Compliance scanning tools verify that all systems meet the updated baseline requirements.

Diagram

🔧 BASELINE MAINTENANCE
  ⏰ SCHEDULED REVIEW
       ↓
  🔍 ASSESS CHANGES
  ├── 🆕 NEW THREATS
  ├── 📜 COMPLIANCE UPDATES
  └── 🔧 TECH CHANGES
       ↓
  📝 UPDATE BASELINES
       ↓
  🔄 REDEPLOY CHANGES

Mobile Device Hardening

Explanation

Security measures applied to smartphones and tablets to protect against threats.

Examples

Device encryption, app restrictions, remote wipe, screen locks, VPN enforcement

Enterprise Use Case

Use Case A healthcare organization deploys mobile device management (MDM) to harden all employee smartphones accessing patient records. The MDM policy enforces device encryption, requires 6-digit PIN with biometric unlock, blocks jailbroken/rooted devices, restricts app installations to approved medical apps, and enables remote wipe capability. When a doctor's phone is lost, IT remotely wipes the device to protect patient data, ensuring HIPAA compliance.

Diagram

📱 MOBILE HARDENING
  📲 MOBILE DEVICE
  ├── 🔐 STRONG PASSCODE
  ├── 🔒 DEVICE ENCRYPTION
  ├── 🚫 APP RESTRICTIONS
  ├── 📍 LOCATION TRACKING
  └── 🗑️ REMOTE WIPE
       ↓
  🛡️ SECURE MOBILE
       ↓
  💼 BUSINESS READY

Workstation Hardening

Explanation

Security configurations applied to desktop and laptop computers to reduce attack surface.

Examples

Disable unused services, software restrictions, user account control, endpoint protection

Enterprise Use Case

Use Case An IT department hardens all corporate workstations by disabling unnecessary services like Telnet and FTP, enabling User Account Control (UAC) to prevent unauthorized changes, deploying endpoint detection and response (EDR) software, enforcing automatic Windows updates, and using AppLocker to restrict which applications users can run. These hardening measures reduce the attack surface and prevent 95% of common malware from executing on employee laptops.

Diagram

💻 WORKSTATION HARDENING
  🖥️ DESKTOP COMPUTER
  ├── 🚫 DISABLE UNUSED SERVICES
  ├── 🛡️ ANTIVIRUS/EDR
  ├── 🔐 UAC ENABLED
  ├── 🔄 AUTO-UPDATES
  └── 🔒 USER RESTRICTIONS
       ↓
  🛡️ HARDENED ENDPOINT
       ↓
  💼 SECURE PRODUCTIVITY

Network Device Hardening (Switches/Routers)

Explanation

Security configurations for network infrastructure devices to prevent unauthorized access.

Examples

Default password changes, SNMP security, unused port shutdown, firmware updates

Enterprise Use Case

Use Case A network administrator hardens all Cisco switches by changing default passwords to complex 16-character passphrases, disabling unused physical ports, configuring SNMPv3 with encryption instead of SNMPv2c, enabling SSH and disabling Telnet for management, implementing port security to prevent MAC flooding, and scheduling automatic firmware updates. When audited, the hardened switches pass PCI-DSS compliance scans without findings.

Diagram

🌐 NETWORK HARDENING
  🔧 NETWORK DEVICE
  ├── 🔑 CHANGE DEFAULTS
  ├── 🚫 DISABLE UNUSED PORTS
  ├── 🔒 ENABLE ENCRYPTION
  ├── 📊 SECURE MANAGEMENT
  └── 🔄 FIRMWARE UPDATES
       ↓
  🛡️ SECURED INFRASTRUCTURE
       ↓
  🌐 RELIABLE NETWORK

Bring Your Own Device (BYOD)

Explanation

Policy allowing employees to use personal devices for work purposes with appropriate security controls.

Examples

Personal smartphones, tablets, laptops, mobile device management, containerization

Enterprise Use Case

Use Case A software company implements a BYOD program allowing developers to use their personal MacBooks and iPhones for work. Employees enroll devices in the MDM system which creates a secure container separating work apps and data from personal content. The MDM enforces encryption, requires VPN for corporate access, enables remote wipe of only the work container, and prohibits jailbroken devices. This reduces hardware costs while maintaining security and employee satisfaction.

Diagram

📱 BYOD DEPLOYMENT
  👤 EMPLOYEE
  "I want to use my phone"
       ↓
  📋 BYOD POLICY
  ├── 📱 DEVICE ENROLLMENT
  ├── 🛡️ SECURITY CONTROLS
  ├── 🔐 CONTAINERIZATION
  └── 📊 MONITORING
       ↓
  💼 SECURE WORK ACCESS
       ↓
  😊 EMPLOYEE SATISFACTION
← Domain 1: General Security ConceptsDomain 3: Security Architecture →