InfoSec Notes
HubCybersecurity vs Information SecurityHistory of Information SecurityImportance of Information SecuritySecurity Principles and the CIA TriadWhat is Information Security?Accountability in Information SecurityAuthentication in Information SecurityAuthorization in Information SecurityAvailability in Information SecurityConfidentiality in Information SecurityIntegrity in Information SecurityNon-Repudiation in Information SecurityAES - Advanced Encryption StandardAsymmetric Key CryptographyDES - Data Encryption StandardDigital SignaturesEncryption vs DecryptionCryptographic Hash FunctionsIntroduction to CryptographyPublic Key Infrastructure (PKI)RSA AlgorithmSymmetric Key CryptographyIntroduction to Access ControlAttribute-Based Access Control (ABAC)Discretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC) — Information SecurityZero Trust Security ArchitectureFirewalls in Network SecurityIntrusion Detection Systems (IDS)Intrusion Prevention Systems (IPS)Network Monitoring and AnalysisNetwork Security BasicsSecure Network DesignVirtual Private Networks (VPN)Wireless Network SecurityAPI SecurityIntroduction to Application SecuritySecurity Code ReviewDependency and Supply Chain SecurityDynamic Application Security Testing (DAST)Secure Software Development LifecycleStatic Application Security Testing (SAST)Web Authentication MechanismsCross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)File Upload SecurityHTTPS and SSL/TLSSecure Coding Practices — Information SecuritySession Management SecuritySQL Injection Attacks and PreventionIntroduction to Web SecurityOS Access Control ModelsEndpoint SecurityFile System Permissions and SecurityLinux SecurityIntroduction to OS SecurityUser Account ManagementWindows SecurityCloud Security FundamentalsCloud Security Best PracticesContainer Security — Information SecurityData Security in the CloudCloud Identity and Access ManagementKubernetes SecurityShared Responsibility Model — Information SecurityIntroduction to Digital ForensicsDisk ForensicsDigital Evidence CollectionDigital Forensic ToolsIncident Investigation ProceduresMemory ForensicsNetwork ForensicsContainment StrategiesDetection and Analysis PhaseEradication and RecoveryIntroduction to Incident ResponseIncident Response LifecycleIncident Response PlaybooksPost-Incident Review and Lessons LearnedBusiness Continuity PlanningDisaster Recovery PlanningRisk Assessment MethodologyIntroduction to Risk ManagementSecurity ControlsThreat ModelingVulnerability AssessmentCompliance ManagementGDPR Data Protection OverviewISO 27001 Information Security ManagementNIST Cybersecurity FrameworkSecurity Audits and AssessmentsSecurity GovernanceSecurity Policies and StandardsCloud Security Interview QuestionsCryptography Interview QuestionsInformation Security CheatsheetInformation Security Interview QuestionsNetwork Security Interview QuestionsGlossary of Information Security TermsImportant Security Concepts ReferenceRecommended Books and Learning ResourcesSecurity Tools OverviewIncident Response LabLog Analysis ProjectNetwork Monitoring ProjectPassword Manager ProjectSecure Login System ProjectVulnerability Scanner ProjectInsider ThreatsMalware Types and AnalysisPhishing Attacks and PreventionRansomware AttacksSecurity Threats OverviewSocial Engineering AttacksSpyware and Surveillance SoftwareTrojan Horse MalwareComputer VirusesNetwork Worms
Understanding social engineering techniques including pretexting, baiting, quid pro quo, and building human-layer defenses.
Overview
Understanding social engineering is essential for building effective defenses. This topic covers the mechanics, real-world examples, detection methods, and prevention strategies that security professionals need to protect their organizations.
How It Works
Example
Social Engineering Attacks Attack Lifecycle:
========================================
1. Reconnaissance
- Identify targets and gather information
- Research vulnerabilities and attack vectors
2. Initial Access
- Exploit vulnerability or social engineering
- Deliver payload via email, web, or USB
3. Execution
- Malicious code runs on target system
- Establish persistence and communication
4. Impact
- Data theft, system damage, or extortion
- Lateral movement to other systems
Types and Classification
| Type | Characteristics | Risk Level | Common Vector |
|---|---|---|---|
| Targeted | Specific victim, sophisticated | Critical | Spear phishing, zero-days |
| Opportunistic | Mass targeting, automated | High | Phishing campaigns, exploits |
| Insider | Employee/contractor initiated | High | Physical/logical access abuse |
| Supply chain | Via trusted third party | Critical | Software updates, dependencies |
Detection Methods
Example
import re
from datetime import datetime
from collections import defaultdict
class ThreatDetector:
"""Basic threat detection patterns."""
def __init__(self):
self.indicators = []
self.alert_threshold = 3
self.event_counts = defaultdict(int)
def analyze_event(self, event: dict) -> dict:
"""Analyze security event for threat indicators."""
risk_score = 0
indicators = []
# Check for known malicious patterns
if event.get("source_ip") in self.known_bad_ips:
risk_score += 80
indicators.append("Known malicious IP")
# Check for anomalous behavior
if event.get("bytes_out", 0) > 100_000_000: # 100MB exfil
risk_score += 60
indicators.append("Large data transfer")
# Check for off-hours activity
hour = datetime.fromisoformat(event.get("timestamp", "")).hour
if hour < 6 or hour > 22:
risk_score += 20
indicators.append("Off-hours activity")
# Check for multiple failed attempts
user = event.get("user", "unknown")
if event.get("status") == "failed":
self.event_counts[f"{user}_failures"] += 1
if self.event_counts[f"{user}_failures"] > 5:
risk_score += 40
indicators.append("Multiple failures detected")
severity = "critical" if risk_score >= 80 else "high" if risk_score >= 60 else "medium" if risk_score >= 30 else "low"
return {
"risk_score": risk_score,
"severity": severity,
"indicators": indicators,
"action": "alert" if risk_score >= 60 else "monitor"
}
known_bad_ips = set() # Would be populated from threat intel feeds
Prevention Strategies
| Layer | Control | Implementation |
|---|---|---|
| People | Security awareness training | Monthly phishing simulations |
| Process | Incident response plans | Documented playbooks, tabletop exercises |
| Technology | EDR/XDR deployment | CrowdStrike, SentinelOne, Defender |
| Data | Backup and encryption | 3-2-1-1-0 backup rule, AES-256 |
| Network | Segmentation and monitoring | Zero trust, SIEM correlation |
Real-World Case Studies
Case 1: Large-Scale Attack
Timeline:
- Day 0: Initial compromise via phishing email
- Day 1-30: Reconnaissance and lateral movement
- Day 31-60: Data staging and exfiltration
- Day 61: Detection by security team
- Day 62+: Containment and remediation
Impact: Millions of records exposed, regulatory fines, reputation damage.
Lessons Learned:
- Faster detection reduces impact exponentially
- Network segmentation limits lateral movement
- Regular access reviews prevent privilege accumulation
- Endpoint detection catches what perimeter misses
Response Procedure
Example
Incident Response for Social Engineering Attacks:
========================================
1. DETECT
- SIEM alert correlation
- EDR behavioral detection
- User reports
2. CONTAIN
- Isolate affected systems
- Block malicious IPs/domains
- Disable compromised accounts
3. ERADICATE
- Remove malware/backdoors
- Patch exploited vulnerability
- Reset compromised credentials
4. RECOVER
- Restore from clean backups
- Rebuild affected systems
- Verify system integrity
5. LEARN
- Document timeline and actions
- Update detection rules
- Improve security controls
Interview Questions
- How would you detect this type of threat in an enterprise environment?
- Combine multiple detection layers: network monitoring for unusual traffic patterns, endpoint detection for suspicious process behavior, SIEM correlation for related events across systems, user behavior analytics for anomalous actions, and threat intelligence feeds for known indicators.
- What is the most effective prevention strategy?
- Defense in depth combining: security awareness training (human layer), email security and web filtering (delivery prevention), endpoint protection (execution prevention), network segmentation (movement limitation), and robust backup strategy (impact reduction).
- Describe the attack kill chain for this threat type.
- Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command & Control → Actions on Objectives. Breaking any link in the chain stops the attack. Defense should target multiple links simultaneously.
- How do you prioritize response when multiple systems are affected?
- Prioritize by: business criticality of affected systems, data sensitivity, spread potential, and regulatory requirements. Contain high-value targets first, then work outward. Use pre-defined asset classifications from business impact analysis.
- What metrics would you track to measure the effectiveness of your defenses?
- Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), percentage of attacks blocked at perimeter, false positive rate, number of successful phishing attempts, patch compliance rate, and time from vulnerability disclosure to remediation.
Continue the lesson path
Study next in this module
01Threats And AttacksSecurity Threats OverviewComprehensive classification of security threats including threat actors, attack vectors, and the modern threat landscape.02Threats And AttacksSpyware and Surveillance SoftwareGuide to spyware including keyloggers, screen capture tools, stalkerware, and privacy protection measures.03Threats And AttacksRansomware AttacksDeep dive into ransomware operations, encryption mechanisms, notable campaigns, and comprehensive prevention and response strategies.04Threats And AttacksTrojan Horse MalwareUnderstanding trojan malware types including RATs, banking trojans, and detection and removal techniques.