Skip to main content

Cybersecurity Threat Actor Analysis Study Guide

Learn about network segmentation, the Zero Trust model, and system hardening techniques. Understand how to reduce attack surfaces and build resilient digital infrastructures against modern cyber threats.

Save this study guide to your study set

Sign up free

Your learning path

Analyzing a CompTIA Security+ Study Guide Post

CompTIA Security+ Study Guide Overview

  • CompTIA Security+ Study Guide
  • Practice test questions
  • Electronic flashcards
  • Searchable key term glossary

Security Fundamentals

The CIA Triad

Learn the three pillars of information security: Confidentiality, Integrity, and Availability, and how to implement controls for each.

Core Security Principles

Understand essential frameworks like Least Privilege, Defense in Depth, and Non-Repudiation used to design secure systems.

Threat Actor Profiles

Identify different types of adversaries, from script kiddies to nation-states, and understand their motivations and methods.

Threats, Vulnerabilities, and Risk

Distinguish between weaknesses (vulnerabilities), potential dangers (threats), and the actual realization of an exploit (attacks) to understand the risk formula.

Malware Types and Characteristics

Identify various forms of malicious software, including viruses, worms, trojans, ransomware, and rootkits, and how they function.

Social Engineering Tactics

Learn how attackers manipulate human psychology through phishing, vishing, baiting, and other deceptive techniques to bypass technical controls.

Network and Injection Attacks

Understand technical exploits such as DoS/DDoS, Man-in-the-Middle (MitM), and injection attacks like SQLi and XSS.

  • DoS/DDoS
  • Man-in-the-Middle (MitM)
  • SQL injection (SQLi)
  • Cross-site scripting (XSS)

General Security Concepts, Threats, and Vulnerabilities

Security Concepts, Threats, Vulnerabilities, and Attacks

Explain security concepts, control categories, cryptographic solutions, threat actors, motivations, threat vectors, vulnerabilities, and indicators of malicious activity.

  • Defense in depth
  • Confidentiality, integrity, and availability (CIA)
  • Authentication, authorization, accounting (AAA)
  • Non-repudiation
  • Zero Trust principles
  • Least privilege
  • Control categories
  • Control types
  • Change management processes
  • Public key infrastructure (PKI)
  • Encryption
  • Digital signatures
  • Hashing algorithms
  • Threats and vulnerabilities
  • Common Vulnerability Scoring System (CVSS)
  • Threat actors and motivations
  • Threat vectors
  • Attack surfaces
  • Malware attacks
  • Social engineering attacks

Change Management and Technical Execution

Change Management and Technical Change Processes

A formal process for managing change through approval processes, impact analysis, and technical execution to avoid downtime and mistakes.

  • Change management
  • Change approval process
  • Impact analysis
  • Sandbox testing environment
  • Backout plan
  • Maintenance window
  • Standard operating procedure
  • Technical change management
  • Allow list / deny list
  • Downtime
  • Legacy applications
  • Dependencies
  • Documentation
  • Version control

Security Architecture

Physical Security Controls

Learn about deterrent, preventive, detective, and corrective controls used to protect hardware, facilities, and environmental systems.

Network Security & Hardening

Understand secure network design principles like segmentation and Zero Trust, along with methods to reduce attack surfaces through hardening.

Cloud Security Models

Encryption, PKI, and Data Obfuscation

Cryptography and Data Obfuscation Technologies

This content covers Public Key Infrastructure, symmetric and asymmetric encryption, data obfuscation techniques, hashing, digital signatures, and blockchain technology.

  • Public Key Infrastructure (PKI)
  • Symmetric encryption
  • Asymmetric encryption
  • Key escrow
  • Data at rest
  • Database encryption
  • Transport encryption
  • Key exchange
  • Trusted Platform Module (TPM)
  • Hardware Security Module (HSM)
  • Key management system
  • Enclave
  • Obfuscation
  • Steganography
  • Tokenization
  • Data masking
  • Hashing
  • Salt
  • Digital signatures
  • Blockchain

Digital Certificates and PKI Trust Models

Information regarding digital certificates, X.509 standards, Certificate Authorities, and certificate revocation methods.

  • Digital certificates
  • X.509 standard
  • Public key certificate
  • Root of trust
  • Certificate Authorities (CA)
  • Certificate signing requests (CSR)
  • Private certificate authorities
  • Self-signed certificates
  • Wildcard certificates
  • Certificate Revocation List (CRL)
  • Online Certificate Status Protocol (OCSP)
  • OCSP stapling

Identity and Access Management

Authentication and Protocols

Authorization Models

Understand how permissions are granted using models like DAC, MAC, RBAC, and the highly granular ABAC.

IAM Lifecycle Management

Master the continuous cycle of provisioning, maintaining (preventing privilege creep), and deprovisioning identities.

Security Architecture, Operations, and Management

Security Awareness and Certification Objectives

Apply security awareness concepts to improve organizational security through various training types, delivery mechanisms, and common training topics.

  • Security awareness concepts
  • Training types
  • Delivery mechanisms
  • Reporting and monitoring of effectiveness
  • Common training topics
  • Social engineering
  • Password and credential management
  • Business email compromise
  • Operational security

Threat Actors, Vectors, and Vulnerabilities

Threat Actors and Common Threat Vectors

This content describes threat actor attributes, motivations, and various threat vectors including message-based, image-based, file-based, and social engineering attacks.

  • Threat actor attributes
  • Motivations of threat actors
  • Nation states
  • Advanced Persistent Threat (APT)
  • Unskilled attackers
  • Hacktivist
  • Insider threat
  • Organized crime
  • Shadow IT
  • Threat vectors
  • Message-based vectors
  • Phishing
  • Social engineering
  • Image-based vectors
  • File-based vectors
  • Voice call vectors
  • Vishing
  • Removable device vectors
  • Vulnerable software vectors
  • Unsupported systems vectors

Common Cybersecurity Vulnerabilities and Attacks

This content covers various security threats including social engineering, memory injection, buffer overflows, race conditions, malicious updates, operating system vulnerabilities, code injection, cross-site scripting, hardware, virtualization, cloud, supply chain, misconfiguration, mobile device, and zero-day vulnerabilities.

  • Misinformation/disinformation
  • Brand impersonation
  • Memory injection
  • DLL injection
  • Buffer overflows
  • Race conditions
  • Time-of-check to time-of-use (TOCTOU)
  • Malicious updates
  • Supply chain attacks
  • Operating system vulnerabilities
  • SQL injection (SQLi)
  • Cross-site scripting (XSS)
  • Persistent (stored) XSS
  • Reflected XSS
  • Hardware vulnerabilities
  • Firmware
  • End-of-life (EOL)
  • End of service life (EOSL)
  • Legacy platforms
  • Virtualization vulnerabilities

Overview of Malware and Physical Attacks

An overview of malware types and methods including viruses, worms, ransomware, and spyware, alongside physical attacks and environmental threats.

  • Malware types
  • Viruses
  • Worms
  • Ransomware
  • Trojan Horse
  • Rootkit
  • Keylogger
  • Spyware
  • Bloatware
  • Logic bomb
  • Fileless virus
  • Program viruses
  • Boot sector viruses
  • Script viruses
  • Macro viruses
  • Physical attacks
  • Brute force
  • RFID cloning
  • Environmental attacks

Common Network and Application Attacks

This content covers various security threats including denial of service, DNS attacks, wireless attacks, on-path attacks, replay attacks, malicious code, and application attacks.

  • Denial of Service
  • Distributed Denial of Service (DDoS)
  • DNS poisoning
  • Domain hijacking
  • URL hijacking
  • Typosquatting
  • Wireless deauthentication
  • On-path attacks
  • ARP poisoning
  • On-browser attack
  • Replay attack
  • Session hijacking
  • Malicious code
  • SQL injection
  • Buffer overflows
  • Privilege escalation
  • Cross-site request forgery (CSRF)
  • Directory traversal

Cryptographic Attacks and Indicators of Compromise

This content covers cryptographic attacks, password security, indicators of compromise, and network segmentation and access control.

  • Birthday attack
  • Hash collision
  • MD5
  • Downgrade attack
  • POODLE vulnerability
  • SSL stripping
  • Plaintext passwords
  • Password hashing
  • SHA-256 hash
  • Spraying attack
  • Brute force attacks
  • Indicators of compromise (IOC)
  • Account lockout
  • Concurrent session usage
  • Impossible travel
  • Resource consumption
  • Resource inaccessibility
  • Out-of-cycle logging
  • Missing logs
  • Network segmentation

Hardening and Secure Infrastructure Techniques

Mitigation and hardening techniques include patching, encryption, monitoring, and least privilege to protect endpoints, cloud infrastructures, and network appliances.

  • Mitigation Techniques
  • Hardening Techniques
  • Patching
  • Encryption
  • Monitoring
  • Least Privilege
  • Configuration Enforcement
  • Decommissioning
  • Endpoint Detection and Response (EDR)
  • Host-based Firewall
  • Host-based Intrusion Prevention System (HIPS)
  • Cloud Infrastructures
  • Cloud Responsibility Matrix
  • Infrastructure as Code
  • Serverless Architecture
  • Microservices and APIs
  • Physical and Logical Segmentation
  • Software Defined Networking (SDN)
  • Virtualization
  • Application Containerization

Data Protection and Resiliency Strategies

This topic covers data types, classifications, states of data, and methods for protecting information through encryption, hashing, and obfuscation, alongside resiliency techniques like high availability, backups, and power resiliency.

  • Data types and classifications
  • Personally Identifiable Information (PII)
  • Protected Health Information (PHI)
  • Data at rest
  • Data in transit
  • Data in use
  • Data sovereignty
  • Geolocation and geofencing
  • Encryption
  • Hashing
  • Obfuscation
  • Masking
  • Tokenization
  • High availability
  • Server clustering
  • Load balancing
  • Site resiliency (Hot, Warm, Cold sites)
  • Capacity planning
  • Recovery testing
  • Backups and snapshots

Hardening Targets and Wireless Security

Establishing secure baselines and hardening targets across various platforms including mobile devices, workstations, cloud infrastructure, and IoT devices while implementing wireless security settings and application security concepts.

  • Secure baselines
  • Hardening targets
  • Mobile Device Management (MDM)
  • Wireless site surveys
  • WPA3
  • Simultaneous Authentication of Equals (SAE)
  • AAA framework
  • RADIUS (Remote Authentication Dial-in User Service)
  • .1X
  • Extensible Authentication Protocol (EAP)
  • Secure coding concepts
  • Input validation
  • Secure cookies

Application Security and Vulnerability Management

This content covers application security techniques, asset management processes, vulnerability scanning, threat intelligence, penetration testing, and security monitoring.

  • Static Application Security Testing (SAST)
  • Code signing
  • Sandboxing
  • Application security monitoring
  • Asset management
  • Media sanitization
  • Physical destruction
  • Data retention
  • Vulnerability scanning
  • Dynamic analysis (fuzzing)
  • Package monitoring
  • Threat intelligence
  • Open-source intelligence (OSINT)
  • Penetration testing
  • Rules of engagement
  • Common Vulnerability Scoring System (CVSS)
  • Common Vulnerabilities and Exposures (CVE)
  • Vulnerability remediation
  • Segmentation
  • Compensating controls

Security Tools and Network Protection

This content covers security tools, firewalls, web filtering, operating system security, secure protocols, email security, monitoring data, and endpoint security.

  • Data Loss Prevention (DLP)
  • Simple Network Management Protocol (SNMP)
  • NetFlow
  • Vulnerability scanners
  • Network-based firewalls
  • Next-generation Firewalls (NGFW)
  • Intrusion Prevention System (IPS)
  • Web Filtering
  • Proxies
  • DNS filtering
  • Active Directory
  • Group Policy
  • Security-Enhanced Linux (SELinux)
  • Secure Protocols
  • Email security
  • Sender Policy Framework (SPF)
  • DMARC
  • File Integrity Monitoring (FIM)
  • Endpoint security
  • Posture assessment

Identity, Access, and Risk Management

This content covers identity and access management, access control models, multifactor authentication, incident response, digital forensics, and risk management strategies.

  • Extended Detection and Response (XDR)
  • User behavior analytics
  • Identity and Access Management (IAM)
  • Identity lifecycle management
  • Authentication and authorization
  • Identity governance
  • Provisioning and de-provisioning
  • Single sign-on (SSO)
  • LDAP (Lightweight Directory Access Protocol)
  • Security Assertion Markup Language (SAML)
  • Federation
  • Mandatory Access Control (MAC)
  • Discretionary Access Control (DAC)
  • Role-based access control (RBAC)
  • Rule-based access control
  • Attribute-based access control (ABAC)
  • Multifactor authentication
  • Biometric authentication
  • Password complexity and length
  • Passwordless authentication

Third-Party Risk, Compliance, and Privacy

This content covers third-party risk assessment, agreement types, compliance reporting, privacy regulations, and cybersecurity audits.

  • Third-party risk assessment
  • Penetration testing
  • Right-to-audit clauses
  • Supply chain analysis
  • Vendor monitoring
  • Service Level Agreement (SLA)
  • Memorandum of Understanding (MOU)
  • Memorandum of Agreement (MOA)
  • Master Service Agreement (MSA)
  • Compliance reporting
  • General Data Protection Regulation (GDPR)
  • Data subject
  • Data owner
  • Data controller
  • Data processor
  • Data inventory
  • Cybersecurity audit
  • Attestation

Penetration Testing and Security Awareness

This content covers penetration testing perspectives, reconnaissance methods, audits, assessments, and security awareness training to mitigate social engineering and anomalous behavior.

  • Physical penetration testing
  • Offensive red team
  • Defensive blue team
  • Integrated pentesting
  • Passive reconnaissance
  • Active reconnaissance
  • External audits
  • Phishing campaigns
  • Anomalous behavior recognition
  • Security awareness metrics
  • User training
  • Social engineering
  • Insider threat
  • Password management
  • Operational security

Security Operations

Monitoring and Detection

Incident Response Lifecycle

Master the structured phases of managing a breach, from preparation and containment to eradication and recovery.

Digital Forensics and Remediation

Understand how to preserve evidence using the chain of custody and order of volatility, and how to remediate vulnerabilities.

Business Continuity and Recovery

Learn to plan for disruptions using RPO (data loss) and RTO (downtime) metrics within BCP and DR frameworks.

Make it your own.

Keep these readings and topics in a new study set, or add them to one you already use.

Get started freeLog in