Chapter 1
Security Operations
Course: Comptia Cysa Cso 003
Subject: Comptia Cysa Plus Cso 003
Chapter: Security Operations
Definitions:
- Threat Intelligence: The proactive gathering, analyzing, and sharing of information about cyber threats to help organizations identify, prevent, and respond effectively to cyber-attacks.
- Threat Hunting: A proactive security practice involving actively searching within networks to identify hidden threats or vulnerabilities that automated systems have missed.
1. Threat Actors
Threat actors refer to individuals, groups, or entities responsible for malicious activities against information systems, motivated by various objectives such as espionage, financial gain, or activism.
1. Advanced Persistent Threat (APT)
Definition:
An Advanced Persistent Threat (APT) refers to a highly organized, sophisticated group of attackers that execute prolonged cyber-attacks, often with state sponsorship. They maintain stealthy, persistent access to targeted systems for espionage, sabotage, or intelligence-gathering purposes.
Characteristics of APTs:
- Persistent access: Maintains long-term, stealthy footholds in compromised networks.
- Sophisticated tools: Custom-developed malware and zero-day exploits.
- Stealth Techniques: Techniques such as fileless malware, rootkits, and advanced obfuscation.