index.html

<!DOCTYPE html>
<html lang="en">

<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <link rel="stylesheet" href="style.css">
    <title>Google CyberSecurity</title>
</head>

<body>
    <header id="main-header">
        <nav id="navbar">
            <h1 id="h11">Google CyberSecurity</h1>
            <ul>
                <div class="head">
                    <li class="nav-link"><a href="#Course 1">
                            <h1 h1 id="h1">Course 1</h1>
                        </a>
                    </li>
                </div>
                <ul>
                    <li class="nav-link"><a href="#Module 11">
                            <h3>Module 1</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#cst">
                                    <h4>Common cybersecurity terminology</h4>
                                </a></li>
                            <li class="nav-link"><a href="#transferable">
                                    <h4>transferable and technical cybersecurity skills </h4>
                                </a></li>
                            <li class="nav-link"><a href="#glossary11">
                                    <h4>Glossary terms from module 1</h4>
                                </a></li>


                        </ul>


                    </li>
                    <li class="nav-link"><a href="#Module 12">
                            <h3>Module 2</h3>
                        </a>

                        <ul>
                            <li class="nav-link"><a href="#attacks">
                                    <h4>Common attacks and their effectiveness</h4>
                                </a></li>
                            <li class="nav-link"><a href="#typeOfAttack">
                                    <h4>Determine the type of attack </h4>
                                </a></li>
                            <li class="nav-link"><a href="#understand">
                                    <h4>Understand attackers</h4>
                                </a></li>

                            <li class="nav-link"><a href="#glossary12">
                                    <h4>Glossary terms from module 2</h4>
                                </a></li>
                        </ul>


                    </li>
                    <li class="nav-link"><a href="#Module 13">
                            <h3>Module 3</h3>
                        </a>

                        <ul>
                            <li class="nav-link"><a href="#frameworks">
                                    <h4>Controls, frameworks, and compliance</h4>
                                </a></li>
                            <li class="nav-link"><a href="#Ethical">
                                    <h4>Ethical concepts that guide cybersecurity decisions </h4>
                                </a></li>
                            <li class="nav-link"><a href="#glossary13">
                                    <h4>Glossary terms from module 3
                                    </h4>
                                </a></li>
                        </ul>


                    </li>
                    <li class="nav-link"><a href="#Module 14">
                            <h3>Module 4</h3>
                        </a>
                        <ul>

                            <li class="nav-link"><a href="#tools">
                                    <h4>Tools for protecting business operations</h4>
                                </a></li>
                            <li class="nav-link"><a href="#useTools">
                                    <h4>Use tools to protect business operations </h4>
                                </a></li>
                            <li class="nav-link"><a href="#glossary14">
                                    <h4>Glossary terms from module 4</h4>
                                </a></li>
                        </ul>


                    </li>

                </ul>

                </li>
                <div class="head">
                    <li class="nav-link"><a href="#Course 2">
                            <h1 h1 id="h1">Course 2</h1>
                        </a>
                    </li>
                </div>
                <ul>
                    <li class="nav-link"><a href="#Module 21">
                            <h3>Module 1</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic211">
                                    <h4>Security domains cybersecurity analysts need to know</h4>
                                </a></li>
                            <li class="nav-link"><a href="#topic212">
                                    <h4>Manage common threats, risks, and vulnerabilities </h4>
                                </a></li>
                            <li class="nav-link"><a href="#topic213">
                                    <h4>Glossary terms from module 1
                                    </h4>
                                </a></li>
                        </ul>

                    </li>
                    <li class="nav-link"><a href="#Module 22">
                            <h3>Module 2</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic221">
                                    <h4>The relationship between frameworks and controls</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic222">
                                    <h4>Use the CIA triad to protect organizations </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic223">
                                    <h4>More about OWASP security principles
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic224">
                                    <h4>More about security audits
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic225">
                                    <h4>Glossary terms from module 2
                                    </h4>
                                </a></li>
                        </ul>
                    </li>
                    <li class="nav-link"><a href="#Module 23">
                            <h3>Module 3</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic231">
                                    <h4>The future of SIEM tools</h4>
                                </a></li>
                            <li class="nav-link"><a href="#topic232">
                                    <h4>More about cybersecurity tools </h4>
                                </a></li>
                            <li class="nav-link"><a href="#topic233">
                                    <h4>Use SIEM tools to protect organizations
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic234">
                                    <h4>Glossary terms from module 3</h4>
                                </a></li>
                        </ul>
                    </li>
                    <li class="nav-link"><a href="#Module 24">
                            <h3>Module 4</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic241">
                                    <h4>More about playbooks </h4>
                                </a></li>
                            <li class="nav-link"><a href="#topic242">
                                    <h4>Playbooks, SIEM tools, and SOAR tools </h4>
                                </a></li>
                            <li class="nav-link"><a href="#topic243">
                                    <h4>Glossary terms from module 4
                                    </h4>
                                </a></li>
                        </ul>
                    </li>

                </ul>
                </li>

                <div class="head">
                    <li class="nav-link"><a href="#Course 3">
                            <h1 h1 id="h1">Course 3</h1>
                        </a>
                    </li>
                </div>

                <ul>
                    <li class="nav-link"><a href="#Module 31">
                            <h3>Module 1</h3>

                            <ul>
                                <li class="nav-link"><a href="#topic311">
                                        <h4>Network components, devices, and diagrams</h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic312">
                                        <h4>Cloud computing and software-defined networks </h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic313">
                                        <h4>Learn more about the TCP/IP model</h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic314">
                                        <h4>The OSI model
                                        </h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic315">
                                        <h4>Components of network layer communication
                                        </h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic316">
                                        <h4>Glossary terms from module 1
                                        </h4>
                                    </a></li>
                            </ul>
                        </a></li>


                    <li class="nav-link"><a href="#Module 32">
                            <h3>Module 2</h3>
                            <ul>
                                <li class="nav-link"><a href="#topic321">
                                        <h4>Common network protocols </h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic322">
                                        <h4>Additional network protocols </h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic323">
                                        <h4>The evolution of wireless security protocols
                                        </h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic324">
                                        <h4>Subnetting and CIDR
                                        </h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic325">
                                        <h4>Virtual networks and privacy
                                        </h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic326">
                                        <h4>VPN protocols: Wireguard and IPSec
                                        </h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic327">
                                        <h4>Glossary terms from module 2
                                        </h4>
                                    </a></li>


                            </ul>


                        </a></li>
                    <li class="nav-link"><a href="#Module 33">
                            <h3>Module 3</h3>

                            <ul>
                                <li class="nav-link"><a href="#topic331">
                                        <h4>How intrusions compromise your system </h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic332">
                                        <h4>Read tcpdump logs </h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic333">
                                        <h4>Real-life DDoS attack
                                        </h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic334">
                                        <h4>Overview of interception tactics
                                        </h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic335">
                                        <h4>Glossary terms from module 3
                                        </h4>
                                    </a></li>
                            </ul>
                        </a></li>
                    <li class="nav-link"><a href="#Module 34">
                            <h3>Module 4</h3>

                            <ul>
                                <li class="nav-link"><a href="#topic341">
                                        <h4>Brute force attacks and OS hardening</h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic342">
                                        <h4>Network security applications</h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic343">
                                        <h4>Secure the cloud
                                        </h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic344">
                                        <h4>Cryptography and cloud security
                                        </h4>
                                    </a></li>

                                <li class="nav-link"><a href="#topic345">
                                        <h4>Glossary terms from module 4
                                        </h4>
                                    </a></li>
                            </ul>
                        </a></li>

                </ul>
                </li>
                <div class="head">
                    <li class="nav-link"><a href="#Course 4">
                            <h1 h1 id="h1">Course 4</h1>
                        </a>


                    </li>
                </div>

                <ul>
                    <li class="nav-link"><a href="#Module 41">
                            <h3>Module 1</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic411">
                                    <h4>Compare operating systems </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic412">
                                    <h4>Requests to the operating system</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic413">
                                    <h4>Virtualization technology
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic414">
                                    <h4>The command line in use
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic415">
                                    <h4>Glossary terms from module 1

                                    </h4>
                                </a></li>
                        </ul>
                        </a>
                    </li>
                    </li>
                    <li class="nav-link"><a href="#Module 42">
                            <h3>Module 2</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic421">
                                    <h4>Linux architecture explained</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic422">
                                    <h4>More Linux distributions</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic423">
                                    <h4>Package managers for installing applications
                                    </h4>
                                </a></li>


                            <li class="nav-link"><a href="#topic424">
                                    <h4>Different types of shells
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic425">
                                    <h4>Glossary terms from module 2 </h4>
                                </a></li>
                        </ul>
                        </a>
                    </li>
                    </li>
                    <li class="nav-link"><a href="#Module 43">
                            <h3>Module 3</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic431">
                                    <h4>Navigate Linux and read file content </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic432">
                                    <h4>Filter content in Linux</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic433">
                                    <h4>Manage directories and files
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic434">
                                    <h4>Permission commands
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic435">
                                    <h4>Responsible use of sudo
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic436">
                                    <h4>Linux resources
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic437">
                                    <h4>Glossary terms from module 3
                                    </h4>
                                </a></li>
                        </ul>
                        </a>


                    </li>
                    </li>
                    <li class="nav-link"><a href="#Module 44">
                            <h3>Module 4</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic441">
                                    <h4>SQL filtering versus Linux filtering</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic442">
                                    <h4>Query a database </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic443">
                                    <h4>Resources for completing SQL labs
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic444">
                                    <h4>The WHERE clause and basic operators
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic445">
                                    <h4>Operators for filtering dates and numbers
                                    </h4>
                                </a></li>


                            <li class="nav-link"><a href="#topic445">
                                    <h4>More on filters with AND, OR, and NOT
                                    </h4>
                                </a></li>


                            <li class="nav-link"><a href="#topic446">
                                    <h4>Compare types of joins
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic447">
                                    <h4>Continuous learning in SQL
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic448">
                                    <h4>Glossary terms from module 4
                                    </h4>
                                </a></li>
                        </ul>
                        </a>
                    </li>
                    </li>

                </ul>
                </li>


                <div class="head">
                    <li class="nav-link"><a href="#Course 5">
                            <h1 h1 id="h1">Course 5</h1>
                        </a>
                    </li>
                </div>

                <ul>
                    <li class="nav-link"><a href="#Module 51">
                            <h3>Module 1</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic511">
                                    <h4>Understand risks, threats, and vulnerabilities</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic512">
                                    <h4>Common classification requirements </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic513">
                                    <h4>The emergence of cloud security
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic514">
                                    <h4>Security guidelines in action
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic515">
                                    <h4>Glossary terms from module 1
                                    </h4>
                                </a></li>
                        </ul>
                        </a>
                    </li>
                    </li>
                    <li class="nav-link"><a href="#Module 52">
                            <h3>Module 2</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic521">
                                    <h4>Principle of least privilege </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic522">
                                    <h4>The data lifecycle </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic523">
                                    <h4>Information privacy: Regulations and compliance
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic524">
                                    <h4>Symmetric and asymmetric encryption
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic525">
                                    <h4>The evolution of hash functions
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic526">
                                    <h4>The rise of SSO and MFA
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic527">
                                    <h4>Identity and access management
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic528">
                                    <h4>Glossary terms from module 2

                                    </h4>
                                </a></li>


                        </ul>
                        </a>
                    </li>
                    </li>
                    <li class="nav-link"><a href="#Module 53">
                            <h3>Module 3</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic531">
                                    <h4>The OWASP Top 10</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic532">
                                    <h4>Open source intelligence</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic533">
                                    <h4>Approaches to vulnerability scanning
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic534">
                                    <h4>The importance of updates
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic535">
                                    <h4>Penetration testing
                                    </h4>
                                </a></li>
                            <li class="nav-link"><a href="#topic536">
                                    <h4>Approach cybersecurity with an attacker mindset
                                    </h4>
                                </a></li>
                            <li class="nav-link"><a href="#topic537">
                                    <h4>Types of threat actors
                                    </h4>
                                </a></li>
                            <li class="nav-link"><a href="#topic538">
                                    <h4>Fortify against brute force cyber attacks
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic539">
                                    <h4>Glossary terms from module 3
                                    </h4>
                                </a></li>
                        </ul>
                        </a>
                    </li>
                    </li>
                    <li class="nav-link"><a href="#Module 54">
                            <h3>Module 4</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic541">
                                    <h4>Social engineering tactics</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic542">
                                    <h4>Types of phishing</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic543">
                                    <h4>An introduction to malware
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic544">
                                    <h4>Prevent injection attacks
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic545">
                                    <h4>Traits of an effective threat model
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic546">
                                    <h4>Glossary terms from module 4
                                    </h4>
                                </a></li>
                        </ul>
                        </a>
                    </li>
                    </li>

                </ul>
                </li>
                <div class="head">
                    <li class="nav-link"><a href="#Course 6">
                            <h1 h1 id="h1">Course 6</h1>
                        </a>
                    </li>
                </div>

                <ul>
                    <li class="nav-link"><a href="#Module 61">
                            <h3>Module 1</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic611">
                                    <h4>Roles in response </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic612">
                                    <h4>Overview of detection tools </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic613">
                                    <h4>Overview of SIEM technology
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic614">
                                    <h4>Glossary terms from module 1
                                    </h4>
                                </a></li>


                        </ul>
                        </a>
                    </li>
                    </li>
                    <li class="nav-link"><a href="#Module 62">
                            <h3>Module 2</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic621">
                                    <h4>Maintain awareness with network monitoring </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic622">
                                    <h4>Learn more about packet captures

                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic623">
                                    <h4>Investigate packet details
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic624">
                                    <h4>Overview of tcpdump
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic625">
                                    <h4>Glossary terms from module 2
                                    </h4>
                                </a></li>


                        </ul>
                        </a>
                    </li>
                    </li>
                    <li class="nav-link"><a href="#Module 63">
                            <h3>Module 3</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic631">
                                    <h4>Cybersecurity incident detection methods</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic632">
                                    <h4>Indicators of compromise</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic633">
                                    <h4>Analyze indicators of compromise with investigative tools
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic634">
                                    <h4>Best practices for effective documentation
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic635">
                                    <h4>The triage process
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic636">
                                    <h4>Business continuity considerations


                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic637">
                                    <h4>Post-incident review
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic638">
                                    <h4>Glossary terms from module 3
                                    </h4>
                                </a></li>
                        </ul>
                        </a>
                    </li>
                    </li>
                    <li class="nav-link"><a href="#Module 64">
                            <h3>Module 4</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic641">
                                    <h4>Best practices for log collection and management</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic642">
                                    <h4>Overview of log file formats

                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic643">
                                    <h4> Detection tools and techniques


                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic644">
                                    <h4>Overview of Suricata
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic645">
                                    <h4>Log sources and log ingestion
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic646">
                                    <h4>Search methods with SIEM tools
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic647">
                                    <h4>Glossary terms from module 4
                                    </h4>
                                </a></li>
                        </ul>
                        </a>
                    </li>
                    </li>

                </ul>
                </li>
                <div class="head">
                    <li class="nav-link"><a href="#Course 7">
                            <h1 h1 id="h1">Course 7</h1>
                        </a>
                    </li>
                </div>

                <ul>
                    <li class="nav-link"><a href="#Module 71">
                            <h3>Module 1</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic711">
                                    <h4>Get to know Python </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic712">
                                    <h4>Python environments </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic713">
                                    <h4>More about data types
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic714">
                                    <h4>Assign and reassign variables in Python
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic715">
                                    <h4>More on conditionals in Python
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic716">
                                    <h4>More on loops in Python
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic717">
                                    <h4>Glossary terms from module 1
                                    </h4>
                                </a></li>


                        </ul>
                        </a>
                    </li>
                    </li>
                    <li class="nav-link"><a href="#Module 72">
                            <h3>Module 2</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic721">
                                    <h4>Python functions in cybersecurity</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic722">
                                    <h4>Functions and variables</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic723">
                                    <h4>Work with built-in functions
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic724">
                                    <h4>Import modules and libraries in Python
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic725">
                                    <h4>Ensure proper syntax and readability in Python
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic726">
                                    <h4>Glossary terms from module 2
                                    </h4>
                                </a></li>


                        </ul>
                        </a>
                    </li>
                    </li>
                    <li class="nav-link"><a href="#Module 73">
                            <h3>Module 3</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic731">
                                    <h4>Strings and the security analyst </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic732">
                                    <h4>Lists and the security analyst </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic733">
                                    <h4>More about regular expressions
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic734">
                                    <h4>Glossary terms from module 3
                                    </h4>
                                </a></li>


                        </ul>
                        </a>
                    </li>
                    </li>
                    <li class="nav-link"><a href="#Module 74">
                            <h3>Module 4</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic741">
                                    <h4>Essential Python components for automation </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic742">
                                    <h4>Import files into Python</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic743">
                                    <h4>Work with files in Python
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic744">
                                    <h4>Explore debugging techniques
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic745">
                                    <h4>Glossary terms from module 4
                                    </h4>
                                </a></li>
                        </ul>
                        </a>
                    </li>
                    </li>

                </ul>
                </li>
                <div class="head">
                    <li class="nav-link"><a href="#Course 8">
                            <h1 h1 id="h1">Course 8</h1>
                        </a>
                    </li>
                </div>

                <ul>
                    <li class="nav-link"><a href="#Module 81">
                            <h3>Module 1</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic811">
                                    <h4>Data and asset classification</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic812">
                                    <h4>Disaster recovery and business continuity</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic813">
                                    <h4>Juliana's story: Asset protection
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic814">
                                    <h4>lossary terms from module 1
                                    </h4>
                                </a></li>


                        </ul>
                        </a>
                    </li>
                    </li>
                    <li class="nav-link"><a href="#Module 82">
                            <h3>Module 2</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic821">
                                    <h4>Escalate with a purpose</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic822">
                                    <h4>Recognize roles and responsibilities during escalation</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic823">
                                    <h4>Escalation timing
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic824">
                                    <h4>Juliana's story: Attention to detail
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic825">
                                    <h4>Glossary terms from module 2
                                    </h4>
                                </a></li>


                        </ul>
                        </a>
                    </li>
                    </li>
                    <li class="nav-link"><a href="#Module 83">
                            <h3>Module 3</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic831">
                                    <h4>The purpose and impact of stakeholders</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic832">
                                    <h4>Communicate effectively with stakeholders</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic833">
                                    <h4>Create visual dashboards for impactful cybersecurity communications
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic834">
                                    <h4>Juliana’s story: Effective communication
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic835">
                                    <h4>Glossary terms from module 3
                                    </h4>
                                </a></li>


                        </ul>
                        </a>
                    </li>
                    </li>
                    <li class="nav-link"><a href="#Module 84">
                            <h3>Module 4</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic841">
                                    <h4>Strategies for engaging with the cybersecurity community</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic842">
                                    <h4>Connect with other cybersecurity professionals</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic843">
                                    <h4>Glossary terms from module 4

                                    </h4>
                                </a></li>


                        </ul>
                        </a>
                    </li>
                    </li>

                    <li class="nav-link"><a href="#Module 85">
                            <h3>Module 5</h3>
                        </a>
                        <ul>
                            <li class="nav-link"><a href="#topic851">
                                    <h4>Tips for finding and applying for a job</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic852">
                                    <h4>The interview process</h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic853">
                                    <h4>Prepare for technical interviews
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic854">
                                    <h4>Apply the STAR method during interviews
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic855">
                                    <h4>Prepare for interviews
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic856">
                                    <h4>Prepare for interviews with Interview Warmup
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic857">
                                    <h4>Learn more about developing an elevator pitch
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic858">
                                    <h4>Tips for interviewing remotely
                                    </h4>
                                </a></li>

                            <li class="nav-link"><a href="#topic859">
                                    <h4>Glossary terms from module 5
                                    </h4>
                                </a></li>

                        </ul>
                        </a>
                    </li>
                    </li>


                </ul>
                </li>
            </ul>
        </nav>
    </header>


    <!-- Main-Content -->

    <main id="main-doc">
        <section class="main-section" id="Module 11">
            <h2>Module 1</h2>
        </section>
        <section class="main-section" id="cst">

            <h2>Common cybersecurity terminology</h2>
            <article class="main-article">
                <p>As you’ve learned, <span><strong>cybersecurity</strong></span> (also known as security) is the
                    practice of ensuring confidentiality, integrity, and availability of information by protecting
                    networks, devices, people, and data from unauthorized access or criminal exploitation. In this
                    reading, you’ll be introduced to some key terms used in the cybersecurity profession. Then, you’ll
                    be provided with a resource that’s useful for staying informed about changes to cybersecurity
                    terminology.</p>

                <h4>Key cybersecurity terms and concepts</h4>
                <p>There are many terms and concepts that are important for security professionals to know. Being
                    familiar with them can help you better identify the threats that can harm organizations and people
                    alike. A security analyst or cybersecurity analyst focuses on monitoring networks for breaches. They
                    also help develop strategies to secure an organization and research information technology (IT)
                    security trends to remain alert and informed about potential threats. Additionally, an analyst works
                    to prevent incidents. In order for analysts to effectively do these types of tasks, they need to
                    develop knowledge of the following key concepts. </p>


                <ul>
                    <li><span><strong>Compliance</strong></span> is the process of adhering to internal standards and
                        external regulations and enables organizations to avoid fines and security breaches.</li>


                    <li><span><strong>Security Frameworks</strong></span> are guidelines used for building plans to help
                        mitigate risks and threats to data and privacy.</li>

                    <li><strong>Security controls</strong> are safeguards designed to reduce specific security risks.
                        They are used with security frameworks to establish a strong security posture.</li>

                    <li><strong>Security Posture</strong>is an organization’s ability to manage its defense of critical
                        assets and data and react to change. A strong security posture leads to lower risk for the
                        organization.</li>


                    <li>A <span><strong>threat actor</strong></span>, or malicious attacker, is any person or group who
                        presents a security risk. This risk can relate to computers, applications, networks, and data
                    </li>

                    <li>An <span><strong>internal threat</strong></span> can be a current or former employee, an
                        external vendor, or a trusted partner who poses a security risk. At times, an internal threat is
                        accidental. For example, an employee who accidentally clicks on a malicious email link would be
                        considered an accidental threat. Other times, the internal threat actor intentionally engages in
                        risky activities, such as unauthorized data access.</li>

                    <li><strong>Network security</strong> is the practice of keeping an organization's network
                        infrastructure secure from unauthorized access. This includes data, services, systems, and
                        devices that are stored in an organization’s network.</li>

                    <li><strong>Cloud Security</strong> is the process of ensuring that assets stored in the cloud are
                        properly configured, or set up correctly, and access to those assets is limited to authorized
                        users. The cloud is a network made up of a collection of servers or computers that store
                        resources and data in remote physical locations known as data centers that can be accessed via
                        the internet. Cloud security is a growing subfield of cybersecurity that specifically focuses on
                        the protection of data, applications, and infrastructure in the cloud.

                    </li>

                    <li><strong>Programming</strong> is a process that can be used to create a specific set of
                        instructions for a computer to execute tasks. These tasks can include:
                        <ol>
                            <li>Automation of repetitive tasks (e.g., searching a list of malicious domains)</li>
                            <li>Reviewing web traffic </li>
                            <li>Alerting suspicious activity</li>
                        </ol>
                    </li>
                </ul>

            </article>
        </section>


        <section class="main-section" id="transferable">

            <h2>Transferable and technical cybersecurity skills </h2>

            <article class="main-article">
                <p>Previously, you learned that cybersecurity analysts need to develop certain core skills to be
                    successful at work. Transferable skills are skills from other areas of study or practice that can
                    apply to different careers. <span><strong>Technical skills</strong></span> may apply to several
                    professions, as well; however, they typically require knowledge of specific tools, procedures, and
                    policies. In this reading, you’ll explore both transferable skills and technical skills further.</p>

                <h4>Transferable skills</h4>
                <p>You have probably developed many transferable skills through life experiences; some of those skills
                    will help you thrive as a cybersecurity professional. These include:</p>

                <ol>
                    <li><strong>Communication</strong>: As a cybersecurity analyst, you will need to communicate and
                        collaborate with others. Understanding others’ questions or concerns and communicating
                        information clearly to individuals with technical and non-technical knowledge will help you
                        mitigate security issues quickly. </li>
                    <li><strong>Problem-solving</strong>: One of your main tasks as a cybersecurity analyst will be to
                        proactively identify and solve problems. You can do this by recognizing attack patterns, then
                        determining the most efficient solution to minimize risk. Don't be afraid to take risks, and try
                        new things. Also, understand that it's rare to find a perfect solution to a problem. You’ll
                        likely need to compromise.</li>
                    <li><strong>Time management</strong>: Having a heightened sense of urgency and prioritizing tasks
                        appropriately is essential in the cybersecurity field. So, effective time management will help
                        you minimize potential damage and risk to critical assets and data. Additionally, it will be
                        important to prioritize tasks and stay focused on the most urgent issue.</li>
                    <li><strong>Growth mindset</strong>: This is an evolving industry, so an important transferable
                        skill is a willingness to learn. Technology moves fast, and that's a great thing! It doesn't
                        mean you will need to learn it all, but it does mean that you’ll need to continue to learn
                        throughout your career. Fortunately, you will be able to apply much of what you learn in this
                        program to your ongoing professional development.</li>
                    <li><strong>Diverse perspectives</strong>: The only way to go far is together. By having respect for
                        each other and encouraging diverse perspectives and mutual respect, you’ll undoubtedly find
                        multiple and better solutions to security problems. </li>
                </ol>
            </article>
        </section>


        <section class="main-section" id="glossary11">
            <h2>Glossary terms from module 1</h2>
            <article class="main-article">

                <ul>
                    <li><strong>Cybersecurity (or security)</strong>: The practice of ensuring confidentiality,
                        integrity, and availability of information by protecting networks, devices, people, and data
                        from unauthorized access or criminal exploitation</li>

                    <li><strong>Cloud security</strong>: The process of ensuring that assets stored in the cloud are
                        properly configured and access to those assets is limited to authorized users</li>

                    <li><strong>Internal threat</strong>: A current or former employee, external vendor, or trusted
                        partner who poses a security risk</li>
                    <li><strong>Network security</strong>: The practice of keeping an organization's network
                        infrastructure secure from unauthorized access</li>

                    <li><strong>Personally identifiable information (PII)</strong>: Any information used to infer an
                        individual’s identity</li>

                    <li><strong>Security posture</strong>: An organization’s ability to manage its defense of critical
                        assets and data and react to change </li>
                    <li><strong>Sensitive personally identifiable information (SPII)</strong>: A specific type of PII
                        that falls under stricter handling guidelines</li>
                    <li><strong>Technical skills</strong>: Skills that require knowledge of specific tools, procedures,
                        and policies </li>
                    <li><strong>Threat</strong>: Any circumstance or event that can negatively impact assets</li>
                    <li><strong>threat actor</strong>: Any person or group who presents a security risk

                    </li>
                    <li><strong>Transferable skills</strong>: Skills from other areas that can apply to different
                        careers </li>
                </ul>
            </article>

        </section>

        <section class="main-section" id="Module 12">
            <h2>Module 2</h2>
        </section>


        <section class="main-section" id="attacks">
            <h2>Common attacks and their effectiveness</h2>

            <article class="main-article">
                <p>Previously, you learned about past and present attacks that helped shape the cybersecurity industry.
                    These included the LoveLetter attack, also called the ILOVEYOU virus, and the Morris worm. One
                    outcome was the establishment of response teams, which are now commonly referred to as computer
                    security incident response teams (CSIRTs). In this reading, you will learn more about common methods
                    of attack. Becoming familiar with different attack methods, and the evolving tactics and techniques
                    threat actors use, will help you better protect organizations and people.</p>

                <h4>Phishing</h4>
                <p><strong>Phishing </strong> is the use of digital communications to trick people into revealing
                    sensitive data or deploying malicious software. </p>

                <header>Some of the most common types of phishing attacks today include: </header>
                <ul>
                    <li><strong>Business Email Compromise (BEC)</strong>: A threat actor sends an email message that
                        seems to be from a known source to make a seemingly legitimate request for information, in order
                        to obtain a financial advantage.</li>
                    <li><strong>Spear phishing</strong>: A malicious email attack that targets a specific user or group
                        of users. The email seems to originate from a trusted source.</li>
                    <li><strong>Whaling</strong>: A form of spear phishing. Threat actors target company executives to
                        gain access to sensitive data.</li>

                    <li><strong>Vishing</strong>: The exploitation of electronic voice communication to obtain sensitive
                        information or to impersonate a known source.</li>

                    <li><strong>Smishing</strong>: The use of text messages to trick users, in order to obtain sensitive
                        information or to impersonate a known source.</li>
                </ul>

                <h4>Malware</h4>
                <p><strong>Malware</strong> is software designed to harm devices or networks. There are many types of
                    malware. The primary purpose of malware is to obtain money, or in some cases, an intelligence
                    advantage that can be used against a person, an organization, or a territory.

                </p>

                <header>Some of the most common types of malware attacks today include:</header>
                <ul>
                    <li><strong>Viruses</strong>: Malicious code written to interfere with computer operations and cause
                        damage to data and software. A virus needs to be initiated by a user (i.e., a threat actor), who
                        transmits the virus via a malicious attachment or file download. When someone opens the
                        malicious attachment or download, the virus hides itself in other files in the now infected
                        system. When the infected files are opened, it allows the virus to insert its own code to damage
                        and/or destroy data in the system.</li>

                    <li><strong>Worms</strong>: Malware that can duplicate and spread itself across systems on its own.
                        In contrast to a virus, a worm does not need to be downloaded by a user. Instead, it
                        self-replicates and spreads from an already infected computer to other devices on the same
                        network.</li>

                    <li><strong>Ransomware</strong>: A malicious attack where threat actors encrypt an organization's
                        data and demand payment to restore access. </li>

                    <li><strong>Spyware</strong>: Malware that’s used to gather and sell information without consent.
                        Spyware can be used to access devices. This allows threat actors to collect personal data, such
                        as private emails, texts, voice and image recordings, and locations.</li>
                </ul>

                <h4>Social Engineering</h4>
                <p><strong>Social engineering</strong> is a manipulation technique that exploits human error to gain
                    private information, access, or valuables. Human error is usually a result of trusting someone
                    without question. It’s the mission of a threat actor, acting as a social engineer, to create an
                    environment of false trust and lies to exploit as many people as possible. </p>

                <header>Some of the most common types of social engineering attacks today include:</header>
                <ul>
                    <li><strong>Social media phishing</strong>: A threat actor collects detailed information about their
                        target from social media sites. Then, they initiate an attack.</li>
                    <li><strong>Watering hole attack</strong>: A threat actor attacks a website frequently visited by a
                        specific group of users.</li>
                    <li><strong>USB baiting</strong>: A threat actor strategically leaves a malware USB stick for an
                        employee to find and install, to unknowingly infect a network.

                    </li>
                    <li><strong>Physical social engineering</strong>: A threat actor impersonates an employee, customer,
                        or vendor to obtain unauthorized access to a physical location.</li>
                </ul>

                <h4>Social engineering principles </h4>
                <p><strong>Social engineering</strong> is incredibly effective. This is because people are generally
                    trusting and conditioned to respect authority. The number of social engineering attacks is
                    increasing with every new social media application that allows public access to people's data.
                    Although sharing personal data—such as your location or photos—can be convenient, it’s also a risk.
                </p>

                <header>Reasons why social engineering attacks are effective include:</header>

                <ul>
                    <li><strong>Authority</strong>: Threat actors impersonate individuals with power. This is because
                        people, in general, have been conditioned to respect and follow authority figures.</li>
                    <li><strong>Intimidation</strong>: Threat actors use bullying tactics. This includes persuading and
                        intimidating victims into doing what they’re told. </li>
                    <li><strong>Consensus/Social proof</strong>: Because people sometimes do things that they believe
                        many others are doing, threat actors use others’ trust to pretend they are legitimate. For
                        example, a threat actor might try to gain access to private data by telling an employee that
                        other people at the company have given them access to that data in the past. </li>
                    <li><strong>Scarcity</strong>: A tactic used to imply that goods or services are in limited supply.
                    </li>
                    <li><strong>Familiarity</strong>: Threat actors establish a fake emotional connection with users
                        that can be exploited. </li>
                    <li><strong>Trust</strong>: Threat actors establish an emotional relationship with users that can be
                        exploited over time. They use this relationship to develop trust and gain personal information.

                    </li>
                    <li> <strong>Urgency</strong>: A threat actor persuades others to respond quickly and without
                        questioning.

                    </li>
                </ul>


            </article>
        </section>

        <section class="main-section" id="typeOfAttack">
            <h2>Determine the type of attack</h2>
            <article class="main-article">
                <p>Previously, you learned about the eight Certified Information Systems Security Professional (CISSP)
                    security domains. The domains can help you better understand how a security analyst's job duties can
                    be organized into categories. Additionally, the domains can help establish an understanding of how
                    to manage risk. In this reading, you will learn about additional methods of attack. You’ll also be
                    able to recognize the types of risk these attacks present.</p> <br>

                <img src="resource/course2para1.png" alt="" id="img">

                <h4>Attack types</h4>

                <p>
                    <strong>Password attack</strong>
                    A <span><strong></strong></span> is an attempt to access password-secured devices, systems,
                    networks, or data. Some forms of password attacks that you’ll learn about later in the certificate
                    program are:

                <ul>
                    <li> Brute force</li>
                    <li>Rainbow table</li>
                    <p>Password attacks fall under the communication and network security domain. </p>
                </ul>
                </p>

                <h4>Social engineering attack</h4>
                <p><strong>Social engineering</strong> is a manipulation technique that exploits human error to gain
                    private information, access, or valuables. Some forms of social engineering attacks that you will
                    continue to learn about throughout the program are: </p>
                <ul>
                    <li>Phishing</li>

                    <li>Smishing</li>

                    <li>Vishing</li>

                    <li>Spear phishing</li>

                    <li>Whaling</li>

                    <li>Social media phishing</li>

                    <li>Business Email Compromise (BEC)</li>

                    <li>Watering hole attack</li>


                    <li>USB (Universal Serial Bus) baiting</li>

                    <li>Physical social engineering </li>
                    <p>Social engineering attacks are related to the security and risk management domain.</p>
                </ul>

                <h4>Adversarial artificial intelligence</h4>
                <p><strong>Adversarial artificial intelligence</strong> is a technique that manipulates
                    technology to conduct attacks more efficiently. Adversarial artificial intelligence falls under both
                    the communication and network security and the identity and access management domains.</p> <br>


                <h4>Supply-chain attack</h4>
                <p>A <strong>upply-chain attack</strong> targets systems, applications, hardware, and/or software to
                    locate a vulnerability where malware can be deployed. Because every item sold undergoes a process
                    that involves third parties, this means that the security breach can occur at any point in the
                    supply chain. These attacks are costly because they can affect multiple organizations and the
                    individuals who work for them. Supply-chain attacks can fall under several domains, including but
                    not limited to the security and risk management, security architecture and engineering, and security
                    operations domains.</p> <br>

                <h4>Cryptographic attack</h4>
                <p>A <strong>cryptographic attack</strong> affects secure forms of communication between a sender and
                    intended recipient. Some forms of cryptographic attacks are:
                <ul>
                    <li>Birthday</li>
                    <li>Collision</li>
                    <li>Downgrade</li>
                    <p>Cryptographic attacks fall under the communication and network security domain. </p>
                </ul>
                </p> <br>

            </article>
        </section>


        <section class="main-section" id="understand">
            <h2>Understand attackers</h2>
            <article class="main-article">
                <p>Previously, you were introduced to the concept of threat actors. As a reminder, a threat actor is any
                    person or group who presents a security risk. In this reading, you’ll learn about different types of
                    <strong>threat actors</strong>. You will also learn about their motivations, intentions, and how
                    they’ve influenced the security industry.
                </p> <br>

                <h4>Threat actor types</h4>
                <h5>Advanced persistent threats</h5>
                <p>Advanced persistent threats (APTs) have significant expertise accessing an organization's network
                    without authorization. APTs tend to research their targets (e.g., large corporations or government
                    entities) in advance and can remain undetected for an extended period of time. Their intentions and
                    motivations can include:
                <ul>
                    <li>Damaging critical infrastructure, such as the power grid and natural resources</li>
                    <li> Gaining access to intellectual property, such as trade secrets or patents

                    </li>
                </ul>
                </p> <br>


                <h4>Insider threats</h4>
                <p>Insider threats abuse their authorized access to obtain data that may harm an organization. Their
                    intentions and motivations can include: <br>
                <ul>
                    <li>Sabotage</li>
                    <li>Corruption</li>
                    <li>Espionage</li>
                    <li>Unauthorized data access or leaks </li>
                </ul>

                </p><br>

                <h4>Hacktivists</h4>
                <p>Hacktivists are threat actors that are driven by a political agenda. They abuse digital technology to
                    accomplish their goals, which may include:
                <ul>
                    <li>Demonstrations</li>
                    <li>Propaganda</li>
                    <li>Social change campaigns</li>
                    <li>Fame</li>
                </ul>
                </p>

                <h4>Hacker types</h4>
                <img src="resource/course1module2img2.png" alt="" id="img">
                <p>A <strong>hacker</strong> is any person who uses computers to gain access to computer systems,
                    networks, or data. They can be beginner or advanced technology professionals who use their skills
                    for a variety of reasons. There are three main categories of hackers. <br>
                <ul>
                    <li>Authorized hackers are also called ethical hackers. They follow a code of ethics and adhere to
                        the law to conduct organizational risk evaluations. They are motivated to safeguard people and
                        organizations from malicious threat actors.</li>
                    <li>Semi-authorized hackers are considered researchers. They search for vulnerabilities but don’t
                        take advantage of the vulnerabilities they find.

                    </li>
                    <li>Unauthorized hackers are also called unethical hackers. They are malicious threat actors who do
                        not follow or respect the law. Their goal is to collect and sell confidential data for financial
                        gain. </li>
                </ul>
                </p>
                <p><strong>Note:</strong> There are multiple hacker types that fall into one or more of these three
                    categories.</p>

                <p>New and unskilled threat actors have various goals, including:
                <ul>
                    <li>To learn and enhance their hacking skills</li>
                    <li>To seek revenge</li>
                    <li>To exploit security weaknesses by using existing malware, programming scripts, and other tactics
                    </li>

                    <p>Other types of hackers are not motivated by any particular agenda other than completing the job
                        they were contracted to do. These types of hackers can be considered unethical or ethical
                        hackers. They have been known to work on both illegal and legal tasks for pay.
                        <br>
                        <br>
                        There are also hackers who consider themselves vigilantes. Their main goal is to protect the
                        world from unethical hackers.
                    </p>

                </ul>
                </p>
            </article>
        </section> <br> <br> <br>


        <section class="main-section" id="glossary12">

            <article class="main-article">
                <ul>
                    <li> Adversarial artificial intelligence (AI): A technique that manipulates artificial intelligence
                        (AI) and machine learning (ML) technology to conduct attacks more efficiently </li>

                    <li><strong>Business Email Compromise (BEC)</strong>: A type of phishing attack where a threat actor
                        impersonates a known source to obtain financial advantage</li>

                    <li><strong>CISSP</strong>: Certified Information Systems Security Professional is a globally
                        recognized and highly sought-after information security certification, awarded by the
                        International Information Systems Security Certification Consortium </li>

                    <li><strong>Computer virus</strong>: Malicious code written to interfere with computer operations
                        and cause damage to data and software </li>

                    <li><strong>Cryptographic attack</strong>: An attack that affects secure forms of communication
                        between a sender and intended recipient</li>

                    <li><strong>Hackerstrong</strong>: Any person who uses computers to gain access to computer systems,
                        networks, or data</li>

                    <li><strong>Malware</strong>: Software designed to harm devices or networks</li>

                    <li><strong>Password attack</strong>: An attempt to access password secured devices, systems,
                        networks, or data</li>

                    <li><strong>Phishing</strong>: The use of digital communications to trick people into revealing
                        sensitive data or deploying malicious software</li>

                    <li><strong>Physical attack</strong>: A security incident that affects not only digital but also
                        physical environments where the incident is deployed</li>

                    <li><strong>Physical social engineering</strong>: An attack in which a threat actor impersonates an
                        employee, customer, or vendor to obtain unauthorized access to a physical location</li>

                    <li><strong>Social engineering</strong>: A manipulation technique that exploits human error to gain
                        private information, access, or valuables</li>

                    <li><strong>Social media phishing</strong>: A type of attack where a threat actor collects detailed
                        information about their target on social media sites before initiating the attack</li>

                    <li><strong>Spear phishing</strong>: A malicious email attack targeting a specific user or group of
                        users, appearing to originate from a trusted source</li>

                    <li><strong>Supply-chain attack</strong>: An attack that targets systems, applications, hardware,
                        and/or software to locate a vulnerability where malware can be deployed</li>

                    <li><strong>USB baiting</strong>: An attack in which a threat actor strategically leaves a malware
                        USB stick for an employee to find and install to unknowingly infect a network</li>

                    <li><strong>Virus</strong>: refer to “computer virus”</li>

                    <li><strong>Vishing</strong>: The exploitation of electronic voice communication to obtain sensitive
                        information or to impersonate a known source</li>

                    <li><strong>Watering hole attack</strong>: A type of attack when a threat actor compromises a
                        website frequently visited by a specific group of users</li>
                </ul>


            </article>
        </section>


        <section class="main-section" id="Module 13">
            <h2>Module 3</h2>
        </section>


        <section class="main-section" id="frameworks">
            <h2>Controls, frameworks, and compliance</h2>

            <article class="main-article">
                <p>Previously, you were introduced to security frameworks and how they provide a structured approach to
                    implementing a security lifecycle. As a reminder, a security lifecycle is a constantly evolving set
                    of policies and standards. In this reading, you will learn more about how security frameworks,
                    controls, and compliance regulations—or laws—are used together to manage security and make sure
                    everyone does their part to minimize risk.</p>

                <h4>How controls, frameworks, and compliance are related</h4>
                <p>The <span><strong>confidentiality, integrity, and availability (CIA) triad</strong></span> is a model
                    that helps inform how organizations consider risk when setting up systems and security policies.
                </p>

                <img src="resource/course1module31.png" alt="" id="img">
                <p>CIA are the three foundational principles used by cybersecurity professionals to establish
                    appropriate controls that mitigate threats, risks, and vulnerabilities.
                    <br> <br>
                    As you may recall, <span><strong>security controls</strong></span> are safeguards designed to reduce
                    specific security risks. So they are used alongside frameworks to ensure that security goals and
                    processes are implemented correctly and that organizations meet regulatory compliance requirements.
                </p>

                <p>
                    Security frameworks are guidelines used for building plans to help mitigate risks and threats to
                    data and privacy. They have four core components:
                <ul id="list">
                    <li>Identifying and documenting security goals </li>

                    <li>Setting guidelines to achieve security goals</li>

                    <li>Implementing strong security processes</li>

                    <li>Monitoring and communicating resul</li>
                </ul>

                <strong>Compliance</strong> is the process of adhering to internal standards and external regulations.
                </p>

                <h4>Specific controls, frameworks, and compliance</h4>
                <p>The National Institute of Standards and Technology (NIST) is a U.S.-based agency that develops
                    multiple voluntary compliance frameworks that organizations worldwide can use to help manage risk.
                    The more aligned an organization is with compliance, the lower the risk.

                    Examples of frameworks include the NIST Cybersecurity Framework (CSF) and the NIST Risk Management
                    Framework (RMF). <br><br>

                    <strong>Note</strong>: Specifications and guidelines can change depending on the type of
                    organization you work for.
                </p>

                <h4>The Federal Energy Regulatory Commission - North American Electric Reliability Corporation
                    (FERC-NERC)</h4>
                <p>FERC-NERC is a regulation that applies to organizations that work with electricity or that are
                    involved with the U.S. and North American power grid. These types of organizations have an
                    obligation to prepare for, mitigate, and report any potential security incident that can negatively
                    affect the power grid. They are also legally required to adhere to the Critical Infrastructure
                    Protection (CIP) Reliability Standards defined by the FERC. </p>
                <h4>The Federal Risk and Authorization Management Program (FedRAMP®)</h4>
                <p>FedRAMP is a U.S. federal government program that standardizes security assessment, authorization,
                    monitoring, and handling of cloud services and product offerings. Its purpose is to provide
                    consistency across the government sector and third-party cloud providers. </p>
                <h4>Center for Internet Security (CIS®)</h4>
                <p>CIS is a nonprofit with multiple areas of emphasis. It provides a set of controls that can be used to
                    safeguard systems and networks against attacks. Its purpose is to help organizations establish a
                    better plan of defense. CIS also provides actionable controls that security professionals may follow
                    if a security incident occurs. </p>
                <h4>General Data Protection Regulation (GDPR)</h4>
                <p>GDPR is a European Union (E.U.) general data regulation that protects the processing of E.U.
                    residents’ data and their right to privacy in and out of E.U. territory. For example, if an
                    organization is not being transparent about the data they are holding about an E.U. citizen and why
                    they are holding that data, this is an infringement that can result in a fine to the organization.
                    Additionally, if a breach occurs and an E.U. citizen’s data is compromised, they must be informed.
                    The affected organization has 72 hours to notify the E.U. citizen about the breach.</p>
                <h4>Payment Card Industry Data Security Standard (PCI DSS)</h4>
                <p>PCI DSS is an international security standard meant to ensure that organizations storing, accepting,
                    processing, and transmitting credit card information do so in a secure environment. The objective of
                    this compliance standard is to reduce credit card fraud. </p>
                <h4>The Health Insurance Portability and Accountability Act (HIPAA)</h4>
                <p>HIPAA is a U.S. federal law established in 1996 to protect patients' health information. This law
                    prohibits patient information from being shared without their consent. It is governed by three
                    rules:
                <ul>
                    <li>Privacy</li>
                    <li>Security </li>
                    <li>Breach notification </li>
                </ul>

                Organizations that store patient data have a legal obligation to inform patients of a breach because if
                patients' <span><strong>Protected Health Information</strong></span> (PHI) is exposed, it can lead to
                identity theft and insurance fraud. PHI relates to the past, present, or future physical or mental
                health or condition of an individual, whether it’s a plan of care or payments for care. Along with
                understanding HIPAA as a law, security professionals also need to be familiar with the Health
                Information Trust Alliance (HITRUST®), which is a security framework and assurance program that helps
                institutions meet HIPAA compliance.
                </p>

                <h4>International Organization for Standardization (ISO) </h4>
                <p>ISO was created to establish international standards related to technology, manufacturing, and
                    management across borders. It helps organizations improve their processes and procedures for staff
                    retention, planning, waste, and services. </p>

                <h4>System and Organizations Controls (SOC type 1, SOC type 2)</h4>
                <p>The American Institute of Certified Public Accountants® (AICPA) auditing standards board developed
                    this standard. The SOC1 and SOC2 are a series of reports that focus on an organization's user access
                    policies at different organizational levels such as:
                <ul>
                    <li>Associate</li>
                    <li>Supervisor</li>
                    <li>Manager</li>
                    <li>Executive</li>
                    <li>Vendor </li>
                    <li>Others </li>
                </ul>
                They are used to assess an organization’s financial compliance and levels of risk. They also cover
                confidentiality, privacy, integrity, availability, security, and overall data safety. Control failures
                in these areas can lead to fraud. <br> <br>
                <strong>Pro tip</strong>: There are a number of regulations that are frequently revised. You are
                encouraged to keep up-to-date with changes and explore more frameworks, controls, and compliance. Two
                suggestions to research: the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act.
                </p>

            </article>
        </section>


        <section class="main-section" id="Ethical">
            <h1>Ethical concepts that guide cybersecurity decisions</h1>
            <article class="main-article">
                <p>Previously, you were introduced to the concept of <strong>security ethics</strong>. Security ethics
                    are guidelines for making appropriate decisions as a security professional. Being ethical requires
                    that security professionals remain unbiased and maintain the security and confidentiality of private
                    data. Having a strong sense of ethics can help you navigate your decisions as a cybersecurity
                    professional so you’re able to mitigate threats posed by threat actors’ constantly evolving tactics
                    and techniques. In this reading, you’ll learn about more ethical concepts that are essential to know
                    so you can make appropriate decisions about how to legally and ethically respond to attacks in a way
                    that protects organizations and people alike.
                </p>

                <h4>Ethical concerns and laws related to counterattacks </h4>
                <h5>United States standpoint on counterattacks </h5>
                <p>In the U.S., deploying a counterattack on a threat actor is illegal because of laws like the Computer
                    Fraud and Abuse Act of 1986 and the Cybersecurity Information Sharing Act of 2015, among others. You
                    can only defend. The act of counterattacking in the U.S. is perceived as an act of vigilantism. A
                    vigilante is a person who is not a member of law enforcement who decides to stop a crime on their
                    own. And because threat actors are criminals, counterattacks can lead to further escalation of the
                    attack, which can cause even more damage and harm. Lastly, if the threat actor in question is a
                    state-sponsored hacktivist, a counterattack can lead to serious international implications. A
                    hacktivist is a person who uses hacking to achieve a political goal. The political goal may be to
                    promote social change or civil disobedience.

                    For these reasons, the only individuals in the U.S. who are allowed to counterattack are approved
                    employees of the federal government or military personnel. </p>

                <h4>International standpoint on counterattacks</h4>
                <p>The International Court of Justice (ICJ), which updates its guidance regularly, states that a person
                    or group can counterattack if:
                <ul>
                    <li>The counterattack will only affect the party that attacked first.</li>
                    <li>The counterattack is a direct communication asking the initial attacker to stop.</li>
                    <li>The counterattack does not escalate the situation.</li>
                    <li> The counterattack effects can be reversed.</li><br>

                </ul>
                Organizations typically do not counterattack because the above scenarios and parameters are hard to
                measure. There is a lot of uncertainty dictating what is and is not lawful, and at times negative
                outcomes are very difficult to control. Counterattack actions generally lead to a worse outcome,
                especially when you are not an experienced professional in the field.
                </p>

                <h4> Ethical principles and methodologies</h4>
                <p>Because counterattacks are generally disapproved of or illegal, the security realm has created
                    frameworks and controls—such as the confidentiality, integrity, and availability (CIA) triad and
                    others discussed earlier in the program—to address issues of confidentiality, privacy protections,
                    and laws. To better understand the relationship between these issues and the ethical obligations of
                    cybersecurity professionals, review the following key concepts as they relate to using ethics to
                    protect organizations and the people they serve. <br>

                    <strong>Confidentiality</strong> means that only authorized users can access specific assets or
                    data. Confidentiality as it relates to professional ethics means that there needs to be a high level
                    of respect for privacy to safeguard private assets and data. <br>

                    <strong>Privacy protection</strong> means safeguarding personal information from unauthorized use.
                    Personally identifiable information (PII) and sensitive personally identifiable information (SPII)
                    are types of personal data that can cause people harm if they are stolen. PII data is any
                    information used to infer an individual's identity, like their name and phone number. SPII data is a
                    specific type of PII that falls under stricter handling guidelines, including social security
                    numbers and credit card numbers. To effectively safeguard PII and SPII data, security professionals
                    hold an ethical obligation to secure private information, identify security vulnerabilities, manage
                    organizational risks, and align security with business goals. <br> <br>

                    <strong>Laws</strong> are rules that are recognized by a community and enforced by a governing
                    entity. As a security professional, you will have an ethical obligation to protect your
                    organization, its internal infrastructure, and the people involved with the organization. To do
                    this:

                <ul>
                    <li>You must remain unbiased and conduct your work honestly, responsibly, and with the highest
                        respect for the law. </li>
                    <li>Be transparent and just, and rely on evidence.</li>
                    <li>Ensure that you are consistently invested in the work you are doing, so you can appropriately
                        and ethically address issues that arise. </li>
                    <li>Stay informed and strive to advance your skills, so you can contribute to the betterment of the
                        cyber landscape. </li>
                </ul>
                <br>
                As an example, consider the <strong>Health Insurance Portability and Accountability Act</strong>
                (HIPAA), which is a U.S. federal law established to protect patients' health information, also known as
                PHI, or protected health information. This law prohibits patient information from being shared without
                their consent. So, as a security professional, you might help ensure that the organization you work for
                adheres to both its legal and ethical obligation to inform patients of a breach if their health care
                data is exposed.

                </p>

            </article>
        </section>

        <section class="main-section" id="glossary13">
            <h4>Glossary terms from module 3</h4>
            <article class="main-article">
                Asset: An item perceived as having value to an organization

                <strong>Availability</strong>: The idea that data is accessible to those who are authorized to access it

                <strong>Compliance</strong>: The process of adhering to internal standards and external regulations

                <strong>Confidentiality</strong>: The idea that only authorized users can access specific assets or data

                <strong>Confidentiality, integrity, availability (CIA) triad</strong>: A model that helps inform how
                organizations consider risk when setting up systems and security policies

                <strong>Hacktivist</strong>: A person who uses hacking to achieve a political goal

                <strong>Health Insurance Portability and Accountability Act (HIPAA)</strong>: A U.S. federal law
                established to protect patients' health information

                <strong>Integrity</strong>: The idea that the data is correct, authentic, and reliable

                <strong>National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF)</strong>: A
                voluntary framework that consists of standards, guidelines, and best practices to manage cybersecurity
                risk

                <strong>Privacy protection</strong>: The act of safeguarding personal information from unauthorized use

                <strong>Protected health information (PHI)</strong>: Information that relates to the past, present, or
                future physical or mental health or condition of an individual

                <strong>Security architecture</strong>: A type of security design composed of multiple components, such
                as tools and processes, that are used to protect an organization from risks and external threats

                <strong>Security controls</strong>: Safeguards designed to reduce specific security risks

                <strong>Security ethics</strong>: Guidelines for making appropriate decisions as a security professional

                <strong>Security frameworks</strong>: Guidelines used for building plans to help mitigate risk and
                threats to data and privacy

                <strong>Security governance</strong>: Practices that help support, define, and direct security efforts
                of an organization

                <strong>Sensitive personally identifiable information (SPII)</strong>: A specific type of PII that falls
                under stricter handling guidelines

            </article>
        </section>


        <section class="main-section" id="Module 14">
            <h2>Module 4</h2>
        </section>


        <section class="main-section" id="tools">
            <h2>Tools for protecting business operations</h2>

            <article class="main-article">
                <p>Previously, you were introduced to several technical skills that security analysts need to develop.
                    You were also introduced to some tools entry-level security analysts may have in their toolkit. In
                    this reading, you’ll learn more about how technical skills and tools help security analysts mitigate
                    risks.</p>

                <h4>An entry-level analyst’s toolkit</h4>
                <p>Every organization may provide a different toolkit, depending on its security needs. As a future
                    analyst, it’s important that you are familiar with industry standard tools and can demonstrate your
                    ability to learn how to use similar tools in a potential workplace. </p>

                <img src="resource/course1module41.png" id="img" alt="">

                <h4>Security information and event management (SIEM) tools</h4>
                <p> A <strong>SIEM tool</strong> is an application that collects and analyzes log data to monitor
                    critical activities in an organization. A log is a record of events that occur within an
                    organization’s systems. Depending on the amount of data you’re working with, it could take hours or
                    days to filter through log data on your own. SIEM tools reduce the amount of data an analyst must
                    review by providing alerts for specific types of threats, risks, and vulnerabilities. <br> <br>

                    SIEM tools provide a series of dashboards that visually organize data into categories, allowing
                    users to select the data they wish to analyze. Different SIEM tools have different dashboard types
                    that display the information you have access to. <br> <br>

                    SIEM tools also come with different hosting options, including on-premise and cloud. Organizations
                    may choose one hosting option over another based on a security team member’s expertise. For example,
                    because a cloud-hosted version tends to be easier to set up, use, and maintain than an on-premise
                    version, a less experienced security team may choose this option for their organization. <br> <br>
                </p>

                <h4>Network protocol analyzers (packet sniffers)</h4>
                <p>A <strong>network protocol analyzer</strong>, also known as a <strong>packet sniffer</strong>, is a
                    tool designed to capture and analyze data traffic in a network. This means that the tool keeps a
                    record of all the data that a computer within an organization's network encounters. Later in the
                    program, you’ll have an opportunity to practice using some common network protocol analyzer (packet
                    sniffer) tools. </p> <br>

                <h4>Playbooks</h4>
                <p>A playbook is a manual that provides details about any operational action, such as how to respond to
                    a security incident. Organizations usually have multiple playbooks documenting processes and
                    procedures for their teams to follow. Playbooks vary from one organization to the next, but they all
                    have a similar purpose: To guide analysts through a series of steps to complete specific
                    security-related tasks. <br>

                    For example, consider the following scenario: You are working as a security analyst for an incident
                    response firm. You are given a case involving a small medical practice that has suffered a security
                    breach. Your job is to help with the forensic investigation and provide evidence to a cybersecurity
                    insurance company. They will then use your investigative findings to determine whether the medical
                    practice will receive their insurance payout. <br> <br>

                    In this scenario, playbooks would outline the specific actions you need to take to conduct the
                    investigation. Playbooks also help ensure that you are following proper protocols and procedures.
                    When working on a forensic case, there are two playbooks you might follow. <br>

                <ul>
                    <li>The first type of playbook you might consult is called the chain of custody playbook. Chain of
                        custody is the process of documenting evidence possession and control during an incident
                        lifecycle. As a security analyst involved in a forensic analysis, you will work with the
                        computer data that was breached. You and the forensic team will also need to document who, what,
                        where, and why you have the collected evidence. The evidence is your responsibility while it is
                        in your possession. Evidence must be kept safe and tracked. Every time evidence is moved, it
                        should be reported. This allows all parties involved to know exactly where the evidence is at
                        all times.</li>
                    <li>The second playbook your team might use is called the protecting and preserving evidence
                        playbook. Protecting and preserving evidence is the process of properly working with fragile and
                        volatile digital evidence. As a security analyst, understanding what fragile and volatile
                        digital evidence is, along with why there is a procedure, is critical. As you follow this
                        playbook, you will consult the order of volatility, which is a sequence outlining the order of
                        data that must be preserved from first to last. It prioritizes volatile data, which is data that
                        may be lost if the device in question powers off, regardless of the reason. While conducting an
                        investigation, improper management of digital evidence can compromise and alter that evidence.
                        When evidence is improperly managed during an investigation, it can no longer be used. For this
                        reason, the first priority in any investigation is to properly preserve the data. You can
                        preserve the data by making copies and conducting your investigation using those copies.</li>

                </ul>
                </p>


            </article>
        </section>

        <section class="main-section" id="useTools">
            <h2>Use tools to protect business operations</h2>

            <article class="main-article">

                <p>Previously, you were introduced to programming, operating systems, and tools commonly used by
                    cybersecurity professionals. In this reading, you’ll learn more about programming and operating
                    systems, as well as other tools that entry-level analysts use to help protect organizations and the
                    people they serve. </p> <br>

                <h4>Tools and their purposes</h4>
                <h5>Programming </h5>
                <p>Programming is a process that can be used to create a specific set of instructions for a computer to
                    execute tasks. Security analysts use programming languages, such as Python, to execute automation.
                    Automation is the use of technology to reduce human and manual effort in performing common and
                    repetitive tasks. Automation also helps reduce the risk of human error. <br> <br>

                    Another programming language used by analysts is called Structured Query Language (SQL). SQL is used
                    to create, interact with, and request information from a database. A database is an organized
                    collection of information or data. There can be millions of data points in a database. A data point
                    is a specific piece of information. </p> <br>

                <h4>Operating systems</h4>
                <p>An operating system is the interface between computer hardware and the user. Linux®, macOS®, and
                    Windows are operating systems. They each offer different functionality and user experiences. <br>
                    <br>

                    Previously, you were introduced to Linux as an open-source operating system. Open source means that
                    the code is available to the public and allows people to make contributions to improve the software.
                    Linux is not a programming language; however, it does involve the use of a command line within the
                    operating system. A command is an instruction telling the computer to do something. A command-line
                    interface is a text-based user interface that uses commands to interact with the computer. You will
                    learn more about Linux, including the Linux kernel and GNU, in a later course.
                </p> <br>

                <h4>Web vulnerability </h4>
                <p>A web vulnerability is a unique flaw in a web application that a threat actor could exploit by using
                    malicious code or behavior, to allow unauthorized access, data theft, and malware deployment.</p>
                <br>

                <h4>Antivirus software</h4>
                <p>Antivirus software is a software program used to prevent, detect, and eliminate malware and viruses.
                    It is also called anti-malware. Depending on the type of antivirus software, it can scan the memory
                    of a device to find patterns that indicate the presence of malware. </p> <br>

                <h4>Intrusion detection system </h4>
                <p>An intrusion detection system (IDS) is an application that monitors system activity and alerts on
                    possible intrusions. The system scans and analyzes network packets, which carry small amounts of
                    data through a network. The small amount of data makes the detection process easier for an IDS to
                    identify potential threats to sensitive data. Other occurrences an IDS might detect can include
                    theft and unauthorized access.</p>

                <h4>Encryption</h4>
                <p>Encryption makes data unreadable and difficult to decode for an unauthorized user; its main goal is
                    to ensure confidentiality of private data. Encryption is the process of converting data from a
                    readable format to a cryptographically encoded format. Cryptographic encoding means converting
                    plaintext into secure ciphertext. Plaintext is unencrypted information and secure ciphertext is the
                    result of encryption.
                    <br><br>

                    Note: Encoding and encryption serve different purposes. Encoding uses a public conversion algorithm
                    to enable systems that use different data representations to share information.
                </p> <br>

                <h4>Penetration testing </h4>
                <p>Penetration testing, also called pen testing, is the act of participating in a simulated attack that
                    helps identify vulnerabilities in systems, networks, websites, applications, and processes. It is a
                    thorough risk assessment that can evaluate and identify external and internal threats as well as
                    weaknesses.</p>
            </article>
        </section>

        <section class="main-section" id="glossary14">
            <h2>Glossary terms from module 4</h2>

            <article class="main-article">
                <strong> Antivirus software</strong>: A software program used to prevent, detect, and eliminate malware
                and viruses <br>

                <strong>Database</strong>: An organized collection of information or data <br>

                <strong>Data point</strong>: A specific piece of information <br>

                <strong>Intrusion detection system (IDS)</strong>: An application that monitors system activity and
                alerts on possible intrusions <br>

                <strong>Linux</strong>: An open-source operating system <br>

                <strong>Log</strong>: A record of events that occur within an organization’s systems <br>

                <strong>Network protocol analyzer (packet sniffer)</strong>: A tool designed to capture and analyze data
                traffic within a network <br>

                <strong>Order of volatility</strong>: A sequence outlining the order of data that must be preserved from
                first to last <br>

                <strong>Programming</strong>: A process that can be used to create a specific set of instructions for a
                computer to execute tasks <br>

                <strong>Protecting and preserving evidence</strong>: The process of properly working with fragile and
                volatile digital evidence <br>

                <strong>Security information and event management (SIEM)</strong>: An application that collects and
                analyzes log data to monitor critical activities in an organization <br>

                <strong>SQL (Structured Query Language)</strong>: A query language used to create, interact with, and
                request information from a database <br>
            </article>
        </section>


        <br><br><br><br><br>

        <section class="main-section" id="Course 2">
            <h2 id="cs2">Course 2</h2>
        </section>


        <section class="main-section" id="Module 21">
            <h2>Module 1</h2>
        </section>
        <br> <br>


        <section class="main-section" id="topic211">
            <h2>Security domains cybersecurity analysts need to know</h2>

            <article class="main-article">
                <p>As an analyst, you can explore various areas of cybersecurity that interest you. One way to explore
                    those areas is by understanding different security domains and how they’re used to organize the work
                    of security professionals. In this reading you will learn more about CISSP’s eight security domains
                    and how they relate to the work you’ll do as a security analyst. </p>
                <br><br>
                <img src="resource/course2para1.png" alt="">
                <br><br>

                <h4>Domain one: Security and risk management</h4>
                <p>
                    All organizations must develop their security posture. Security posture is an organization’s ability
                    to manage its defense of critical assets and data and react to change. Elements of the security and
                    risk management domain that impact an organization's security posture include:

                <ul>
                    <li>Security goals and objectives</li>
                    <li>Risk mitigation processes</li>
                    <li>Compliance</li>
                    <li>Business continuity plans</li>
                    <li>Legal regulations</li>
                    <li>Professional and organizational ethics</li>
                </ul>

                Information security, or InfoSec, is also related to this domain and refers to a set of processes
                established to secure information. An organization may use playbooks and implement training as a part of
                their security and risk management program, based on their needs and perceived risk. There are many
                InfoSec design processes, such as:

                <ul>
                    <li>Incident response</li>
                    <li>Vulnerability management</li>
                    <li>Application security</li>
                    <li>Cloud security</li>
                    <li>Infrastructure security</li>

                </ul>
                As an example, a security team may need to alter how personally identifiable information (PII) is
                treated in order to adhere to the European Union's General Data Protection Regulation (GDPR).
                </p> <br> <br>

                <h4>Domain two: Asset security</h4> <br>
                <p>Asset security involves managing the cybersecurity processes of organizational assets, including the
                    storage, maintenance, retention, and destruction of physical and virtual data. Because the loss or
                    theft of assets can expose an organization and increase the level of risk, keeping track of assets
                    and the data they hold is essential. Conducting a security impact analysis, establishing a recovery
                    plan, and managing data exposure will depend on the level of risk associated with each asset.
                    Security analysts may need to store, maintain, and retain data by creating backups to ensure they
                    are able to restore the environment if a security incident places the organization’s data at risk.
                </p>

                <br><br>

                <h4>Domain three: Security architecture and engineering </h4>
                <p>This domain focuses on managing data security. Ensuring effective tools, systems, and processes are
                    in place helps protect an organization’s assets and data. Security architects and engineers create
                    these processes. <br><br>

                    One important aspect of this domain is the concept of shared responsibility. Shared responsibility
                    means all individuals involved take an active role in lowering risk during the design of a security
                    system. Additional design principles related to this domain, which are discussed later in the
                    program, include:

                <ul>
                    <li> Threat modeling</li>

                    <li>Least privilege</li>

                    <li>Defense in depth</li>

                    <li> Fail securely</li>

                    <li>Separation of duties</li>

                    <li>Keep it simple</li>

                    <li>Zero trust</li>

                    <li>Trust but verify</li>
                </ul>
                An example of managing data is the use of a security information and event management (SIEM) tool to
                monitor for flags related to unusual login or user activity that could indicate a threat actor is
                attempting to access private data.</p> <br><br>

                <h4>Domain four: Communication and network security</h4>
                <p>This domain focuses on managing and securing physical networks and wireless communications. This
                    includes on-site, remote, and cloud communications. <br>

                    Organizations with remote, hybrid, and on-site work environments must ensure data remains secure,
                    but managing external connections to make certain that remote workers are securely accessing an
                    organization’s networks is a challenge. Designing network security controls—such as restricted
                    network access—can help protect users and ensure an organization’s network remains secure when
                    employees travel or work outside of the main office. </p> <br> <br>

                <h4>Domain five: Identity and access management</h4>
                <p>The identity and access management (IAM) domain focuses on keeping data secure. It does this by
                    ensuring user identities are trusted and authenticated and that access to physical and logical
                    assets is authorized. This helps prevent unauthorized users, while allowing authorized users to
                    perform their tasks. <br>

                    Essentially, IAM uses what is referred to as the principle of least privilege, which is the concept
                    of granting only the minimal access and authorization required to complete a task. As an example, a
                    cybersecurity analyst might be asked to ensure that customer service representatives can only view
                    the private data of a customer, such as their phone number, while working to resolve the customer's
                    issue; then remove access when the customer's issue is resolved.</p> <br><br>

                <h4>Domain six: Security assessment and testing </h4>
                <p>The security assessment and testing domain focuses on identifying and mitigating risks, threats, and
                    vulnerabilities. Security assessments help organizations determine whether their internal systems
                    are secure or at risk. Organizations might employ penetration testers, often referred to as “pen
                    testers,” to find vulnerabilities that could be exploited by a threat actor. <br>

                    This domain suggests that organizations conduct security control testing, as well as collect and
                    analyze data. Additionally, it emphasizes the importance of conducting security audits to monitor
                    for and reduce the probability of a data breach. To contribute to these types of tasks,
                    cybersecurity professionals may be tasked with auditing user permissions to validate that users have
                    the correct levels of access to internal systems.</p> <br><br>

                <h4>Domain seven: Security operations </h4>
                <p>The security operations domain focuses on the investigation of a potential data breach and the
                    implementation of preventative measures after a security incident has occurred. This includes using
                    strategies, processes, and tools such as:

                <ul>
                    <li>Training and awareness</li>
                    <li>Reporting and documentation</li>
                    <li>Intrusion detection and prevention</li>
                    <li>SIEM tools</li>
                    <li>Log management</li>
                    <li>Incident management</li>
                    <li>Playbooks</li>
                    <li>Post-breach forensics</li>
                    <li>Reflecting on lessons learned</li>

                    The cybersecurity professionals involved in this domain work as a team to manage, prevent, and
                    investigate threats, risks, and vulnerabilities. These individuals are trained to handle active
                    attacks, such as large amounts of data being accessed from an organization's internal network,
                    outside of normal working hours. Once a threat is identified, the team works diligently to keep
                    private data and information safe from threat actors.

                </ul>
                </p> <br><br>

                <h4>Domain eight: Software development security</h4>
                <p>The software development security domain is focused on using secure programming practices and
                    guidelines to create secure applications. Having secure applications helps deliver secure and
                    reliable services, which helps protect organizations and their users. <br><br>

                    Security must be incorporated into each element of the software development life cycle, from design
                    and development to testing and release. To achieve security, the software development process must
                    have security in mind at each step. Security cannot be an afterthought. <br><br>

                    Performing application security tests can help ensure vulnerabilities are identified and mitigated
                    accordingly. Having a system in place to test the programming conventions, software executables, and
                    security measures embedded in the software is necessary. Having quality assurance and pen tester
                    professionals ensure the software has met security and performance standards is also an essential
                    part of the software development process. For example, an entry-level analyst working for a
                    pharmaceutical company might be asked to make sure encryption is properly configured for a new
                    medical device that will store private patient data. </p> <br>

            </article>
        </section>


        <section class="main-section" id="topic212">
            <h2>Manage common threats, risks, and vulnerabilities</h2>

            <article class="main-article">
                <p>Previously, you learned that security involves protecting organizations and people from threats,
                    risks, and vulnerabilities. Understanding the current threat landscapes gives organizations the
                    ability to create policies and processes designed to help prevent and mitigate these types of
                    security issues. In this reading, you will further explore how to manage risk and some common threat
                    actor tactics and techniques, so you are better prepared to protect organizations and the people
                    they serve when you enter the cybersecurity field. </p>
                <h4>Risk management</h4>
                <p>A primary goal of organizations is to protect assets. An asset is an item perceived as having value
                    to an organization. Assets can be digital or physical. Examples of digital assets include the
                    personal information of employees, clients, or vendors, such as:
                <ul>
                    <li>Social Security Numbers (SSNs), or unique national identification numbers assigned to
                        individuals </li>

                    <li> Dates of birth</li>
                    <li>Bank account numbers</li>
                    <li>Mailing addresses</li>

                </ul>

                <h4>Examples of physical assets include:</h4>
                <ul>
                    <li> Payment kiosks</li>

                    <li> Servers</li>

                    <li>Desktop computers</li>

                    <li>Office spaces</li>
                </ul>

                <h4>Some common strategies used to manage risks include:</h4>
                <ul>
                    <li> <strong>Acceptance:</strong> Accepting a risk to avoid disrupting business continuity</li>

                    <li><strong>Avoidance:</strong> Creating a plan to avoid the risk altogether</li>

                    <li> <strong>Transference:</strong> Transferring risk to a third party to manage</li>

                    <li> <strong>Mitigation:</strong> Lessening the impact of a known risk</li>
                </ul>
                Additionally, organizations implement risk management processes based on widely accepted frameworks to
                help protect digital and physical assets from various threats, risks, and vulnerabilities. Examples of
                frameworks commonly used in the cybersecurity industry include the National Institute of Standards and
                Technology Risk Management Framework (NIST RMF
                ) and Health Information Trust Alliance (HITRUST
                ).


                </p>

                <h4>Today’s most common threats, risks, and vulnerabilities</h4>
                <p>
                <h4>Threats</h4>
                A threat is any circumstance or event that can negatively impact assets. As an entry-level security
                analyst, your job is to help defend the organization’s assets from inside and outside threats.
                Therefore, understanding common types of threats is important to an analyst’s daily work. As a reminder,
                common threats include:
                <ul>
                    <li>
                        Insider threats: Staff members or vendors abuse their authorized access to obtain data that may
                        harm an organization.</li>

                    <li>Advanced persistent threats (APTs): A threat actor maintains unauthorized access to a system for
                        an extended period of time.</li>
                </ul>

                <h4>Risks</h4>
                A risk is anything that can impact the confidentiality, integrity, or availability of an asset. A basic
                formula for determining the level of risk is that risk equals the likelihood of a threat. One way to
                think about this is that a risk is being late to work and threats are traffic, an accident, a flat tire,
                etc. <br><br>

                There are different factors that can affect the likelihood of a risk to an organization’s assets,
                including:
                <ul>
                    <li> External risk: Anything outside the organization that has the potential to harm organizational
                        assets, such as threat actors attempting to gain access to private information</li>

                    <li>Internal risk: A current or former employee, vendor, or trusted partner who poses a security
                        risk</li>

                    <li>Legacy systems: Old systems that might not be accounted for or updated, but can still impact
                        assets, such as workstations or old mainframe systems. For example, an organization might have
                        an old vending machine that takes credit card payments or a workstation that is still connected
                        to the legacy accounting system.</li>

                    <li>
                        Multiparty risk: Outsourcing work to third-party vendors can give them access to intellectual
                        property, such as trade secrets, software designs, and inventions.</li>

                    <li>Software compliance/licensing: Software that is not updated or in compliance, or patches that
                        are not installed in a timely manner</li>
                </ul>

                Note: The OWASP’s common attack types list contains three new risks for the years 2017 to 2021: insecure
                design, software and data integrity failures, and server-side request forgery. This update emphasizes
                the fact that security is a constantly evolving field. It also demonstrates the importance of staying up
                to date on current threat actor tactics and techniques, so you can be better prepared to manage these
                types of risks.

                <img src="resource/course2module123.png" id="img" alt="">
                </p>
                <p>
                <h4>Vulnerabilities</h4>
                A vulnerability is a weakness that can be exploited by a threat. Therefore, organizations need to
                regularly inspect for vulnerabilities within their systems. Some vulnerabilities include:
                <ul>
                    <li> ProxyLogon: A pre-authenticated vulnerability that affects the Microsoft Exchange server. This
                        means a threat actor can complete a user authentication process to deploy malicious code from a
                        remote location.</li>

                    <li>ZeroLogon: A vulnerability in Microsoft’s Netlogon authentication protocol. An authentication
                        protocol is a way to verify a person's identity. Netlogon is a service that ensures a user’s
                        identity before allowing access to a website's location.</li>

                    <li>Log4Shell: Allows attackers to run Java code on someone else’s computer or leak sensitive
                        information. It does this by enabling a remote attacker to take control of devices connected to
                        the internet and run malicious code.</li>

                    <li>PetitPotam: Affects Windows New Technology Local Area Network (LAN) Manager (NTLM). It is a
                        theft technique that allows a LAN-based attacker to initiate an authentication request.</li>

                    <li>Security logging and monitoring failures: Insufficient logging and monitoring capabilities that
                        result in attackers exploiting vulnerabilities without the organization knowing it</li>

                    <li>Server-side request forgery: Allows attackers to manipulate a server-side application into
                        accessing and updating backend resources. It can also allow threat actors to steal data.</li>
                </ul> <br>
                As an entry-level security analyst, you might work in vulnerability management, which is monitoring a
                system to identify and mitigate vulnerabilities. Although patches and updates may exist, if they are not
                applied, intrusions can still occur. For this reason, constant monitoring is important. The sooner an
                organization identifies a vulnerability and addresses it by patching it or updating their systems, the
                sooner it can be mitigated, reducing the organization’s exposure to the vulnerability.

                </p>

            </article>
        </section>

        <section class="main-section" id="topic213">
            <h2>Glossary terms from module 1 </h2>

            <ul>
                <h4>Terms and definitions from Course 2, Module 1</h4>

                <li>Assess: The fifth step of the NIST RMF that means to determine if established controls are
                    implemented correctly</li>

                <li>Authorize: The sixth step of the NIST RMF that refers to being accountable for the security and
                    privacy risks that may exist in an organization</li>

                <li>Business continuity: An organization's ability to maintain their everyday productivity by
                    establishing risk disaster recovery plans</li>

                <li>Categorize: The second step of the NIST RMF that is used to develop risk management processes and
                    tasks</li>

                <li>External threat: Anything outside the organization that has the potential to harm organizational
                    assets</li>

                <li>Implement: The fourth step of the NIST RMF that means to implement security and privacy plans for an
                    organization</li>

                <li>Internal threat: A current or former employee, external vendor, or trusted partner who poses a
                    security risk</li>

                <li>Monitor: The seventh step of the NIST RMF that means be aware of how systems are operating</li>

                <li>Prepare: The first step of the NIST RMF related to activities that are necessary to manage security
                    and privacy risks before a breach occurs</li>

                <li>Ransomware: A malicious attack where threat actors encrypt an organization’s data and demand payment
                    to restore access </li>

                <li>Risk: Anything that can impact the confidentiality, integrity, or availability of an asset</li>

                <li>Risk mitigation: The process of having the right procedures and rules in place to quickly reduce the
                    impact of a risk like a breach</li>

                <li>Security posture: An organization’s ability to manage its defense of critical assets and data and
                    react to change</li>

                <li>Select: The third step of the NIST RMF that means to choose, customize, and capture documentation of
                    the controls that protect an organization</li>

                <li>Shared responsibility: The idea that all individuals within an organization take an active role in
                    lowering risk and maintaining both physical and virtual security</li>

                <li>Social engineering: A manipulation technique that exploits human error to gain private information,
                    access, or valuables </li>

                <li>Vulnerability: A weakness that can be exploited by a threat</li>
            </ul>

            <article class="main-article">


                <section class="main-section" id="Module 22">
                    <h2>Module 2</h2>
                </section>


                <section class="main-section" id="topic221">
                    <h4>The relationship between frameworks and controls</h4>

                    <article class="main-article">

                        <p>Previously, you learned how organizations use security frameworks and controls to protect
                            against threats, risks, and vulnerabilities. This included discussions about the National
                            Institute of Standards and Technology’s (NIST’s) Risk Management Framework (RMF) and
                            Cybersecurity Framework (CSF), as well as the confidentiality, integrity, and availability
                            (CIA) triad. In this reading, you will further explore security frameworks and controls and
                            how they are used together to help mitigate organizational risk.</p>

                        <h4>Frameworks and controls</h4>
                        <p>
                            <li>Security frameworks are guidelines used for building plans to help mitigate risk and
                                threats to data and privacy. Frameworks support organizations’ ability to adhere to
                                compliance laws and regulations. For example, the healthcare industry uses frameworks to
                                comply with the United States’ Health Insurance Portability and Accountability Act
                                (HIPAA), which requires that medical professionals keep patient information safe. </li>

                            <li>Security controls are safeguards designed to reduce specific security risks. Security
                                controls are the measures organizations use to lower risk and threats to data and
                                privacy. For example, a control that can be used alongside frameworks to ensure a
                                hospital remains compliant with HIPAA is requiring that patients use multi-factor
                                authentication (MFA) to access their medical records. Using a measure like MFA to
                                validate someone’s identity is one way to help mitigate potential risks and threats to
                                private data.</li>
                        </p>

                        <h4>Specific frameworks and controls</h4>
                        <p>There are many different frameworks and controls that organizations can use to remain
                            compliant with regulations and achieve their security goals. Frameworks covered in this
                            reading are the Cyber Threat Framework (CTF) and the International Organization for
                            Standardization/International Electrotechnical Commission (ISO/IEC) 27001. Several common
                            security controls, used alongside these types of frameworks, are also explained. </p>
                        <h4>Cyber Threat Framework (CTF)</h4>
                        <p>According to the Office of the Director of National Intelligence, the CTF was developed by
                            the U.S. government to provide “a common language for describing and communicating
                            information about cyber threat activity.” By providing a common language to communicate
                            information about threat activity, the CTF helps cybersecurity professionals analyze and
                            share information more efficiently. This allows organizations to improve their response to
                            the constantly evolving cybersecurity landscape and threat actors' many tactics and
                            techniques.</p>
                        <h4>International Organization for Standardization/International Electrotechnical Commission
                            (ISO/IEC) 27001</h4>

                        <p>An internationally recognized and used framework is ISO/IEC 27001. The ISO 27000 family of
                            standards enables organizations of all sectors and sizes to manage the security of assets,
                            such as financial information, intellectual property, employee data, and information
                            entrusted to third parties. This framework outlines requirements for an information security
                            management system, best practices, and controls that support an organization’s ability to
                            manage risks. Although the ISO/IEC 27001 framework does not require the use of specific
                            controls, it does provide a collection of controls that organizations can use to improve
                            their security posture. </p>

                        <h4>Controls</h4>
                        <p>Controls are used alongside frameworks to reduce the possibility and impact of a security
                            threat, risk, or vulnerability. Controls can be physical, technical, and administrative and
                            are typically used to prevent, detect, or correct security issues. <br>
                        <ul>
                            <strong> Examples of physical controls:</strong>

                            <li>Gates, fences, and locks</li>

                            <li>Security guards</li>

                            <li>Closed-circuit television (CCTV), surveillance cameras, and motion detectors</li>

                            <li>Access cards or badges to enter office spaces</li>

                            <strong> Examples of technical controls:</strong>

                            <li>Firewalls</li>

                            <li>MFA</li>

                            <li> Antivirus software</li>

                            <strong> Examples of administrative controls:</strong>

                            <li>Separation of duties</li>

                            <li>Authorization</li>

                            <li> Asset classification</li>
                        </ul>
                        </p>
                    </article>
                </section>

                <section class="main-section" id="topic222">
                    <h4>Use the CIA triad to protect organizations</h4>

                    <article class="main-article">
                        <p>Previously, you were introduced to the confidentiality, integrity, and availability (CIA)
                            triad and how it helps organizations consider and mitigate risk. In this reading, you will
                            learn how cybersecurity analysts use the CIA triad in the workplace. </p>
                        <h4>The CIA triad for analysts</h4>
                        <p>The CIA triad is a model that helps inform how organizations consider risk when setting up
                            systems and security policies. It is made up of three elements that cybersecurity analysts
                            and organizations work toward upholding: confidentiality, integrity, and availability.
                            Maintaining an acceptable level of risk and ensuring systems and policies are designed with
                            these elements in mind helps establish a successful security posture, which refers to an
                            organization’s ability to manage its defense of critical assets and data and react to
                            change. </p>
                        <h4>Confidentiality</h4>
                        <p>Confidentiality is the idea that only authorized users can access specific assets or data. In
                            an organization, confidentiality can be enhanced through the implementation of design
                            principles, such as the principle of least privilege. The principle of least privilege
                            limits users' access to only the information they need to complete work-related tasks.
                            Limiting access is one way of maintaining the confidentiality and security of private data.
                        </p>
                        <h4>Integrity</h4>
                        <p>Integrity is the idea that the data is verifiably correct, authentic, and reliable. Having
                            protocols in place to verify the authenticity of data is essential. One way to verify data
                            integrity is through cryptography
                            , which is used to transform data so unauthorized parties cannot read or tamper with it
                            (NIST, 2022). Another example of how an organization might implement integrity is by
                            enabling encryption, which is the process of converting data from a readable format to an
                            encoded format. Encryption can be used to prevent access and ensure data, such as messages
                            on an organization's internal chat platform, cannot be tampered with. </p>

                        <h4>Availability</h4>
                        <p>Availability is the idea that data is accessible to those who are authorized to use it. When
                            a system adheres to both availability and confidentiality principles, data can be used when
                            needed. In the workplace, this could mean that the organization allows remote employees to
                            access its internal network to perform their jobs. It’s worth noting that access to data on
                            the internal network is still limited, depending on what type of access employees need to do
                            their jobs. If, for example, an employee works in the organization’s accounting department,
                            they might need access to corporate accounts but not data related to ongoing development
                            projects. </p>
                    </article>
                </section>


                <section class="main-section" id="topic223">
                    <h4>More about OWASP security principles </h4>

                    <article class="main-article">
                        <p>Previously, you learned that cybersecurity analysts help keep data safe and reduce risk for
                            an organization by using a variety of security frameworks, controls, and security
                            principles. In this reading, you will learn about more Open Web Application Security
                            Project, recently renamed Open Worldwide Application Security Project® (OWASP), security
                            principles and how entry-level analysts use them. </p>

                        <h4>Security principles</h4>
                        <p>In the workplace, security principles are embedded in your daily tasks. Whether you are
                            analyzing logs, monitoring a security information and event management (SIEM) dashboard, or
                            using a vulnerability scanner

                            , you will use these principles in some way. <br><br>

                        <h4>Previously, you were introduced to several OWASP security principles. These included:
                        </h4>
                        <ul>
                            <li> Minimize attack surface area: Attack surface refers to all the potential
                                vulnerabilities a threat actor could exploit.</li>

                            <li>Principle of least privilege: Users have the least amount of access required to perform
                                their everyday tasks.</li>

                            <li>Defense in depth: Organizations should have varying security controls that mitigate
                                risks and threats.</li>

                            <li>Separation of duties: Critical actions should rely on multiple people, each of whom
                                follow the principle of least privilege. </li>

                            <li>Keep security simple: Avoid unnecessarily complicated solutions. Complexity makes
                                security difficult. </li>

                            <li>Fix security issues correctly: When security incidents occur, identify the root cause,
                                contain the impact, identify vulnerabilities, and conduct tests to ensure that
                                remediation is successful.</li>
                        </ul>
                        </p>

                        <h4>Additional OWASP security principles</h4>
                        <p>Next, you’ll learn about four additional OWASP security principles that cybersecurity
                            analysts and their teams use to keep organizational operations and people safe.

                            <li><strong>Establish secure defaults</strong> <br>This principle means that the optimal
                                security state of an application is also its default state for users; it should take
                                extra work to make the application insecure. </li>

                            <li><strong>Fail securely</strong> <br>

                                Fail securely means that when a control fails or stops, it should do so by defaulting to
                                its most secure option. For example, when a firewall fails it should simply close all
                                connections and block all new ones, rather than start accepting everything.</li>

                            <li> <strong>Don’t trust services</strong><br>

                                Many organizations work with third-party partners. These outside partners often have
                                different security policies than the organization does. And the organization shouldn’t
                                explicitly trust that their partners’ systems are secure. For example, if a third-party
                                vendor tracks reward points for airline customers, the airline should ensure that the
                                balance is accurate before sharing that information with their customers.</li>


                            <li><strong>Avoid security by obscurity
                                </strong> <br>
                                The security of key systems should not rely on keeping details hidden. Consider the
                                following example from OWASP (2016):

                                The security of an application should not rely on keeping the source code secret. Its
                                security should rely upon many other factors, including reasonable password policies,
                                defense in depth, business transaction limits, solid network architecture, and fraud and
                                audit controls.</li>
                        </p>

                    </article>
                </section>

                <section class="main-section" id="topic224">
                    <h4>More about security audits</h4>

                    <article class="main-article">
                        <p>Previously, you were introduced to how to plan and complete an internal security audit. In
                            this reading, you will learn more about security audits, including the goals and objectives
                            of audits. </p>

                        <h4>Security audits</h4>
                        <p>A security audit is a review of an organization's security controls, policies, and procedures
                            against a set of expectations. Audits are independent reviews that evaluate whether an
                            organization is meeting internal and external criteria. Internal criteria include outlined
                            policies, procedures, and best practices. External criteria include regulatory compliance,
                            laws, and federal regulations. <br>

                            Additionally, a security audit can be used to assess an organization's established security
                            controls. As a reminder, security controls are safeguards designed to reduce specific
                            security risks. <br>

                            Audits help ensure that security checks are made (i.e., daily monitoring of security
                            information and event management dashboards), to identify threats, risks, and
                            vulnerabilities. This helps maintain an organization’s security posture. And, if there are
                            security issues, a remediation process must be in place. <br></p>

                        <h4>Goals and objectives of an audit</h4>

                        <p>

                            The goal of an audit is to ensure an organization's information technology (IT) practices
                            are meeting industry and organizational standards. The objective is to identify and address
                            areas of remediation and growth. Audits provide direction and clarity by identifying what
                            the current failures are and developing a plan to correct them. <br><br>

                            Security audits must be performed to safeguard data and avoid penalties and fines from
                            governmental agencies. The frequency of audits is dependent on local laws and federal
                            compliance regulations.</p>

                        <h4>Factors that affect audits</h4>

                        <p>Factors that determine the types of audits an organization implements include:
                        <ul>
                            <li>

                            <li>Industry type</li>

                            <li>Organization size</li>

                            <li>Ties to the applicable government regulations</li>

                            <li>A business’s geographical location</li>

                            <li>A business decision to adhere to a specific regulatory compliance </li>
                        </ul>
                        </p>


                        <h4>The role of frameworks and controls in audits</h4>
                        <p>Along with compliance, it’s important to mention the role of frameworks and controls in
                            security audits. Frameworks such as the National Institute of Standards and Technology
                            Cybersecurity Framework (NIST CSF) and the international standard for information security
                            (ISO 27000) series are designed to help organizations prepare for regulatory compliance
                            security audits. By adhering to these and other relevant frameworks, organizations can save
                            time when conducting external and internal audits. Additionally, frameworks, when used
                            alongside controls, can support organizations’ ability to align with regulatory compliance
                            requirements and standards. <br><br>

                            There are three main categories of controls to review during an audit, which are
                            administrative and/or managerial, technical, and physical controls. To learn more about
                            specific controls related to each category, click the following link and select “Use
                            Template.” <br>


                        </p>

                        <h4>Audit checklist</h4>
                        <p>It’s necessary to create an audit checklist before conducting an audit. A checklist is
                            generally made up of the following areas of focus:
                        <ul>
                            <strong>dentify the scope of the audit</strong> <br>

                            The audit should:

                            <li>List assets that will be assessed (e.g., firewalls are configured correctly, PII is
                                secure, physical assets are locked, etc.) </li>

                            <li> Note how the audit will help the organization achieve its desired goals</li>

                            <li>Indicate how often an audit should be performed</li>

                            <li>Include an evaluation of organizational policies, protocols, and procedures to make sure
                                they are working as intended and being implemented by employees</li>
                        </ul>

                        <strong>Complete a risk assessment</strong>

                        <li> A risk assessment is used to evaluate identified organizational risks related to budget,
                            controls, internal processes, and external standards (i.e., regulations).</li>

                        <strong>Conduct the audit
                        </strong>
                        <li>When conducting an internal audit, you will assess the security of the identified assets
                            listed in the audit scope.</li>

                        <strong>Create a mitigation plan</strong>

                        <li>A mitigation plan is a strategy established to lower the level of risk and potential costs,
                            penalties, or other issues that can negatively affect the organization’s security posture.
                        </li>

                        <strong>Communicate results to stakeholders</strong>

                        <li>The end result of this process is providing a detailed report of findings, suggested
                            improvements needed to lower the organization's level of risk, and compliance regulations
                            and standards the organization needs to adhere to. </li>
                        </p>
                    </article>
                </section>

                <section class="main-section" id="topic225">
                    <h4>Glossary terms from module 2</h4>

                    <article class="main-article">
                        <p>

                        <ul>


                            <li>Asset: An item perceived as having value to an organization</li>

                            <li>Attack vectors: The pathways attackers use to penetrate security defenses</li>

                            <li>Authentication: The process of verifying who someone is</li>

                            <li>Authorization: The concept of granting access to specific resources in a system</li>

                            <li>Availability: The idea that data is accessible to those who are authorized to access
                                it
                            </li>
                            <li>Biometrics: The unique physical characteristics that can be used to verify a
                                person’s identity</li>

                            <li>Confidentiality: The idea that only authorized users can access specific assets or
                                data
                            </li>
                            <li>Confidentiality, integrity, availability (CIA) triad: A model that helps inform how
                                organizations consider risk when setting up systems and security policies
                            </li>
                            <li>Detect: A NIST core function related to identifying potential security incidents and
                                improving monitoring capabilities to increase the speed and efficiency of detections
                            </li>
                            <li>Encryption: The process of converting data from a readable format to an encoded
                                format
                            </li>
                            <li>Identify: A NIST core function related to management of cybersecurity risk and its
                                effect on an organization’s people and assets
                            </li>
                            <li>Integrity: The idea that the data is correct, authentic, and reliable
                            </li>
                            <li>National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF):
                                A voluntary framework that consists of standards, guidelines, and best practices to
                                manage cybersecurity risk </li>

                            <li>National Institute of Standards and Technology (NIST) Special Publication (S.P.)
                                800-53: A unified framework for protecting the security of information systems
                                within the U.S. federal government
                            </li>
                            <li>Open Web Application Security Project/Open Worldwide Application Security Project
                                (OWASP): A non-profit organization focused on improving software security</li>

                            <li>Protect: A NIST core function used to protect an organization through the
                                implementation of policies, procedures, training, and tools that help mitigate
                                cybersecurity threats</li>

                            <li>Recover: A NIST core function related to returning affected systems back to normal
                                operation</li>

                            <li>Respond: A NIST core function related to making sure that the proper procedures are
                                used to contain, neutralize, and analyze security incidents, and implement
                                improvements to the security process</li>

                            <li>Risk: Anything that can impact the confidentiality, integrity, or availability of an
                                asset
                            </li>
                            <li>Security audit: A review of an organization's security controls, policies, and
                                procedures against a set of expectations</li>

                            <li>Security controls: Safeguards designed to reduce specific security risks </li>

                            <li>Security frameworks: Guidelines used for building plans to help mitigate risk and
                                threats to data and privacy</li>

                            <li>Security posture: An organization’s ability to manage its defense of critical assets
                                and data and react to change</li>

                            <li>Threat: Any circumstance or event that can negatively impact assets</li>
                        </ul>
                        </p>
                    </article>
                </section>

                <section class="main-section" id="Module 23">
                    <h2>Module 3</h2>
                </section>


                <section class="main-section" id="topic231">
                    <h2>The future of SIEM tools</h2>

                    <article class="main-article">
                        <p>Previously, you were introduced to security information and event management (SIEM) tools,
                            along with a few examples of SIEM tools. In this reading, you will learn more about how SIEM
                            tools are used to protect organizational operations. You will also gain insight into how and
                            why SIEM tools are changing to help protect organizations and the people they serve from
                            evolving threat actor tactics and techniques.</p>

                        <h4>Current SIEM solutions </h4>
                        <p>A SIEM tool is an application that collects and analyzes log data to monitor critical
                            activities in an organization. SIEM tools offer real-time monitoring and tracking of
                            security event logs. The data is then used to conduct a thorough analysis of any potential
                            security threat, risk, or vulnerability identified. SIEM tools have many dashboard options.
                            Each dashboard option helps cybersecurity team members manage and monitor organizational
                            data. However, currently, SIEM tools require human interaction for analysis of security
                            events. </p>

                        <h4>The future of SIEM tools</h4>
                        <p>As cybersecurity continues to evolve, the need for cloud functionality has increased. SIEM
                            tools have and continue to evolve to function in cloud-hosted and cloud-native environments.
                            Cloud-hosted SIEM tools are operated by vendors who are responsible for maintaining and
                            managing the infrastructure required to use the tools. Cloud-hosted tools are simply
                            accessed through the internet and are an ideal solution for organizations that don’t want to
                            invest in creating and maintaining their own infrastructure. <br><br>

                            Similar to cloud-hosted SIEM tools, cloud-native SIEM tools are also fully maintained and
                            managed by vendors and accessed through the internet. However, cloud-native tools are
                            designed to take full advantage of cloud computing capabilities, such as availability,
                            flexibility, and scalability. <br><br>

                            Yet, the evolution of SIEM tools is expected to continue in order to accommodate the
                            changing nature of technology, as well as new threat actor tactics and techniques. For
                            example, consider the current development of interconnected devices with access to the
                            internet, known as the Internet of Things (IoT). The more interconnected devices there are,
                            the larger the cybersecurity attack surface and the amount of data that threat actors can
                            exploit. The diversity of attacks and data that require special attention is expected to
                            grow significantly. Additionally, as artificial intelligence (AI) and machine learning (ML)
                            technology continues to progress, SIEM capabilities will be enhanced to better identify
                            threat-related terminology, dashboard visualization, and data storage functionality.
                            <br><br>

                            The implementation of automation will also help security teams respond faster to possible
                            incidents, performing many actions without waiting for a human response. Security
                            orchestration, automation, and response (SOAR) is a collection of applications, tools, and
                            workflows that uses automation to respond to security events. Essentially, this means that
                            handling common security-related incidents with the use of SIEM tools is expected to become
                            a more streamlined process requiring less manual intervention. This frees up security
                            analysts to handle more complex and uncommon incidents that, consequently, can’t be
                            automated with a SOAR. Nevertheless, the expectation is for cybersecurity-related platforms
                            to communicate and interact with one another. Although the technology allowing
                            interconnected systems and devices to communicate with each other exists, it is still a work
                            in progress. <br><br>
                        </p>


                    </article>
                </section>

                <section class="main-section" id="topic232">
                    <h2>More about cybersecurity tools</h2>


                    <article class="main-article">
                        <p>Previously, you learned about several tools that are used by cybersecurity team members to
                            monitor for and identify potential security threats, risks, and vulnerabilities. In this
                            reading, you’ll learn more about common open-source and proprietary cybersecurity tools that
                            you may use as a cybersecurity professional.</p>
                        <h4>Open-source tools</h4>
                        <p>Open-source tools are often free to use and can be user friendly. The objective of
                            open-source tools is to provide users with software that is built by the public in a
                            collaborative way, which can result in the software being more secure. Additionally,
                            open-source tools allow for more customization by users, resulting in a variety of new
                            services built from the same open-source software package. <br><br>

                            Software engineers create open-source projects to improve software and make it available for
                            anyone to use, as long as the specified license is respected. The source code for
                            open-source projects is readily available to users, as well as the training material that
                            accompanies them. Having these sources readily available allows users to modify and improve
                            project materials. </p>

                        <h4>Proprietary tools</h4>
                        <p>Proprietary tools are developed and owned by a person or company, and users typically pay a
                            fee for usage and training. The owners of proprietary tools are the only ones who can access
                            and modify the source code. This means that users generally need to wait for updates to be
                            made to the software, and at times they might need to pay a fee for those updates.
                            Proprietary software generally allows users to modify a limited number of features to meet
                            individual and organizational needs. Examples of proprietary tools include Splunk® and
                            Chronicle SIEM tools.</p>

                        <h4>Common misconceptions</h4>
                        <p>There is a common misconception that open-source tools are less effective and not as safe to
                            use as proprietary tools. However, developers have been creating open-source materials for
                            years that have become industry standards. Although it is true that threat actors have
                            attempted to manipulate open-source tools, because these tools are open source it is
                            actually harder for people with malicious intent to successfully cause harm. The wide
                            exposure and immediate access to the source code by well-intentioned and informed users and
                            professionals makes it less likely for issues to occur, because they can fix issues as soon
                            as they’re identified.
                        </p>
                        <h4>Examples of open-source tools</h4>
                        <p>
                        <ul>
                            <li><strong>Linux</strong> <br>

                                Linux is an open-source operating system that is widely used. It allows you to tailor
                                the operating system to your needs using a command-line interface. An operating system
                                is the interface between computer hardware and the user. It’s used to communicate with
                                the hardware of a computer and manage software applications. <br>

                                There are multiple versions of Linux that exist to accomplish specific tasks. Linux and
                                its command-line interface will be discussed in detail, later in the certificate
                                program. </li>
                            <li><strong>Suricata
                                </strong> <br>
                                Suricata is an open-source network analysis and threat detection software. Network
                                analysis and threat detection software is used to inspect network traffic to identify
                                suspicious behavior and generate network data logs. The detection software finds
                                activity across users, computers, or Internet Protocol (IP) addresses to help uncover
                                potential threats, risks, or vulnerabilities. <br>

                                Suricata was developed by the Open Information Security Foundation (OISF). OISF is
                                dedicated to maintaining open-source use of the Suricata project to ensure it’s free and
                                publicly available. Suricata is widely used in the public and private sector, and it
                                integrates with many SIEM tools and other security tools. Suricata will also be
                                discussed in greater detail later in the program. <br>
                            </li>

                        </ul>
                        </p>


                    </article>
                </section>


                <section class="main-section" id="topic233">
                    <h2>Use SIEM tools to protect organizations</h2>


                    <article class="main-article">
                        <p>Previously, you were introduced to security information and event management (SIEM) tools and
                            a few SIEM dashboards. You also learned about different threats, risks, and vulnerabilities
                            an organization may experience. In this reading, you will learn more about SIEM dashboard
                            data and how cybersecurity professionals use that data to identify a potential threat, risk,
                            or vulnerability.</p>

                        <h4>Splunk</h4>
                        <p>Splunk offers different SIEM tool options: Splunk® Enterprise and Splunk® Cloud. Both allow
                            you to review an organization's data on dashboards. This helps security professionals manage
                            an organization's internal infrastructure by collecting, searching, monitoring, and
                            analyzing log data from multiple sources to obtain full visibility into an organization’s
                            everyday operations.
                            <br><br>
                            Review the following Splunk dashboards and their purposes:
                            <br>
                        <ul>
                            <li><strong>Security posture dashboard</strong>


                                The security posture dashboard is designed for security operations centers (SOCs). It
                                displays the last 24 hours of an organization’s notable security-related events and
                                trends and allows security professionals to determine if security infrastructure and
                                policies are performing as designed. Security analysts can use this dashboard to monitor
                                and investigate potential threats in real time, such as suspicious network activity
                                originating from a specific IP address. </li><br><br>

                            <li><strong>Executive summary dashboard</strong>

                                The executive summary dashboard analyzes and monitors the overall health of the
                                organization over time. This helps security teams improve security measures that reduce
                                risk. Security analysts might use this dashboard to provide high-level insights to
                                stakeholders, such as generating a summary of security incidents and trends over a
                                specific period of time.
                            </li><br><br>

                            <li><strong>Incident review dashboard</strong>

                                The incident review dashboard allows analysts to identify suspicious patterns that can
                                occur in the event of an incident. It assists by highlighting higher risk items that
                                need immediate review by an analyst. This dashboard can be very helpful because it
                                provides a visual timeline of the events leading up to an incident.
                            </li>

                            <li> <strong>Risk analysis dashboard</strong>

                                The risk analysis dashboard helps analysts identify risk for each risk object (e.g., a
                                specific user, a computer, or an IP address). It shows changes in risk-related activity
                                or behavior, such as a user logging in outside of normal working hours or unusually high
                                network traffic from a specific computer. A security analyst might use this dashboard to
                                analyze the potential impact of vulnerabilities in critical assets, which helps analysts
                                prioritize their risk mitigation efforts.</li>
                        </ul>

                        </p>

                        <h4>Chronicle</h4>
                        <p>Chronicle is a cloud-native SIEM tool from Google that retains, analyzes, and searches log
                            data to identify potential security threats, risks, and vulnerabilities. Chronicle allows
                            you to collect and analyze log data according to: <br><br>

                        <ul>
                            <li>A specific asset</li>

                            <li>A domain name</li>

                            <li> A user</li>

                            <li>An IP address</li>
                        </ul><br>

                        Chronicle provides multiple dashboards that help analysts monitor an organization’s logs, create
                        filters and alerts, and track suspicious domain names.

                        Review the following Chronicle dashboards and their purposes: <br><br>
                        <h4>Enterprise insights dashboard</h4>

                        The enterprise insights dashboard highlights recent alerts. It identifies suspicious domain
                        names in logs, known as indicators of compromise (IOCs). Each result is labeled with a
                        confidence score to indicate the likelihood of a threat. It also provides a severity level that
                        indicates the significance of each threat to the organization. A security analyst might use this
                        dashboard to monitor login or data access attempts related to a critical asset—like an
                        application or system—from unusual locations or devices. <br><br>

                        <h4>Data ingestion and health dashboard</h4>

                        The data ingestion and health dashboard shows the number of event logs, log sources, and success
                        rates of data being processed into Chronicle. A security analyst might use this dashboard to
                        ensure that log sources are correctly configured and that logs are received without error. This
                        helps ensure that log related issues are addressed so that the security team has access to the
                        log data they need. <br><br>


                        <h4>IOC matches dashboard</h4>

                        The IOC matches dashboard indicates the top threats, risks, and vulnerabilities to the
                        organization. Security professionals use this dashboard to observe domain names, IP addresses,
                        and device IOCs over time in order to identify trends. This information is then used to direct
                        the security team’s focus to the highest priority threats. For example, security analysts can
                        use this dashboard to search for additional activity associated with an alert, such as a
                        suspicious user login from an unusual geographic location. <br>


                        <h4> Main dashboard</h4>

                        The main dashboard displays a high-level summary of information related to the organization’s
                        data ingestion, alerting, and event activity over time. Security professionals can use this
                        dashboard to access a timeline of security events—such as a spike in failed login attempts— to
                        identify threat trends across log sources, devices, IP addresses, and physical locations.
                        <br>
                        <h4>Rule detections dashboard </h4>
                        The rule detections dashboard provides statistics related to incidents with the highest
                        occurrences, severities, and detections over time. Security analysts can use this dashboard to
                        access a list of all the alerts triggered by a specific detection rule, such as a rule designed
                        to alert whenever a user opens a known malicious attachment from an email. Analysts then use
                        those statistics to help manage recurring incidents and establish mitigation tactics to reduce
                        an organization's level of risk. <br><br>

                        <h4>User sign in overview dashboard</h4>

                        The user sign in overview dashboard provides information about user access behavior across the
                        organization. Security analysts can use this dashboard to access a list of all user sign-in
                        events to identify unusual user activity, such as a user signing in from multiple locations at
                        the same time. This information is then used to help mitigate threats, risks, and
                        vulnerabilities to user accounts and the organization’s applications.</p>

                    </article>
                </section>


                <section class="main-section" id="topic234">
                    <h2>Glossary terms from module 3</h2>


                    <article class="main-article">
                        <p>
                        <h4>Terms and definitions from Course 2, Module 3</h4>

                        <li>Chronicle: A cloud-native tool designed to retain, analyze, and search data</li>

                        <li>Incident response: An organization’s quick attempt to identify an attack, contain the
                            damage, and correct the effects of a security breach</li>

                        <li>Log: A record of events that occur within an organization’s systems </li>

                        <li>Metrics: Key technical attributes such as response time, availability, and failure rate,
                            which are used to assess the performance of a software application
                        </li>
                        <li>Operating system (OS): The interface between computer hardware and the user</li>

                        <li>Playbook: A manual that provides details about any operational action</li>

                        <li>Security information and event management (SIEM): An application that collects and analyzes
                            log data to monitor critical activities in an organization</li>

                        <li> Security orchestration, automation, and response (SOAR): A collection of applications,
                            tools, and workflows that use automation to respond to security events</li>

                        <li>SIEM tools: A software platform that collects, analyzes, and correlates security data from
                            various sources across your IT infrastructure that helps identify and respond to security
                            threats in real-time, investigate security incidents, and comply with security regulations
                        </li>
                        <li>Splunk Cloud: A cloud-hosted tool used to collect, search, and monitor log data
                        </li>
                        <li>Splunk Enterprise: A self-hosted tool used to retain, analyze, and search an organization's
                            log data to provide security information and alerts in real-time</li>
                        </p>
                    </article>
                </section>

                <section class="main-section" id="Module 24">
                    <h2>Module 4</h2>
                </section>


                <section class="main-section" id="topic241">
                    <h4>More about playbooks </h4>

                    <article class="main-article">
                        <p>Previously, you learned that playbooks are tools used by cybersecurity professionals to
                            identify and respond to security issues. In this reading, you’ll learn more about playbooks
                            and their purpose in the field of cybersecurity.
                        </p>

                        <h4>Playbook overview</h4>
                        <p>A playbook is a manual that provides details about any operational action. Essentially, a
                            playbook provides a predefined and up-to-date list of steps to perform when responding to an
                            incident.

                            <img src="resource/course2module41.png" alt="" id="img">

                            <br><br>
                            Playbooks are accompanied by a strategy. The strategy outlines expectations of team members
                            who are assigned a task, and some playbooks also list the individuals responsible. The
                            outlined expectations are accompanied by a plan. The plan dictates how the specific task
                            outlined in the playbook must be completed. <br>

                            Playbooks should be treated as living documents, which means that they are frequently
                            updated by security team members to address industry changes and new threats. Playbooks are
                            generally managed as a collaborative effort, since security team members have different
                            levels of expertise. <br>

                            Updates are often made if: <br><br>

                        <ul>
                            <li> A failure is identified, such as an oversight in the outlined policies and procedures,
                                or in the playbook itself. </li>

                            <li>There is a change in industry standards, such as changes in laws or regulatory
                                compliance.</li>

                            <li> The cybersecurity landscape changes due to evolving threat actor tactics and
                                techniques.</li>
                        </ul>
                        </p>

                        <h4>Types of playbooks</h4>
                        <p>Playbooks sometimes cover specific incidents and vulnerabilities. These might include
                            ransomware, vishing, business email compromise (BEC), and other attacks previously
                            discussed. Incident and vulnerability response playbooks are very common, but they are not
                            the only types of playbooks organizations develop. <br>

                            Each organization has a different set of playbook tools, methodologies, protocols, and
                            procedures that they adhere to, and different individuals are involved at each step of the
                            response process, depending on the country they are in. For example, incident notification
                            requirements from government-imposed laws and regulations, along with compliance standards,
                            affect the content in the playbooks. These requirements are subject to change based on where
                            the incident originated and the type of data affected. <br> </p>

                        <h4>Incident and vulnerability response playbooks</h4>
                        <p>Incident and vulnerability response playbooks are commonly used by entry-level cybersecurity
                            professionals. They are developed based on the goals outlined in an organization’s business
                            continuity plan. A business continuity plan is an established path forward allowing a
                            business to recover and continue to operate as normal, despite a disruption like a security
                            breach. <br>

                            These two types of playbooks are similar in that they both contain predefined and up-to-date
                            lists of steps to perform when responding to an incident. Following these steps is necessary
                            to ensure that you, as a security professional, are adhering to legal and organizational
                            standards and protocols. These playbooks also help minimize errors and ensure that important
                            actions are performed within a specific timeframe. <br>

                            When an incident, threat, or vulnerability occurs or is identified, the level of risk to the
                            organization depends on the potential damage to its assets. A basic formula for determining
                            the level of risk is that risk equals the likelihood of a threat. For this reason, a sense
                            of urgency is essential. Following the steps outlined in playbooks is also important if any
                            forensic task is being carried out. Mishandling data can easily compromise forensic data,
                            rendering it unusable. <br>
                        <ul>Common steps included in incident and vulnerability playbooks include:

                            <li>Preparation</li>

                            <li>Detection</li>

                            <li>Analysis</li>

                            <li>Containment</li>

                            <li>Eradication</li>

                            <li> Recovery from an incident </li> <br><br>

                            Additional steps include performing post-incident activities, and a coordination of efforts
                            throughout the investigation and incident and vulnerability response stages.
                        </ul>


                        </p>
                    </article>
                </section>

                <section class="main-section" id="topic242">
                    <h4>Playbooks, SIEM tools, and SOAR tools </h4>


                    <article class="main-article">
                        <p>Previously, you learned that security teams encounter threats, risks, vulnerabilities, and
                            incidents on a regular basis and that they follow playbooks to address security-related
                            issues. In this reading, you will learn more about playbooks, including how they are used in
                            security information and event management (SIEM) and security orchestration, automation, and
                            response (SOAR). </p>

                        <h4>Playbooks and SIEM tools</h4>
                        <p>Playbooks are used by cybersecurity teams in the event of an incident. Playbooks help
                            security teams respond to incidents by ensuring that a consistent list of actions are
                            followed in a prescribed way, regardless of who is working on the case. Playbooks can be
                            very detailed and may include flow charts and tables to clarify what actions to take and in
                            which order. Playbooks are also used for recovery procedures in the event of a ransomware
                            attack. Different types of security incidents have their own playbooks that detail who
                            should take what action and when. <br><br>

                            Playbooks are generally used alongside SIEM tools. If, for example, unusual user behavior is
                            flagged by a SIEM tool, a playbook provides analysts with instructions about how to address
                            the issue. <br></p>
                        <h4>Playbooks and SOAR tools</h4>
                        <p>Playbooks are also used with SOAR tools. SOAR tools are similar to SIEM tools in that they
                            are used for threat monitoring. SOAR is a piece of software used to automate repetitive
                            tasks generated by tools such as a SIEM or managed detection and response (MDR). For
                            example, if a user attempts to log into their computer too many times with the wrong
                            password, a SOAR would automatically block their account to stop a possible intrusion. Then,
                            analysts would refer to a playbook to take steps to resolve the issue.</p>
                    </article>
                </section>


                <section class="main-section" id="topic243">
                    <h4>Glossary terms from module 4</h4>


                    <article class="main-article">
                        <ul><strong>Terms and definitions from Course 2, Module 4</strong>
                            <li>

                                Incident response: An organization’s quick attempt to identify an attack, contain the
                                damage, and correct the effects of a security breach</li>

                            <li>Playbook: A manual that provides details about any operational action</li>
                        </ul>
                    </article>
                </section>


                <section class="main-section" id="Course 3">
                    <h2 id="cs2">Course 3</h2>
                </section>


                <section class="main-section" id="Module 31">
                    <h2>Module 1</h2>
                </section>
                <br> <br>


                <section class="main-section" id="topic311">
                    <h2>Network components, devices, and diagrams</h2>

                    <article class="main-article">


                        <h1>Network Devices and Connections</h1>
                        <p>A foundational understanding of network architecture, sometimes referred to as network
                            design, will help you as you learn about security vulnerabilities inherent in all networks
                            and how malicious actors attempt to exploit them. Let’s get started!</p>

                        <h2>Network Devices</h2>
                        <p>Network devices maintain information and services for users of a network. These devices
                            connect over wired and wireless connections. After establishing a connection to the network,
                            the devices send data packets. The data packets provide information about the source and the
                            destination of the data. This is how the information is sent and received via different
                            devices on a network.</p>
                        <p>The network is the overall infrastructure that allows devices to communicate with each other.
                            Network devices are specialized vehicles like routers and switches that manage what is being
                            sent and received over the network. Additionally, devices like computers and phones connect
                            to the network via network devices.

                            <img src="resource/course3module1.png" id="img" alt="">
                        </p>

                        <h3>Note:</h3>
                        <p>In this diagram, a router connects to the internet through a modem, which is provided by your
                            internet service provider (ISP). The firewall is a security device that monitors incoming
                            and outgoing traffic on your network. The router then directs traffic to the devices on your
                            home network, which can include computers, laptops, smartphones, tablets, printers, and
                            other devices. You can imagine here that the server is a file server. All devices on this
                            network can access the files in this server. This diagram also includes a switch which is an
                            optional device that can be used to connect more devices to your network by providing
                            additional ports and Ethernet connections. Additionally, there are 2 routers connected to
                            the switch here for load balancing purposes which will improve the performance of the
                            network.</p>

                        <h2>Devices and Desktop Computers</h2>
                        <p>Most internet users are familiar with everyday devices, such as personal computers, laptops,
                            mobile phones, and tablets. Each device and desktop computer has a unique MAC address and IP
                            address, which identify it on the network. They also have a network interface that sends and
                            receives data packets. These devices can connect to the network via a hard wire or a
                            wireless connection.</p>

                        <h2>Firewalls</h2>
                        <p>A firewall is a network security device that monitors traffic to or from your network. It is
                            like your first line of defense. Firewalls can also restrict specific incoming and outgoing
                            network traffic. The organization configures the security rules of the firewall. Firewalls
                            often reside between the secured and controlled internal network and the untrusted network
                            resources outside the organization, such as the internet. Remember, though, firewalls are
                            just one line of defense in the cybersecurity landscape.</p>

                        <h2>Servers</h2>
                        <p>Servers provide information and services for devices like computers, smart home devices, and
                            smartphones on the network. The devices that connect to a server are called clients. The
                            following graphic outlines this model, which is called the client-server model. In this
                            model, clients send requests to the server for information and services. The server performs
                            the requests for the clients. Common examples include DNS servers that perform domain name
                            lookups for internet sites, file servers that store and retrieve files from a database, and
                            corporate mail servers that organize mail for a company.

                            <img src="resource/course3module1b.png" id="img" alt="">
                        </p>

                        <h2>Hubs and Switches</h2>
                        <p>Hubs and switches both direct traffic on a local network. A hub is a device that provides a
                            common point of connection for all devices directly connected to it. Hubs additionally
                            repeat all information out to all ports. From a security perspective, this makes hubs
                            vulnerable to eavesdropping. For this reason, hubs are not used as often on modern networks;
                            most organizations use switches instead. Hubs are more commonly used for a limited network
                            setup like a home office.</p>

                        <p>Switches are the preferred choice for most networks. A switch forwards packets between
                            devices directly connected to it. They analyze the destination address of each data packet
                            and send it to the intended device. Switches maintain a MAC address table that matches MAC
                            addresses of devices on the network to port numbers on the switch and forwards incoming data
                            packets according to the destination MAC address. Switches are a part of the data link layer
                            in the TCP/IP model. Overall, switches improve performance and security.</p>

                        <h2>Routers</h2>
                        <p>Routers connect networks and direct traffic, based on the IP address of the destination
                            network. Routers allow devices on different networks to communicate with each other. In the
                            TCP/IP model, routers are a part of the network layer. The IP address of the destination
                            network is contained in the IP header. The router reads the IP header information and
                            forwards the packet to the next router on the path to the destination. This continues until
                            the packet reaches the destination network. Routers can also include a firewall feature that
                            allows or blocks incoming traffic based on information in the transmission. This stops
                            malicious traffic from entering the private network and damaging the local area network.</p>

                        <h2>Modems and Wireless Access Points</h2>
                        <p>Modems usually connect your home or office with an internet service provider (ISP). ISPs
                            provide internet connectivity via telephone lines or coaxial cables. Modems receive
                            transmissions or digital signals from the internet and translate them into analog signals
                            that can travel through the physical connection provided by your ISP. Usually, modems
                            connect to a router that takes the decoded transmissions and sends them on to the local
                            network.</p>

                        <p><strong>Note:</strong> Enterprise networks used by large organizations to connect their users
                            and devices often use other broadband technologies to handle high-volume traffic, instead of
                            using a modem.</p>

                        <img src="resource/course3module1c.png" id="img" alt="">

                        <h2>Wireless Access Point</h2>
                        <p>A wireless access point sends and receives digital signals over radio waves creating a
                            wireless network. Devices with wireless adapters connect to the access point using Wi-Fi.
                            Wi-Fi refers to a set of standards that are used by network devices to communicate
                            wirelessly. Wireless access points and the devices connected to them use Wi-Fi protocols to
                            send data through radio waves where they are sent to routers and switches and directed along
                            the path to their final destination.
                            <img src="resource/course3module1d.png" id="img" alt="">
                        </p>

                        <h2>Using Network Diagrams as a Security Analyst</h2>
                        <p>Network diagrams allow network administrators and security personnel to imagine the
                            architecture and design of their organization’s private network.</p>

                        <p>Network diagrams are maps that show the devices on the network and how they connect. Network
                            diagrams use small representative graphics to portray each network device and dotted lines
                            to show how each device connects to the other. By studying network diagrams, security
                            analysts develop and refine their strategies for securing network architectures.
                            <img src="resource/course3module1e.png" id="img" alt="">
                        </p>


                        <section class="main-section" id="topic312">
                            <h2>Cloud computing and software-defined networks</h2>

                            <article class="main-article">

                                <p>In this section of the course, you’ve been learning the basic architecture of
                                    networks. You’ve learned about how physical network devices like workstations,
                                    servers, routers, and switches connect to each other to create a network. Networks
                                    may cover small geographical areas, as is the case in a local area network (LAN). Or
                                    they may span a large geographic area, like a city, state, or country, as is the
                                    case in a wide area network (WAN). You also learned about cloud networks and how
                                    cloud computing has grown in recent years. <br><br>

                                    In this reading, you will further examine the concepts of cloud computing and cloud
                                    networking. You’ll also learn about hybrid networks and software-defined networks,
                                    as well as the benefits they offer. This reading will also cover the benefits of
                                    hosting networks in the cloud and why cloud-hosting is beneficial for large
                                    organizations.</p>

                                <h2>Computing processes in the cloud</h2>
                                <p>
                                    Traditional networks are called on-premise networks, which means that all of the
                                    devices used for network operations are kept at a physical location owned by the
                                    company, like in an office building, for example. Cloud computing, however, refers
                                    to the practice of using remote servers, applications, and network services that are
                                    hosted on the internet instead of at a physical location owned by the company.
                                </p>
                                <p>
                                    A cloud service provider (CSP) is a company that offers cloud computing services.
                                    These companies own large data centers in locations around the globe that house
                                    millions of servers. Data centers provide technology services, such as storage, and
                                    compute at such a large scale that they can sell their services to other companies
                                    for a fee. Companies can pay for the storage and services they need and consume them
                                    through the CSP’s application programming interface (API) or web console.
                                </p>
                                <p>
                                    CSPs provide three main categories of services:
                                </p>
                                <ul>
                                    <li>Software as a service (SaaS):refers to software suites operated by the CSP that
                                        a company can use remotely without hosting the software. </li>
                                    <li>Infrastructure as a service (IaaS):refers to the use of virtual computer
                                        components offered by the CSP. These include virtual containers and storage that
                                        are configured remotely through the CSP’s API or web console. Cloud-compute and
                                        storage services can be used to operate existing applications and other
                                        technology workloads without significant modifications. Existing applications
                                        can be modified to take advantage of the availability, performance, and security
                                        features that are unique to cloud provider services.</li>
                                    <li>Platform as a service (PaaS):refers to tools that application developers can use
                                        to design custom applications for their company. Custom applications are
                                        designed and accessed in the cloud and used for a company’s specific business
                                        needs.</li>
                                </ul>
                                <p>
                                    <img src="resource/course3module1topic2.png" id="img" alt="">
                                    Differences between IaaS, PaaS, and SaaS and how each connects to a physical data
                                    center.
                                </p>
                        </section>

                        <section>
                            <h2>Hybrid cloud environments</h2>
                            <p>
                                When organizations use a CSP’s services in addition to their on-premise computers,
                                networks, and storage, it is referred to as a hybrid cloud environment. When
                                organizations use more than one CSP, it is called a multi-cloud environment. The vast
                                majority of organizations use hybrid cloud environments to reduce costs and maintain
                                control over network resources.
                            </p>
                        </section>

                        <section>
                            <h2>Software-defined networks</h2>
                            <p>
                                CSPs offer networking tools similar to the physical devices that you have learned about
                                in this section of the course. Next, you’ll review software-defined networking in the
                                cloud. Software-defined networks (SDNs) are made up of virtual network devices and
                                services. Just like CSPs provide virtual computers, many SDNs also provide virtual
                                switches, routers, firewalls, and more. Most modern network hardware devices also
                                support network virtualization and software-defined networking. This means that physical
                                switches and routers use software to perform packet routing. In the case of cloud
                                networking, the SDN tools are hosted on servers located at the CSP’s data center.
                            </p>
                        </section>

                        <section>
                            <h2>Benefits of cloud computing and software-defined networks</h2>
                            <h3>Reliability</h3>
                            <p>
                                Reliability in cloud computing is based on how available cloud services and resources
                                are, how secure connections are, and how often the services are effectively running.
                                Cloud computing allows employees and customers to access the resources they need
                                consistently and with minimal interruption.
                            </p>
                            <h3>Cost</h3>
                            <p>
                                Traditionally, companies have had to provide their own network infrastructure, at least
                                for internet connections. This meant there could be potentially significant upfront
                                costs for companies. However, because CSPs have such large data centers, they are able
                                to offer virtual devices and services at a fraction of the cost required for companies
                                to install, patch, upgrade, and manage the components and software themselves.
                            </p>
                            <h3>Scalability</h3>
                            <p>
                                Another challenge that companies face with traditional computing is scalability. When
                                organizations experience an increase in their business needs, they might be forced to
                                buy more equipment and software to keep up. But what if business decreases shortly
                                after? They might no longer have the business to justify the cost incurred by the
                                upgraded components. CSPs reduce this risk by making it easy to consume services in an
                                elastic utility model as needed. This means that companies only pay for what they need
                                when they need it.
                            </p>
                            <p>
                                Changes can be made quickly through the CSPs, APIs, or web console—much more quickly
                                than if network technicians had to purchase their own hardware and set it up. For
                                example, if a company needs to protect against a threat to their network, web
                                application firewalls (WAFs), intrusion detection/protection systems (IDS/IPS), or L3/L4
                                firewalls can be configured quickly whenever necessary, leading to better network
                                performance and security.
                            </p>
                        </section>

                        <section>
                            <h2>Key takeaways</h2>
                            <p>
                                In this reading, you learned more about cloud computing and cloud networking. You
                                learned that CSPs are companies that own large data centers that house millions of
                                servers in locations all over the globe and then provide modern technology services,
                                including compute, storage, and networking, through the internet. SDNs are an approach
                                to network management. SDNs enable dynamic, programmatically efficient network
                                configurations to improve network performance and monitoring. This makes it more like
                                cloud computing than traditional network management. Organizations can improve
                                reliability, save costs, and scale quickly by using CSPs to provide networking services
                                instead of building and maintaining their own network infrastructure.
                            </p>
                    </article>
                </section>


                <section class="main-section" id="topic313">
                    <h2>Learn more about the TCP/IP model</h2>

                    <article class="main-article">


                        <title>TCP/IP Model</title>


                        <h2>The TCP/IP model</h2>
                        <p>
                            The TCP/IP model is a framework used to visualize how data is organized and transmitted
                            across a network. This model helps network engineers and network security analysts
                            conceptualize processes on the network and communicate where disruptions or security threats
                            occur.
                        </p>
                        <p>
                            The TCP/IP model has four layers: the network access layer, internet layer, transport layer,
                            and application layer. When troubleshooting issues on the network, security professionals
                            can analyze which layers were impacted by an attack based on what processes were involved in
                            an incident.
                        </p>
                        <figure>
                            <img src="resource/course3module1para3b.png" id="img" alt="">
                            <figcaption>The four layers of the TCP/IP model</figcaption>
                        </figure>
                </section>

                <section>
                    <h2>Network access layer</h2>
                    <p>
                        The network access layer, sometimes called the data link layer, deals with the creation of data
                        packets and their transmission across a network. This layer corresponds to the physical hardware
                        involved in network transmission. Hubs, modems, cables, and wiring are all considered part of
                        this layer. The address resolution protocol (ARP) is part of the network access layer.
                    </p>
                </section>

                <section>
                    <h2>Internet layer</h2>
                    <p>
                        The internet layer, sometimes referred to as the network layer, is responsible for ensuring the
                        delivery to the destination host, which potentially resides on a different network. It ensures
                        IP addresses are attached to data packets to indicate the location of the sender and receiver.
                        The internet layer also determines which protocol is responsible for delivering the data packets
                        and ensures the delivery to the destination host.
                    </p>
                    <p>
                        Here are some of the common protocols that operate at the internet layer:
                    </p>
                    <ul>
                        <li>Internet Protocol (IP)</li>
                        <li>Internet Control Message Protocol (ICMP)</li>
                    </ul>
                </section>

                <section>
                    <h2>Transport layer</h2>
                    <p>
                        The transport layer is responsible for delivering data between two systems or networks and
                        includes protocols to control the flow of traffic across a network. TCP and UDP are the two
                        transport protocols that occur at this layer.
                    </p>
                    <p>
                        <strong>Transmission Control Protocol (TCP)</strong>
                        <br>
                        The Transmission Control Protocol (TCP) is an internet communication protocol that allows two
                        devices to form a connection and stream data.
                    </p>
                    <p>
                        <strong>User Datagram Protocol (UDP)</strong>
                        <br>
                        The User Datagram Protocol (UDP) is a connectionless protocol that does not establish a
                        connection between devices before transmissions.
                    </p>
                </section>

                <section>
                    <h2>Application layer</h2>
                    <p>
                        The application layer in the TCP/IP model is similar to the application, presentation, and
                        session layers of the OSI model. The application layer is responsible for making network
                        requests or responding to requests. Some common protocols used on this layer are:
                    </p>
                    <ul>
                        <li>Hypertext transfer protocol (HTTP)</li>
                        <li>Simple mail transfer protocol (SMTP)</li>
                        <li>Secure shell (SSH)</li>
                        <li>File transfer protocol (FTP)</li>
                        <li>Domain name system (DNS)</li>
                    </ul>
                </section>

                <section>
                    <h2>TCP/IP model versus OSI model</h2>
                    <img src="resource/course3module1para3b.png" alt="">
                    <p>
                        The OSI visually organizes network protocols into different layers. Network professionals often
                        use this model to communicate with each other about potential sources of problems or security
                        threats when they occur.
                    </p>
                    <p>
                        The TCP/IP model combines multiple layers of the OSI model. There are many similarities between
                        the two models. Both models define standards for networking and divide the network communication
                        process into different layers. The TCP/IP model is a simplified version of the OSI model.
                    </p>

                </section>

                <section>
                    <h2>Key takeaways</h2>
                    <p>
                        Both the TCP/IP and OSI models are conceptual models that help network professionals visualize
                        network processes and protocols in regards to data transmission between two or more systems. The
                        TCP/IP model contains four layers, and the OSI model contains seven layers.
                    </p>
            </article>
        </section>
        </section>


        <section class="main-section" id="topic314">
            <h2>The OSI model </h2>

            <article class="main-article">


                <p>
                    The TCP/IP model is a framework used to visualize how data is organized and transmitted across a
                    network. This model helps network engineers and security analysts conceptualize processes on the
                    network and communicate where disruptions or security threats occur.
                </p>
                <p>
                    The TCP/IP model has four layers: the network access layer, internet layer, transport layer, and
                    application layer. When analyzing network events, security professionals can determine what layer or
                    layers an attack occurred in based on what processes were involved in the incident.
                </p>
                <p>
                    The OSI model is a standardized concept that describes the seven layers computers use to communicate
                    and send data over the network. Network and security professionals often use this model to
                    communicate with each other about potential sources of problems or security threats when they occur.
                </p>
                <figure>
                    <img src="resource/course3module1para4"
                        alt="The seven layers of the OSI model labeled application, presentation, session, transport, network, data link, and physical">
                    <figcaption>The seven layers of the OSI model</figcaption>
                </figure>
        </section>

        <section>
            <h2>Layer 7: Application layer</h2>
            <p>
                The application layer includes processes that directly involve the everyday user. This layer includes
                all of the networking protocols that software applications use to connect a user to the internet. This
                characteristic is the identifying feature of the application layer—user connection to the internet via
                applications and requests.
            </p>
            <p>
                An example of a type of communication that happens at the application layer is using a web browser. The
                internet browser uses HTTP or HTTPS to send and receive information from the website server. The email
                application uses simple mail transfer protocol (SMTP) to send and receive email information. Also, web
                browsers use the domain name system (DNS) protocol to translate website domain names into IP addresses
                which identify the web server that hosts the information for the website.
            </p>
        </section>

        <section>
            <h2>Layer 6: Presentation layer</h2>
            <p>
                Functions at the presentation layer involve data translation and encryption for the network. This layer
                adds to and replaces data with formats that can be understood by applications (layer 7) on both sending
                and receiving systems. Formats at the user end may be different from those of the receiving system.
                Processes at the presentation layer require the use of a standardized format.
            </p>
            <p>
                Some formatting functions that occur at layer 6 include encryption, compression, and confirmation that
                the character code set can be interpreted on the receiving system. One example of encryption that takes
                place at this layer is SSL, which encrypts data between web servers and browsers as part of websites
                with HTTPS.
            </p>
        </section>

        <section>
            <h2>Layer 5: Session layer</h2>
            <p>
                A session describes when a connection is established between two devices. An open session allows the
                devices to communicate with each other. Session layer protocols keep the session open while data is
                being transferred and terminate the session once the transmission is complete.
            </p>
            <p>
                The session layer is also responsible for activities such as authentication, reconnection, and setting
                checkpoints during a data transfer. If a session is interrupted, checkpoints ensure that the
                transmission picks up at the last session checkpoint when the connection resumes. Sessions include a
                request and response between applications. Functions in the session layer respond to requests for
                service from processes in the presentation layer (layer 6) and send requests for services to the
                transport layer (layer 4).
            </p>
        </section>

        <section>
            <h2>Layer 4: Transport layer</h2>
            <p>
                The transport layer is responsible for delivering data between devices. This layer also handles the
                speed of data transfer, flow of the transfer, and breaking data down into smaller segments to make them
                easier to transport. Segmentation is the process of dividing up a large data transmission into smaller
                pieces that can be processed by the receiving system. These segments need to be reassembled at their
                destination so they can be processed at the session layer (layer 5). The speed and rate of the
                transmission also has to match the connection speed of the destination system. TCP and UDP are transport
                layer protocols.
            </p>
        </section>

        <section>
            <h2>Layer 3: Network layer</h2>
            <p>
                The network layer oversees receiving the frames from the data link layer (layer 2) and delivers them to
                the intended destination. The intended destination can be found based on the address that resides in the
                frame of the data packets. Data packets allow communication between two networks. These packets include
                IP addresses that tell routers where to send them. They are routed from the sending network to the
                receiving network.
            </p>
        </section>

        <section>
            <h2>Layer 2: Data link layer</h2>
            <p>
                The data link layer organizes sending and receiving data packets within a single network. The data link
                layer is home to switches on the local network and network interface cards on local devices.
            </p>
            <p>
                Protocols like network control protocol (NCP), high-level data link control (HDLC), and synchronous data
                link control protocol (SDLC) are used at the data link layer.
            </p>
        </section>

        <section>
            <h2>Layer 1: Physical layer</h2>
            <p>
                As the name suggests, the physical layer corresponds to the physical hardware involved in network
                transmission. Hubs, modems, and the cables and wiring that connect them are all considered part of the
                physical layer. To travel across an ethernet or coaxial cable, a data packet needs to be translated into
                a stream of 0s and 1s. The stream of 0s and 1s are sent across the physical wiring and cables, received,
                and then passed on to higher levels of the OSI model.
            </p>
        </section>

        <section>
            <h2>Key takeaways</h2>
            <p>
                Both the TCP/IP and OSI models are conceptual models that help network professionals design network
                processes and protocols with regards to data transmission between two or more systems. The OSI model
                contains seven communication layers. Network and security professionals use the OSI model to communicate
                with each other about potential sources of problems or security threats when they occur. Network
                engineers and network security analysts use the TCP/IP and OSI models to conceptualize network processes
                and communicate the location of disruptions or threats.
            </p>
        </section>

        </article>
        </section>

        <section class="main-section" id="topic315">
            <h2>Components of network layer communication</h2>


            <article class="main-article">


                <section>
                    <h2>Operations at the network layer</h2>
                    <p>

                        Functions at the network layer organize the addressing and delivery of data packets across the
                        network from the host device to the destination device. This includes directing the packets from
                        one router to another router across the internet, till it reaches the internet protocol (IP)
                        address of the destination network. The destination IP address is contained within the header of
                        each data packet. This address will be stored for future routing purposes in routing tables
                        along the packet’s path to its destination.
                    </p>
                    <p>
                        All data packets include an IP address. A data packet is also referred to as an IP packet for
                        TCP connections or a datagram for UDP connections. A router uses the IP address to route packets
                        from network to network based on information contained in the IP header of a data packet. Header
                        information communicates more than just the address of the destination. It also includes
                        information such as the source IP address, the size of the packet, and which protocol will be
                        used for the data portion of the packet.
                    </p>
                    <figure>
                        <img src="resource/course3module1para5a.png" id="img"
                            alt="Format of an IPv4 packet - An IP packet divided into two parts: a section on the left marked 'header,' and section on the right marked 'data'">
                        <figcaption>Format of an IPv4 packet</figcaption>
                    </figure>
                </section>

                <section>
                    <h2>Diagram of an IPv4 packet header, 13 fields, and bit size</h2>
                    <p>
                        Next, you can review the format of an IP version 4 (IPv4) packet and review a detailed graphic
                        of the packet header. An IPv4 packet is made up of two sections, the header and the data:
                    </p>
                    <ul>
                        <li><strong>An IPv4 header format</strong> is determined by the IPv4 protocol and includes the
                            IP routing information that devices use to direct the packet. The size of the IPv4 header
                            ranges from 20 to 60 bytes. The first 20 bytes are a fixed set of information containing
                            data such as the source and destination IP address, header length, and total length of the
                            packet. The last set of bytes can range from 0 to 40 and consists of the options field.</li>
                        <li>The length of the <strong>data section</strong> of an IPv4 packet can vary greatly in size.
                            However, the maximum possible size of an IPv4 packet is 65,535 bytes. It contains the
                            message being transferred over the internet, like website information or email text.</li>
                    </ul>
                    <figure>
                        <img src="resource/course3module1para5b.png" id="img"
                            alt="Diagram of an IPv4 packet header, 13 fields, and bit size">
                        <figcaption>Diagram of an IPv4 packet header, 13 fields, and bit size</figcaption>
                    </figure>
                </section>

                <section>
                    <h2>Difference between IPv4 and IPv6</h2>
                    <p>
                        In an earlier part of this course, you learned about the history of IP addressing. As the
                        internet grew, it became clear that all of the IPv4 addresses would eventually be depleted; this
                        is called IPv4 address exhaustion. At the time, no one had anticipated how many computing
                        devices would need an IP address. IPv6 was developed to mitigate IPv4 address exhaustion and
                        other related concerns.
                    </p>

                    <p>
                        Some of the key differences between IPv4 and IPv6 include the length and the format of the
                        addresses. IPv4 addresses are made up of four decimal numbers separated by periods, each number
                        ranging from 0 to 255. Together the numbers span 4 bytes, and allow for up to 4.3 billion
                        possible addresses. An example of an IPv4 address would be: 198.51.100.0. IPv6 addresses are
                        made of eight hexadecimal numbers separated by colons, each number consisting of up to four
                        hexadecimal digits. Together, all numbers span 16 bytes, and allow for up to 340 undecillion
                        addresses (340 followed by 36 zeros). An example of an IPv6 address would be:
                        2002:0db8:0000:0000:0000:ff21:0023:1234.
                    </p>
                    <p>
                        Note: to represent one or more consecutive sets of all zeros, you can replace the zeros with a
                        double colon "::", so the above IPv6 address would be "2002:0db8::ff21:0023:1234."
                    </p>
                    <p>
                        There are also some differences in the layout of an IPv6 packet header. The IPv6 header format
                        is much simpler than IPv4. For example, the IPv4 Header includes the IHL, Identification, and
                        Flags fields, whereas the IPv6 does not. The IPv6 header only introduces the Flow Label field,
                        where the Flow Label identifies a packet as requiring special handling by other IPv6 routers.
                    </p>
                    <figure>
                        <img src="resource/course3module1para5c.png" id="img"
                            alt="Side by side diagrams of an IPv4 packet header and a simplified IPv6 packet">
                        <figcaption>Side by side diagrams of an IPv4 packet header and a simplified IPv6 packet
                        </figcaption>
                    </figure>
                </section>

                <section>
                    <h2>Key takeaways</h2>
                    <p>
                        Analyzing the different fields in an IP data packet can be used to find out important security
                        information about the packet. Some examples of security-related information found in IP address
                        packets are: where the packet is coming from, where it’s going, and which protocol it’s using.
                        Understanding the data in an IP data packet will allow you to make critical decisions about the
                        security implications of packets that you inspect.
                    </p>
                </section>


            </article>
        </section>


        <section class="main-section" id="topic316">
            <h2>Glossary terms from module 1 </h2>


            <article class="main-article">


                <title>Course 3, Module 1 Terms and Definitions</title>

                <ul>
                    <li><strong>Bandwidth:</strong> The maximum data transmission capacity over a network, measured by
                        bits per second</li>
                    <li><strong>Cloud computing:</strong> The practice of using remote servers, application, and network
                        services that are hosted on the internet instead of on local physical devices</li>
                    <li><strong>Cloud network:</strong> A collection of servers or computers that stores resources and
                        data in remote data centers that can be accessed via the internet</li>
                    <li><strong>Data packet:</strong> A basic unit of information that travels from one device to
                        another within a network</li>
                    <li><strong>Hub:</strong> A network device that broadcasts information to every device on the
                        network</li>
                    <li><strong>Internet Protocol (IP):</strong> A set of standards used for routing and addressing data
                        packets as they travel between devices on a network</li>
                    <li><strong>Internet Protocol (IP) address:</strong> A unique string of characters that identifies
                        the location of a device on the internet</li>
                    <li><strong>Local Area Network (LAN):</strong> A network that spans small areas like an office
                        building, a school, or a home</li>
                    <li><strong>Media Access Control (MAC) address:</strong> A unique alphanumeric identifier that is
                        assigned to each physical device on a network</li>
                    <li><strong>Modem:</strong> A device that connects your router to the internet and brings internet
                        access to the LAN</li>
                    <li><strong>Network:</strong> A group of connected devices</li>
                    <li><strong>Open systems interconnection (OSI) model:</strong> A standardized concept that describes
                        the seven layers computers use to communicate and send data over the network</li>
                    <li><strong>Packet sniffing:</strong> The practice of capturing and inspecting data packets across a
                        network</li>
                    <li><strong>Port:</strong> A software-based location that organizes the sending and receiving of
                        data between devices on a network</li>
                    <li><strong>Router:</strong> A network device that connects multiple networks together</li>
                    <li><strong>Speed:</strong> The rate at which a device sends and receives data, measured by bits per
                        second</li>
                    <li><strong>Switch:</strong> A device that makes connections between specific devices on a network
                        by sending and receiving data between them</li>
                    <li><strong>TCP/IP model:</strong> A framework used to visualize how data is organized and
                        transmitted across a network</li>
                    <li><strong>Transmission Control Protocol (TCP):</strong> An internet communication protocol that
                        allows two devices to form a connection and stream data</li>
                    <li><strong>User Datagram Protocol (UDP):</strong> A connectionless protocol that does not establish
                        a connection between devices before transmissions</li>
                    <li><strong>Wide Area Network (WAN):</strong> A network that spans a large geographic area like a
                        city, state, or country</li>
                </ul>


            </article>
        </section>


        <section class="main-section" id="Module 32">
            <h2>Module 2</h2>
        </section>


        <section class="main-section" id="topic321">
            <h2>Common network protocols </h2>

            <article class="main-article">


                <p>In this section of the course, you learned about network protocols and how they organize
                    communication over a network. This reading will discuss network protocols in more depth and review
                    some basic protocols that you have learned previously. You will also learn new protocols and discuss
                    some of the ways protocols are involved in network security.</p>
                <h2>Overview of network protocols</h2>
                <p>A network protocol is a set of rules used by two or more devices on a network to describe the order
                    of delivery and the structure of data. Network protocols serve as instructions that come with the
                    information in the data packet. These instructions tell the receiving device what to do with the
                    data. Protocols are like a common language that allows devices all across the world to communicate
                    with and understand each other.</p>
                <p>Even though network protocols perform an essential function in network communication, security
                    analysts should still understand their associated security implications. Some protocols have
                    vulnerabilities that malicious actors exploit. For example, a nefarious actor could use the Domain
                    Name System (DNS) protocol, which resolves web addresses to IP addresses, to divert traffic from a
                    legitimate website to a malicious website containing malware. You’ll learn more about this topic in
                    upcoming course materials.</p>

                <h3>Three categories of network protocols</h3>
                <p>Network protocols can be divided into three main categories: communication protocols, management
                    protocols, and security protocols. There are dozens of different network protocols, but you don’t
                    need to memorize all of them for an entry-level security analyst role. However, it’s important for
                    you to know the ones listed in this reading.</p>

                <h4>Communication protocols</h4>
                <p>Communication protocols govern the exchange of information in network transmission. They dictate how
                    the data is transmitted between devices and the timing of the communication. They also include
                    methods to recover data lost in transit. Here are a few of them.</p>
                <ul>
                    <li><strong>Transmission Control Protocol (TCP):</strong> An internet communication protocol that
                        allows two devices to form a connection and stream data. TCP uses a three-way handshake process.
                        First, the device sends a synchronize (SYN) request to a server. Then the server responds with a
                        SYN/ACK packet to acknowledge receipt of the device's request. Once the server receives the
                        final ACK packet from the device, a TCP connection is established. In the TCP/IP model, TCP
                        occurs at the transport layer.</li>
                    <li><strong>User Datagram Protocol (UDP):</strong> A connectionless protocol that does not establish
                        a connection between devices before a transmission. This makes it less reliable than TCP. But it
                        also means that it works well for transmissions that need to get to their destination quickly.
                        For example, one use of UDP is for sending DNS requests to local DNS servers. In the TCP/IP
                        model, UDP occurs at the transport layer.</li>
                    <li><strong>Hypertext Transfer Protocol (HTTP):</strong> An application layer protocol that provides
                        a method of communication between clients and website servers. HTTP uses port 80. HTTP is
                        considered insecure, so it is being replaced on most websites by a secure version, called HTTPS
                        that uses encryption from SSL/TLS for communication. However, there are still many websites that
                        use the insecure HTTP protocol. In the TCP/IP model, HTTP occurs at the application layer.</li>
                    <li><strong>Domain Name System (DNS):</strong> A protocol that translates internet domain names into
                        IP addresses. When a client computer wishes to access a website domain using their internet
                        browser, a query is sent to a dedicated DNS server. The DNS server then looks up the IP address
                        that corresponds to the website domain. DNS normally uses UDP on port 53. However, if the DNS
                        reply to a request is large, it will switch to using the TCP protocol. In the TCP/IP model, DNS
                        occurs at the application layer.</li>
                </ul>

                <h4>Management Protocols</h4>
                <p>The next category of network protocols is management protocols. Management protocols are used for
                    monitoring and managing activity on a network. They include protocols for error reporting and
                    optimizing performance on the network.</p>
                <ul>
                    <li><strong>Simple Network Management Protocol (SNMP):</strong> A network protocol used for
                        monitoring and managing devices on a network. SNMP can reset a password on a network device or
                        change its baseline configuration. It can also send requests to network devices for a report on
                        how much of the network’s bandwidth is being used up. In the TCP/IP model, SNMP occurs at the
                        application layer.</li>
                    <li><strong>Internet Control Message Protocol (ICMP):</strong> An internet protocol used by devices
                        to tell each other about data transmission errors across the network. ICMP is used by a
                        receiving device to send a report to the sending device about the data transmission. ICMP is
                        commonly used as a quick way to troubleshoot network connectivity and latency by issuing the
                        “ping” command on a Linux operating system. In the TCP/IP model, ICMP occurs at the internet
                        layer.</li>
                </ul>

                <h4>Security Protocols</h4>
                <p>Security protocols are network protocols that ensure that data is sent and received securely across a
                    network. Security protocols use encryption algorithms to protect data in transit. Below are some
                    common security protocols.</p>
                <ul>
                    <li><strong>Hypertext Transfer Protocol Secure (HTTPS):</strong> A network protocol that provides a
                        secure method of communication between clients and website servers. HTTPS is a secure version of
                        HTTP that uses secure sockets layer/transport layer security (SSL/TLS) encryption on all
                        transmissions so that malicious actors cannot read the information contained. HTTPS uses port
                        443. In the TCP/IP model, HTTPS occurs at the application layer.</li>
                    <li><strong>Secure File Transfer Protocol (SFTP):</strong> A secure protocol used to transfer files
                        from one device to another over a network. SFTP uses secure shell (SSH), typically through TCP
                        port 22. SSH uses Advanced Encryption Standard (AES) and other types of encryption to ensure
                        that unintended recipients cannot intercept the transmissions. In the TCP/IP model, SFTP occurs
                        at the application layer. SFTP is used often with cloud storage. Every time a user uploads or
                        downloads a file from cloud storage, the file is transferred using the SFTP protocol.</li>
                </ul>

                <p><strong>Note:</strong> The encryption protocols mentioned do not conceal the source or destination IP
                    address of network traffic. This means a malicious actor can still learn some basic information
                    about the network traffic if they intercept it.</p>

                <h3>Key takeaways</h3>
                <p>The protocols you learned about in this reading are basic networking protocols that entry-level
                    cybersecurity analysts should know. Understanding how protocols function on a network is essential.
                    Cybersecurity analysts can leverage their knowledge of protocols to successfully mitigate
                    vulnerabilities on a network and potentially prevent future attacks.</p>


            </article>
        </section>

        <section class="main-section" id="topic322">
            <h2>Additional network protocols </h2>


            <article class="main-article">

                <p>In previous readings and videos, you learned how network protocols organize the sending and receiving
                    of data across a network. You also learned that protocols can be divided into three categories:
                    communication protocols, management protocols, and security protocols.

                    This reading will introduce you to a few additional concepts and protocols that will come up
                    regularly in your work as a security analyst. Some protocols are assigned port numbers by the
                    Internet Assigned Numbers Authority (IANA). These port numbers are included in the description of
                    each protocol, if assigned.

                </p>
                <h4>Network Address Translation</h4>
                <p>The devices on your local home or office network each have a private IP address that they use to
                    communicate directly with each other. However, in order for the devices with private IP addresses to
                    communicate with the public internet, they need to have a single public IP address that represents
                    all devices on the LAN to the public. For outgoing messages, the router can replace a private source
                    IP address with its public IP address and perform the reverse operation for responses. This process
                    is known as Network Address Translation (NAT) and it generally requires a router or firewall to be
                    specifically configured to perform NAT. NAT is a part of layer 2 (internet layer) and layer 3
                    (transport layer) of the TCP/IP model.</p>

                <!DOCTYPE html>

                <title>Private and Public IP Addresses</title>
                <style>
                    table {
                        border-collapse: collapse;
                        width: 100%;
                    }

                    th,
                    td {
                        border: 1px solid #dddddd;
                        text-align: left;
                        padding: 8px;
                    }

                    th {
                        background-color: #f2f2f2;
                    }
                </style>
                <h2>Private and Public IP Addresses</h2>
                <h3>Private IP Addresses</h3>
                <table>
                    <tr>
                        <th>Assigned by</th>
                        <th>Uniqueness</th>
                        <th>Cost</th>
                        <th>Address Ranges</th>
                    </tr>
                    <tr>
                        <td>Router</td>
                        <td>Unique only within private network</td>
                        <td>No cost to use</td>
                        <td>10.0.0.0-10.255.255.255<br>172.16.0.0-172.31.255.255<br>192.168.0.0-192.168.255.255</td>
                    </tr>
                </table>

                <h3>Public IP Addresses</h3>
                <table>
                    <tr>
                        <th>Assigned by</th>
                        <th>Uniqueness</th>
                        <th>Cost</th>
                        <th>Address Ranges</th>
                    </tr>
                    <tr>
                        <td>ISP and IANA</td>
                        <td>Unique address in global internet</td>
                        <td>Costs to lease a public IP address</td>
                        <td>1.0.0.0-9.255.255.255<br>11.0.0.0-126.255.255.255<br>128.0.0.0-172.15.255.255<br>172.32.0.0-192.167.255.255<br>192.169.0.0-233.255.255.255
                        </td>
                    </tr>
                </table>


                <title>Network Protocols and Port Numbers</title>
                <style>
                    h2,
                    h3,
                    p {
                        margin-bottom: 10px;
                    }

                    table {
                        border-collapse: collapse;
                        width: 100%;
                        margin-bottom: 20px;
                    }

                    th,
                    td {
                        border: 1px solid #ddd;
                        padding: 8px;
                        text-align: left;
                    }

                    th {
                        background-color: #f2f2f2;
                    }
                </style>


                <h2>Dynamic Host Configuration Protocol (DHCP)</h2>
                <p>Dynamic Host Configuration Protocol (DHCP) is in the management family of network protocols. DHCP is
                    an application layer protocol used on a network to configure devices. It works with the router to
                    assign a unique IP address to each device and provide the addresses of the appropriate DNS server
                    and default gateway for each device. DHCP servers operate on UDP port 67 while DHCP clients operate
                    on UDP port 68.</p>

                <h2>Address Resolution Protocol (ARP)</h2>
                <p>Address Resolution Protocol (ARP) is mainly a network access layer protocol in the TCP/IP model used
                    to translate the IP addresses that are found in data packets into the MAC address of the hardware
                    device. Each device on the network performs ARP and keeps track of matching IP and MAC addresses in
                    an ARP cache. ARP does not have a specific port number since it is a layer 2 protocol and port
                    numbers are associated with the layer 7 application layer.</p>

                <h2>Telnet</h2>
                <p>Telnet is an application layer protocol that is used to connect with a remote system. Telnet sends
                    all information in clear text. It uses command line prompts to control another device similar to
                    secure shell (SSH), but Telnet is not as secure as SSH. Telnet can be used to connect to local or
                    remote devices and uses TCP port 23.</p>

                <h2>Secure Shell (SSH)</h2>
                <p>Secure Shell (SSH) is used to create a secure connection with a remote system. This application layer
                    protocol provides an alternative for secure authentication and encrypted communication. SSH operates
                    over TCP port 22 and is a replacement for less secure protocols, such as Telnet.</p>

                <h2>Post Office Protocol (POP)</h2>
                <p>Post Office Protocol (POP) is an application layer protocol used to manage and retrieve email from a
                    mail server. POP3 is the most commonly used version of POP. POP uses TCP/UDP port 110 for
                    unencrypted communication and TCP/UDP port 995 for encrypted communication using SSL/TLS.</p>

                <h2>Internet Message Access Protocol (IMAP)</h2>
                <p>Internet Message Access Protocol (IMAP) is used for incoming email. IMAP downloads the headers of
                    emails and the message content. It uses TCP port 143 for unencrypted email and TCP port 993 over the
                    TLS protocol for encrypted email.</p>

                <h2>Simple Mail Transfer Protocol (SMTP)</h2>
                <p>Simple Mail Transfer Protocol (SMTP) is used to transmit and route email from the sender to the
                    recipient’s address. SMTP uses TCP/UDP port 25 for unencrypted communication and TCP/UDP port 587
                    using TLS for encrypted communication.</p>

                <h2>Protocols and Port Numbers</h2>
                <p>Port numbers are used by network devices to determine what should be done with the information
                    contained in each data packet once they reach their destination. Firewalls can filter out unwanted
                    traffic based on port numbers. For example, an organization may configure a firewall to only allow
                    access to TCP port 995 (POP3) by IP addresses belonging to the organization.</p>

                <h2>Protocol and Port Numbers</h2>
                <table>
                    <tr>
                        <th>Protocol</th>
                        <th>Port</th>
                    </tr>
                    <tr>
                        <td>DHCP</td>
                        <td>UDP port 67 (servers)</td>
                    </tr>
                    <tr>
                        <td></td>
                        <td>UDP port 68 (clients)</td>
                    </tr>
                    <tr>
                        <td>ARP</td>
                        <td>none</td>
                    </tr>
                    <tr>
                        <td>Telnet</td>
                        <td>TCP port 23</td>
                    </tr>
                    <tr>
                        <td>SSH</td>
                        <td>TCP port 22</td>
                    </tr>
                    <tr>
                        <td>POP3</td>
                        <td>TCP/UDP port 110 (unencrypted)</td>
                    </tr>
                    <tr>
                        <td></td>
                        <td>TCP/UDP port 995 (encrypted, SSL/TLS)</td>
                    </tr>
                    <tr>
                        <td>IMAP</td>
                        <td>TCP port 143 (unencrypted)</td>
                    </tr>
                    <tr>
                        <td></td>
                        <td>TCP port 993 (encrypted, SSL/TLS)</td>
                    </tr>
                    <tr>
                        <td>SMTP</td>
                        <td>TCP/UDP Port 25 (unencrypted)</td>
                    </tr>
                    <tr>
                        <td>SMTPS</td>
                        <td>TCP/UDP port 587 (encrypted, TLS)</td>
                    </tr>
                </table>


            </article>
        </section>


        <section class="main-section" id="topic323">
            <h2>The evolution of wireless security protocols</h2>


            <article class="main-article">

                <title>Wireless Security Protocols</title>

                <body>
                    <h1>Introduction to Wireless Security Protocols</h1>

                    <p>In the early days of the internet, all internet communication happened across physical cables. It
                        wasn’t until the mid-1980s that authorities in the United States designated a spectrum of radio
                        wave frequencies that could be used without a license, so there was more opportunity for the
                        internet to expand.</p>

                    <p>In the late 1990s and early 2000s, technologies were developed to send and receive data over
                        radio. Today, users access wireless internet through laptops, smart phones, tablets, and
                        desktops. Smart devices, like thermostats, door locks, and security cameras, also use wireless
                        internet to communicate with each other and with services on the internet.</p>
                    <img src="resource/course3module2imga.png" id="img" alt="">

                    <h2>Wi-Fi Standards and Protocols</h2>

                    <p>Many people today refer to wireless internet as Wi-Fi. Wi-Fi refers to a set of standards that
                        define communication for wireless LANs. Wi-Fi is a marketing term commissioned by the Wireless
                        Ethernet Compatibility Alliance (WECA). WECA has since renamed their organization Wi-Fi
                        Alliance.</p>

                    <p>Wi-Fi standards and protocols are based on the 802.11 family of internet communication standards
                        determined by the Institute of Electrical and Electronics Engineers (IEEE). So, as a security
                        analyst, you might also see Wi-Fi referred to as IEEE 802.11.</p>

                    <p>Wi-Fi communications are secured by wireless networking protocols. Wireless security protocols
                        have evolved over the years, helping to identify and resolve vulnerabilities with more advanced
                        wireless technologies.</p>

                    <h2>Wired Equivalent Privacy (WEP)</h2>

                    <p>Wired equivalent privacy (WEP) is a wireless security protocol designed to provide users with the
                        same level of privacy on wireless network connections as they have on wired network connections.
                        WEP was developed in 1999 and is the oldest of the wireless security standards.</p>

                    <p>WEP is largely out of use today, but security analysts should still understand WEP in case they
                        encounter it. For example, a network router might have used WEP as the default security protocol
                        and the network administrator never changed it. Or, devices on a network might be too old to
                        support newer Wi-Fi security protocols. Nevertheless, a malicious actor could potentially break
                        the WEP encryption, so it’s now considered a high-risk security protocol.</p>

                    <h2>Wi-Fi Protected Access (WPA)</h2>

                    <p>Wi-Fi Protected Access (WPA) was developed in 2003 to improve upon WEP, address the security
                        issues that it presented, and replace it. WPA was always intended to be a transitional measure
                        so backwards compatibility could be established with older hardware.

                        The flaws with WEP were in the protocol itself and how the encryption was used. WPA addressed
                        this weakness by using a protocol called Temporal Key Integrity Protocol (TKIP). WPA encryption
                        algorithm uses larger secret keys than WEPs, making it more difficult to guess the key by trial
                        and error.

                        WPA also includes a message integrity check that includes a message authentication tag with each
                        transmission. If a malicious actor attempts to alter the transmission in any way or resend at
                        another time, WPA’s message integrity check will identify the attack and reject the
                        transmission.

                        Despite the security improvements of WPA, it still has vulnerabilities. Malicious actors can use
                        a key reinstallation attack (or KRACK attack) to decrypt transmissions using WPA. Attackers can
                        insert themselves in the WPA authentication handshake process and insert a new encryption key
                        instead of the dynamic one assigned by WPA. If they set the new key to all zeros, it is as if
                        the transmission is not encrypted at all.

                        Because of this significant vulnerability, WPA was replaced with an updated version of the
                        protocol called WPA2.
                    </p>


                    <h2>WPA2 & WPA3</h2>
                    <h3>WPA2</h3>
                    <p>The second version of Wi-Fi Protected Access—known as WPA2—was released in 2004. WPA2 improves
                        upon WPA by using the Advanced Encryption Standard (AES). WPA2 also improves upon WPA’s use of
                        TKIP. WPA2 uses the Counter Mode Cipher Block Chain Message Authentication Code Protocol (CCMP),
                        which provides encapsulation and ensures message authentication and integrity. Because of the
                        strength of WPA2, it is considered the security standard for all Wi-Fi transmissions today.
                        WPA2, like its predecessor, is vulnerable to KRACK attacks. This led to the development of WPA3
                        in 2018.</p>

                    <h4>Personal</h4>
                    <p>WPA2 personal mode is best suited for home networks for a variety of reasons. It is easy to
                        implement, initial setup takes less time for personal than enterprise version. The global
                        passphrase for WPA2 personal version needs to be applied to each individual computer and access
                        point in a network. This makes it ideal for home networks, but unmanageable for organizations.
                    </p>

                    <h4>Enterprise</h4>
                    <p>WPA2 enterprise mode works best for business applications. It provides the necessary security for
                        wireless networks in business settings. The initial setup is more complicated than WPA2 personal
                        mode, but enterprise mode offers individualized and centralized control over the Wi-Fi access to
                        a business network. This means that network administrators can grant or remove user access to a
                        network at any time. Users never have access to encryption keys, this prevents potential
                        attackers from recovering network keys on individual computers.</p>

                    <h3>WPA3</h3>
                    <p>WPA3 is a secure Wi-Fi protocol and is growing in usage as more WPA3 compatible devices are
                        released. These are the key differences between WPA2 and WPA3:</p>
                    <ul>
                        <li>WPA3 addresses the authentication handshake vulnerability to KRACK attacks, which is present
                            in WPA2.</li>
                        <li>WPA3 uses Simultaneous Authentication of Equals (SAE), a password-authenticated,
                            cipher-key-sharing agreement. This prevents attackers from downloading data from wireless
                            network connections to their systems to attempt to decode it.</li>
                        <li>WPA3 has increased encryption to make passwords more secure by using 128-bit encryption,
                            with WPA3-Enterprise mode offering optional 192-bit encryption.</li>
                    </ul>

                    <h3>Key Takeaways</h3>
                    <p>As a security analyst, knowing the history of how Wi-Fi security protocols developed helps you to
                        better understand what to consider when protecting wireless networks. It’s important that you
                        understand the vulnerabilities of each protocol and how important it is that devices on your
                        network use the most up-to-date security technologies.</p>


            </article>
        </section>


        <section class="main-section" id="topic324">
            <h2>Subnetting and CIDR</h2>
            <article class="main-article">


                <h2>Overview of Subnetting</h2>
                <p>Earlier in this course, you learned about network segmentation, a security technique that divides
                    networks into sections. A private network can be segmented to protect portions of the network from
                    the internet, which is an unsecured global network.</p>

                <p>For example, you learned about the uncontrolled zone, the controlled zone, the demilitarized zone,
                    and the restricted zone. Feel free to review the video about security zones for a refresher on how
                    network segmentation can be used to add a layer of security to your organization’s network
                    operations. Creating security zones is one example of a networking strategy called subnetting.</p>

                <h3>Overview of Subnetting</h3>
                <p>Subnetting is the subdivision of a network into logical groups called subnets. It works like a
                    network inside a network. Subnetting divides up a network address range into smaller subnets within
                    the network. These smaller subnets form based on the IP addresses and network mask of the devices on
                    the network. Subnetting creates a network of devices to function as their own network. This makes
                    the network more efficient and can also be used to create security zones. If devices on the same
                    subnet communicate with each other, the switch changes the transmissions to stay on the same subnet,
                    improving speed and efficiency of the communications.</p>

                <img src="resource/course3module1img2.png" id="img" alt="">

                <h3>Classless Inter-Domain Routing notation for subnetting</h3>
                <p>Classless Inter-Domain Routing (CIDR) is a method of assigning subnet masks to IP addresses to create
                    a subnet. Classless addressing replaces classful addressing. Classful addressing was used in the
                    1980s as a system of grouping IP addresses into classes (Class A to Class E). Each class included a
                    limited number of IP addresses, which were depleted as the number of devices connecting to the
                    internet outgrew the classful range in the 1990s. Classless CIDR addressing expanded the number of
                    available IPv4 addresses.</p>

                <p>CIDR allows cybersecurity professionals to segment classful networks into smaller chunks. CIDR IP
                    addresses are formatted like IPv4 addresses, but they include a slash (“/’”) followed by a number at
                    the end of the address, This extra number is called the IP network prefix. For example, a regular
                    IPv4 address uses the 198.51.100.0 format, whereas a CIDR IP address would include the IP network
                    prefix at the end of the address, 198.51.100.0/24. This CIDR address encompasses all IP addresses
                    between 198.51.100.0 and 198.51.100.255. The system of CIDR addressing reduces the number of entries
                    in routing tables and provides more available IP addresses within networks.</p>

                <p>Note: You may learn more about CIDR during your career, but it won't be covered in any additional
                    depth in this certificate program. For now, you only need a basic understanding of this concept.</p>

                <h3>Security benefits of subnetting</h3>
                <p>Subnetting allows network professionals and analysts to create a network within their own network
                    without requesting another network IP address from their internet service provider. This process
                    uses network bandwidth more efficiently and improves network performance. Subnetting is one
                    component of creating isolated subnetworks through physical isolation, routing configuration, and
                    firewalls.</p>

                <h3>Key takeaways</h3>
                <p>Subnetting is a common security strategy used by organizations. Subnetting allows organizations to
                    create smaller networks within their private network. This improves the efficiency of the network
                    and can be used to create security zones.</p>


            </article>
        </section>


        <section class="main-section" id="topic325">
            <h2>Virtual networks and privacy</h2>
            <article class="main-article">


                <section>
                    <h2>This section of the course covered a lot of information about network operations.</h2>
                    <p>You reviewed the fundamentals of network architecture and communication and can now use this
                        knowledge as you learn how to secure networks. Securing a private network requires maintaining
                        the confidentiality of your data and restricting access to authorized users.</p>
                    <p>In this reading, you will review several network security topics previously covered in the
                        course, including virtual private networks (VPNs), proxy servers, firewalls, and security zones.
                        You'll continue to learn more about these concepts and how they relate to each other as you
                        continue through the course.</p>
                </section>

                <section>
                    <h3>Common Network Protocols</h3>
                    <p>Network protocols are used to direct traffic to the correct device and service depending on the
                        kind of communication being performed by the devices on the network. Protocols are the rules
                        used by all network devices that provide a mutually agreed upon foundation for how to transfer
                        data across a network.</p>
                    <p>There are three main categories of network protocols: communication protocols, management
                        protocols, and security protocols.</p>
                    <ul>
                        <li><strong>Communication protocols:</strong> Used to establish connections between servers.
                            Examples include TCP, UDP, and Simple Mail Transfer Protocol (SMTP), which provides a
                            framework for email communication.</li>
                        <li><strong>Management protocols:</strong> Used to troubleshoot network issues. One example is
                            the Internet Control Message Protocol (ICMP).</li>
                        <li><strong>Security protocols:</strong> Provide encryption for data in transit. Examples
                            include IPSec and SSL/TLS.</li>
                    </ul>
                    <p>Some other commonly used protocols are:</p>
                    <ul>
                        <li>HyperText Transfer Protocol (HTTP): Application layer communication protocol for
                            browser-server communication.</li>
                        <li>Domain Name System (DNS): Application layer protocol for translating host names to IP
                            addresses.</li>
                        <li>Address Resolution Protocol (ARP): Network layer protocol for mapping IP addresses to
                            physical machines or MAC addresses recognized on the local area network.</li>
                    </ul>
                </section>

                <section>
                    <h3>Wi-Fi</h3>
                    <p>This section of the course also introduced various wireless security protocols, including WEP,
                        WPA, WPA2, and WPA3. WPA3 encrypts traffic with the Advanced Encryption Standard (AES) cipher as
                        it travels from your device to the wireless access point. WPA2 and WPA3 offer two modes:
                        personal and enterprise.</p>
                    <p>Personal mode is best suited for home networks while enterprise mode is generally utilized for
                        business networks and applications.</p>
                </section>

                <section>
                    <h3>Network Security Tools and Practices</h3>
                    <h4>Firewalls</h4>
                    <p>Firewalls are network virtual appliances (NVAs) or hardware devices that inspect and can filter
                        network traffic before it’s permitted to enter the private network. Traditional firewalls are
                        configured with rules that tell it what types of data packets are allowed based on the port
                        number and IP address of the data packet.</p>
                    <p>There are two main categories of firewalls:</p>
                    <ul>
                        <li><strong>Stateless:</strong> A class of firewall that operates based on predefined rules and
                            does not keep track of information from data packets.</li>
                        <li><strong>Stateful:</strong> A class of firewall that keeps track of information passing
                            through it and proactively filters out threats. Unlike stateless firewalls, which require
                            rules to be configured in two directions, a stateful firewall only requires a rule in one
                            direction. This is because it uses a "state table" to track connections, so it can match
                            return traffic to an existing session.</li>
                    </ul>
                    <p>Next-generation firewalls (NGFWs) are the most technologically advanced firewall protection. They
                        exceed the security offered by stateful firewalls because they include deep packet inspection
                        and intrusion prevention features that detect security threats and notify firewall
                        administrators. NGFWs can inspect traffic at the application layer of the TCP/IP model and are
                        typically application aware.</p>
                </section>

                <section>
                    <h4>Proxy Servers</h4>
                    <p>A proxy server is another way to add security to your private network. Proxy servers utilize
                        network address translation (NAT) to serve as a barrier between clients on the network and
                        external threats. Forward proxies handle queries from internal clients when they access
                        resources external to the network. Reverse proxies function opposite of forward proxies; they
                        handle requests from external systems to services on the internal network. Some proxy servers
                        can also be configured with rules, like a firewall. For example, you can create filters to block
                        websites identified as containing malware.</p>
                </section>

                <section>
                    <h4>Virtual Private Networks (VPN)</h4>
                    <p>A VPN is a service that encrypts data in transit and disguises your IP address. VPNs use a
                        process called encapsulation to wrap unencrypted data in an encrypted data packet, allowing data
                        to be sent across the public network while remaining anonymous. Enterprises and other
                        organizations use VPNs to help protect communications from users’ devices to corporate
                        resources. Individuals also use VPNs to increase personal privacy.</p>
                    <p>Organizations are increasingly using a combination of VPN and SD-WAN capabilities to secure their
                        networks. Software-defined wide area network (SD-WAN) is a virtual WAN service that allows
                        organizations to securely connect users to applications across multiple locations and over large
                        geographical distances.</p>
                </section>

                <section>
                    <h3>Key Takeaways</h3>
                    <ul>
                        <li>There are three main categories of network protocols: communication, management, and
                            security protocols.</li>
                        <li>Firewalls, proxy servers, and VPNs are fundamental network security tools.</li>
                        <li>More organizations are implementing a cloud-based approach to network security by
                            incorporating a combination of VPN and SD-WAN capabilities as a service.</li>
                    </ul>
                </section>
            </article>
        </section>

        <section class="main-section" id="topic326">
            <h2>VPN protocols: Wireguard and IPSec</h2>
            <article class="main-article">


                <section>
                    <h2>VPN Overview</h2>
                    <p>A VPN, or virtual private network, is a network security service that changes your public IP
                        address and hides your virtual location so that you can keep your data private when you’re using
                        a public network like the internet. VPNs provide a server that acts as a gateway between a
                        computer and the internet. This server creates a path similar to a virtual tunnel that hides the
                        computer’s IP address and encrypts the data in transit to the internet. The main purpose of a
                        VPN is to create a secure connection between a computer and a network. Additionally, a VPN
                        allows trusted connections to be established on non-trusted networks. VPN protocols determine
                        how the secure network tunnel is formed. Different VPN providers provide different VPN
                        protocols.</p>
                </section>

                <section>
                    <h3>Remote Access and Site-to-Site VPNs</h3>
                    <p>Individual users use remote access VPNs to establish a connection between a personal device and a
                        VPN server. Remote access VPNs encrypt data sent or received through a personal device. The
                        connection between the user and the remote access VPN is established through the internet.</p>
                    <p>Enterprises use site-to-site VPNs largely to extend their network to other networks and
                        locations. This is particularly useful for organizations that have many offices across the
                        globe. IPSec is commonly used in site-to-site VPNs to create an encrypted tunnel between the
                        primary network and the remote network. One disadvantage of site-to-site VPNs is how complex
                        they can be to configure and manage compared to remote VPNs.</p>
                </section>

                <section>
                    <h3>WireGuard VPN vs. IPSec VPN</h3>
                    <p>WireGuard and IPSec are two different VPN protocols used to encrypt traffic over a secure network
                        tunnel. The majority of VPN providers offer a variety of options for VPN protocols, such as
                        WireGuard or IPSec. Ultimately, choosing between IPSec and WireGuard depends on many factors,
                        including connection speeds, compatibility with existing network infrastructure, and business or
                        individual needs.</p>
                    <h4>WireGuard VPN</h4>
                    <p>WireGuard is a high-speed VPN protocol, with advanced encryption, to protect users when they are
                        accessing the internet. It’s designed to be simple to set up and maintain. WireGuard can be used
                        for both site-to-site connection and client-server connections. WireGuard is relatively newer
                        than IPSec, and is used by many people due to the fact that its download speed is enhanced by
                        using fewer lines of code. WireGuard is also open source, which makes it easier for users to
                        deploy and debug. This protocol is useful for processes that require faster download speeds,
                        such as streaming video content or downloading large files.</p>
                    <h4>IPSec VPN</h4>
                    <p>IPSec is another VPN protocol that may be used to set up VPNs. Most VPN providers use IPSec to
                        encrypt and authenticate data packets in order to establish secure, encrypted connections. Since
                        IPSec is one of the earlier VPN protocols, many operating systems support IPSec from VPN
                        providers.</p>
                    <p>Although IPSec and WireGuard are both VPN protocols, IPSec is older and more complex than
                        WireGuard. Some clients may prefer IPSec due to its longer history of use, extensive security
                        testing, and widespread adoption. However, others may prefer WireGuard because of its potential
                        for better performance and simpler configuration.</p>
                </section>

                <section>
                    <h3>Key Takeaways</h3>
                    <p>A VPN protocol is similar to a network protocol: It’s a set of rules or instructions that will
                        determine how data moves between endpoints. There are two types of VPNs: remote access and
                        site-to-site. Remote access VPNs establish a connection between a personal device and a VPN
                        server and encrypt or decrypt data exchanged with a personal device. Enterprises use
                        site-to-site VPNs largely to extend their network to different locations and networks. IPSec can
                        be used to create site-to-site connections and WireGuard can be used for both site-to-site and
                        remote access connections.</p>
                </section>


            </article>
        </section>


        <section class="main-section" id="topic327">
            <h2>Glossary terms from module 2</h2>
            <article class="main-article">


                <title>Course 3, Module 2 - Terms and Definitions</title>

                <section>
                    <h2>Terms and Definitions from Course 3, Module 2</h2>
                    <dl>
                        <dt>Address Resolution Protocol (ARP)</dt>
                        <dd>A network protocol used to determine the MAC address of the next router or device on the
                            path</dd>

                        <dt>Cloud-based firewalls</dt>
                        <dd>Software firewalls that are hosted by the cloud service provider</dd>

                        <dt>Controlled zone</dt>
                        <dd>A subnet that protects the internal network from the uncontrolled zone</dd>

                        <dt>Domain Name System (DNS)</dt>
                        <dd>A networking protocol that translates internet domain names into IP addresses</dd>

                        <dt>Encapsulation</dt>
                        <dd>A process performed by a VPN service that protects your data by wrapping sensitive data in
                            other data packets</dd>

                        <dt>Firewall</dt>
                        <dd>A network security device that monitors traffic to or from your network</dd>

                        <dt>Forward proxy server</dt>
                        <dd>A server that regulates and restricts a person’s access to the internet</dd>

                        <dt>Hypertext Transfer Protocol (HTTP)</dt>
                        <dd>An application layer protocol that provides a method of communication between clients and
                            website servers</dd>

                        <dt>Hypertext Transfer Protocol Secure (HTTPS)</dt>
                        <dd>A network protocol that provides a secure method of communication between clients and
                            servers</dd>

                        <dt>IEEE 802.11 (Wi-Fi)</dt>
                        <dd>A set of standards that define communication for wireless LANs</dd>

                        <dt>Network protocols</dt>
                        <dd>A set of rules used by two or more devices on a network to describe the order of delivery of
                            data and the structure of data</dd>

                        <dt>Network segmentation</dt>
                        <dd>A security technique that divides the network into segments</dd>

                        <dt>Port filtering</dt>
                        <dd>A firewall function that blocks or allows certain port numbers to limit unwanted
                            communication</dd>

                        <dt>Proxy server</dt>
                        <dd>A server that fulfills the requests of its clients by forwarding them to other servers</dd>

                        <dt>Reverse proxy server</dt>
                        <dd>A server that regulates and restricts the internet's access to an internal server</dd>

                        <dt>Secure File Transfer Protocol (SFTP)</dt>
                        <dd>A secure protocol used to transfer files from one device to another over a network</dd>

                        <dt>Secure shell (SSH)</dt>
                        <dd>A security protocol used to create a shell with a remote system</dd>

                        <dt>Security zone</dt>
                        <dd>A segment of a company’s network that protects the internal network from the internet</dd>

                        <dt>Simple Network Management Protocol (SNMP)</dt>
                        <dd>A network protocol used for monitoring and managing devices on a network</dd>

                        <dt>Stateful</dt>
                        <dd>A class of firewall that keeps track of information passing through it and proactively
                            filters out threats</dd>

                        <dt>Stateless</dt>
                        <dd>A class of firewall that operates based on predefined rules and does not keep track of
                            information from data packets</dd>

                        <dt>Subnetting</dt>
                        <dd>The subdivision of a network into logical groups called subnets</dd>

                        <dt>Transmission Control Protocol (TCP)</dt>
                        <dd>An internet communication protocol that allows two devices to form a connection and stream
                            data</dd>

                        <dt>Uncontrolled zone</dt>
                        <dd>The portion of the network outside the organization</dd>

                        <dt>Virtual private network (VPN)</dt>
                        <dd>A network security service that changes your public IP address and masks your virtual
                            location so that you can keep your data private when you are using a public network like the
                            internet</dd>

                        <dt>Wi-Fi Protected Access (WPA)</dt>
                        <dd>A wireless security protocol for devices to connect to the internet</dd>
                    </dl>
                </section>


            </article>

        </section>


        <section class="main-section" id="Module 33">
            <h2>Module 3</h2>
        </section>
        <br> <br>


        <section class="main-section" id="topic331">
            <h2>How intrusions compromise your system </h2>

            <article class="main-article">


                <section>
                    <h2>Network Attacks and Impacts</h2>
                    <p>In this section of the course, you learned that every network has inherent vulnerabilities and
                        could become the target of a network attack.</p>
                    <p>Attackers could have varying motivations for attacking your organization’s network. They may have
                        financial, personal, or political motivations, or they may be a disgruntled employee or an
                        activist who disagrees with the company's values and wants to harm an organization’s operations.
                        Malicious actors can target any network. Security analysts must be constantly alert to potential
                        vulnerabilities in their organization’s network and take quick action to mitigate them.</p>
                </section>

                <section>
                    <h3>Network Interception Attacks</h3>
                    <p>Network interception attacks work by intercepting network traffic and stealing valuable
                        information or interfering with the transmission in some way.</p>
                    <p>Malicious actors can use hardware or software tools to capture and inspect data in transit. This
                        is referred to as packet sniffing. In addition to seeing information that they are not entitled
                        to, malicious actors can also intercept network traffic and alter it. These attacks can cause
                        damage to an organization’s network by inserting malicious code modifications or altering the
                        message and interrupting network operations. For example, an attacker can intercept a bank
                        transfer and change the account receiving the funds to one that the attacker controls.</p>
                    <p>Later in this course you will learn more about malicious packet sniffing, and other types of
                        network interception attacks: on-path attacks and replay attacks.</p>
                </section>

                <section>
                    <h3>Backdoor Attacks</h3>
                    <p>A backdoor attack is another type of attack you will need to be aware of as a security analyst.
                        An organization may have a lot of security measures in place, including cameras, biometric scans
                        and access codes to keep employees from entering and exiting without being seen. However, an
                        employee might work around the security measures by finding a backdoor to the building that is
                        not as heavily monitored, allowing them to sneak out for the afternoon without being seen.</p>
                    <p>In cybersecurity, backdoors are weaknesses intentionally left by programmers or system and
                        network administrators that bypass normal access control mechanisms. Backdoors are intended to
                        help programmers conduct troubleshooting or administrative tasks. However, backdoors can also be
                        installed by attackers after they’ve compromised an organization to ensure they have persistent
                        access.</p>
                    <p>Once the hacker has entered an insecure network through a backdoor, they can cause extensive
                        damage: installing malware, performing a denial of service (DoS) attack, stealing private
                        information or changing other security settings that leaves the system vulnerable to other
                        attacks. A DoS attack is an attack that targets a network or server and floods it with network
                        traffic.</p>
                </section>

                <section>
                    <h3>Possible Impacts on an Organization</h3>
                    <p>As you’ve learned already, network attacks can have a significant negative impact on an
                        organization. Let’s examine some potential consequences.</p>
                    <ul>
                        <li><strong>Financial:</strong> When a system is taken offline with a DoS attack or some other
                            tactic, they prevent a company from performing tasks that generate revenue. Depending on the
                            size of an organization, interrupted operations can cost millions of dollars. Reparation
                            costs to rebuild software infrastructure and to pay large sums associated with potential
                            ransomware can be financially difficult. In addition, if a malicious actor gets access to
                            the personal information of the company’s clients or customers, the company may face heavy
                            litigation and settlement costs if customers seek legal recourse.</li>
                        <li><strong>Reputation:</strong> Attacks can also have a negative impact on the reputation of an
                            organization. If it becomes public knowledge that a company has experienced a cyber attack,
                            the public may become concerned about the security practices of the organization. They may
                            stop trusting the company with their personal information and choose a competitor to fulfill
                            their needs.</li>
                        <li><strong>Public Safety:</strong> If an attack occurs on a government network, this can
                            potentially impact the safety and welfare of the citizens of a country. In recent years,
                            defense agencies across the globe are investing heavily in combating cyber warfare tactics.
                            If a malicious actor gained access to a power grid, a public water system, or even a
                            military defense communication system, the public could face physical harm due to a network
                            intrusion attack.</li>
                    </ul>
                </section>

                <section>
                    <h3>Key Takeaways</h3>
                    <p>Malicious actors are constantly looking for ways to exploit systems. They learn about new
                        vulnerabilities as they arise and attempt to exploit every vulnerability in a system. Attackers
                        leverage backdoor attack methods and network interception attacks to gain access to sensitive
                        information they can use to exploit an organization or cause serious damage. These types of
                        attacks can impact an organization financially, damage its reputation, and potentially put the
                        public in danger. It is important that security analysts stay educated in order to maintain
                        network safety and reduce the likelihood and impact of these types of attacks. Securing networks
                        has never been more important.</p>
                </section>

            </article>
        </section>


        <section class="main-section" id="topic332">
            <h2>Read tcpdump logs </h2>

            <article class="main-content">


                <section>
                    <h2>Network Protocol Analyzer: tcpdump</h2>
                    <p>A network protocol analyzer, sometimes called a packet sniffer or a packet analyzer, is a tool
                        designed to capture and analyze data traffic within a network. They are commonly used as
                        investigative tools to monitor networks and identify suspicious activity. There are a wide
                        variety of network protocol analyzers available, but some of the most common analyzers include:
                    </p>
                    <ul>
                        <li>SolarWinds NetFlow Traffic Analyzer</li>
                        <li>ManageEngine OpManager</li>
                        <li>Azure Network Watcher</li>
                        <li>Wireshark</li>
                        <li>tcpdump</li>
                    </ul>
                    <p>This reading will focus exclusively on tcpdump, though you can apply what you learn here to many
                        of the other network protocol analyzers you'll use as a cybersecurity analyst to defend against
                        any network intrusions. In an upcoming activity, you’ll review a tcpdump data traffic log and
                        identify a DoS attack to practice these skills.</p>
                </section>

                <section>
                    <h3>tcpdump</h3>
                    <p>tcpdump is a command-line network protocol analyzer. It is popular, lightweight–meaning it uses
                        little memory and has a low CPU usage–and uses the open-source libpcap library. tcpdump is text
                        based, meaning all commands in tcpdump are executed in the terminal. It can also be installed on
                        other Unix-based operating systems, such as macOS®. It is preinstalled on many Linux
                        distributions.</p>
                    <p>tcpdump provides a brief packet analysis and converts key information about network traffic into
                        formats easily read by humans. It prints information about each packet directly into your
                        terminal. tcpdump also displays the source IP address, destination IP addresses, and the port
                        numbers being used in the communications.</p>
                </section>

                <section>
                    <h3>Interpreting output</h3>
                    <p>tcpdump prints the output of the command as the sniffed packets in the command line, and
                        optionally to a log file, after a command is executed. The output of a packet capture contains
                        many pieces of important information about the network traffic.</p>
                    <h4>Types of Information Presented in a tcpdump Packet Capture</h4>

                    <img src="resource/course3img.png" id="img" alt="">
                    <p>Some information you receive from a packet capture includes:</p>
                    <ul>
                        <li><strong>Timestamp:</strong> The output begins with the timestamp, formatted as hours,
                            minutes, seconds, and fractions of a second.</li>
                        <li><strong>Source IP:</strong> The packet’s origin is provided by its source IP address.</li>
                        <li><strong>Source port:</strong> This port number is where the packet originated.</li>
                        <li><strong>Destination IP:</strong> The destination IP address is where the packet is being
                            transmitted to.</li>
                        <li><strong>Destination port:</strong> This port number is where the packet is being transmitted
                            to.</li>
                    </ul>
                    <p>Note: By default, tcpdump will attempt to resolve host addresses to hostnames. It'll also replace
                        port numbers with commonly associated services that use these ports.</p>
                </section>

                <section>
                    <h3>Common Uses</h3>
                    <p>tcpdump and other network protocol analyzers are commonly used to capture and view network
                        communications and to collect statistics about the network, such as troubleshooting network
                        performance issues. They can also be used to:</p>
                    <ul>
                        <li>Establish a baseline for network traffic patterns and network utilization metrics.</li>
                        <li>Detect and identify malicious traffic.</li>
                        <li>Create customized alerts to send the right notifications when network issues or security
                            threats arise.</li>
                        <li>Locate unauthorized instant messaging (IM), traffic, or wireless access points.</li>
                    </ul>
                    <p>However, attackers can also use network protocol analyzers maliciously to gain information about
                        a specific network. For example, attackers can capture data packets that contain sensitive
                        information, such as account usernames and passwords. As a cybersecurity analyst, It’s important
                        to understand the purpose and uses of network protocol analyzers.</p>
                </section>

                <section>
                    <h3>Key Takeaways</h3>
                    <p>Network protocol analyzers, like tcpdump, are common tools that can be used to monitor network
                        traffic patterns and investigate suspicious activity. tcpdump is a command-line network protocol
                        analyzer that is compatible with Linux/Unix and macOS®. When you run a tcpdump command, the tool
                        will output packet routing information, like the timestamp, source IP address and port number,
                        and the destination IP address and port number. Unfortunately, attackers can also use network
                        protocol analyzers to capture data packets that contain sensitive information, such as account
                        usernames and passwords.</p>
                </section>

            </article>
        </section>

        <section class="main-section" id="topic333">
            <h2>Real-life DDoS attack </h2>

            <article class="main-article">


                <section>
                    <h2>DDoS Attack on DNS Servers - 2016 Case Study</h2>
                    <p>Previously, you were introduced to Denial of Service (DoS) attacks. You also learned that
                        volumetric distributed DoS (DDoS) attacks overwhelm a network by sending unwanted data packets
                        in such large quantities that the servers become unable to service normal users. This can be
                        detrimental to an organization. When systems fail, organizations cannot meet their customers'
                        needs. They often lose money, and in some cases, incur other losses. An organization’s
                        reputation may also suffer if news of a successful DDoS attack reaches consumers, who then
                        question the security of the organization.</p>
                </section>

                <section>
                    <h3>A DDoS targeting a widely used DNS server</h3>
                    <p>In previous videos, you learned about the function of a DNS server. As a review, DNS servers
                        translate website domain names into the IP address of the system that contains the information
                        for the website. For instance, if a user were to type in a website URL, a DNS server would
                        translate that into a numeric IP address that directs network traffic to the location of the
                        website’s server.</p>
                    <p>On the day of the DDoS attack we are studying, many large companies were using a DNS service
                        provider. The service provider was hosting the DNS system for these companies. This meant that
                        when internet users typed in the URL of the website they wanted to access, their devices would
                        be directed to the right place. On October 21, 2016, the service provider was the victim of a
                        DDoS attack.</p>
                </section>

                <section>
                    <h3>Leading up to the attack</h3>
                    <p>Before the attack on the service provider, a group of university students created a botnet with
                        the intention to attack various gaming servers and networks. A botnet is a collection of
                        computers infected by malware that are under the control of a single threat actor, known as the
                        “bot-herder." Each computer in the botnet can be remotely controlled to send a data packet to a
                        target system. In a botnet attack, cyber criminals instruct all the bots on the botnet to send
                        data packets to the target system at the same time, resulting in a DDoS attack.</p>
                    <p>The group of university students posted the code for the botnet online so that it would be
                        accessible to thousands of internet users and authorities wouldn’t be able to trace the botnet
                        back to the students. In doing so, they made it possible for other malicious actors to learn the
                        code to the botnet and control it remotely. This included the cyber criminals who attacked the
                        DNS service provider.</p>
                </section>

                <section>
                    <h3>The day of the attack</h3>
                    <p>At 7:00 a.m. on the day of the attack, the botnet sent tens of millions of DNS requests to the
                        service provider. This overwhelmed the system and the DNS service shut down. This meant that all
                        of the websites that used the service provider could not be reached. When users tried to access
                        various websites that used the service provider, they were not directed to the website they
                        typed in their browser. Outages for each web service occurred all over North America and Europe.
                    </p>
                    <p>The service provider’s systems were restored after only two hours of downtime. Although the cyber
                        criminals sent subsequent waves of botnet attacks, the DNS company was prepared and able to
                        mitigate the impact.</p>
                </section>

                <section>
                    <h3>Key takeaways</h3>
                    <p>As demonstrated in the above example, DDoS attacks can be very damaging to an organization. As a
                        security analyst, it’s important to acknowledge the seriousness of such an attack so that you’re
                        aware of opportunities to protect the network from them. If your network has important
                        operations distributed across hosts that can be dynamically scaled, then operations can continue
                        if the baseline host infrastructure goes offline. DDoS attacks are damaging, but there are
                        concrete actions that security analysts can take to help protect their organizations. Keep going
                        through this course and you will learn about common mitigation strategies to protect against
                        DDoS attacks.</p>
                </section>

            </article>
        </section>

        <section class="main-section" id="topic334">
            <h2>Overview of interception tactics </h2>

            <article class="main-article">
                <title>Interception Attacks and IP Spoofing</title>

                <section>
                    <h2>A Closer Review of Packet Sniffing</h2>
                    <p>Packet sniffing is the practice of capturing and inspecting data packets across a network. On a
                        private network, data packets are directed to the matching destination device on the network.
                        The device’s Network Interface Card (NIC) reads the data transmission, and if it contains the
                        device’s MAC address, it accepts the packet and sends it to the device to process the
                        information based on the protocol. However, a NIC can be set to promiscuous mode, which means
                        that it accepts all traffic on the network, even the packets that aren’t addressed to the NIC’s
                        device. Malicious actors might use software like Wireshark to capture the data on a private
                        network and store it for later use. They can then use the personal information to their own
                        advantage. Alternatively, they might use the IP and MAC addresses of authorized users of the
                        private network to perform IP spoofing.</p>
                </section>

                <section>
                    <h2>A Closer Review of IP Spoofing</h2>
                    <p>After a malicious actor has sniffed packets on the network, they can impersonate the IP and MAC
                        addresses of authorized devices to perform an IP spoofing attack. Firewalls can prevent IP
                        spoofing attacks by configuring it to refuse unauthorized IP packets and suspicious traffic.
                        Next, you’ll examine a few common IP spoofing attacks that are important to be familiar with as
                        a security analyst.</p>
                </section>

                <section>
                    <h3>On-Path Attack</h3>
                    <p>An on-path attack happens when a hacker intercepts the communication between two devices or
                        servers that have a trusted relationship. The transmission between these two trusted network
                        devices could contain valuable information like usernames and passwords that the malicious actor
                        can collect. An on-path attack is sometimes referred to as a meddler-in-the middle attack
                        because the hacker is hiding in the middle of communications between two trusted parties.</p>
                </section>

                <section>
                    <h3>Smurf Attack</h3>
                    <p>A smurf attack is a network attack that is performed when an attacker sniffs an authorized user’s
                        IP address and floods it with packets. Once the spoofed packet reaches the broadcast address, it
                        is sent to all of the devices and servers on the network. In a smurf attack, IP spoofing is
                        combined with another denial of service (DoS) technique to flood the network with unwanted
                        traffic. An important way to protect against a smurf attack is to use an advanced firewall that
                        can monitor any unusual traffic on the network.</p>
                </section>

                <section>
                    <h3>DoS Attack</h3>
                    <p>A Denial of Service attack is a class of attacks where the attacker prevents the compromised
                        system from performing legitimate activity or responding to legitimate traffic. Unlike IP
                        spoofing, however, the attacker will not receive a response from the targeted host. Everything
                        about the data packet is authorized including the IP address in the header of the packet. In IP
                        spoofing attacks, the malicious actor uses IP packets containing fake IP addresses. The
                        attackers keep sending IP packets containing fake IP addresses until the network server crashes.
                    </p>
                </section>

                <section>
                    <h2>Key Takeaways</h2>
                    <p>This reading covered several types of common IP spoofing attacks. Whether it is an on-path
                        attack, IP spoofing attack, or a smurf attack, analysts need to ensure that mitigation
                        strategies are in place to limit the threat and prevent security breaches.</p>
                </section>

            </article>
        </section>


        <section class="main-section" id="topic335">
            <h2>Glossary terms from module 3 </h2>

            <article class="main-article">
                <title>Course 3, Module 3: Terms and Definitions</title>

                <section>
                    <h2>Active Packet Sniffing</h2>
                    <p>A type of attack where data packets are manipulated in transit.</p>
                </section>

                <section>
                    <h2>Botnet</h2>
                    <p>A collection of computers infected by malware that are under the control of a single threat
                        actor, known as the “bot-herder”.</p>
                </section>

                <section>
                    <h2>Denial of Service (DoS) Attack</h2>
                    <p>An attack that targets a network or server and floods it with network traffic.</p>
                </section>

                <section>
                    <h2>Distributed Denial of Service (DDoS) Attack</h2>
                    <p>A type of denial of service attack that uses multiple devices or servers located in different
                        locations to flood the target network with unwanted traffic.</p>
                </section>

                <section>
                    <h2>Internet Control Message Protocol (ICMP)</h2>
                    <p>An internet protocol used by devices to tell each other about data transmission errors across the
                        network.</p>
                </section>

                <section>
                    <h2>Internet Control Message Protocol (ICMP) Flood</h2>
                    <p>A type of DoS attack performed by an attacker repeatedly sending ICMP request packets to a
                        network server.</p>
                </section>

                <section>
                    <h2>IP Spoofing</h2>
                    <p>A network attack performed when an attacker changes the source IP of a data packet to impersonate
                        an authorized system and gain access to a network.</p>
                </section>

                <section>
                    <h2>On-Path Attack</h2>
                    <p>An attack where a malicious actor places themselves in the middle of an authorized connection and
                        intercepts or alters the data in transit.</p>
                </section>

                <section>
                    <h2>Packet Sniffing</h2>
                    <p>The practice of capturing and inspecting data packets across a network.</p>
                </section>

                <section>
                    <h2>Passive Packet Sniffing</h2>
                    <p>A type of attack where a malicious actor connects to a network hub and looks at all traffic on
                        the network.</p>
                </section>

                <section>
                    <h2>Ping of Death</h2>
                    <p>A type of DoS attack caused when a hacker pings a system by sending it an oversized ICMP packet
                        that is bigger than 64KB.</p>
                </section>

                <section>
                    <h2>Replay Attack</h2>
                    <p>A network attack performed when a malicious actor intercepts a data packet in transit and delays
                        it or repeats it at another time.</p>
                </section>

                <section>
                    <h2>Smurf Attack</h2>
                    <p>A network attack performed when an attacker sniffs an authorized user’s IP address and floods it
                        with ICMP packets.</p>
                </section>

                <section>
                    <h2>Synchronize (SYN) Flood Attack</h2>
                    <p>A type of DoS attack that simulates a TCP/IP connection and floods a server with SYN packets.</p>

                </section>
            </article>
        </section>


        <section class="main-section" id="Module 34">
            <h2>Module 4</h2>
        </section>
        <br> <br>


        <section class="main-section" id="topic341">
            <h2>Brute force attacks and OS hardening </h2>

            <article class="main-article">
                <title>Brute Force Attacks and Prevention Measures</title>

                <section>
                    <h2>Brute Force Attacks</h2>
                    <p>A brute force attack is a trial-and-error process of discovering private information. There are
                        different types of brute force attacks:</p>
                    <ul>
                        <li>Simple brute force attacks: Attackers try to guess a user's login credentials by entering
                            any combination of usernames and passwords until they find the correct one.</li>
                        <li>Dictionary attacks: Attackers use a list of commonly used passwords and stolen credentials
                            from previous breaches to access a system.</li>
                    </ul>
                </section>

                <section>
                    <h2>Assessing Vulnerabilities</h2>
                    <p>Companies can run tests on their network or web applications to assess vulnerabilities:</p>
                    <h3>Virtual Machines (VMs)</h3>
                    <p>Virtual machines (VMs) are software versions of physical computers. They provide an additional
                        layer of security by allowing code to run in an isolated environment.</p>
                    <h3>Sandbox Environments</h3>
                    <p>A sandbox is a testing environment that allows execution of software separate from the network.
                        It's used for testing patches, identifying bugs, or detecting vulnerabilities.</p>
                </section>

                <section>
                    <h2>Prevention Measures</h2>
                    <p>Common measures organizations use to prevent brute force attacks:</p>
                    <ul>
                        <li>Salting and hashing: Converts information into a unique value and adds random characters to
                            hashed passwords.</li>
                        <li>Multi-factor authentication (MFA) and two-factor authentication (2FA): Requires users to
                            verify their identity in multiple ways.</li>
                        <li>CAPTCHA and reCAPTCHA: Asks users to complete a test to prove they are human and prevent
                            software from brute forcing passwords.</li>
                        <li>Password policies: Standardize good password practices throughout the organization.</li>
                    </ul>
                </section>
            </article>
        </section>


        <section class="main-section" id="topic342">
            <h2> Network security applications</h2>

            <article class="main-article">
                <title>Network Hardening and Monitoring</title>


                <section>
                    <h2>Firewall</h2>
                    <p>A firewall allows or blocks traffic based on a set of rules. NGFWs can inspect packet payloads.
                        Each system should have its own firewall.</p>
                    <p><img src="resource/course3module1aa.png" alt="Firewall Diagram"></p>
                </section>

                <section>
                    <h2>Intrusion Detection System (IDS)</h2>
                    <p>An IDS monitors system activity, alerts on possible intrusions, and detects known attacks or
                        anomalies. It sends alerts to network administrators for further investigation.</p>
                    <p><img src="resource/course3module1bb.png" alt="IDS Diagram"></p>
                </section>

                <section>
                    <h2>Intrusion Prevention System (IPS)</h2>
                    <p>An IPS monitors system activity for intrusive activity and actively stops anomalies when
                        detected. It sits behind the firewall and offers high-level security.</p>
                    <p><img src="resource/course3modulecc.png" alt="IPS Diagram"></p>
                </section>

                <section>
                    <h2>Full Packet Capture Devices</h2>
                    <p>These devices record and analyze all data transmitted over a network, aiding in investigating
                        alerts created by IDS.</p>
                </section>

                <section>
                    <h2>Security Information and Event Management (SIEM)</h2>
                    <p>A SIEM system collects and analyzes log data to monitor critical activities in an organization.
                        It works in real time to report suspicious activity in a centralized dashboard.</p>
                    <p><img src="resource/course3module1ee.png" alt="SIEM Dashboard"></p>
                    <p>Splunk and Chronicle are common SIEM tools that provide detailed dashboards for analyzing an
                        organization's data.</p>
                </section>

                <h2>Key takeaways</h2>


                <table>
                    <tr>
                        <th>Device / Tool</th>
                        <th>Advantages</th>
                        <th>Disadvantages</th>
                    </tr>
                    <tr>
                        <td>Firewall</td>
                        <td>A firewall allows or blocks traffic based on a set of rules.</td>
                        <td>A firewall is only able to filter packets based on information provided in the header of the
                            packets.</td>
                    </tr>
                    <tr>
                        <td>Intrusion Detection System (IDS)</td>
                        <td>An IDS detects and alerts admins about possible intrusions, attacks, and other malicious
                            traffic.</td>
                        <td>An IDS can only scan for known attacks or obvious anomalies; new and sophisticated attacks
                            might not be caught. It doesn’t actually stop the incoming traffic.</td>
                    </tr>
                    <tr>
                        <td>Intrusion Prevention System (IPS)</td>
                        <td>An IPS monitors system activity for intrusions and anomalies and takes action to stop them.
                        </td>
                        <td>An IPS is an inline appliance. If it fails, the connection between the private network and
                            the internet breaks. It might detect false positives and block legitimate traffic.</td>
                    </tr>
                    <tr>
                        <td>Security Information and Event Management (SIEM)</td>
                        <td>A SIEM tool collects and analyzes log data from multiple network machines. It aggregates
                            security events for monitoring in a central dashboard.</td>
                        <td>A SIEM tool only reports on possible security issues. It does not take any actions to stop
                            or prevent suspicious events.</td>
                    </tr>
                </table>

                <p>Each of these devices or tools cost money to purchase, install, and maintain. An organization might
                    need to hire additional personnel to monitor the security tools, as in the case of a SIEM.
                    Decision-makers are tasked with selecting the appropriate level of security based on cost and risk
                    to the organization. You will learn more about choosing levels of security later in the course. </p>


            </article>
        </section>

        <section class="main-section" id="topic343">
            <h2> Secure the cloud</h2>

            <article class="main-article">

                <title>Cloud Security Considerations</title>
                <style>
                    body {
                        font-family: Arial, sans-serif;
                        line-height: 1.6;
                        margin: 20px;
                    }

                    h2 {
                        color: #333;
                    }

                    p {
                        margin-bottom: 20px;
                    }
                </style>

                <h2>Cloud Security Considerations</h2>
                <p>Many organizations choose to use cloud services because of the ease of deployment, speed of
                    deployment, cost savings, and scalability of these options. Cloud computing presents unique security
                    challenges that cybersecurity analysts need to be aware of.</p>
                <ul>
                    <li><strong>Identity Access Management (IAM):</strong> Helps organizations manage digital identities
                        and authorizes user access to cloud resources. Loose configuration of user roles increases the
                        risk of unauthorized access.</li>
                    <li><strong>Configuration:</strong> Each cloud service must be carefully configured to meet security
                        and compliance requirements. Misconfigurations are a common source of cloud security issues,
                        especially during initial migration.</li>
                    <li><strong>Attack Surface:</strong> Cloud service providers offer numerous applications and
                        services, increasing an organization’s overall attack surface. Proper security measures must be
                        implemented to mitigate risks.</li>
                    <li><strong>Zero-day Attacks:</strong> Zero-day attacks are exploits previously unknown. Cloud
                        service providers are often quicker to respond to such attacks compared to traditional IT
                        organizations.</li>
                    <li><strong>Visibility and Tracking:</strong> Cloud networks offer visibility through flow logs and
                        tools like packet mirroring. However, organizations may have limited access to monitor traffic
                        on CSP servers.</li>
                    <li><strong>Things Change Fast:</strong> CSPs regularly update their services, impacting security
                        considerations for organizations. Organizations must adapt their IT processes accordingly.</li>
                </ul>
                <h2>Shared Responsibility Model</h2>
                <p>The shared responsibility model states that the CSP is responsible for security involving the cloud
                    infrastructure, while the organization using the service is responsible for assets and processes
                    stored or operated in the cloud.</p>
                <p>Organizations should not assume that the CSP is taking care of security aspects they have not
                    explicitly taken responsibility for. It is essential for organizations to correctly configure and
                    maintain security practices for their cloud services.</p>
            </article>
        </section>


        <section class="main-section" id="topic344">
            <h2> Cryptography and cloud security</h2>

            <article class="main-article">

                <title>Cloud Security Hardening and Cryptography</title>

                <h2>Cloud Security Hardening</h2>
                <p>Various techniques and tools can be used to secure cloud network infrastructure and resources. Some
                    common cloud security hardening techniques include:</p>
                <ul>
                    <li>Identity access management (IAM)</li>
                    <li>Hypervisors</li>
                    <li>Baselining</li>
                </ul>
                <h2>Identity Access Management (IAM)</h2>
                <p>IAM helps organizations manage digital identities and authorizes user access to different cloud
                    resources.</p>
                <h2>Hypervisors</h2>
                <p>Hypervisors abstract the host’s hardware from the operating software environment. There are two types
                    of hypervisors:</p>
                <ul>
                    <li>Type one hypervisors run on the hardware of the host computer.</li>
                    <li>Type two hypervisors operate on the software of the host computer.</li>
                </ul>
                <h2>Baselining</h2>
                <p>Baselining for cloud networks and operations covers how the cloud environment is configured and set
                    up. Proper configuration and setup can greatly improve the security and performance of a cloud
                    environment.</p>
                <h2>Cryptography in the Cloud</h2>
                <p>Cryptography secures data processed and stored in a cloud environment using encryption and secure key
                    management systems.</p>
                <h2>Cryptographic Erasure</h2>
                <p>Cryptographic erasure is a method of erasing encryption keys for encrypted data, making it
                    undecipherable.</p>
                <h2>Key Management</h2>
                <p>Measures such as Trusted Platform Module (TPM) and Cloud Hardware Security Module (CloudHSM) help
                    keep encryption keys secure.</p>
                <p>Organizations can assess and monitor the risk involved with allowing CSPs to manage the
                    infrastructure by reviewing audits and security controls.</p>

                <h4>Key takeaways</h4>

                <p>

                    Cloud security hardening is a critical component to consider when assessing the security of various
                    public cloud environments and improving the security within your organization. Identity access
                    management (IAM), correctly configuring a baseline for the cloud environment, securing hypervisors,
                    cryptography, and cryptographic erasure are all methods to use to further secure cloud
                    infrastructure.</p>


            </article>
        </section>


        <section class="main-section" id="topic345">
            <h2> Glossary terms from module 4 </h2>

            <article class="main-article">
                <title>Course 3, Module 4 Terms and Definitions</title>

                <h2>Baseline Configuration (Baseline Image)</h2>
                <p>A documented set of specifications within a system that is used as a basis for future builds,
                    releases, and updates.</p>
                <h2>Hardware</h2>
                <p>The physical components of a computer.</p>
                <h2>Multi-factor Authentication (MFA)</h2>
                <p>A security measure which requires a user to verify their identity in two or more ways to access a
                    system or network.</p>
                <h2>Network Log Analysis</h2>
                <p>The process of examining network logs to identify events of interest.</p>
                <h2>Operating System (OS)</h2>
                <p>The interface between computer hardware and the user.</p>
                <h2>Patch Update</h2>
                <p>A software and operating system update that addresses security vulnerabilities within a program or
                    product.</p>
                <h2>Penetration Testing (Pen Test)</h2>
                <p>A simulated attack that helps identify vulnerabilities in systems, networks, websites, applications,
                    and processes.</p>
                <h2>Security Hardening</h2>
                <p>The process of strengthening a system to reduce its vulnerabilities and attack surface.</p>
                <h2>Security Information and Event Management (SIEM)</h2>
                <p>An application that collects and analyzes log data to monitor critical activities for an
                    organization.</p>
                <h2>World-writable File</h2>
                <p>A file that can be altered by anyone in the world.</p>

            </article>
        </section>


        <section class="main-section" id="Course 4">
            <h2 id="cs2">Course 4</h2>
        </section>


        <section class="main-section" id="Module 41">
            <h2>Module 1</h2>
        </section>
        <br> <br>


        <section class="main-section" id="topic411">
            <h2>Compare operating systems </h2>

            <article class="main-article">


                <h1>Comparison of Operating Systems</h1>

                <p>You previously explored why operating systems are an important part of how a computer works. In this
                    reading, you’ll compare some popular operating systems used today. You’ll also focus on the risks of
                    using legacy operating systems.</p>

                <h2>Common Operating Systems</h2>

                <p>The following operating systems are useful to know in the security industry: Windows, macOS®, Linux,
                    ChromeOS, Android, and iOS.</p>

                <h3>Windows and macOS</h3>

                <p>Windows and macOS are both common operating systems. The Windows operating system was introduced in
                    1985, and macOS was introduced in 1984. Both operating systems are used in personal and enterprise
                    computers.</p>

                <p>Windows is a closed-source operating system, which means the source code is not shared freely with
                    the public. macOS is partially open source. It has some open-source components, such as macOS’s
                    kernel. macOS also has some closed-source components.</p>

                <h3>Linux</h3>

                <p>The first version of Linux was released in 1991, and other major releases followed in the early
                    1990s. Linux is a completely open-source operating system, which means that anyone can access Linux
                    and its source code. The open-source nature of Linux allows developers in the Linux community to
                    collaborate.</p>

                <p>Linux is particularly important to the security industry. There are some distributions that are
                    specifically designed for security. Later in this course, you’ll learn about Linux and its
                    importance to the security industry.</p>

                <h3>ChromeOS</h3>

                <p>ChromeOS launched in 2011. It’s partially open source and is derived from Chromium OS, which is
                    completely open source. ChromeOS is frequently used in the education field.</p>

                <h3>Android and iOS</h3>

                <p>Android and iOS are both mobile operating systems. Unlike the other operating systems mentioned,
                    mobile operating systems are typically used in mobile devices, such as phones, tablets, and watches.
                    Android was introduced for public use in 2008, and iOS was introduced in 2007. Android is open
                    source, and iOS is partially open source.</p>

                <h2>Operating Systems and Vulnerabilities</h2>

                <p>Security issues are inevitable with all operating systems. An important part of protecting an
                    operating system is keeping the system and all of its components up to date.</p>

                <h2>Legacy Operating Systems</h2>

                <p>A legacy operating system is an operating system that is outdated but still being used. Some
                    organizations continue to use legacy operating systems because software they rely on is not
                    compatible with newer operating systems. This can be more common in industries that use a lot of
                    equipment that requires embedded software—software that’s placed inside components of the equipment.
                </p>

                <p>Legacy operating systems can be vulnerable to security issues because they’re no longer supported or
                    updated. This means that legacy operating systems might be vulnerable to new threats.</p>

                <h2>Other Vulnerabilities</h2>

                <p>Even when operating systems are kept up to date, they can still become vulnerable to attack. Below
                    are several resources that include information on operating systems and their vulnerabilities.</p>

                <ul>
                    <li><a href="#">Microsoft Security Response Center (MSRC)</a>: A list of known vulnerabilities
                        affecting Microsoft products and services</li>
                    <li><a href="#">Apple Security Updates</a>: A list of security updates and information for Apple®
                        operating systems, including macOS and iOS, and other products</li>
                    <li><a href="#">Common Vulnerabilities and Exposures (CVE) Report for Ubuntu</a>: A list of known
                        vulnerabilities affecting Ubuntu, which is a specific distribution of Linux</li>
                    <li><a href="#">Google Cloud Security Bulletin</a>: A list of known vulnerabilities affecting Google
                        Cloud products and services</li>
                </ul>

                <p>Keeping an operating system up to date is one key way to help the system stay secure. Because it can
                    be difficult to keep all systems updated at all times, it’s important for security analysts to be
                    knowledgeable about legacy operating systems and the risks they can create.</p>

                <h2>Key Takeaways</h2>

                <ul>
                    <li>Windows, macOS, Linux, ChromeOS, Android, and iOS are all commonly used operating systems.</li>
                    <li>Security analysts should be aware of vulnerabilities that affect operating systems.</li>
                    <li>It’s especially important for security analysts to be familiar with legacy operating systems,
                        which are systems that are outdated but still being used.</li>
                </ul>


            </article>
        </section>


        <section class="main-section" id="topic412">
            <h2>Requests to the operating system </h2>

            <article class="main-article">

                <h1>Understanding Operating Systems</h1>

                <h2>Booting the Computer</h2>

                <p>When you boot, or turn on, your computer, either a BIOS or UEFI microchip is activated. The Basic
                    Input/Output System (BIOS) is a microchip that contains loading instructions for the computer and is
                    prevalent in older systems. The Unified Extensible Firmware Interface (UEFI) is a microchip that
                    contains loading instructions for the computer and replaces BIOS on more modern systems.</p>

                <p>The BIOS and UEFI chips both perform the same function for booting the computer. BIOS was the
                    standard chip until 2007, when UEFI chips increased in use. Now, most new computers include a UEFI
                    chip. UEFI provides enhanced security features.</p>

                <p>The BIOS or UEFI microchips contain a variety of loading instructions for the computer to follow. For
                    example, one of the loading instructions is to verify the health of the computer’s hardware.</p>

                <p>The last instruction from the BIOS or UEFI activates the bootloader. The bootloader is a software
                    program that boots the operating system. Once the operating system has finished booting, your
                    computer is ready for use.</p>

                <h2>Completing a Task</h2>

                <p>As previously discussed, operating systems help us use computers more efficiently. Once a computer
                    has gone through the booting process, completing a task on a computer is a four-part process.</p>
                <img src="resource/course41.png" id="img" alt="">
                <ol>
                    <li>User</li>
                    <li>Application</li>
                    <li>Operating system</li>
                    <li>Hardware</li>
                </ol>

                <h3>User</h3>

                <p>The first part of the process is the user. The user initiates the process by having something they
                    want to accomplish on the computer.</p>

                <h3>Application</h3>

                <p>The application is the software program that users interact with to complete a task.</p>

                <h3>Operating System</h3>

                <p>The operating system receives the user’s request from the application. It’s the operating system’s
                    job to interpret the request and direct its flow.</p>

                <h3>Hardware</h3>

                <p>The hardware is where all the processing is done to complete the tasks initiated by the user.</p>

                <p>After the work is done by the hardware, it sends the output back through the operating system to the
                    application so that it can display the results to the user.</p>

                <h2>The OS at Work Behind the Scenes</h2>

                <p>Consider once again how a computer is similar to a car. There are processes that someone won’t
                    directly observe when operating a car, but they do feel it move forward when they press the gas
                    pedal. It’s the same with a computer. Important work happens inside a computer that you don’t
                    experience directly. This work involves the operating system.</p>

                <p>You can explore this through another analogy. The process of using an operating system is also
                    similar to ordering at a restaurant.</p>

                <p>Ordering food is similar to using an application on a computer. When you order your food, you make a
                    specific request like “a small soup, very hot.” When you use an application, you also make specific
                    requests like “print three double-sided copies of this document.”</p>

                <p>Finally, the kitchen is like the OS. You don’t know what happens in the kitchen, but it’s critical in
                    interpreting the request and ensuring you receive what you ordered. Similarly, though the work of
                    the OS is not directly transparent to you, it’s critical in completing your tasks.</p>

                <h2>An Example: Downloading a File from an Internet Browser</h2>

                <p>Previously, you explored how operating systems, applications, and hardware work together by examining
                    a task involving a calculation. You can expand this understanding by exploring how the OS completes
                    another task, downloading a file from an internet browser:</p>

                <ol>
                    <li>The user decides they want to download a file that they found online, so they click on a
                        download button near the file in the internet browser application.</li>
                    <li>Then, the internet browser communicates this action to the OS.</li>
                    <li>The OS sends the request to download the file to the appropriate hardware for processing.</li>
                    <li>The hardware begins downloading the file, and the OS sends this information to the internet
                        browser application. The internet browser then informs the user when the file has been
                        downloaded.</li>
                </ol>

                <h2>Key Takeaways</h2>

                <p>Although it operates in the background, the operating system is an essential part of the process of
                    using a computer. The operating system connects applications and hardware to allow users to complete
                    a task.</p>


            </article>
        </section>


        <section class="main-section" id="topic413">
            <h2>Virtualization technology </h2>

            <article class="main-article">


                <title>Virtual Machines and Virtualization</title>


                <h1>What is a virtual machine?</h1>

                <p>A virtual machine (VM) is a virtual version of a physical computer. Virtual machines are one example
                    of virtualization. Virtualization is the process of using software to create virtual representations
                    of various physical machines. The term “virtual” refers to machines that don’t exist physically, but
                    operate like they do because their software simulates physical hardware. Virtual systems don’t use
                    dedicated physical hardware. Instead, they use software-defined versions of the physical hardware.
                    This means that a single virtual machine has a virtual CPU, virtual storage, and other virtual
                    hardware. Virtual systems are just code.</p>

                <p><img src="resource/vm.jpeg" id="img"
                        alt="Illustration of a dark gray computer with arrows to light gray computers that have 'VM' on the screen and are surrounded by dotted lines.">
                </p>

                <p>You can run multiple virtual machines using the physical hardware of a single computer. This involves
                    dividing the resources of the host computer to be shared across all physical and virtual components.
                    For example, Random Access Memory (RAM) is a hardware component used for short-term memory. If a
                    computer has 16GB of RAM, it can host three virtual machines so that the physical computer and
                    virtual machines each have 4GB of RAM. Also, each of these virtual machines would have their own
                    operating system and function similarly to a typical computer.</p>

                <h2>Benefits of virtual machines</h2>

                <h3>Security</h3>

                <p>One benefit is that virtualization can provide an isolated environment, or a sandbox, on the physical
                    host machine. When a computer has multiple virtual machines, these virtual machines are “guests” of
                    the computer. Specifically, they are isolated from the host computer and other guest virtual
                    machines. This provides a layer of security, because virtual machines can be kept separate from the
                    other systems. For example, if an individual virtual machine becomes infected with malware, it can
                    be dealt with more securely because it’s isolated from the other machines. A security professional
                    could also intentionally place malware on a virtual machine to examine it in a more secure
                    environment.</p>

                <p>Note: Although using virtual machines is useful when investigating potentially infected machines or
                    running malware in a constrained environment, there are still some risks. For example, a malicious
                    program can escape virtualization and access the host machine. This is why you should never
                    completely trust virtualized systems.</p>

                <h3>Efficiency</h3>

                <p>Using virtual machines can also be an efficient and convenient way to perform security tasks. You can
                    open multiple virtual machines at once and switch easily between them. This allows you to streamline
                    security tasks, such as testing and exploring various applications.</p>

                <p>You can compare the efficiency of a virtual machine to a city bus. A single city bus has a lot of
                    room and is an efficient way to transport many people simultaneously. If city buses didn’t exist,
                    then everyone on the bus would have to drive their own cars. This uses more gas, cars, and other
                    resources than riding the city bus.</p>

                <p>Similar to how many people can ride one bus, many virtual machines can be hosted on the same physical
                    machine. That way, separate physical machines aren't needed to perform certain tasks.</p>

                <h2>Managing virtual machines</h2>

                <p>Virtual machines can be managed with a software called a hypervisor. Hypervisors help users manage
                    multiple virtual machines and connect the virtual and physical hardware. Hypervisors also help with
                    allocating the shared resources of the physical host machine to one or more virtual machines.</p>

                <p>One hypervisor that is useful for you to be familiar with is the Kernel-based Virtual Machine (KVM).
                    KVM is an open-source hypervisor that is supported by most major Linux distributions. It is built
                    into the Linux kernel, which means it can be used to create virtual machines on any machine running
                    a Linux operating system without the need for additional software.</p>

                <h2>Other forms of virtualization</h2>

                <p>In addition to virtual machines, there are other forms of virtualization. Some of these
                    virtualization technologies do not use operating systems. For example, multiple virtual servers can
                    be created from a single physical server. Virtual networks can also be created to more efficiently
                    use the hardware of a physical network.</p>

                <h2>Key takeaways</h2>

                <p>Virtual machines are virtual versions of physical computers and are one example of virtualization.
                    Virtualization is a key technology in the security industry, and it’s important for security
                    analysts to understand the basics. There are many benefits to using virtual machines, such as
                    isolation of malware and other security risks. However, it’s important to remember there’s still a
                    risk of malicious software escaping their virtualized environments.</p>

</body>

</html>


</article>
</section>


<section class="main-section" id="topic414">
    <h2>The command line in use </h2>

    <article class="main-article">
        <title>CLI vs. GUI in Cybersecurity</title>


        <h1>CLI vs. GUI</h1>

        <p>A graphical user interface (GUI) is a user interface that uses icons on the screen to manage different tasks
            on the computer. A command-line interface (CLI) is a text-based user interface that uses commands to
            interact with the computer.</p>

        <p><img src="resource/gui.png" id="img"
                alt="Side by side comparison of a graphical user interface with icons and a command line interface with code.">
        </p>

        <h2>Display</h2>

        <p>One notable difference between these two interfaces is how they appear on the screen. A GUI has graphics and
            icons, such as the icons on your desktop or taskbar for launching programs. In contrast, a CLI only has
            text. It looks similar to lines of code.</p>

        <h2>Function</h2>

        <p>These two interfaces also differ in how they function. A GUI is an interface that only allows you to make one
            request at a time. However, a CLI allows you to make multiple requests at a time.</p>

        <h2>Advantages of a CLI in cybersecurity</h2>

        <p>The choice between using a GUI or CLI is partly based on personal preference, but security analysts should be
            able to use both interfaces. Using a CLI can provide certain advantages.</p>

        <h3>Efficiency</h3>

        <p>Some prefer the CLI because it can be used more quickly when you know how to manage this interface. For a new
            user, a GUI might be more efficient because they’re easier for beginners to navigate.</p>

        <p>Because a CLI can accept multiple requests at one time, it’s more powerful when you need to perform multiple
            tasks efficiently. For example, if you had to create multiple new files in your system, you could quickly
            perform this task in a CLI. If you were using a GUI, this could take much longer, because you have to repeat
            the same steps for each new file.</p>

        <h3>History file</h3>

        <p>For security analysts, using the Linux CLI is helpful because it records a history file of all the commands
            and actions in the CLI. If you were using a GUI, your actions are not necessarily saved in a history file.
        </p>

        <p>For example, you might be in a situation where you’re responding to an incident using a playbook. The
            playbook’s instructions require you to run a series of different commands. If you used a CLI, you’d be able
            to go back to the history and ensure all of the commands were correctly used. This could be helpful if there
            were issues using the playbook and you had to review the steps you performed in the command line.</p>

        <p>Additionally, if you suspect an attacker has compromised your system, you might be able to trace their
            actions using the history file.</p>

        <h2>Key takeaways</h2>

        <p>GUIs and CLIs are two types of user interfaces that security analysts should be familiar with. There are
            multiple differences between a GUI and a CLI, including their displays and how they function. When working
            in cybersecurity, a CLI is often preferred over a GUI because it can handle multiple tasks simultaneously
            and it includes a history file.</p>


    </article>
</section>


<section class="main-section" id="topic415">
    <h2> Glossary terms from module 1 </h2>

    <article class="main-article">
        <title>Course 4, Module 1 Terms and Definitions</title>


        <h2>Terms and Definitions from Course 4, Module 1</h2>

        <ul>
            <li><strong>Application:</strong> A program that performs a specific task</li>
            <li><strong>Basic Input/Output System (BIOS):</strong> A microchip that contains loading instructions for
                the computer and is prevalent in older systems</li>
            <li><strong>Bootloader:</strong> A software program that boots the operating system</li>
            <li><strong>Command-line interface (CLI):</strong> A text-based user interface that uses commands to
                interact with the computer</li>
            <li><strong>Graphical user interface (GUI):</strong> A user interface that uses icons on the screen to
                manage different tasks on the computer</li>
            <li><strong>Hardware:</strong> The physical components of a computer</li>
            <li><strong>Legacy operating system:</strong> An operating system that is outdated but still being used</li>
            <li><strong>Operating system (OS):</strong> The interface between computer hardware and the user</li>
            <li><strong>Random Access Memory (RAM):</strong> A hardware component used for short-term memory</li>
            <li><strong>Unified Extensible Firmware Interface (UEFI):</strong> A microchip that contains loading
                instructions for the computer and replaces BIOS on more modern systems</li>
            <li><strong>User interface:</strong> A program that allows the user to control the functions of the
                operating system</li>
            <li><strong>Virtual machine (VM):</strong> A virtual version of a physical computer</li>
        </ul>


    </article>
</section>


<section class="main-section" id="Module 42">
    <h2>Module 2</h2>
</section>
<br> <br>


<section class="main-section" id="topic421">
    <h2>Linux architecture explained </h2>

    <article class="main-article">

        <h1>Understanding Linux Architecture</h1>

        <p>Understanding the Linux architecture is important for a security analyst. When you understand how a system is
            organized, it makes it easier to understand how it functions. In this reading, you’ll learn more about the
            individual components in the Linux architecture. A request to complete a task starts with the user and then
            flows through applications, the shell, the Filesystem Hierarchy Standard, the kernel, and the hardware.</p>

        <h2>User</h2>

        <p>The user is the person interacting with a computer. They initiate and manage computer tasks. Linux is a
            multi-user system, which means that multiple users can use the same resources at the same time.</p>

        <h2>Applications</h2>

        <p>An application is a program that performs a specific task. There are many different applications on your
            computer. Some applications typically come pre-installed on your computer, such as calculators or calendars.
            Other applications might have to be installed, such as some web browsers or email clients. In Linux, you'll
            often use a package manager to install applications. A package manager is a tool that helps users install,
            manage, and remove packages or applications. A package is a piece of software that can be combined with
            other packages to form an application.</p>

        <h2>Shell</h2>

        <p>The shell is the command-line interpreter. Everything entered into the shell is text-based. The shell allows
            users to give commands to the kernel and receive responses from it. You can think of the shell as a
            translator between you and your computer. The shell translates the commands you enter so that the computer
            can perform the tasks you want.</p>

        <h2>Filesystem Hierarchy Standard (FHS)</h2>

        <p>The Filesystem Hierarchy Standard (FHS) is the component of the Linux OS that organizes data. It specifies
            the location where data is stored in the operating system.</p>

        <p>A directory is a file that organizes where other files are stored. Directories are sometimes called
            “folders,” and they can contain files or other directories. The FHS defines how directories, directory
            contents, and other storage are organized so the operating system knows where to find specific data.</p>

        <h2>Kernel</h2>

        <p>The kernel is the component of the Linux OS that manages processes and memory. It communicates with the
            applications to route commands. The Linux kernel is unique to the Linux OS and is critical for allocating
            resources in the system. The kernel controls all major functions of the hardware, which can help get tasks
            expedited more efficiently.</p>

        <h2>Hardware</h2>

        <p>The hardware is the physical components of a computer. You might be familiar with some hardware components,
            such as hard drives or CPUs. Hardware is categorized as either peripheral or internal.</p>

        <h3>Peripheral devices</h3>

        <p>Peripheral devices are hardware components that are attached and controlled by the computer system. They are
            not core components needed to run the computer system. Peripheral devices can be added or removed freely.
            Examples of peripheral devices include monitors, printers, the keyboard, and the mouse.</p>

        <h3>Internal hardware</h3>

        <p>Internal hardware are the components required to run the computer. Internal hardware includes a main circuit
            board and all components attached to it. This main circuit board is also called the motherboard. Internal
            hardware includes the following:</p>

        <ul>
            <li>The Central Processing Unit (CPU) is a computer’s main processor, which is used to perform general
                computing tasks on a computer. The CPU executes the instructions provided by programs, which enables
                these programs to run.</li>
            <li>Random Access Memory (RAM) is a hardware component used for short-term memory. It’s where data is stored
                temporarily as you perform tasks on your computer.</li>
            <li>The hard drive is a hardware component used for long-term memory. It’s where programs and files are
                stored for the computer to access later.</li>
        </ul>

        <h2>Key takeaways</h2>

        <p>It’s important for security analysts to understand the Linux architecture and how these components are
            organized. The components of the Linux architecture are the user, applications, shell, Filesystem Hierarchy
            Standard, kernel, and hardware. Each of these components is important in how Linux functions.</p>


    </article>
</section>


<section class="main-section" id="topic422">
    <h2>More Linux distributions</h2>

    <article class="main-article">


        <h1>Additional Linux Distributions for Security Analysts</h1>

        <p>KALI LINUX ™ is an open-source distribution of Linux that is widely used in the security industry. This is
            because KALI LINUX ™, which is Debian-based, is pre-installed with many useful tools for penetration testing
            and digital forensics. A penetration test is a simulated attack that helps identify vulnerabilities in
            systems, networks, websites, applications, and processes. Digital forensics is the practice of collecting
            and analyzing data to determine what has happened after an attack. These are key activities in the security
            industry.</p>

        <p>However, KALI LINUX ™ is not the only Linux distribution that is used in cybersecurity.</p>

        <h2>Ubuntu</h2>

        <p>Ubuntu is an open-source, user-friendly distribution that is widely used in security and other industries. It
            has both a command-line interface (CLI) and a graphical user interface (GUI). Ubuntu is also Debian-derived
            and includes common applications by default. Users can also download many more applications from a package
            manager, including security-focused tools. Because of its wide use, Ubuntu has an especially large number of
            community resources to support users.</p>

        <p>Ubuntu is also widely used for cloud computing. As organizations migrate to cloud servers, cybersecurity work
            may more regularly involve Ubuntu derivatives.</p>

        <h2>Parrot</h2>

        <p>Parrot is an open-source distribution that is commonly used for security. Similar to KALI LINUX ™, Parrot
            comes with pre-installed tools related to penetration testing and digital forensics. Like both KALI LINUX ™
            and Ubuntu, it is based on Debian.</p>

        <p>Parrot is also considered to be a user-friendly Linux distribution. This is because it has a GUI that many
            find easy to navigate. This is in addition to Parrot’s CLI.</p>

        <h2>Red Hat® Enterprise Linux®</h2>

        <p>Red Hat Enterprise Linux is a subscription-based distribution of Linux built for enterprise use. Red Hat is
            not free, which is a major difference from the previously mentioned distributions. Because it’s built and
            supported for enterprise use, Red Hat also offers a dedicated support team for customers to call about
            issues.</p>

        <h2>CentOS</h2>

        <p>CentOS is an open-source distribution that is closely related to Red Hat. It uses source code published by
            Red Hat to provide a similar platform. However, CentOS does not offer the same enterprise support that Red
            Hat provides and is supported through the community.</p>

        <h2>Key takeaways</h2>

        <p>KALI LINUX ™, Ubuntu, Parrot, Red Hat, and CentOS are all widely used Linux distributions. It’s important for
            security analysts to be aware of these distributions that they might encounter in their career.</p>


    </article>
</section>


<section class="main-section" id="topic423">
    <h2>Package managers for installing applications</h2>

    <article class="main-article">


        <h1>Introduction to Package Managers</h1>

        <p>A package is a piece of software that can be combined with other packages to form an application. Some
            packages may be large enough to form applications on their own.</p>

        <p>Packages contain the files necessary for an application to be installed. These files include dependencies,
            which are supplemental files used to run an application.</p>

        <p>Package managers can help resolve any issues with dependencies and perform other management tasks. A package
            manager is a tool that helps users install, manage, and remove packages or applications. Linux uses multiple
            package managers.</p>

        <p><strong>Note:</strong> It’s important to use the most recent version of a package when possible. The most
            recent version has the most up-to-date bug fixes and security patches. These help keep your system more
            secure.</p>

        <h2>Types of Package Managers</h2>

        <p>Many commonly used Linux distributions are derived from the same parent distribution. For example, KALI LINUX
            ™, Ubuntu, and Parrot all come from Debian. CentOS comes from Red Hat.</p>

        <p>This knowledge is useful when installing applications because certain package managers work with certain
            distributions. For example, the Red Hat Package Manager (RPM) can be used for Linux distributions derived
            from Red Hat, and package managers such as dpkg can be used for Linux distributions derived from Debian.</p>

        <p>Different package managers typically use different file extensions. For example, Red Hat Package Manager
            (RPM) has files which use the <code>.rpm</code> file extension, such as
            <code>Package-Version-Release_Architecture.rpm</code>. Package managers for Debian-derived Linux
            distributions, such as dpkg, have files which use the <code>.deb</code> file extension, such as
            <code>Package_Version-Release_Architecture.deb</code>.
        </p>

        <h2>Package Management Tools</h2>

        <p>In addition to package managers like RPM and dpkg, there are also package management tools that allow you to
            easily work with packages through the shell. Package management tools are sometimes utilized instead of
            package managers because they allow users to more easily perform basic tasks, such as installing a new
            package. Two notable tools are the Advanced Package Tool (APT) and Yellowdog Updater Modified (YUM).</p>

        <h3>Advanced Package Tool (APT)</h3>

        <p>APT is a tool used with Debian-derived distributions. It is run from the command-line interface to manage,
            search, and install packages.</p>

        <h3>Yellowdog Updater Modified (YUM)</h3>

        <p>YUM is a tool used with Red Hat-derived distributions. It is run from the command-line interface to manage,
            search, and install packages. YUM works with <code>.rpm</code> files.</p>

        <h2>Key takeaways</h2>

        <p>A package is a piece of software that can be combined with other packages to form an application. Packages
            can be managed using a package manager. There are multiple package managers and package management tools for
            different Linux distributions. Package management tools allow users to easily work with packages through the
            shell. Debian-derived Linux distributions use package managers like dpkg as well as package management tools
            like Advanced Package Tool (APT). Red Hat-derived distributions use the Red Hat Package Manager (RPM) or
            tools like Yellowdog Updater Modified (YUM).</p>


    </article>
</section>


<section class="main-section" id="topic424">
    <h2>Different types of shells </h2>

    <article class="main-article">

        <h1>Understanding Linux Shells</h1>

        <p>As you explored previously, the shell is the command-line interpreter. You can think of a shell as a
            translator between you and the computer system. Shells allow you to give commands to the computer and
            receive responses from it. When you enter a command into a shell, the shell executes many internal processes
            to interpret your command, send it to the kernel, and return your results.</p>

        <h2>Types of Shells</h2>

        <p>The many different types of Linux shells include the following:</p>

        <ul>
            <li>Bourne-Again Shell (bash)</li>
            <li>C Shell (csh)</li>
            <li>Korn Shell (ksh)</li>
            <li>Enhanced C shell (tcsh)</li>
            <li>Z Shell (zsh)</li>
        </ul>

        <p>All Linux shells use common Linux commands, but they can differ in other features. For example, ksh and bash
            use the dollar sign ($) to indicate where users type in their commands. Other shells, such as zsh, use the
            percent sign (%) for this purpose.</p>

        <h2>Bash</h2>

        <p>Bash is the default shell in most Linux distributions. It’s considered a user-friendly shell. You can use
            bash for basic Linux commands as well as larger projects.</p>

        <p>Bash is also the most popular shell in the cybersecurity profession. You’ll use bash throughout this course
            as you learn and practice Linux commands.</p>

        <h2>Key takeaways</h2>

        <p>Shells are a fundamental part of the Linux operating system. Shells allow you to give commands to the
            computer and receive responses from it. They can be thought of as a translator between you and your computer
            system. There are many different types of shells, but the bash shell is the most commonly used shell in the
            cybersecurity profession. You’ll learn how to enter Linux commands through the bash shell later in this
            course.</p>


    </article>
</section>


<section class="main-section" id="topic425">
    <h2>Glossary terms from module 2 </h2>

    <article class="main-article">
        <h1>Course 4, Module 2: Terms and Definitions</h1>

        <ul>
            <li><strong>Application:</strong> A program that performs a specific task</li>
            <li><strong>Bash:</strong> The default shell in most Linux distributions</li>
            <li><strong>CentOS:</strong> An open-source distribution that is closely related to Red Hat</li>
            <li><strong>Central Processing Unit (CPU):</strong> A computer’s main processor, which is used to perform
                general computing tasks on a computer</li>
            <li><strong>Command:</strong> An instruction telling the computer to do something</li>
            <li><strong>Digital forensics:</strong> The practice of collecting and analyzing data to determine what has
                happened after an attack</li>
            <li><strong>Directory:</strong> A file that organizes where other files are stored</li>
            <li><strong>Distributions:</strong> The different versions of Linux</li>
            <li><strong>File path:</strong> The location of a file or directory</li>
            <li><strong>Filesystem Hierarchy Standard (FHS):</strong> The component of the Linux OS that organizes data
            </li>
            <li><strong>Graphical user interface (GUI):</strong> A user interface that uses icons on the screen to
                manage different tasks on the computer</li>
            <li><strong>Hard drive:</strong> A hardware component used for long-term memory</li>
            <li><strong>Hardware:</strong> The physical components of a computer</li>
            <li><strong>Internal hardware:</strong> The components required to run the computer</li>
            <li><strong>Kali Linux ™:</strong> An open-source distribution of Linux that is widely used in the security
                industry</li>
            <li><strong>Kernel:</strong> The component of the Linux OS that manages processes and memory</li>
            <li><strong>Linux:</strong> An open source operating system</li>
            <li><strong>Package:</strong> A piece of software that can be combined with other packages to form an
                application</li>
            <li><strong>Package manager:</strong> A tool that helps users install, manage, and remove packages or
                applications</li>
            <li><strong>Parrot:</strong> An open-source distribution that is commonly used for security</li>
            <li><strong>Penetration test (pen test):</strong> A simulated attack that helps identify vulnerabilities in
                systems, networks, websites, applications, and processes</li>
            <li><strong>Peripheral devices:</strong> Hardware components that are attached and controlled by the
                computer system</li>
            <li><strong>Random Access Memory (RAM):</strong> A hardware component used for short-term memory</li>
            <li><strong>Red Hat® Enterprise Linux® (also referred to simply as Red Hat in this course):</strong> A
                subscription-based distribution of Linux built for enterprise use</li>
            <li><strong>Shell:</strong> The command-line interpreter</li>
            <li><strong>Standard error:</strong> An error message returned by the OS through the shell</li>
            <li><strong>Standard input:</strong> Information received by the OS via the command line</li>
            <li><strong>Standard output:</strong> Information returned by the OS through the shell</li>
            <li><strong>String data:</strong> Data consisting of an ordered sequence of characters</li>
            <li><strong>Ubuntu:</strong> An open-source, user-friendly distribution that is widely used in security and
                other industries</li>
            <li><strong>User:</strong> The person interacting with a computer</li>
        </ul>


    </article>
</section>


<section class="main-section" id="Module 43">
    <h2>Module 3</h2>
</section>
<br> <br>


<section class="main-section" id="topic431">
    <h2> Navigate Linux and read file content </h2>

    <article class="main-article">

        <h1>Navigating the File System in Linux</h1>

        <h2>Filesystem Hierarchy Standard (FHS)</h2>
        <p>Previously, you learned that the Filesystem Hierarchy Standard (FHS) is the component of Linux that organizes
            data. The FHS is important because it defines how directories, directory contents, and other storage is
            organized in the operating system.</p>

        <h3>Root directory</h3>
        <p>The root directory is the highest-level directory in Linux, and it’s always represented with a forward slash
            (/). All subdirectories branch off the root directory. Subdirectories can continue branching out to as many
            levels as necessary.</p>

        <h3>Standard FHS directories</h3>
        <p>Directly below the root directory, you’ll find standard FHS directories. In the diagram, home, bin, and etc
            are standard FHS directories. Here are a few examples of what standard directories contain:</p>
        <ul>
            <li>/home: Each user in the system gets their own home directory.</li>
            <li>/bin: This directory stands for “binary” and contains binary files and other executables.</li>
            <li>/etc: This directory stores the system’s configuration files.</li>
            <li>/tmp: This directory stores many temporary files.</li>
            <li>/mnt: This directory stands for “mount” and stores media, such as USB drives and hard drives.</li>
        </ul>

        <h3>User-specific subdirectories</h3>
        <p>Under home are subdirectories for specific users. In the diagram, these users are analyst and analyst2. Each
            user has their own personal subdirectories, such as projects, logs, or reports.</p>

        <h2>Key commands for navigating the file system</h2>

        <h3>pwd</h3>
        <p>The pwd command prints the working directory to the screen. Or in other words, it returns the directory that
            you’re currently in.</p>

        <h3>ls</h3>
        <p>The ls command displays the names of the files and directories in the current working directory.</p>

        <h3>cd</h3>
        <p>The cd command navigates between directories.</p>

        <h2>Common commands for reading file content</h2>

        <h3>cat</h3>
        <p>The cat command displays the content of a file.</p>

        <h3>head</h3>
        <p>The head command displays just the beginning of a file, by default 10 lines.</p>

        <h3>tail</h3>
        <p>The tail command displays just the end of a file, by default 10 lines.</p>

        <h3>less</h3>
        <p>The less command returns the content of a file one page at a time.</p>

        <p>It’s important for security analysts to be able to navigate Linux and the file system of the FHS. Some key
            commands for navigating the file system include pwd, ls, and cd. Reading file content is also an important
            skill in the security profession. This can be done with commands such as cat, head, tail, and less.</p>


    </article>
</section>


<section class="main-section" id="topic432">
    <h2> Filter content in Linux </h2>

    <article class="main-article">

        <h1>Filtering Information in Linux</h1>

        <h2>Filtering for Information</h2>
        <p>Previously, you explored how filtering for information is an important skill for security analysts. Filtering
            is selecting data that match a certain condition.</p>

        <h3>grep</h3>
        <p>The grep command searches a specified file and returns all lines containing a specified string or text.</p>

        <h3>Piping</h3>
        <p>Piping sends the standard output of one command as standard input to another command for further processing.
        </p>

        <h3>find</h3>
        <p>The find command searches for directories and files that meet specified criteria.</p>

        <h2>grep</h2>
        <p>The grep command searches a specified file and returns all lines in the file containing a specified string or
            text. For example, entering <code>grep OS updates.txt</code> returns all lines containing OS in the
            updates.txt file.</p>

        <h2>Piping</h2>
        <p>The pipe command is accessed using the pipe character (|). Piping sends the standard output of one command as
            standard input to another command for further processing.</p>

        <h2>find</h2>
        <p>The find command searches for directories and files that meet specified criteria. One key criteria analysts
            might use with find is to find file or directory names that contain a specific string. The specific string
            you’re searching for must be entered in quotes after the <code>-name</code> or <code>-iname</code> options.
        </p>

        <h3>-name and -iname</h3>
        <p>The <code>-name</code> and <code>-iname</code> options are used with find to search for file or directory
            names that contain a specific string. The difference is that <code>-name</code> is case-sensitive, and
            <code>-iname</code> is not.
        </p>

        <h3>-mtime</h3>
        <p>The <code>-mtime</code> option can be used with find to find files or directories last modified within a
            certain time frame. For example, entering <code>find /home/analyst/projects -mtime -3</code> returns all
            files and directories in the projects directory that have been modified within the past three days.</p>

        <h2>Key Takeaways</h2>
        <p>Filtering for information using Linux commands is an important skill for security analysts so that they can
            customize data to fit their needs. Three key Linux commands for this are grep, piping (|), and find. These
            commands can be used to navigate and filter for information in the file system.</p>


    </article>
</section>

<section class="main-section" id="topic433">
    <h2> Manage directories and files </h2>

    <article class="main-article">


        <h1>Managing the File System in Linux</h1>

        <h2>Creating and Modifying Directories</h2>

        <h3>mkdir</h3>
        <p>The mkdir command creates a new directory.</p>

        <h3>rmdir</h3>
        <p>The rmdir command removes a directory.</p>

        <h2>Creating and Modifying Files</h2>

        <h3>touch and rm</h3>
        <p>The touch command creates a new file, and the rm command removes a file.</p>

        <h3>mv and cp</h3>
        <p>The mv command moves a file or directory to a new location, and the cp command copies a file or directory to
            a new location.</p>

        <h2>nano Text Editor</h2>

        <p>nano is a command-line file editor that is easy to use and widely used in the security profession.</p>

        <h2>Standard Output Redirection</h2>

        <p>In addition to piping, you can use the > and >> operators to redirect standard output.</p>

        <h2>Key Takeaways</h2>

        <p>Knowing how to manage the file system in Linux is an important skill for security analysts. Useful commands
            for this include: mkdir, rmdir, touch, rm, mv, and cp. When security analysts need to write to files, they
            can use the nano text editor, or the > and >> operators.</p>


    </article>
</section>


<section class="main-section" id="topic434">
    <h2>Permission commands </h2>

    <article class="main-article">
        <h1>Reading Permissions in Linux</h1>

        <table border="1">
            <tr>
                <th>Character</th>
                <th>Purpose</th>
            </tr>
            <tr>
                <td>r</td>
                <td>Read permission</td>
            </tr>
            <tr>
                <td>w</td>
                <td>Write permission</td>
            </tr>
            <tr>
                <td>x</td>
                <td>Execute permission</td>
            </tr>
        </table>

        <p>In Linux, permissions are represented with a 10-character string. Permissions include:</p>

        <ul>
            <li><strong>read:</strong> for files, this is the ability to read the file contents; for directories, this
                is the ability to read all contents in the directory including both files and subdirectories</li>
            <li><strong>write:</strong> for files, this is the ability to make modifications on the file contents; for
                directories, this is the ability to create new files in the directory</li>
            <li><strong>execute:</strong> for files, this is the ability to execute the file if it’s a program; for
                directories, this is the ability to enter the directory and access its files</li>
        </ul>

        <p>These permissions are given to these types of owners:</p>

        <ul>
            <li><strong>user:</strong> the owner of the file</li>
            <li><strong>group:</strong> a larger group that the owner is a part of</li>
            <li><strong>other:</strong> all other users on the system</li>
        </ul>

        <p>Each character in the 10-character string conveys different information about these permissions.</p>

        <table border="1">
            <tr>
                <th>Character</th>
                <th>Example</th>
                <th>Meaning</th>
            </tr>
            <tr>
                <td>1st</td>
                <td>drwxrwxrwx</td>
                <td>
                    <ul>
                        <li>d for directory</li>
                        <li>- for a regular file</li>
                    </ul>
                </td>
            </tr>
            <tr>
                <td>2nd</td>
                <td>drwxrwxrwx</td>
                <td>
                    <ul>
                        <li>r if the user has read permissions</li>
                        <li>- if the user lacks read permissions</li>
                    </ul>
                </td>
            </tr>
            <tr>
                <td>3rd</td>
                <td>drwxrwxrwx</td>
                <td>
                    <ul>
                        <li>w if the user has write permissions</li>
                        <li>- if the user lacks write permissions</li>
                    </ul>
                </td>
            </tr>
            <tr>
                <td>4th</td>
                <td>drwxrwxrwx</td>
                <td>
                    <ul>
                        <li>x if the user has execute permissions</li>
                        <li>- if the user lacks execute permissions</li>
                    </ul>
                </td>
            </tr>
            <tr>
                <td>5th</td>
                <td>drwxrwxrwx</td>
                <td>
                    <ul>
                        <li>r if the group has read permissions</li>
                        <li>- if the group lacks read permissions</li>
                    </ul>
                </td>
            </tr>
            <tr>
                <td>6th</td>
                <td>drwxrwxrwx</td>
                <td>
                    <ul>
                        <li>w if the group has write permissions</li>
                        <li>- if the group lacks write permissions</li>
                    </ul>
                </td>
            </tr>
            <tr>
                <td>7th</td>
                <td>drwxrwxrwx</td>
                <td>
                    <ul>
                        <li>x if the group has execute permissions</li>
                        <li>- if the group lacks execute permissions</li>
                    </ul>
                </td>
            </tr>
            <tr>
                <td>8th</td>
                <td>drwxrwxrwx</td>
                <td>
                    <ul>
                        <li>r if the other owner type has read permissions</li>
                        <li>- if the other owner type lacks read permissions</li>
                    </ul>
                </td>
            </tr>
            <tr>
                <td>9th</td>
                <td>drwxrwxrwx</td>
                <td>
                    <ul>
                        <li>w if the other owner type has write permissions</li>
                        <li>- if the other owner type lacks write permissions</li>
                    </ul>
                </td>
            </tr>
            <tr>
                <td>10th</td>
                <td>drwxrwxrwx</td>
                <td>
                    <ul>
                        <li>x if the other owner type has execute permissions</li>
                        <li>- if the other owner type lacks execute permissions</li>
                    </ul>
                </td>
            </tr>
        </table>

        <h4> The following table reviews how each character is used within the first argument of chmod:</h4>

        <table border="1">
            <tr>
                <th>Character</th>
                <th>Meaning</th>
            </tr>
            <tr>
                <td>r</td>
                <td>Read permission</td>
            </tr>
            <tr>
                <td>w</td>
                <td>Write permission</td>
            </tr>
            <tr>
                <td>x</td>
                <td>Execute permission</td>
            </tr>
            <tr>
                <td>+</td>
                <td>Adds the specified permission</td>
            </tr>
            <tr>
                <td>-</td>
                <td>Removes the specified permission</td>
            </tr>
            <tr>
                <td>=</td>
                <td>Sets the specified permission exactly as specified, overwriting existing permissions</td>
            </tr>
            <tr>
                <td>u</td>
                <td>User (owner)</td>
            </tr>
            <tr>
                <td>g</td>
                <td>Group</td>
            </tr>
            <tr>
                <td>o</td>
                <td>Other (all other users)</td>
            </tr>
        </table>
        <p>Exploring existing permissions

            You can use the ls command to investigate who has permissions on files and directories. Previously, you
            learned that ls displays the names of files in directories in the current working directory.

            There are additional options you can add to the ls command to make your command more specific. Some of these
            options provide details about permissions. Here are a few important ls options for security analysts:

            ls -a: Displays hidden files. Hidden files start with a period (.) at the beginning.

            ls -l: Displays permissions to files and directories. Also displays other additional information, including
            owner name, group, file size, and the time of last modification.

            ls -la: Displays permissions to files and directories, including hidden files. This is a combination of the
            other two options.

            Changing permissions

            The principle of least privilege is the concept of granting only the minimal access and authorization
            required to complete a task or function. In other words, users should not have privileges that are beyond
            what is necessary. Not following the principle of least privilege can create security risks.

            The chmod command can help you manage this authorization. The chmod command changes permissions on files and
            directories.
            Using chmod

            The chmod command requires two arguments. The first argument indicates how to change permissions, and the
            second argument indicates the file or directory that you want to change permissions for. For example, the
            following command would add all permissions to login_sessions.txt:

            chmod u+rwx,g+rwx,o+rwx login_sessions.txt

            If you wanted to take all the permissions away, you could use

            chmod u-rwx,g-rwx,o-rwx login_sessions.txt

            Another way to assign these permissions is to use the equals sign (=) in this first argument. Using = with
            chmod sets, or assigns, the permissions exactly as specified. For example, the following command would set
            read permissions for login_sessions.txt for user, group, and other:

            chmod u=r,g=r,o=r login_sessions.txt

            This command overwrites existing permissions. For instance, if the user previously had write permissions,
            these write permissions are removed after you specify only read permissions with =.

        </p>

        <p>As a security analyst, you may encounter a situation like this one: There’s a file called bonuses.txt within
            a compensation directory. The owner of this file is a member of the Human Resources department with a
            username of hrrep1. It has been decided that hrrep1 needs access to this file. But, since this file contains
            confidential information, no one else in the hr group needs access.</p>

        <p>You run <code>ls -l</code> to check the permissions of files in the compensation directory and discover that
            the permissions for bonuses.txt are <code>-rw-rw----</code>. The group owner type has read and write
            permissions that do not align with the principle of least privilege.</p>

        <p>To remedy the situation, you input <code>chmod g-rw bonuses.txt</code>. Now, only the user who needs to
            access this file to carry out their job responsibilities can access this file.</p>


    </article>
</section>


<section class="main-section" id="topic435">
    <h2>Responsible use of sudo
    </h2>

    <article class="main-article">
        <p>The <strong>sudo</strong> command is important for security analysts because it allows users to have elevated
            permissions without risking the system by running commands as the root user. You’ll continue exploring
            authorization, authentication, and Linux commands in this reading and learn two more commands that can be
            used with sudo: <strong>usermod</strong> and <strong>chown</strong>.</p>

        <h3>Responsible use of sudo</h3>

        <p>To manage authorization and authentication, you need to be a root user, or a user with elevated privileges to
            modify the system. The root user can also be called the “super user.” You become a root user by logging in
            as the root user. However, running commands as the root user is not recommended in Linux because it can
            create security risks if malicious actors compromise that account. It’s also easy to make irreversible
            mistakes, and the system can’t track who ran a command. For these reasons, rather than logging in as the
            root user, it’s recommended you use sudo in Linux when you need elevated privileges.</p>

        <p>The <strong>sudo</strong> command temporarily grants elevated permissions to specific users. The name of this
            command comes from “super user do.” Users must be given access in a configuration file to use sudo. This
            file is called the “sudoers file.” Although using sudo is preferable to logging in as the root user, it's
            important to be aware that users with the elevated permissions to use sudo might be more at risk in the
            event of an attack.</p>

        <p>You can compare this to a hotel with a master key. The master key can be used to access any room in the
            hotel. There are some workers at the hotel who need this key to perform their work. For example, to clean
            all the rooms, the janitor would scan their ID badge and then use this master key. However, if someone
            outside the hotel’s network gained access to the janitor’s ID badge and master key, they could access any
            room in the hotel. In this example, the janitor with the master key represents a user using sudo for
            elevated privileges. Because of the dangers of sudo, only users who really need to use it should have these
            permissions.</p>

        <p>Additionally, even if you need access to sudo, you should be careful about using it with only the commands
            you need and nothing more. Running commands with sudo allows users to bypass the typical security controls
            that are in place to prevent elevated access to an attacker.</p>

        <p><strong>Note:</strong> Be aware of sudo if copying commands from an online source. It’s important you don’t
            use sudo accidentally.</p>

        <h3>Authentication and authorization with sudo</h3>

        <p>You can use sudo with many authentication and authorization management tasks. As a reminder, authentication
            is the process of verifying who someone is, and authorization is the concept of granting access to specific
            resources in a system. Some of the key commands used for these tasks include the following:</p>

        <ul>
            <li><strong>useradd</strong></li>
            <li><strong>usermod</strong></li>
            <li><strong>userdel</strong></li>
            <li><strong>chown</strong></li>
        </ul>

        <h4>useradd</h4>

        <p>The <strong>useradd</strong> command adds a user to the system. To add a user with the username of
            <em>fgarcia</em> with sudo, enter <code>sudo useradd fgarcia</code>. There are additional options you can
            use with <strong>useradd</strong>:
        </p>

        <ul>
            <li><code>-g</code>: Sets the user’s default group, also called their primary group</li>
            <li><code>-G</code>: Adds the user to additional groups, also called supplemental or secondary groups</li>
        </ul>

        <p>To use the <code>-g</code> option, the primary group must be specified after <code>-g</code>. For example,
            entering <code>sudo useradd -g security fgarcia</code> adds <em>fgarcia</em> as a new user and assigns their
            primary group to be security.</p>

        <p>To use the <code>-G</code> option, the supplemental group must be passed into the command after
            <code>-G</code>. You can add more than one supplemental group at a time with the <code>-G</code> option.
            Entering <code>sudo useradd -G finance,admin fgarcia</code> adds <em>fgarcia</em> as a new user and adds
            them to the existing finance and admin groups.
        </p>

        <h4>usermod</h4>

        <p>The <strong>usermod</strong> command modifies existing user accounts. The same <code>-g</code> and
            <code>-G</code> options from the <strong>useradd</strong> command can be used with <strong>usermod</strong>
            if a user already exists.
        </p>

        <p>There are other options you can use with <strong>usermod</strong> to specify how you want to modify the user,
            including:</p>

        <ul>
            <li><code>-d</code>: Changes the user’s home directory.</li>
            <li><code>-l</code>: Changes the user’s login name.</li>
            <li><code>-L</code>: Locks the account so the user can’t log in.</li>
        </ul>

        <h4>userdel</h4>

        <p>The <strong>userdel</strong> command deletes a user from the system. For example, entering
            <code>sudo userdel fgarcia</code> deletes <em>fgarcia</em> as a user. Be careful before you delete a user
            using this command.
        </p>

        <p>The <strong>userdel</strong> command doesn’t delete the files in the user’s home directory unless you use the
            <code>-r</code> option. Entering <code>sudo userdel -r fgarcia</code> would delete <em>fgarcia</em> as a
            user and delete all files in their home directory.
        </p>

        <p><strong>Note:</strong> Instead of deleting the user, you could consider deactivating their account with
            <code>usermod -L</code>. This prevents the user from logging in while still giving you access to their
            account and associated permissions. For example, if a user left an organization, this option would allow you
            to identify which files they have ownership over, so you could move this ownership to other users.
        </p>

        <h4>chown</h4>

        <p>The <strong>chown</strong> command changes ownership of a file or directory. You can use
            <strong>chown</strong> to change user or group ownership.
        </p>

        <p>Similar to <strong>useradd</strong>, <strong>usermod</strong>, and <strong>userdel</strong>, there are
            additional options that can be used with <strong>chown</strong>.</p>

        <p>Key takeaways:</p>

        <p>Authentication is the process of a user verifying their identity, and authorization is the process of
            determining what they have access to. You can use the <strong>sudo</strong> command to temporarily run
            commands with elevated privileges to complete authentication and authorization management tasks.
            Specifically
    </article>
</section>


<section class="main-section" id="topic436">
    <h2>Linux resources </h2>

    <article class="main-article">
        <p>Previously, you were introduced to the Linux community and some resources that exist to help Linux users.
            Linux has many options available to give users the information they need. This reading will review these
            resources. When you’re aware of the resources available to you, you can continue to learn Linux
            independently. You can also discover even more ways that Linux can support your work as a security analyst.
        </p>

        <h3>Linux community</h3>

        <p>Linux has a large online community, and this is a huge resource for Linux users of all levels. You can likely
            find the answers to your questions with a simple online search. Troubleshooting issues by searching and
            reading online is an effective way to discover how others approached your issue. It’s also a great way for
            beginners to learn more about Linux.</p>

        <p>The <strong>UNIX and Linux Stack Exchange</strong> is a trusted resource for troubleshooting Linux issues.
            The Unix and Linux Stack Exchange is a question and answer website where community members can ask and
            answer questions about Linux. Community members vote on answers, so the higher quality answers are displayed
            at the top. Many of the questions are related to specific topics from advanced users, and the topics might
            help you troubleshoot issues as you continue using Linux.</p>

        <h3>Integrated Linux support</h3>

        <p>Linux also has several commands that you can use for support.</p>

        <ul>
            <li><strong>man</strong></li>
            <li><strong>apropos</strong></li>
            <li><strong>whatis</strong></li>
        </ul>

        <h4>man</h4>

        <p>The <strong>man</strong> command displays information on other commands and how they work. It’s short for
            “manual.” To search for information on a command, enter the command after man. For example, entering
            <code>man chown</code> returns detailed information about chown, including the various options you can use
            with it. The output of the man command is also called a “man page.”
        </p>

        <h4>apropos</h4>

        <p>The <strong>apropos</strong> command searches the man page descriptions for a specified string. Man pages can
            be lengthy and difficult to search through if you’re looking for a specific keyword. To use apropos, enter
            the keyword after apropos.</p>

        <p>You can also include the <code>-a</code> option to search for multiple words. For example, entering
            <code>apropos -a graph editor</code> outputs man pages that contain both the words “graph" and "editor” in
            their descriptions.
        </p>

        <h4>whatis</h4>

        <p>The <strong>whatis</strong> command displays a description of a command on a single line. For example,
            entering <code>whatis nano</code> outputs the description of nano. This command is useful when you don't
            need a detailed description, just a general idea of the command. This might be as a reminder. Or, it might
            be after you discover a new command through a colleague or online resource and want to know more.</p>

        <h3>Key takeaways</h3>

        <p>There are many resources available for troubleshooting issues or getting support for Linux. Linux has a large
            global community of users who ask and answer questions on online resources, such as the Unix and Linux Stack
            Exchange. You can also use integrated support commands in Linux, such as man, apropos, and whatis.</p>
    </article>
</section>


<section class="main-section" id="topic437">
    <h2>Glossary terms from module 3 </h2>

    <article class="main-article">
        <ul>
            <li><strong>Absolute file path:</strong> The full file path, which starts from the root</li>
            <li><strong>Argument (Linux):</strong> Specific information needed by a command</li>
            <li><strong>Authentication:</strong> The process of verifying who someone is</li>
            <li><strong>Authorization:</strong> The concept of granting access to specific resources in a system</li>
            <li><strong>Bash:</strong> The default shell in most Linux distributions</li>
            <li><strong>Command:</strong> An instruction telling the computer to do something</li>
            <li><strong>File path:</strong> The location of a file or directory</li>
            <li><strong>Filesystem Hierarchy Standard (FHS):</strong> The component of the Linux OS that organizes data
            </li>
            <li><strong>Filtering:</strong> Selecting data that match a certain condition</li>
            <li><strong>nano:</strong> A command-line file editor that is available by default in many Linux
                distributions</li>
            <li><strong>Options:</strong> Input that modifies the behavior of a command</li>
            <li><strong>Permissions:</strong> The type of access granted for a file or directory</li>
            <li><strong>Principle of least privilege:</strong> The concept of granting only the minimal access and
                authorization required to complete a task or function</li>
            <li><strong>Relative file path:</strong> A file path that starts from the user's current directory</li>
            <li><strong>Root directory:</strong> The highest-level directory in Linux</li>
            <li><strong>Root user (or superuser):</strong> A user with elevated privileges to modify the system</li>
            <li><strong>Standard input:</strong> Information received by the OS via the command line</li>
            <li><strong>Standard output:</strong> Information returned by the OS through the shell</li>
        </ul>
    </article>
</section>


<section class="main-section" id="Module 44">
    <h2>Module 4</h2>
</section>
<br> <br>


<section class="main-section" id="topic441">
    <h2>SQL filtering versus Linux filtering </h2>

    <article class="main-article">
        <p><strong>Accessing SQL</strong></p>
        <p>There are many interfaces for accessing SQL and many different versions of SQL. One way to access SQL is
            through the Linux command line.</p>
        <p>To access SQL from Linux, you need to type in a command for the version of SQL that you want to use. For
            example, if you want to access SQLite, you can enter the command sqlite3 in the command line.</p>
        <p>After this, any commands typed in the command line will be directed to SQL instead of Linux commands.</p>

        <p><strong>Differences between Linux and SQL filtering</strong></p>

        <p><strong>Purpose</strong></p>
        <p>Linux filters data in the context of files and directories on a computer system. It’s used for tasks like
            searching for specific files, manipulating file permissions, or managing processes.</p>
        <p>SQL is used to filter data within a database management system. It’s used for querying and manipulating data
            stored in tables and retrieving specific information based on defined criteria.</p>

        <p><strong>Syntax</strong></p>
        <p>Linux uses various commands and command-line options specific to each filtering tool. Syntax varies depending
            on the tool and purpose. Some examples of Linux commands are find, sed, cut, and grep.</p>
        <p>SQL uses the Structured Query Language (SQL), a standardized language with specific keywords and clauses for
            filtering data across different SQL databases. Some examples of SQL keywords and clauses are WHERE, SELECT,
            and JOIN.</p>

        <p><strong>Structure</strong></p>
        <p>SQL offers a lot more structure than Linux, which is more free-form and not as tidy.</p>
        <p>For example, if you wanted to access a log of employee log-in attempts, SQL would have each record separated
            into columns. Linux would print the data as a line of text without this organization. As a result, selecting
            a specific column to analyze would be easier and more efficient in SQL.</p>
        <p>In terms of structure, SQL provides results that are more easily readable and that can be adjusted more
            quickly than when using Linux.</p>

        <p><strong>Joining tables</strong></p>
        <p>Some security-related decisions require information from different tables. SQL allows the analyst to join
            multiple tables together when returning data. Linux doesn’t have that same functionality; it doesn’t allow
            data to be connected to other information on your computer. This is more restrictive for an analyst going
            through security logs.</p>

        <p><strong>Best uses</strong></p>
        <p>As a security analyst, it’s important to understand when you can use which tool. Although SQL has a more
            organized structure and allows you to join tables, this doesn’t mean that there aren’t situations that would
            require you to filter data in Linux.</p>
        <p>A lot of data used in cybersecurity will be stored in a database format that works with SQL. However, other
            logs might be in a format that is not compatible with SQL. For instance, if the data is stored in a text
            file, you cannot search through it with SQL. In those cases, it is useful to know how to filter in Linux.
        </p>

        <p><strong>Key takeaways</strong></p>
        <p>Linux filtering focuses on managing files and directories on a system, while SQL filtering focuses on
            structured data manipulation within databases. To work with SQL, you can access it from multiple different
            interfaces, such as the Linux command line. Both SQL and Linux allow you to filter for specific data, but
            SQL offers the advantages of structuring the data and allowing you to join data from multiple tables.</p>
    </article>
</section>


<section class="main-section" id="topic442">
    <h2> Query a database </h2>

    <article class="main-article">
        <p><strong>Basic SQL query</strong></p>
        <p>There are two essential keywords in any SQL query: <strong>SELECT</strong> and <strong>FROM</strong>. You
            will use these keywords every time you want to query a SQL database. Using them together helps SQL identify
            what data you need from a database and the table you are returning it from.</p>
        <p>The video demonstrated this SQL query:</p>
        <pre><code>SELECT employee_id, device_id
    FROM employees;
    </code></pre>
        <p>In readings and quizzes, this course uses a sample database called the Chinook database to run queries. The
            Chinook database includes data that might be created at a digital media company. A security analyst employed
            by this company might need to query this data.</p>
        <p>As an example, you can run this query to return data from the customers table of the Chinook database:</p>
        <pre><code>SELECT
    </code></pre>
        <p><strong>SELECT</strong></p>
        <p>The <strong>SELECT</strong> keyword indicates which columns to return. For example, you can return the
            customerid column from the Chinook database with</p>
        <pre><code>SELECT customerid
    </code></pre>
        <p>You can also select multiple columns by separating them with a comma. For example, if you want to return both
            the customerid and city columns, you should write <strong>SELECT customerid, city</strong>.</p>
        <p>If you want to return all columns in a table, you can follow the SELECT keyword with an asterisk (*). The
            first line in the query will be <strong>SELECT *</strong>.</p>
        <p><strong>FROM</strong></p>
        <p>The <strong>SELECT</strong> keyword always comes with the <strong>FROM</strong> keyword.
            <strong>FROM</strong> indicates which table to query. To use the <strong>FROM</strong> keyword, you should
            write it after the <strong>SELECT</strong> keyword, often on a new line, and follow it with the name of the
            table you’re querying. If you want to return all columns from the customers table, you can write:
        </p>
        <pre><code>SELECT *
    FROM customers;
    </code></pre>
        <p>When you want to end the query here, you put a semicolon (;) at the end to tell SQL that this is the entire
            query.</p>
        <p><strong>ORDER BY</strong></p>
        <p>Database tables are often very complicated, and this is where other SQL keywords come in handy. <strong>ORDER
                BY</strong> is an important keyword for organizing the data you extract from a table.</p>
        <p><strong>ORDER BY</strong> sequences the records returned by a query based on a specified column or columns.
            This can be in either ascending or descending order.</p>
        <p><strong>Sorting in ascending order</strong></p>
        <p>To use the <strong>
    </article>
</section>

<section class="main-section" id="topic443">
    <h2> The WHERE clause and basic operators </h2>

    <article class="main-article">
        <p><strong>How filtering helps</strong></p>
        <p>As a security analyst, you'll often be responsible for working with very large and complicated security logs.
            To find the information you need, you'll often need to use SQL to filter the logs.</p>
        <p>In a cybersecurity context, you might use filters to find the login attempts of a specific user or all login
            attempts made at the time of a security issue. As another example, you might filter to find the devices that
            are running a specific version of an application.</p>
        <p><strong>WHERE</strong></p>
        <p>To create a filter in SQL, you need to use the keyword <strong>WHERE</strong>. <strong>WHERE</strong>
            indicates the condition for a filter.</p>
        <p>If you needed to email employees with a title of IT Staff, you might use a query like the one in the
            following example. You can run this example to examine what it returns:</p>
        <pre><code>SELECT * 
    FROM employees
    WHERE title = 'IT Staff';
    </code></pre>
        <p>Rather than returning all records in the employees table, this <strong>WHERE</strong> clause instructs SQL to
            return only those that contain 'IT Staff' in the title column. It uses the equals sign (=) operator to set
            this condition.</p>
        <p><strong>Filtering for patterns</strong></p>
        <p>You can also filter based on a pattern. For example, you can identify entries that start or end with a
            certain character or characters. Filtering for a pattern requires incorporating two more elements into your
            <strong>WHERE</strong> clause:
        </p>
        <ul>
            <li>a wildcard</li>
            <li>the <strong>LIKE</strong> operator</li>
        </ul>
        <p><strong>Wildcards</strong></p>
        <p>A wildcard is a special character that can be substituted with any other character. Two of the most useful
            wildcards are the percentage sign (%) and the underscore (_):</p>
        <ul>
            <li>The percentage sign substitutes for any number of other characters.</li>
            <li>The underscore symbol only substitutes for one other character.</li>
        </ul>
        <p>These wildcards can be placed after a string, before a string, or in both locations depending on the pattern
            you’re filtering for.</p>
        <p>The following table includes these wildcards applied to the string 'a' and examples of what each pattern
            would return:</p>
        <table>
            <thead>
                <tr>
                    <th>Pattern</th>
                    <th>Results that could be returned</th>
                </tr>
            </thead>
            <tbody>
                <tr>
                    <td>'a%'</td>
                    <td>apple123, art, a</td>
                </tr>
                <tr>
                    <td>'a_'</td>
                    <td>as, an, a7</td>
                </tr>
                <tr>
                    <td>'a__'</td>
                    <td>ant, add, a1c</td>
                </tr>
                <tr>
                    <td>'%a'</td>
                    <td>pizza, Z6ra, a</td>
                </tr>
                <tr>
                    <td>'_a'</td>
                    <td>ma, 1a, Ha</td>
                </tr>
                <tr>
                    <td>'%a%'</td>
                    <td>Again, back, a</td>
                </tr>
                <tr>
                    <td>'_a_'</td>
                    <td>Car, ban, ea7</td>
                </tr>
            </tbody>
        </table>
        <p><strong>LIKE</strong></p>
        <p>To apply wildcards to the filter, you need to use the <strong>LIKE</strong> operator instead of an equals
            sign (=). <strong>LIKE</strong> is used with <strong>WHERE</strong> to search for a pattern in a column.</p>
        <p>For instance, if you want to email employees with a title of either 'IT Staff' or 'IT Manager', you can use
            <strong>LIKE</strong> operator combined with the % wildcard:
        </p>
        <pre><code>SELECT * 
    FROM employees
    WHERE title LIKE 'IT%';
    </code></pre>
        <p>This query returns all records with values in the title column that start with the pattern of 'IT'. This
            means both 'IT Staff' and 'IT Manager' are returned.</p>
        <p>As another example, if you want to search through the invoices table to find all customers located in states
            with an abbreviation of 'NY', 'NV', 'NS' or 'NT', you can use the 'N_' pattern on the state column:</p>
        <pre><code>SELECT * 
    FROM invoices
    WHERE state LIKE 'N_';
    </code></pre>
        <p>This returns all the records with state abbreviations that follow this pattern.</p>
        <p><strong>Key takeaways</strong></p>
        <p>Filters are important when refining what your query returns. <strong>WHERE</strong> is an essential keyword
            for adding a filter to your query. You can also filter for patterns by combining the <strong>LIKE</strong>
            operator with the percentage sign (%) and the underscore (_) wildcards.</p>

    </article>
</section>


<section class="main-section" id="topic444">
    <h2> Operators for filtering dates and numbers </h2>

    <article class="main-article">
        <p><strong>Numbers, dates, and times in cybersecurity</strong></p>
        <p>Security analysts work with more than just string data, or data consisting of an ordered sequence of
            characters.</p>
        <p>They also frequently work with numeric data, or data consisting of numbers. A few examples of numeric data
            that you might encounter in your work as a security analyst include:</p>
        <ul>
            <li>the number of login attempts</li>
            <li>the count of a specific type of log entry</li>
            <li>the volume of data being sent from a source</li>
            <li>the volume of data being sent to a destination</li>
        </ul>
        <p>You'll also encounter date and time data, or data representing a date and/or time. As a first example, logs
            will generally timestamp every record. Other time and date data might include:</p>
        <ul>
            <li>login dates</li>
            <li>login times</li>
            <li>dates for patches</li>
            <li>the duration of a connection</li>
        </ul>
        <p><strong>Comparison operators</strong></p>
        <p>In SQL, filtering numeric and date and time data often involves operators. You can use the following
            operators in your filters to make sure you return only the rows you need:</p>
        <table>
            <thead>
                <tr>
                    <th>operator</th>
                    <th>use</th>
                </tr>
            </thead>
            <tbody>
                <tr>
                    <td>&lt;</td>
                    <td>less than</td>
                </tr>
                <tr>
                    <td>&gt;</td>
                    <td>greater than</td>
                </tr>
                <tr>
                    <td>=</td>
                    <td>equal to</td>
                </tr>
                <tr>
                    <td>&lt;=</td>
                    <td>less than or equal to</td>
                </tr>
                <tr>
                    <td>&gt;=</td>
                    <td>greater than or equal to</td>
                </tr>
                <tr>
                    <td>&lt;&gt;</td>
                    <td>not equal to</td>
                </tr>
            </tbody>
        </table>
        <p>Note: You can also use != as an alternative operator for not equal to.</p>
        <p><strong>Incorporating operators into filters</strong></p>
        <p>These comparison operators are used in the <strong>WHERE</strong> clause at the end of a query. The following
            query uses the &gt; operator to filter the birthdate column. You can run this query to explore its output:
        </p>
        <pre><code>SELECT first_name, last_name
    FROM employees
    WHERE birthdate &gt; '1970-01-01';
    </code></pre>
        <p>This query returns the first and last names of employees born after, but not on, '1970-01-01' (or January 1,
            1970). If you were to use the &gt;= operator instead, the results would also include results on exactly
            '1970-01-01'.</p>
        <p>In other words, the &gt; operator is exclusive and the &gt;= operator is inclusive. An exclusive operator is
            an operator that does not include the value of comparison. An inclusive operator is an operator that
            includes the value of comparison.</p>
        <p><strong>BETWEEN</strong></p>
        <p>Another operator used for numeric data as well as date and time data is the BETWEEN operator. BETWEEN filters
            for numbers or dates within a range. For example, if you want to find the first and last names of all
            employees hired between January 1, 2002 and January 1, 2003, you can use the BETWEEN operator as follows:
        </p>
        <pre><code>SELECT first_name, last_name
    FROM employees
    WHERE hiredate BETWEEN '2002-01-01' AND '2003-01-01';
    </code></pre>
        <p>Note: The BETWEEN operator is inclusive. This means records with a hiredate of January 1, 2002 or January 1,
            2003 are included in the results of the previous query.</p>
        <p><strong>Key takeaways</strong></p>
        <p>Operators are important when filtering numeric and date and time data. These include exclusive operators such
            as &lt; and inclusive operators such as &lt;=. The BETWEEN operator, another inclusive operator, helps you
            return the data you need within a range.</p>
    </article>
</section>

<section class="main-section" id="topic445">
    <h2> More on filters with AND, OR, and NOT</h2>

    <article class="main-article">
        <p><strong>Logical operators</strong></p>
        <p>AND, OR, and NOT allow you to filter your queries to return the specific information that will help you in
            your work as a security analyst. They are all considered logical operators.</p>
        <p><strong>AND</strong></p>
        <p>First, AND is used to filter on two conditions. AND specifies that both conditions must be met
            simultaneously.</p>
        <p>As an example, a cybersecurity concern might affect only those customer accounts that meet both the condition
            of being handled by a support representative with an ID of 5 and the condition of being located in the USA.
            To find the names and emails of those specific customers, you should place the two conditions on either side
            of the AND operator in the WHERE clause:</p>
        <pre><code>SELECT firstname, lastname, email, country, supportrepid
    FROM customers
    WHERE supportrepid = 5 AND country = 'USA';
    </code></pre>
        <p>Running this query returns four rows of information about the customers. You can use this information to
            contact them about the security concern.</p>
        <p><strong>OR</strong></p>
        <p>The OR operator also connects two conditions, but OR specifies that either condition can be met. It returns
            results where the first condition, the second condition, or both are met.</p>
        <p>For example, if you are responsible for finding all customers who are either in the USA or Canada so that you
            can communicate information about a security update, you can use an OR operator to find all the needed
            records. As the following query demonstrates, you should place the two conditions on either side of the OR
            operator in the WHERE clause:</p>
        <pre><code>SELECT firstname, lastname, email, country
    FROM customers
    WHERE country = 'Canada' OR country = 'USA';
    </code></pre>
        <p>The query returns all customers in either the US or Canada.</p>
        <p><strong>NOT</strong></p>
        <p>Unlike the previous two operators, the NOT operator only works on a single condition, and not on multiple
            ones. The NOT operator negates a condition. This means that SQL returns all records that don’t match the
            condition specified in the query.</p>
        <p>For example, if a cybersecurity issue doesn't affect customers in the USA but might affect those in other
            countries, you can return all customers who are not in the USA. This would be more efficient than creating
            individual conditions for all of the other countries. To use the NOT operator for this task, write the
            following query and place NOT directly after WHERE:</p>
        <pre><code>SELECT firstname, lastname, email, country
    FROM customers
    WHERE NOT country = 'USA';
    </code></pre>
        <p>SQL returns every entry where the customers are not from the USA.</p>
        <p><strong>Combining logical operators</strong></p>
        <p>Logical operators can be combined in filters. For example, if you know that both the USA and Canada are not
            affected by a cybersecurity issue, you can combine operators to return customers in all countries besides
            these two. In the following query, NOT is placed before the first condition, it's joined to a second
            condition with AND, and then NOT is also placed before that second condition. You can run it to explore what
            it returns:</p>
        <pre><code>SELECT firstname, lastname, email, country
    FROM customers
    WHERE NOT country = 'Canada' AND NOT country = 'USA';
    </code></pre>
        <p><strong>Key takeaways</strong></p>
        <p>Logical operators allow you to create more specific filters that target the security-related information you
            need. The AND operator requires two conditions to be true simultaneously, the OR operator requires either
            one or both conditions to be true, and the NOT operator negates a condition. Logical operators can be
            combined together to create even more specific queries.</p>
    </article>
</section>

<section class="main-section" id="topic446">
    <h2> Compare types of joins </h2>

    <article class="main-article">


        <h1>Inner joins</h1>

        <p>
            The first type of join that you might perform is an inner join. INNER JOIN returns rows matching on a
            specified column that exists in more than one table.
        </p>

        <div>
            <img src="resource/venna.png" alt="Venn diagram showing inner join">
        </div>

        <p>
            It only returns the rows where there is a match, but like other types of joins, it returns all specified
            columns from all joined tables. For example, if the query joins two tables with SELECT *, all columns in
            both of the tables are returned.
        </p>

        <p>
            Note: If a column exists in both of the tables, it is returned twice when SELECT * is used.
        </p>

        <h2>Syntax of an inner join</h2>

        <p>
            To write a query using INNER JOIN, you can use the following syntax:
        </p>

        <pre>
    SELECT *
    FROM employees
    INNER JOIN machines ON employees.device_id = machines.device_id;
    </pre>

        <p>
            You must specify the two tables to join by including the first or left table after FROM and the second or
            right table after INNER JOIN.
        </p>

        <p>
            After the name of the right table, use the ON keyword and the = operator to indicate the column you are
            joining the tables on. It's important that you specify both the table and column names in this portion of
            the join by placing a period (.) between the table and the column.
        </p>

        <p>
            In addition to selecting all columns, you can select only certain columns. For example, if you only want the
            join to return the username, operating_system and device_id columns, you can write this query:
        </p>

        <pre>
    SELECT username, operating_system, employees.device_id
    FROM employees
    INNER JOIN machines ON employees.device_id = machines.device_id;
    </pre>

        <p>
            Note: In the example query, username and operating_system only appear in one of the two tables, so they are
            written with just the column name. On the other hand, because device_id appears in both tables, it's
            necessary to indicate which one to return by specifying both the table and column name
            (employees.device_id).
        </p>

        <h1>Outer joins</h1>

        <h2>Left joins</h2>

        <p>
            When joining two tables, LEFT JOIN returns all the records of the first table, but only returns rows of the
            second table that match on a specified column.
        </p>

        <div>
            <img src="resource/venn1.png" alt="Venn diagram showing left join">
        </div>

        <p>
            The syntax for using LEFT JOIN is demonstrated in the following query:
        </p>

        <pre>
    SELECT *
    FROM employees
    LEFT JOIN machines ON employees.device_id = machines.device_id;
    </pre>

        <p>
            As with all joins, you should specify the first or left table as the table that comes after FROM and the
            second or right table as the table that comes after LEFT JOIN. In the example query, because employees is
            the left table, all of its records are returned. Only records that match on the device_id column are
            returned from the right table, machines.
        </p>

        <h2>Right joins</h2>

        <p>
            When joining two tables, RIGHT JOIN returns all of the records of the second table, but only returns rows
            from the first table that match on a specified column.
        </p>

        <div>
            <img src="resource/venn2.png" alt="Venn diagram showing right join">
        </div>

        <p>
            The following query demonstrates the syntax for RIGHT JOIN:
        </p>

        <pre>
    SELECT *
    FROM employees
    RIGHT JOIN machines ON employees.device_id = machines.device_id;
    </pre>

        <p>
            RIGHT JOIN has the same syntax as LEFT JOIN, with the only difference being the keyword RIGHT JOIN instructs
            SQL to produce different output. The query returns all records from machines, which is the second or right
            table. Only matching records are returned from employees, which is the first or left table.
        </p>

        <p>
            Note: You can use LEFT JOIN and RIGHT JOIN and return the exact same results if you use the tables in
            reverse order. The following RIGHT JOIN query returns the exact same result as the LEFT JOIN query
            demonstrated in the previous section:
        </p>

        <pre>
    SELECT *
    FROM machines
    RIGHT JOIN employees ON employees.device_id = machines.device_id;
    </pre>

        <p>
            All that you have to do is switch the order of the tables that appear before and after the keyword used for
            the join, and you will have swapped the left and right tables.
        </p>

        <h2>Full outer joins</h2>

        <p>
            FULL OUTER JOIN returns all records from both tables. You can think of it as a way of completely merging two
            tables.
        </p>

        <div>
            <img src="resource/venn3.png" alt="Venn diagram showing full outer join">
        </div>

        <p>
            You can review the syntax for using FULL OUTER JOIN in the following query:
        </p>

        <pre>
    SELECT *
    FROM employees
    FULL OUTER JOIN machines ON employees.device_id = machines.device_id;
    </pre>

        <p>
            The results of a FULL OUTER JOIN query include all records from both tables. Similar to INNER JOIN, the
            order of tables does not change the results of the query.
        </p>

        <h2>Key takeaways</h2>

        <p>
            When working in SQL, there are multiple ways to join tables. All joins return the records that match on a
            specified column. INNER JOIN will return only these records. Outer joins also return all other records from
            one or both of the tables. LEFT JOIN returns all records from the first or left table, RIGHT JOIN returns
            all records from the second or right table, and FULL OUTER JOIN returns all records from both tables.
        </p>


    </article>
</section>


<section class="main-section" id="topic447">
    <h2> Continuous learning in SQL </h2>

    <article class="main-article">
        <title>Exploring SQL: Aggregate Functions</title>


        <h1>Aggregate functions</h1>

        <p>
            In SQL, aggregate functions are functions that perform a calculation over multiple data points and return
            the result of the calculation. The actual data is not returned.
        </p>

        <p>
            There are various aggregate functions that perform different calculations:
        </p>

        <ul>
            <li><strong>COUNT</strong> returns a single number that represents the number of rows returned from your
                query.</li>
            <li><strong>AVG</strong> returns a single number that represents the average of the numerical data in a
                column.</li>
            <li><strong>SUM</strong> returns a single number that represents the sum of the numerical data in a column.
            </li>
        </ul>

        <h2>Aggregate function syntax</h2>

        <p>
            To use an aggregate function, place the keyword for it after the SELECT keyword, and then in parentheses,
            indicate the column you want to perform the calculation on.
        </p>

        <p>
            For example, when working with the customers table, you can use aggregate functions to summarize important
            information about the table. If you want to find out how many customers there are in total, you can use the
            COUNT function on any column, and SQL will return the total number of records, excluding NULL values. You
            can run this query and explore its output:
        </p>

        <pre>
        SELECT COUNT(firstname)
        FROM customers;
        </pre>

        <p>
            The result is a table with one column titled COUNT(firstname) and one row that indicates the count.
        </p>

        <p>
            If you want to find the number of customers from a specific country, you can add a filter to your query:
        </p>

        <pre>
        SELECT COUNT(firstname)
        FROM customers
        WHERE country = 'USA';
        </pre>

        <p>
            With this filter, the count is lower because it only includes the records where the country column contains
            a value of 'USA'.
        </p>

        <p>
            There are a lot of other aggregate functions in SQL. The syntax of placing them after SELECT is exactly the
            same as the COUNT function.
        </p>

        <h1>Continuing to learn SQL</h1>

        <p>
            SQL is a widely used querying language, with many more keywords and applications. You can continue to learn
            more about aggregate functions and other aspects of using SQL on your own.
        </p>

        <p>
            Most importantly, approach new tasks with curiosity and a willingness to find new ways to apply SQL to your
            work as a security analyst. Identify the data results that you need and try to use SQL to obtain these
            results.
        </p>

        <p>
            Fortunately, SQL is one of the most important tools for working with databases and analyzing data, so you'll
            find a lot of support in trying to learn SQL online. First, try searching for the concepts you've already
            learned and practiced to find resources that have accurate easy-to-follow explanations. When you identify
            these resources, you can use them to extend your knowledge.
        </p>

        <p>
            Continuing your practical experience with SQL is also important. You can also search for new databases that
            allow you to perform SQL queries using what you've learned.
        </p>

        <h2>Key takeaways</h2>

        <p>
            Aggregate functions like COUNT, SUM, and AVG allow you to work with SQL in new ways. There are many other
            additional aspects of SQL that could be useful to you as an analyst. By continuing to explore SQL on your
            own, you can expand the ways you can apply SQL in a cybersecurity context.
        </p>


    </article>
</section>


<section class="main-section" id="topic448">
    <h2> Course 4 glossary </h2>

    <article class="main-article">

        <h1>Cybersecurity Terms and Definitions</h1>

        <section>
            <h2>A</h2>
            <dl>
                <dt>Absolute file path:</dt>
                <dd>The full file path, which starts from the root.</dd>
                <dt>Application:</dt>
                <dd>A program that performs a specific task.</dd>
                <dt>Argument (Linux):</dt>
                <dd>Specific information needed by a command.</dd>
                <dt>Authentication:</dt>
                <dd>The process of verifying who someone is.</dd>
                <dt>Authorization:</dt>
                <dd>The concept of granting access to specific resources in a system.</dd>
            </dl>
        </section>

        <section>
            <h2>B</h2>
            <dl>
                <dt>Bash:</dt>
                <dd>The default shell in most Linux distributions.</dd>
                <dt>Basic Input/Output System (BIOS):</dt>
                <dd>A microchip that contains loading instructions for the computer and is prevalent in older systems.
                </dd>
                <dt>Bootloader:</dt>
                <dd>A software program that boots the operating system.</dd>
            </dl>
        </section>

        <section>
            <h2>C</h2>
            <dl>
                <dt>CentOS:</dt>
                <dd>An open-source distribution that is closely related to Red Hat.</dd>
                <dt>Central Processing Unit (CPU):</dt>
                <dd>A computer’s main processor, which is used to perform general computing tasks on a computer.</dd>
                <dt>Command:</dt>
                <dd>An instruction telling the computer to do something.</dd>
                <dt>Command-line interface (CLI):</dt>
                <dd>A text-based user interface that uses commands to interact with the computer.</dd>
            </dl>
        </section>

        <section>
            <h2>D</h2>
            <dl>
                <dt>Database:</dt>
                <dd>An organized collection of information or data.</dd>
                <dt>Date and time data:</dt>
                <dd>Data representing a date and/or time.</dd>
                <dt>Digital forensics:</dt>
                <dd>The practice of collecting and analyzing data to determine what has happened after an attack.</dd>
                <dt>Directory:</dt>
                <dd>A file that organizes where other files are stored.</dd>
                <dt>Distributions:</dt>
                <dd>The different versions of Linux.</dd>
            </dl>
        </section>

        <section>
            <h2>E</h2>
            <dl>
                <dt>Exclusive operator:</dt>
                <dd>An operator that does not include the value of comparison.</dd>
            </dl>
        </section>

        <section>
            <h2>F</h2>
            <dl>
                <dt>File path:</dt>
                <dd>The location of a file or directory.</dd>
                <dt>Filesystem Hierarchy Standard (FHS):</dt>
                <dd>The component of the Linux OS that organizes data.</dd>
                <dt>Filtering:</dt>
                <dd>Selecting data that match a certain condition.</dd>
                <dt>Foreign key:</dt>
                <dd>A column in a table that is a primary key in another table.</dd>
            </dl>
        </section>

        <section>
            <h2>G</h2>
            <dl>
                <dt>Graphical user interface (GUI):</dt>
                <dd>A user interface that uses icons on the screen to manage different tasks on the computer.</dd>
            </dl>
        </section>

        <section>
            <h2>H</h2>
            <dl>
                <dt>Hard drive:</dt>
                <dd>A hardware component used for long-term memory.</dd>
                <dt>Hardware:</dt>
                <dd>The physical components of a computer.</dd>
            </dl>
        </section>

        <section>
            <h2>I</h2>
            <dl>
                <dt>Inclusive operator:</dt>
                <dd>An operator that includes the value of comparison.</dd>
                <dt>Internal hardware:</dt>
                <dd>The components required to run the computer.</dd>
            </dl>
        </section>

        <section>
            <h2>K</h2>
            <dl>
                <dt>Kali Linux TM:</dt>
                <dd>An open-source distribution of Linux that is widely used in the security industry.</dd>
                <dt>Kernel:</dt>
                <dd>The component of the Linux OS that manages processes and memory.</dd>
            </dl>
        </section>

        <section>
            <h2>L</h2>
            <dl>
                <dt>Legacy operating system:</dt>
                <dd>An operating system that is outdated but still being used.</dd>
                <dt>Linux:</dt>
                <dd>An open-source operating system.</dd>
                <dt>Log:</dt>
                <dd>A record of events that occur within an organization's systems.</dd>
            </dl>
        </section>

        <section>
            <h2>N</h2>
            <dl>
                <dt>nano:</dt>
                <dd>A command-line file editor that is available by default in many Linux distributions.</dd>
                <dt>Numeric data:</dt>
                <dd>Data consisting of numbers.</dd>
            </dl>
        </section>

        <section>
            <h2>O</h2>
            <dl>
                <dt>Operating system (OS):</dt>
                <dd>The interface between computer hardware and the user.</dd>
                <dt>Operator:</dt>
                <dd>A symbol or keyword that represents an operation.</dd>
                <dt>Options:</dt>
                <dd>Input that modifies the behavior of a command.</dd>
            </dl>
        </section>

        <section>
            <h2>P</h2>
            <dl>
                <dt>Package:</dt>
                <dd>A piece of software that can be combined with other packages to form an application.</dd>
                <dt>Package manager:</dt>
                <dd>A tool that helps users install, manage, and remove packages or applications.</dd>
                <dt>Parrot:</dt>
                <dd>An open-source distribution that is commonly used for security.</dd>
                <dt>Penetration test (pen test):</dt>
                <dd>A simulated attack that helps identify vulnerabilities in systems, networks, websites, applications,
                    and processes.</dd>
                <dt>Peripheral devices:</dt>
                <dd>Hardware components that are attached and controlled by the computer system.</dd>
                <dt>Permissions:</dt>
                <dd>The type of access granted for a file or directory.</dd>
                <dt>Primary key:</dt>
                <dd>A column where every row has a unique entry.</dd>
                <dt>Principle of least privilege:</dt>
                <dd>The concept of granting only the minimal access and authorization required to complete a task or
                    function.</dd>
                <dt>Query:</dt>
                <dd>A request for data from a database table or a combination of tables.</dd>
                <dt>Random Access Memory (RAM):</dt>
                <dd>A hardware component used for short-term memory.</dd>
                <dt>Red Hat® Enterprise Linux®:</dt>
                <dd>A subscription-based distribution of Linux built for enterprise use.</dd>
                <dt>Relational database:</dt>
                <dd>A structured database containing tables that are related to each other.</dd>
                <dt>Relative file path:</dt>
                <dd>A file path that starts from the user's current directory.</dd>
                <dt>Root directory:</dt>
                <dd>The highest-level directory in Linux.</dd>
                <dt>Root user (or superuser):</dt>
                <dd>A user with elevated privileges to modify the system.</dd>
                <dt>S</dt>
                <dd>Shell: The command-line interpreter.</dd>
                <dt>SQL (Structured Query Language):</dt>
                <dd>A programming language used to create, interact with, and request information from a database.</dd>
                <dt>Standard error:</dt>
                <dd>An error message returned by the OS through the shell.</dd>
                <dt>Standard input:</dt>
                <dd>Information received by the OS via the command line.</dd>
                <dt>Standard output:</dt>
                <dd>Information returned by the OS through the shell.</dd>
                <dt>String data:</dt>
                <dd>Data consisting of an ordered sequence of characters.</dd>
                <dt>Syntax:</dt>
                <dd>The rules that determine what is correctly structured in a computing language.</dd>
                <dt>U</dt>
                <dd>Ubuntu: An open-source, user-friendly distribution that is widely used in security and other
                    industries.</dd>
                <dt>Unified Extensible Firmware Interface (UEFI):</dt>
                <dd>A microchip that contains loading instructions for the computer and replaces BIOS on more modern
                    systems.</dd>
                <dt>User:</dt>
                <dd>The person interacting with a computer.</dd>
                <dt>User interface:</dt>
                <dd>A program that allows the user to control the functions of the operating system.</dd>
                <dt>V</dt>
                <dd>Virtual machine (VM): A virtual version of a physical computer.</dd>
                <dt>W</dt>
                <dd>Wildcard: A special character that can be substituted with any other character.</dd>
            </dl>
        </section>

    </article>
</section>


<section class="main-section" id="Course 5">
    <h2 id="cs2">Course 5</h2>
</section>


<section class="main-section" id="Module 51">
    <h2>Module 1</h2>
</section>
<br> <br>


<section class="main-section" id="topic511">
    <h2>Understand risks, threats, and vulnerabilities </h2>

    <article class="main-article">

        <section>
            <h2>Security Concepts</h2>
            <h3>Security Risk</h3>
            <p>Security plans are all about how an organization defines risk. However, this definition can vary widely
                by organization. As you may recall, a risk is anything that can impact the confidentiality, integrity,
                or availability of an asset. Since organizations have particular assets that they value, they tend to
                differ in how they interpret and approach risk.</p>
            <p>One way to interpret risk is to consider the potential effects that negative events can have on a
                business. Another way to present this idea is with this calculation:</p>
            <p>Likelihood x Impact = Risk</p>
            <p>For example, you risk being late when you drive a car to work. This negative event is more likely to
                happen if you get a flat tire along the way. And the impact could be serious, like losing your job. All
                these factors influence how you approach commuting to work every day. The same is true for how
                businesses handle security risks.</p>
            <p>In general, we calculate risk in this field to help:</p>
            <ul>
                <li>Prevent costly and disruptive events</li>
                <li>Identify improvements that can be made to systems and processes</li>
                <li>Determine which risks can be tolerated</li>
                <li>Prioritize the critical assets that require attention</li>
            </ul>
            <p>The business impact of a negative event will always depend on the asset and the situation. Your primary
                focus as a security professional will be to focus on the likelihood side of the equation by dealing with
                certain factors that increase the odds of a problem.</p>
            <h3>Risk Factors</h3>
            <p>As you’ll discover throughout this course, there are two broad risk factors that you’ll be concerned with
                in the field:</p>
            <ul>
                <li>Threats</li>
                <li>Vulnerabilities</li>
            </ul>
            <p>The risk of an asset being harmed or damaged depends greatly on whether a threat takes advantage of
                vulnerabilities.</p>
            <p>Let’s apply this to the risk of being late to work. A threat would be a nail puncturing your tire, since
                tires are vulnerable to running over sharp objects. In terms of security planning, you would want to
                reduce the likelihood of this risk by driving on a clean road.</p>
            <h4>Categories of Threat</h4>
            <p>Threats are circumstances or events that can negatively impact assets. There are many different types of
                threats. However, they are commonly categorized as two types: intentional and unintentional.</p>
            <p>For example, an intentional threat might be a malicious hacker who gains access to sensitive information
                by targeting a misconfigured application. An unintentional threat might be an employee who holds the
                door open for an unknown person and grants them access to a restricted area. Either one can cause an
                event that must be responded to.</p>
            <h4>Categories of Vulnerability</h4>
            <p>Vulnerabilities are weaknesses that can be exploited by threats. There’s a wide range of vulnerabilities,
                but they can be grouped into two categories: technical and human.</p>
            <p>For example, a technical vulnerability can be misconfigured software that might give an unauthorized
                person access to important data. A human vulnerability can be a forgetful employee who loses their
                access card in a parking lot. Either one can lead to risk.</p>
            <h3>Key Takeaways</h3>
            <p>Risks, threats, and vulnerabilities have very specific meanings in security. Knowing the relationship
                between them can help you build a strong foundation as you grow essential skills and knowledge as a
                security analyst. This can help you gain credibility in the industry by demonstrating that you have
                working knowledge of the field. And it signals to your future colleagues that you’re a member of the
                global security community.</p>
        </section>

    </article>
</section>

<section class="main-section" id="topic512">
    <h2>Common classification requirements </h2>

    <article class="main-article">
        <section>
            <h2>Asset Management and Classification</h2>
            <p>Asset management is the process of tracking assets and the risks that affect them. The idea behind this
                process is simple: you can only protect what you know you have.</p>
            <p>Previously, you learned that identifying, tracking, and classifying assets are all important parts of
                asset management. In this reading, you’ll learn more about the purpose and benefits of asset
                classification, including common classification levels.</p>

            <img src="resource/commonclassification.png" id="img" alt="">
            <h3>Why Asset Management Matters</h3>
            <p>Keeping assets safe requires a workable system that helps businesses operate smoothly. Setting these
                systems up requires having detailed knowledge of the assets in an environment. For example, a bank needs
                to have money available each day to serve its customers. Equipment, devices, and processes need to be in
                place to ensure that money is available and secure from unauthorized access.</p>
            <p>Organizations protect a variety of different assets. Some examples might include:</p>
            <ul>
                <li>Digital assets such as customer data or financial records.</li>
                <li>Information systems that process data, like networks or software.</li>
                <li>Physical assets which can include facilities, equipment, or supplies.</li>
                <li>Intangible assets such as brand reputation or intellectual property.</li>
            </ul>
            <p>Regardless of its type, every asset should be classified and accounted for. As you may recall, asset
                classification is the practice of labeling assets based on sensitivity and importance to an
                organization. Determining each of those two factors varies, but the sensitivity and importance of an
                asset typically requires knowing what you have, where it is, who owns it, and how important it is. An
                organization that classifies its assets does so based on these characteristics. Doing so helps them
                determine the sensitivity and value of an asset.</p>
            <h4>Common Asset Classifications</h4>
            <p>Asset classification helps organizations implement an effective risk management strategy. It also helps
                them prioritize security resources, reduce IT costs, and stay in compliance with legal regulations.</p>
            <p>The most common classification scheme is: restricted, confidential, internal-only, and public.</p>
            <ul>
                <li><strong>Restricted:</strong> This category is reserved for incredibly sensitive assets, like
                    need-to-know information.</li>
                <li><strong>Confidential:</strong> Refers to assets whose disclosure may lead to a significant negative
                    impact on an organization.</li>
                <li><strong>Internal-only:</strong> Describes assets that are available to employees and business
                    partners.</li>
                <li><strong>Public:</strong> The lowest level of classification. These assets have no negative
                    consequences to the organization if they’re released.</li>
            </ul>
            <p>How this scheme is applied depends greatly on the characteristics of an asset. Identifying an asset’s
                owner is sometimes the most complicated characteristic to determine.</p>
            <p><em>Note: Although many organizations adopt this classification scheme, there can be variability at the
                    highest levels. For example, government organizations label their most sensitive assets as
                    confidential instead of restricted.</em></p>
            <h4>Challenges of Classifying Information</h4>
            <p>Identifying the owner of certain assets is straightforward, like the owner of a building. Other types of
                assets can be trickier to identify. This is especially true when it comes to information.</p>
            <p>Ownership is just one characteristic that makes classifying information a challenge. Another concern is
                that information can have multiple classification values at the same time. For example, consider a
                letter addressed to you in the mail. The letter contains some public information that’s okay to share,
                like your name. It also contains fairly confidential pieces of information that you’d rather only be
                available to certain people, like your address.</p>
            <p>Key Takeaways:</p>
            <p>Every business is different. Each business will have specific requirements to address when devising their
                security strategy. Knowing why and how businesses classify their assets is an important skill to have as
                a security professional. Information is one of the most important assets in the world. As a
                cybersecurity professional, you will be closely involved with protecting information from damage,
                disclosure, and misuse. Recognizing the challenges that businesses face classifying this type of asset
                is a key to helping them solve their security needs.</p>
        </section>

    </article>
</section>

<section class="main-section" id="topic513">
    <h2>The emergence of cloud security</h2>

    <article class="main-article">
        <section>
            <h2>Cloud Computing and Security Challenges</h2>
            <p>One of the most significant technology developments this century has been the emergence of cloud
                computing. The United Kingdom's National Cyber Security Centre defines cloud computing as, “An
                on-demand, massively scalable service, hosted on shared infrastructure, accessible via the internet.”
            </p>
            <p>Earlier, you learned that most information is in the form of data, which is in a constant state of
                change. In recent years, businesses started moving their data to the cloud. The adoption of cloud-based
                services has complicated how information is kept safe online. In this reading, you’ll learn about these
                challenges and the opportunities they’ve created for security professionals.</p>
            <img src="resource/cloudcom.png" id="img" alt="A cloud lifting a business out of a marketplace and into the sky.">
            <h3>Soaring into the Cloud</h3>
            <p>Starting an online business used to be a complicated and costly process. In years past, companies had to
                build and maintain their own internal solutions to operate in the digital marketplace. Now, it’s much
                easier for anyone to participate because of the cloud.</p>
            <p>The availability of cloud technologies has drastically changed how businesses operate online. These new
                tools allow companies to scale and adapt quickly while also lowering their costs. Despite these
                benefits, the shift to cloud-based services has also introduced a range of new cybersecurity challenges
                that put assets at risk.</p>
            <h3>Cloud-based Services</h3>
            <p>The term cloud-based services refers to a variety of on demand or web-based business solutions. Depending
                on a company’s needs and budget, services can range from website hosting, to application development
                environments, to entire back-end infrastructure.</p>
            <p>There are three main categories of cloud-based services:</p>
            <ul>
                <li><strong>Software as a service (SaaS):</strong> Front-end applications that users access via a web
                    browser.</li>
                <li><strong>Platform as a service (PaaS):</strong> Back-end application development tools that clients
                    can access online.</li>
                <li><strong>Infrastructure as a service (IaaS):</strong> Remote access to a range of back-end systems
                    hosted by the cloud service provider.</li>
            </ul>
            <p>Cloud-based services allow companies to connect with their customers, employees, and business partners
                over the internet. Some of the largest organizations in the world offer cloud-based services like Google
                Cloud Platform and Microsoft Azure.</p>
            <h3>Cloud Security</h3>
            <p>Shifting applications and infrastructure over to the cloud can make it easier to operate an online
                business. It can also complicate keeping data private and safe. Cloud security is a growing subfield of
                cybersecurity that specifically focuses on the protection of data, applications, and infrastructure in
                the cloud.</p>
            <p>In a traditional model, organizations had their entire IT infrastructure on premises. Protecting those
                systems was entirely up to the internal security team in that environment. These responsibilities are
                not so clearly defined when part or all of an operational environment is in the cloud.</p>
            <p>In cloud security, this concept is known as the shared responsibility model. Clients are commonly
                responsible for securing anything that is directly within their control such as identity and access
                management, resource configuration, and data handling.</p>
            <p>However, challenges arise in cloud security such as misconfiguration, monitoring access, and meeting
                regulatory standards.</p>
            <p>Key Takeaways:</p>
            <p>So much of the global marketplace has shifted to cloud-based services. Cloud technology is still new,
                resulting in the emergence of new security models and a range of security challenges. And it’s likely
                that other concerns might arise as more businesses become reliant on the cloud. Being familiar with the
                cloud and the different services that are available is an important step towards supporting any
                organization's efforts to protect information online.</p>
        </section>

    </article>
</section>


<section class="main-section" id="topic514">
    <h2> Security guidelines in action

    </h2>

    <article class="main-article">
        <section>
            <h2>Implementing the NIST Cybersecurity Framework (CSF)</h2>
            <p>Organizations often face an overwhelming amount of risk. Developing a security plan from the beginning
                that addresses all risk can be challenging. This makes security frameworks a useful option.</p>
            <p>Previously, you learned about the NIST Cybersecurity Framework (CSF). A major benefit of the CSF is that
                it's flexible and can be applied to any industry. In this reading, you’ll explore how the NIST CSF can
                be implemented.</p>
            <img src="resource/nist.png" id="img" alt="">
            <h3>Origins of the Framework</h3>
            <p>Originally released in 2014, NIST developed the Cybersecurity Framework to protect critical
                infrastructure in the United States. NIST eventually adapted the CSF to fit the needs of businesses in
                the public and private sector. Their goal was to make the framework more flexible, making it easier to
                adopt for small businesses or anyone else that might lack the resources to develop their own security
                plans.</p>
            <h3>Components of the CSF</h3>
            <p>The framework consists of three main components: the core, tiers, and profiles. In the following
                sections, you'll learn more about each of these CSF components.</p>
            <h4>Core</h4>
            <p>The CSF core is a set of desired cybersecurity outcomes that help organizations customize their security
                plan. It consists of five functions: Identify, Protect, Detect, Respond, and Recover.</p>
            <h4>Tiers</h4>
            <p>The CSF tiers are a way of measuring the sophistication of an organization's cybersecurity program. CSF
                tiers are measured on a scale of 1 to 4, indicating the level of security controls implemented.</p>
            <h4>Profiles</h4>
            <p>The CSF profiles are pre-made templates tailored to address the specific risks of an organization or
                industry. They are used to help organizations develop a baseline for their cybersecurity plans or
                compare their current cybersecurity posture to a specific industry standard.</p>
            <h3>Implementing the CSF</h3>
            <p>Organizations may choose to use the CSF to achieve compliance with various regulations. However,
                implementing the CSF can be a challenge due to its high level of detail. The U.S. Cybersecurity and
                Infrastructure Security Agency (CISA) provides detailed guidance for implementing the CSF:</p>
            <ol>
                <li>Create a current profile of the security operations.</li>
                <li>Perform a risk assessment to identify gaps in security operations.</li>
                <li>Analyze and prioritize existing gaps.</li>
                <li>Implement a plan of action to achieve organizational goals.</li>
            </ol>
            <p>Industries across the global economy have embraced the CSF due to its alignment with security practices
                and regulatory compliance requirements.</p>
            <h3>Key Takeaways</h3>
            <p>The NIST CSF is a flexible resource that organizations may choose to use to assess and improve their
                security posture. It aligns with the security practices of industries worldwide and helps businesses
                meet regulatory compliance requirements.</p>
        </section>

    </article>
</section>

<section class="main-section" id="topic515">
    <h2> Glossary terms from module 1 </h2>

    <article class="main-article">
        <section>
            <h2>Terms and Definitions from Course 5, Module 1</h2>
            <ul>
                <li><strong>Asset:</strong> An item perceived as having value to an organization</li>
                <li><strong>Asset classification:</strong> The practice of labeling assets based on sensitivity and
                    importance to an organization</li>
                <li><strong>Asset inventory:</strong> A catalog of assets that need to be protected</li>
                <li><strong>Asset management:</strong> The process of tracking assets and the risks that affect them
                </li>
                <li><strong>Compliance:</strong> The process of adhering to internal standards and external regulations
                </li>
                <li><strong>Data:</strong> Information that is translated, processed, or stored by a computer</li>
                <li><strong>Data at rest:</strong> Data not currently being accessed</li>
                <li><strong>Data in transit:</strong> Data traveling from one point to another</li>
                <li><strong>Data in use:</strong> Data being accessed by one or more users</li>
                <li><strong>Information security (InfoSec):</strong> The practice of keeping data in all states away
                    from unauthorized users</li>
                <li><strong>National Institute of Standards and Technology (NIST) Cybersecurity Framework
                        (CSF):</strong> A voluntary framework that consists of standards, guidelines, and best practices
                    to manage cybersecurity risk</li>
                <li><strong>Policy:</strong> A set of rules that reduce risk and protect information</li>
                <li><strong>Procedures:</strong> Step-by-step instructions to perform a specific security task</li>
                <li><strong>Regulations:</strong> Rules set by a government or other authority to control the way
                    something is done</li>
                <li><strong>Risk:</strong> Anything that can impact confidentiality, integrity, or availability of an
                    asset</li>
                <li><strong>Standards:</strong> References that inform how to set policies</li>
                <li><strong>Threat:</strong> Any circumstance or event that can negatively impact assets</li>
                <li><strong>Vulnerability:</strong> A weakness that can be exploited by a threat</li>
            </ul>
        </section>

    </article>
</section>


<section class="main-section" id="Module 52">
    <h2>Module 2</h2>
</section>
<br> <br>


<section class="main-section" id="topic521">
    <h2> Principle of least privilege</h2>
    <article class="main-article">
        <h2>Principle of Least Privilege</h2>
        <p>Security controls are essential to keeping sensitive data private and safe. One of the most common controls
            is the principle of least privilege, also referred to as PoLP or least privilege. The principle of least
            privilege is a security concept in which a user is only granted the minimum level of access and
            authorization required to complete a task or function.</p>
        <h3>Limiting access reduces risk</h3>
        <p>Every business needs to plan for the risk of data theft, misuse, or abuse. Implementing the principle of
            least privilege can greatly reduce the risk of costly incidents like data breaches by:</p>
        <ul>
            <li>Limiting access to sensitive information</li>
            <li>Reducing the chances of accidental data modification, tampering, or loss</li>
            <li>Supporting system monitoring and administration</li>
        </ul>
        <p>Least privilege greatly reduces the likelihood of a successful attack by connecting specific resources to
            specific users and placing limits on what they can do. It's an important security control that should be
            applied to any asset. Clearly defining who or what your users are is usually the first step of implementing
            least privilege effectively.</p>
        <h4>Determining access and authorization</h4>
        <p>To implement least privilege, access and authorization must be determined first. There are two questions to
            ask to do so:</p>
        <ul>
            <li>Who is the user?</li>
            <li>How much access do they need to a specific resource?</li>
        </ul>
        <p>Determining who the user is usually straightforward. A user can refer to a person, like a customer, an
            employee, or a vendor. It can also refer to a device or software that's connected to your business network.
            In general, every user should have their own account. Accounts are typically stored and managed within an
            organization's directory service.</p>
        <p>These are the most common types of user accounts:</p>
        <ul>
            <li>Guest accounts are provided to external users who need to access an internal network, like customers,
                clients, contractors, or business partners.</li>
            <li>User accounts are assigned to staff based on their job duties.</li>
            <li>Service accounts are granted to applications or software that needs to interact with other software on
                the network.</li>
            <li>Privileged accounts have elevated permissions or administrative access.</li>
        </ul>
        <p>It's best practice to determine a baseline access level for each account type before implementing least
            privilege. However, the appropriate access level can change from one moment to the next. For example, a
            customer support representative should only have access to your information while they are helping you. Your
            data should then become inaccessible when the support agent starts working with another customer and they
            are no longer actively assisting you. Least privilege can only reduce risk if user accounts are routinely
            and consistently monitored.</p>
        <h5>Auditing account privileges</h5>
        <p>Setting up the right user accounts and assigning them the appropriate privileges is a helpful first step.
            Periodically auditing those accounts is a key part of keeping your company’s systems secure.</p>
        <p>There are three common approaches to auditing user accounts:</p>
        <ul>
            <li>Usage audits</li>
            <li>Privilege audits</li>
            <li>Account change audits</li>
        </ul>
        <p>As a security professional, you might be involved with any of these processes.</p>
        <h6>Usage audits</h6>
        <p>When conducting a usage audit, the security team will review which resources each account is accessing and
            what the user is doing with the resource. Usage audits can help determine whether users are acting in
            accordance with an organization’s security policies. They can also help identify whether a user has
            permissions that can be revoked because they are no longer being used.</p>
        <h6>Privilege audits</h6>
        <p>Users tend to accumulate more access privileges than they need over time, an issue known as privilege creep.
            This might occur if an employee receives a promotion or switches teams and their job duties change.
            Privilege audits assess whether a user's role is in alignment with the resources they have access to.</p>
        <h6>Account change audits</h6>
        <p>Account directory services keep records and logs associated with each user. Changes to an account are usually
            saved and can be used to audit the directory for suspicious activity, like multiple attempts to change an
            account password. Performing account change audits helps to ensure that all account changes are made by
            authorized users.</p>
        <p>Note: Most directory services can be configured to alert system administrators of suspicious activity.</p>
        <h3>Key takeaways</h3>
        <p>The principle of least privilege is a security control that can reduce the risk of unauthorized access to
            sensitive information and resources. Setting up and configuring user accounts with the right levels of
            access and authorization is an important step toward implementing least privilege. Auditing user accounts
            and revoking unnecessary access rights is an important practice that helps to maintain the confidentiality,
            integrity, and availability of information.</p>
</section>

</article>
</section>

<section class="main-section" id="topic522">
    <h2>The data lifecycle </h2>
    <article class="main-article">
        <section>
            <h2>Data Lifecycle and Governance</h2>
            <p>Organizations of all sizes handle a large amount of data that must be kept private. You learned that data
                can be vulnerable whether it is at rest, in use, or in transit. Regardless of the state it is in,
                information should be kept private by limiting access and authorization.</p>
            <h3>The data lifecycle</h3>
            <p>The data lifecycle is an important model that security teams consider when protecting information. It
                influences how they set policies that align with business objectives. It also plays an important role in
                the technologies security teams use to make information accessible.</p>
            <p>In general, the data lifecycle has five stages. Each describe how data flows through an organization from
                the moment it is created until it is no longer useful:</p>
            <ul>
                <li>Collect</li>
                <li>Store</li>
                <li>Use</li>
                <li>Archive</li>
                <li>Destroy</li>
            </ul>

            <img src="resource/datacycle.png" id="img" alt="">
            <p>Protecting information at each stage of this process describes the need to keep it accessible and
                recoverable should something go wrong.</p>
            <h3>Data governance</h3>
            <p>Businesses handle massive amounts of data every day. New information is constantly being collected from
                internal and external sources. A structured approach to managing all of this data is the best way to
                keep it private and secure.</p>
            <p>Data governance is a set of processes that define how an organization manages information. Governance
                often includes policies that specify how to keep data private, accurate, available, and secure
                throughout its lifecycle.</p>
            <p>Effective data governance is a collaborative activity that relies on people. Data governance policies
                commonly categorize individuals into a specific role:</p>
            <ul>
                <li>Data owner: the person that decides who can access, edit, use, or destroy their information.</li>
                <li>Data custodian: anyone or anything that's responsible for the safe handling, transport, and storage
                    of information.</li>
                <li>Data steward: the person or group that maintains and implements data governance policies set by an
                    organization.</li>
            </ul>
            <p>Businesses store, move, and transform data using a wide range of IT systems. Data governance policies
                often assign accountability to data owners, custodians, and stewards.</p>
            <h3>Protecting data at every stage</h3>
            <p>Most security plans include a specific policy that outlines how information will be managed across an
                organization. This is known as a data governance policy. These documents clearly define procedures that
                should be followed to participate in keeping data safe. They place limits on who or what can access
                data. Security professionals are important participants in data governance. As a data custodian, you
                will be responsible for ensuring that data isn’t damaged, stolen, or misused.</p>
            <h3>Legally protected information</h3>
            <p>Data is more than just a bunch of 1s and 0s being processed by a computer. Data can represent someone's
                personal thoughts, actions, and choices. It can represent a purchase, a sensitive medical decision, and
                everything in between. For this reason, data owners should be the ones deciding whether or not to share
                their data. As a security professional, protecting a person's data privacy decisions must always be
                respected.</p>
            <p>Securing data can be challenging. In large part, that's because data owners generate more data than they
                can manage. As a result, data custodians and stewards sometimes lack direct, explicit instructions on
                how they should handle specific types of data. Governments and other regulatory agencies have bridged
                this gap by creating rules that specify the types of information that organizations must protect by
                default:</p>
            <ul>
                <li>PII is any information used to infer an individual's identity. Personally identifiable information,
                    or PII, refers to information that can be used to contact or locate someone.</li>
                <li>PHI stands for protected health information. In the U.S., it is regulated by the Health Insurance
                    Portability and Accountability Act (HIPAA), which defines PHI as “information that relates to the
                    past, present, or future physical or mental health or condition of an individual.” In the EU, PHI
                    has a similar definition but it is regulated by the General Data Protection Regulation (GDPR).</li>
                <li>SPII is a specific type of PII that falls under stricter handling guidelines. The S stands for
                    sensitive, meaning this is a type of personally identifiable information that should only be
                    accessed on a need-to-know basis, such as a bank account number or login credentials.</li>
            </ul>
            <p>Overall, it's important to protect all types of personal information from unauthorized use and
                disclosure.</p>
            <h3>Key takeaways</h3>
            <p>Keeping information private has never been so important. Many organizations have data governance policies
                that outline how they plan to protect sensitive information. As a data custodian, you will play a key
                role in keeping information accessible and safe throughout its lifecycle. There are various types of
                information and controls that you’ll encounter in the field. As you continue through this course, you’ll
                learn more about major security controls that keep data private.</p>
        </section>

    </article>
</section>

<section class="main-section" id="topic523">
    <h2> Information privacy: Regulations and compliance</h2>
    <article class="main-article">
        <section>
            <h2>Security, Privacy, and Regulations</h2>
            <p>Security and privacy have a close relationship. People have the right to control how their personal data
                is collected and used, while organizations have a responsibility to protect the information they collect
                from being compromised or misused. As a security professional, you will be highly involved in these
                efforts.</p>

            <img src="resource/privacy.png" alt="">
            <h3>Information security vs. information privacy</h3>
            <p>Security and privacy are two terms that often get used interchangeably outside of this field. Although
                the two concepts are connected, they represent specific functions:</p>
            <ul>
                <li>Information privacy refers to the protection of unauthorized access and distribution of data.</li>
                <li>Information security (InfoSec) refers to the practice of keeping data in all states away from
                    unauthorized users.</li>
            </ul>
            <p>The key difference: Privacy is about providing people with control over their personal information and
                how it's shared. Security is about protecting people’s choices and keeping their information safe from
                potential threats.</p>
            <p>For example, a retail company might want to collect specific kinds of personal information about its
                customers for marketing purposes, like their age, gender, and location. How this private information
                will be used should be disclosed to customers before it's collected. In addition, customers should be
                given an option to opt-out if they decide not to share their data.</p>
            <p>Once the company obtains consent to collect personal information, it might implement specific security
                controls in place to protect that private data from unauthorized access, use, or disclosure. The company
                should also have security controls in place to respect the privacy of all stakeholders and anyone who
                chose to opt-out.</p>
            <h3>Why privacy matters in security</h3>
            <p>Data privacy and protection are topics that started gaining a lot of attention in the late 1990s. At that
                time, tech companies suddenly went from processing people’s data to storing and using it for business
                purposes. Eventually, this led to a global conversation about whether organizations had the right to
                collect and share someone’s private data. Additionally, the issue of data security became a greater
                concern; the more organizations collected data, the more vulnerable it was to being abused, misused, or
                stolen.</p>
            <p>Many organizations became more concerned about the issues of data privacy. Businesses became more
                transparent about how they were collecting, storing, and using information. They also began implementing
                more security measures to protect people's data privacy. However, without clear rules in place,
                protections were inconsistently applied.</p>
            <h3>Notable privacy regulations</h3>
            <p>Businesses are required to abide by certain laws to operate. Three of the most influential industry
                regulations that every security professional should know about are:</p>
            <ul>
                <li>General Data Protection Regulation (GDPR)</li>
                <li>Payment Card Industry Data Security Standard (PCI DSS)</li>
                <li>Health Insurance Portability and Accountability Act (HIPAA)</li>
            </ul>
            <p>Several other security and privacy compliance laws exist. Which ones your organization needs to follow
                will depend on the industry and the area of authority. Regardless of the circumstances, regulatory
                compliance is important to every business.</p>
            <h3>Security assessments and audits</h3>
            <p>Businesses should comply with important regulations in their industry. Doing so validates that they have
                met a minimum level of security while also demonstrating their dedication to maintaining data privacy.
            </p>
            <p>Meeting compliance standards is usually a continual, two-part process of security audits and assessments:
            </p>
            <ul>
                <li>A security audit is a review of an organization's security controls, policies, and procedures
                    against a set of expectations.</li>
                <li>A security assessment is a check to determine how resilient current security implementations are
                    against threats.</li>
            </ul>
            <p>As a security analyst, you are likely to be involved with security audits and assessments in the field.
                Businesses usually perform security audits less frequently, approximately once per year. Security audits
                may be performed both internally and externally by different third-party groups.</p>
            <p>In contrast, security assessments are usually performed more frequently, about every three-to-six months.
                Security assessments are typically performed by internal employees, often as preparation for a security
                audit. Both evaluations are incredibly important ways to ensure that your systems are effectively
                protecting everyone's privacy.</p>
            <h3>Key takeaways</h3>
            <p>A growing number of businesses are making it a priority to protect and govern the use of sensitive data
                to maintain customer trust. Security professionals should think about data and the need for privacy in
                these terms. Organizations commonly use security assessments and audits to evaluate gaps in their
                security plans. While it is possible to overlook or delay addressing the results of an assessment, doing
                so can have serious business consequences, such as fines or data breaches.</p>
        </section>

    </article>
</section>

<section class="main-section" id="topic524">
    <h2>Symmetric and asymmetric encryption </h2>
    <article class="main-article">
        <section>
            <h2>Encryption Basics</h2>
            <p>All digital information deserves to be kept private, safe, and secure. Encryption is one key to doing
                that! It is useful for transforming information into a form that unintended recipients cannot
                understand. In this reading, you’ll compare symmetric and asymmetric encryption and learn about some
                well-known algorithms for each.</p>
            <h3>Types of encryption</h3>
            <p>There are two main types of encryption:</p>
            <ul>
                <li><strong>Symmetric encryption:</strong> Uses a single secret key to exchange information. Both the
                    sender and receiver must know the secret key for encryption and decryption.</li>
                <li><strong>Asymmetric encryption:</strong> Uses a public and private key pair for encryption and
                    decryption. The public key encrypts data, and the private key decrypts it.</li>
            </ul>
            <h3>The importance of key length</h3>
            <p>Ciphers are vulnerable to brute force attacks, which use a trial and error process to discover private
                information. Longer key lengths are considered more secure but may result in slower processing times.
            </p>
            <h3>Approved algorithms</h3>
            <p>Many web applications use a combination of symmetric and asymmetric encryption. Some well-known
                algorithms include:</p>
            <h4>Symmetric algorithms</h4>
            <ul>
                <li><strong>Triple DES (3DES):</strong> Uses 192-bit keys and is known for its backward compatibility.
                </li>
                <li><strong>Advanced Encryption Standard (AES):</strong> Generates keys of 128, 192, or 256 bits and is
                    highly secure.</li>
            </ul>
            <h4>Asymmetric algorithms</h4>
            <ul>
                <li><strong>Rivest Shamir Adleman (RSA):</strong> Generates public and private key pairs with key sizes
                    of 1,024, 2,048, or 4,096 bits.</li>
                <li><strong>Digital Signature Algorithm (DSA):</strong> Generates key lengths of 2,048 bits and is
                    widely used in public key infrastructure.</li>
            </ul>
            <h3>Generating keys</h3>
            <p>Algorithms like RSA and DSA require the generation of public and private key pairs. OpenSSL is a commonly
                used tool for this purpose, but there are other options available.</p>
            <h3>Obscurity is not security</h3>
            <p>A cryptographic system should not be considered secure if it relies solely on keeping its algorithm
                secret. Kerchoff’s principle emphasizes that the security of a system should not depend on its secrecy.
            </p>
            <h3>Encryption is everywhere</h3>
            <p>Both symmetric and asymmetric encryption are widely used by companies to protect data online. Compliance
                regulations like FIPS 140-3 and GDPR outline requirements for data handling and encryption.</p>
            <h3>Key takeaways</h3>
            <p>Understanding the basics of encryption is crucial for security professionals. Symmetric and asymmetric
                encryption serve different purposes but are both essential for protecting data online and meeting
                compliance regulations.</p>
        </section>

    </article>
</section>

<section class="main-section" id="topic525">
    <h2>The evolution of hash functions </h2>
    <article class="main-article">
        <section>
            <h2>Hash Functions and Their Importance</h2>
            <p>Hash functions are important controls that are part of every company's security strategy. They are widely
                used for authentication and non-repudiation, ensuring the authenticity of information.</p>

            <img src="resource/hash1.png" id="img" alt="">
            <h3>Origins of Hashing</h3>
            <p>Hash functions have been around since the early days of computing and were originally created as a way to
                quickly search for data. One of the earliest hash functions is MD5, developed by Professor Ronald Rivest
                of MIT in the early 1990s.</p>
            <p>Whether it’s used to convert a single email or the source code of an application, MD5 works by converting
                data into a 128-bit value. You might recall that a bit is the smallest unit of data measurement on a
                computer. Bits can either be a 0 or 1. In a computer, bits represent user input in a way that computers
                can interpret. In a hash table, this appears as a string of 32 characters. Altering anything in the
                source file generates an entirely new hash value. <br><br>

                Generally, the longer the hash value, the more secure it is. It wasn’t long after MD5's creation that
                security practitioners discovered 128-bit digests resulted in a major vulnerability. <br>

                Here is an example of how plaintext gets turned into hash values</p>
            <img src="resource/hash2.png" id="img" alt="">
            <h3>Hash Collisions</h3>
            <p>Hash functions map any input into a fixed-size value, which can lead to hash collisions, where different
                inputs produce the same hash value. This vulnerability can be exploited by attackers to impersonate
                authentic data.</p>
            <h3>Next-generation Hashing</h3>
            <p>To address the risk of hash collisions, Secure Hashing Algorithms (SHAs) were developed. These
                algorithms, approved by NIST, generate longer hash values and include SHA-1, SHA-224, SHA-256, SHA-384,
                and SHA-512.</p>
            <h3>Secure Password Storage</h3>
            <p>Hashing is commonly used to securely store passwords in databases. Adding a salt, a random string of
                characters, further strengthens hash functions by making each hash value unique even for identical
                passwords.</p>
            <h3>Rainbow Tables</h3>
            <p>Rainbow tables are files containing pre-generated hash values and their associated plaintext, used by
                attackers to crack hashed passwords. Salting helps mitigate this risk by creating unique hash values for
                identical passwords.</p>
            <h3>Adding Some “Salt”</h3>
            <p>Salting, the addition of a random string of characters to data before hashing, enhances security by
                making hash values more unique and resilient to rainbow table attacks.</p>
            <h3>Key Takeaways</h3>
            <p>Hash functions are vital for validating data integrity and reducing the risk of data breaches. However,
                not all hash functions provide the same level of protection, and it's important to be aware of
                alternatives like salting to enhance security.</p>
        </section>

    </article>
</section>

<section class="main-section" id="topic526">
    <h2> The rise of SSO and MFA </h2>
    <article class="main-article">
        <section>
            <h2>Single Sign-On (SSO) and Multi-Factor Authentication (MFA)</h2>
            <p>Most companies utilize authentication systems to keep their data securely locked up. Usernames and
                passwords serve as keys to unlock information, but are they enough? Information security focuses on
                managing user access and authorization, leading to the adoption of technologies like Single Sign-On
                (SSO) and Multi-Factor Authentication (MFA).</p>
            <h3>A Better Approach to Authentication</h3>
            <p>SSO combines multiple logins into one, improving the user experience, lowering costs, and enhancing
                overall security by reducing access points. It addresses password fatigue, where users tend to reuse
                passwords across services, by shifting the authentication burden away from users.</p>
            <h4>How SSO Works</h4>
            <p>SSO automates trust establishment between a user and a service provider through encrypted access token
                exchange, facilitated by trusted third-parties. It commonly relies on LDAP and SAML protocols, used
                together for on-premises and off-premises transmission respectively.</p>

            <img src="resource/sso1.png" id="img" alt="">
            <h4>Limitations of SSO</h4>
            <p>While SSO offers benefits, it has limitations, such as the risk associated with using a single form of
                authentication, like a lost or stolen password compromising access to multiple services.</p>
            <h3>MFA to the Rescue</h3>
            <p>MFA requires users to verify their identity using two or more factors, such as something they know
                (password), something they have (one-time passcode), and something they are (biometrics). This
                strengthens authentication beyond passwords alone.</p>

            <img src="resource/sso2.png" id="img" alt="">
            <h4>Strengthening Authentication</h4>
            <p>MFA builds on the benefits of SSO by requiring multiple forms of identification, making it difficult for
                threat actors to access systems. It reduces the risk of authenticating the wrong users, especially in
                cloud environments.</p>
            <h3>Key Takeaways</h3>
            <p>Implementing both SSO and MFA enhances security without sacrificing user experience. Relying solely on
                passwords is a vulnerability, but combining SSO and MFA can effectively protect information while
                providing a streamlined user experience.</p>
        </section>

    </article>
</section>

<section class="main-section" id="topic527">
    <h2> Identity and access management</h2>
    <article class="main-article">

        <section>
            <h2>Security Principles and IAM</h2>
            <p>Security is more than simply combining processes and technologies to protect assets. Instead, security is
                about ensuring that these processes and technologies are creating a secure environment that supports a
                defense strategy. A key to doing this is implementing two fundamental security principles that limit
                access to organizational resources:</p>
            <ul>
                <li>The principle of least privilege in which a user is only granted the minimum level of access and
                    authorization required to complete a task or function.</li>
                <li>Separation of duties, which is the principle that users should not be given levels of authorization
                    that would allow them to misuse a system.</li>
            </ul>
            <p>Both principles typically support each other. For example, according to least privilege, a person who
                needs permission to approve purchases from the IT department shouldn't have the permission to approve
                purchases from every department. Likewise, according to separation of duties, the person who can approve
                purchases from the IT department should be different from the person who can input new purchases.</p>
            <p>In other words, least privilege limits the access that an individual receives, while separation of duties
                divides responsibilities among multiple people to prevent any one person from having too much control.
            </p>
            <p>Note: Separation of duties is sometimes referred to as segregation of duties.</p>
            <h3>Identity and access management (IAM)</h3>
            <p>As organizations become more reliant on technology, regulatory agencies have put more pressure on them to
                demonstrate that they’re doing everything they can to prevent threats. Identity and access management
                (IAM) is a collection of processes and technologies that helps organizations manage digital identities
                in their environment. Both AAA and IAM systems are designed to authenticate users, determine their
                access privileges, and track their activities within a system.</p>
            <p>Either model used by your organization is more than a single, clearly defined system. They each consist
                of a collection of security controls that ensure the right user is granted access to the right resources
                at the right time and for the right reasons. Each of those four factors is determined by your
                organization's policies and processes.</p>
            <p>Note: A user can either be a person, a device, or software.</p>
            <h4>Authenticating users</h4>
            <p>To ensure the right user is attempting to access a resource requires some form of proof that the user is
                who they claim to be. In a video on authentication controls, you learned that there are a few factors
                that can be used to authenticate a user:</p>
            <ul>
                <li>Knowledge, or something the user knows</li>
                <li>Ownership, or something the user possesses</li>
                <li>Characteristic, or something the user is</li>
            </ul>
            <p>Authentication is mainly verified with login credentials. Single sign-on (SSO), a technology that
                combines several different logins into one, and multi-factor authentication (MFA), a security measure
                that requires a user to verify their identity in two or more ways to access a system or network, are
                other tools that organizations use to authenticate individuals and systems.</p>
            <p>Pro tip: Another way to remember this authentication model is: something you know, something you have,
                and something you are.</p>
            <h4>User provisioning</h4>
            <p>Back-end systems need to be able to verify whether the information provided by a user is accurate. To
                accomplish this, users must be properly provisioned. User provisioning is the process of creating and
                maintaining a user's digital identity. For example, a college might create a new user account when a new
                instructor is hired. The new account will be configured to provide access to instructor-only resources
                while they are teaching. Security analysts are routinely involved with provisioning users and their
                access privileges.</p>
            <p>Pro tip: Another role analysts have in IAM is to deprovision users. This is an important practice that
                removes a user's access rights when they should no longer have them.</p>
            <h4>Granting authorization</h4>
            <p>If the right user has been authenticated, the network should ensure the right resources are made
                available. There are three common frameworks that organizations use to handle this step of IAM:</p>
            <ul>
                <li>Mandatory access control (MAC)</li>
                <li>Discretionary access control (DAC)</li>
                <li>Role-based access control (RBAC)</li>
            </ul>

            <img src="resource/iam1.png" id="img" alt="">
            <p>Mandatory Access Control (MAC) is the strictest of the three frameworks. Authorization in this model is
                based on a strict need-to-know basis. Access to information must be granted manually by a central
                authority or system administrator. For example, MAC is commonly applied in law enforcement, military,
                and other government agencies where users must request access through a chain of command. MAC is also
                known as non-discretionary control because access isn’t given at the discretion of the data owner.</p>
            <img src="resource/iam2.png" alt="">
            <p>Discretionary Access Control (DAC) is typically applied when a data owner decides appropriate levels of
                access. One example of DAC is when the owner of a Google Drive folder shares editor, viewer, or
                commentor access with someone else.</p>
            <img src="resource/iam3.png" alt="">
            <p>Role-Based Access Control (RBAC) is used when authorization is determined by a user's role within an
                organization. For example, a user in the marketing department may have access to user analytics but not
                network administration.</p>
            <h4>Access control technologies</h4>
            <p>Users often experience authentication and authorization as a single, seamless experience. In large part,
                that’s due to access control technologies that are configured to work together. These tools offer the
                speed and automation needed by administrators to monitor and modify access rights. They also decrease
                errors and potential risks.</p>
            <p>An organization's IT department sometimes develops and maintains customized access control technologies
                on their own. A typical IAM or AAA system consists of a user directory, a set of tools for managing data
                in that directory, an authorization system, and an auditing system. Some organizations create custom
                systems to tailor them to their security needs. However, building an in-house solution comes at a steep
                cost of time and other resources.</p>
            <p>Instead, many organizations opt to license third-party solutions that offer a suite of tools that enable
                them to quickly secure their information systems. Keep in mind, security is about more than combining a
                bunch of tools. It’s always important to configure these technologies so they can help to provide a
                secure environment.</p>
            <h3>Key takeaways</h3>
            <p>Controlling access requires a collection of systems and tools. IAM and AAA are common frameworks for
                implementing least privilege and separation of duties. As a security analyst, you might be responsible
                for user provisioning and collaborating with other IAM or AAA teams. Having familiarity with these
                models is valuable for helping organizations achieve their security objectives. They each ensure that
                the right user is granted access to the right resources at the right time and for the right reasons.</p>
        </section>


    </article>
</section>

<section class="main-section" id="topic528">
    <h2> Glossary terms from module 2 </h2>
    <article class="main-article">
        <h2>Terms and Definitions from Course 5, Module 2</h2>
        <dl>
            <dt>Access controls:</dt>
            <dd>Security controls that manage access, authorization, and accountability of information</dd>

            <dt>Algorithm:</dt>
            <dd>A set of rules used to solve a problem</dd>

            <dt>Application programming interface (API) token:</dt>
            <dd>A small block of encrypted code that contains information about a user</dd>

            <dt>Asymmetric encryption:</dt>
            <dd>The use of a public and private key pair for encryption and decryption of data</dd>

            <dt>Basic auth:</dt>
            <dd>The technology used to establish a user’s request to access a server</dd>

            <dt>Bit:</dt>
            <dd>The smallest unit of data measurement on a computer</dd>

            <dt>Brute force attack:</dt>
            <dd>The trial and error process of discovering private information</dd>

            <dt>Cipher:</dt>
            <dd>An algorithm that encrypts information</dd>

            <dt>Cryptographic key:</dt>
            <dd>A mechanism that decrypts ciphertext</dd>

            <dt>Cryptography:</dt>
            <dd>The process of transforming information into a form that unintended readers can’t understand</dd>

            <dt>Data custodian:</dt>
            <dd>Anyone or anything that’s responsible for the safe handling, transport, and storage of information</dd>

            <dt>Data owner:</dt>
            <dd>The person that decides who can access, edit, use, or destroy their information</dd>

            <dt>Digital certificate:</dt>
            <dd>A file that verifies the identity of a public key holder</dd>

            <dt>Encryption:</dt>
            <dd>The process of converting data from a readable format to an encoded format</dd>

            <dt>Hash collision:</dt>
            <dd>An instance when different inputs produce the same hash value</dd>

            <dt>Hash function:</dt>
            <dd>An algorithm that produces a code that can’t be decrypted</dd>

            <dt>Hash table:</dt>
            <dd>A data structure that's used to store and reference hash values</dd>

            <dt>Identity and access management (IAM):</dt>
            <dd>A collection of processes and technologies that helps organizations manage digital identities in their
                environment</dd>

            <dt>Information privacy:</dt>
            <dd>The protection of unauthorized access and distribution of data</dd>

            <dt>Multi-factor authentication (MFA):</dt>
            <dd>A security measure that requires a user to verify their identity in two or more ways to access a system
                or network</dd>

            <dt>Non-repudiation:</dt>
            <dd>The concept that the authenticity of information can’t be denied</dd>

            <dt>OAuth:</dt>
            <dd>An open-standard authorization protocol that shares designated access between applications</dd>

            <dt>Payment Card Industry Data Security Standards (PCI DSS):</dt>
            <dd>A set of security standards formed by major organizations in the financial industry</dd>

            <dt>Personally identifiable information (PII):</dt>
            <dd>Any information used to infer an individual's identity</dd>

            <dt>Principle of least privilege:</dt>
            <dd>The concept of granting only the minimal access and authorization required to complete a task or
                function</dd>

            <dt>Protected health information (PHI):</dt>
            <dd>Information that relates to the past, present, or future physical or mental health or condition of an
                individual</dd>

            <dt>Public key infrastructure (PKI):</dt>
            <dd>An encryption framework that secures the exchange of online information</dd>

            <dt>Rainbow table:</dt>
            <dd>A file of pre-generated hash values and their associated plaintext</dd>

            <dt>Salting:</dt>
            <dd>An additional safeguard that’s used to strengthen hash functions</dd>

            <dt>Security assessment:</dt>
            <dd>A check to determine how resilient current security implementations are against threats</dd>

            <dt>Security audit:</dt>
            <dd>A review of an organization's security controls, policies, and procedures against a set of expectations
            </dd>

            <dt>Security controls:</dt>
            <dd>Safeguards designed to reduce specific security risks</dd>

            <dt>Separation of duties:</dt>
            <dd>The principle that users should not be given levels of authorization that would allow them to misuse a
                system</dd>

            <dt>Session:</dt>
            <dd>A sequence of network HTTP basic auth requests and responses associated with the same user</dd>

            <dt>Session cookie:</dt>
            <dd>A token that websites use to validate a session and determine how long that session should last</dd>

            <dt>Session hijacking:</dt>
            <dd>An event when attackers obtain a legitimate user’s session ID</dd>

            <dt>Session ID:</dt>
            <dd>A unique token that identifies a user and their device while accessing a system</dd>

            <dt>Single Sign-On (SSO):</dt>
            <dd>A technology that combines several different logins into one</dd>

            <dt>Symmetric encryption:</dt>
            <dd>The use of a single secret key to exchange information</dd>

            <dt>User provisioning:</dt>
            <dd>The process of creating and maintaining a user's digital identity</dd>
        </dl>

    </article>
</section>


<section class="main-section" id="Module 53">
    <h2>Module 3</h2>
</section>
<br> <br>


<section class="main-section" id="topic531">
    <h2> The OWASP Top 10</h2>
    <article class="main-article">
        <h2>Understanding OWASP Top 10</h2>
        <p>To prepare for future risks, security professionals need to stay informed. Previously, you learned about the
            CVE® list, an openly accessible dictionary of known vulnerabilities and exposures. The CVE® list is an
            important source of information that the global security community uses to share information with each
            other.</p>

        <p>In this reading, you’ll learn about another important resource that security professionals reference, the
            Open Web Application Security Project, recently renamed Open Worldwide Application Security Project®
            (OWASP). You’ll learn about OWASP’s role in the global security community and how companies use this
            resource to focus their efforts.</p>

        <h3>What is OWASP?</h3>
        <p>OWASP is a nonprofit foundation that works to improve the security of software. OWASP is an open platform
            that security professionals from around the world use to share information, tools, and events that are
            focused on securing the web.</p>

        <h3>The OWASP Top 10</h3>
        <p>One of OWASP’s most valuable resources is the OWASP Top 10. The organization has published this list since
            2003 as a way to spread awareness of the web’s most targeted vulnerabilities. The Top 10 mainly applies to
            new or custom made software. Many of the world's largest organizations reference the OWASP Top 10 during
            application development to help ensure their programs address common security mistakes.</p>
        <p><strong>Pro tip:</strong> OWASP’s Top 10 is updated every few years as technologies evolve. Rankings are
            based on how often the vulnerabilities are discovered and the level of risk they present.</p>
        <p><strong>Note:</strong> Auditors also use the OWASP Top 10 as one point of reference when checking for
            regulatory compliance.</p>

        <h3>Common Vulnerabilities</h3>
        <p>Businesses often make critical security decisions based on the vulnerabilities listed in the OWASP Top 10.
            This resource influences how businesses design new software that will be on their network, unlike the CVE®
            list, which helps them identify improvements to existing programs. These are the most regularly listed
            vulnerabilities that appear in their rankings to know about:</p>

        <ol>
            <li>Broken access control : <p>Access controls limit what users can do in a web application. For example, a
                    blog might allow visitors to post comments on a recent article but restricts them from deleting the
                    article entirely. Failures in these mechanisms can lead to unauthorized information disclosure,
                    modification, or destruction. They can also give someone unauthorized access to other business
                    applications.</p>
            </li>
            <li>Cryptographic failures: <p>Information is one of the most important assets businesses need to protect.
                    Privacy laws such as General Data Protection Regulation (GDPR) require sensitive data to be
                    protected by effective encryption methods. Vulnerabilities can occur when businesses fail to encrypt
                    things like personally identifiable information (PII). For example, if a web application uses a weak
                    hashing algorithm, like MD5, it’s more at risk of suffering a data breach.</p>
            </li>
            <li>Injection: <p>Injection occurs when malicious code is inserted into a vulnerable application. Although
                    the app appears to work normally, it does things that it wasn’t intended to do. Injection attacks
                    can give threat actors a backdoor into an organization’s information system. A common target is a
                    website’s login form. When these forms are vulnerable to injection, attackers can insert malicious
                    code that gives them access to modify or steal user credentials. </p>
            </li>
            <li>Insecure design: <p>Applications should be designed in such a way that makes them resilient to attack.
                    When they aren’t, they’re much more vulnerable to threats like injection attacks or malware
                    infections. Insecure design refers to a wide range of missing or poorly implemented security
                    controls that should have been programmed into an application when it was being developed.</p>
            </li>
            <li>Security misconfiguration: <p>Misconfigurations occur when security settings aren’t properly set or
                    maintained. Companies use a variety of different interconnected systems. Mistakes often happen when
                    those systems aren’t properly set up or audited. A common example is when businesses deploy
                    equipment, like a network server, using default settings. This can lead businesses to use settings
                    that fail to address the organization's security objectives.</p>
            </li>
            <li>Vulnerable and outdated components: <p>Vulnerable and outdated components is a category that mainly
                    relates to application development. Instead of coding everything from scratch, most developers use
                    open-source libraries to complete their projects faster and easier. This publicly available software
                    is maintained by communities of programmers on a volunteer basis. Applications that use vulnerable
                    components that have not been maintained are at greater risk of being exploited by threat actors.
                </p>
            </li>
            <li>Identification and authentication failures: <p>Identification is the keyword in this vulnerability
                    category. When applications fail to recognize who should have access and what they’re authorized to
                    do, it can lead to serious problems. For example, a home Wi-Fi router normally uses a simple login
                    form to keep unwanted guests off the network. If this defense fails, an attacker can invade the
                    homeowner’s privacy.</p>
            </li>
            <li>Software and data integrity failures: <p>Software and data integrity failures are instances when updates
                    or patches are inadequately reviewed before implementation. Attackers might exploit these weaknesses
                    to deliver malicious software. When that occurs, there can be serious downstream effects. Third
                    parties are likely to become infected if a single system is compromised, an event known as a supply
                    chain attack. <br>

                    A famous example of a supply chain attack is the SolarWinds cyber attack (2020)
                    <br>
                    where hackers injected malicious code into software updates that the company unknowingly released to
                    their customers. <br>
                </p>
            </li>
            <li>Security logging and monitoring failures: <p>In security, it’s important to be able to log and trace
                    back events. Having a record of events like user login attempts is critical to finding and fixing
                    problems. Sufficient monitoring and incident response is equally important.</p>
            </li>
            <li>Server-side request forgery: <p>Companies have public and private information stored on web servers.
                    When you use a hyperlink or click a button on a website, a request is sent to a server that should
                    validate who you are, fetch the appropriate data, and then return it to you.
                    A hacker using their victim's computer to steal data from a web server.</p>
            </li>
        </ol>


        <img src="resource/owasp1.png" alt="">

        <h3>Key Takeaways</h3>
        <p>Staying informed and maintaining awareness about the latest cybersecurity trends can be a useful way to help
            defend against attacks and prepare for future risks in your security career. OWASP’s Top 10 is a useful
            resource where you can learn more about these vulnerabilities.</p>

    </article>
</section>

<section class="main-section" id="topic532">
    <h2> Open source intelligence</h2>
    <article class="main-article">

        <body>
            <h2>Understanding Open-Source Intelligence (OSINT)</h2>
            <p>Cyber attacks can sometimes be prevented with the right information, which starts with knowing where your
                systems are vulnerable. Previously, you learned that the CVE® list and scanning tools are two useful
                ways of finding weaknesses. But, there are other ways to identify vulnerabilities and threats.</p>

            <p>In this reading, you’ll learn about open-source intelligence, commonly known as OSINT. OSINT is the
                collection and analysis of information from publicly available sources to generate usable intelligence.
                It's commonly used to support cybersecurity activities, like identifying potential threats and
                vulnerabilities. You'll learn why open-source intelligence is gathered and how it can improve
                cybersecurity. You’ll also learn about commonly used resources and tools for gathering information and
                intelligence.</p>

            <h3>Information vs Intelligence</h3>
            <p>The terms intelligence and information are often used interchangeably, making it easy to mix them up.
                Both are important aspects of cybersecurity that differ in their focus and objectives.</p>

            <p>Information refers to the collection of raw data or facts about a specific subject. Intelligence, on the
                other hand, refers to the analysis of information to produce knowledge or insights that can be used to
                support decision-making.</p>

            <p>For example, new information might be released about an update to the operating system (OS) that's
                installed on your organization's workstations. Later, you might find that new cyber threats have been
                linked to this new update by researching multiple cybersecurity news resources. The analysis of this
                information can be used as intelligence to guide your organization's decision about installing the OS
                updates on employee workstations.</p>

            <p>In other words, intelligence is derived from information through the process of analysis, interpretation,
                and integration. Gathering information and intelligence are both important aspects of cybersecurity.</p>

            <h3>Intelligence Improves Decision-Making</h3>
            <p>Businesses often use information to gain insights into the behavior of their customers. Insights, or
                intelligence, can then be used to improve their decision making. In security, open-source information is
                used in a similar way to gain insights into threats and vulnerabilities that can pose risks to an
                organization.</p>

            <p>OSINT plays a significant role in information security (InfoSec), which is the practice of keeping data
                in all states away from unauthorized users.</p>

            <p>For example, a company's InfoSec team is responsible for protecting their network from potential threats.
                They might utilize OSINT to monitor online forums and hacker communities for discussions about emerging
                vulnerabilities. If they come across a forum post discussing a newly discovered weakness in a popular
                software that the company uses, the team can quickly assess the risk, prioritize patching efforts, and
                implement necessary safeguards to prevent an attack.</p>

            <p>Here are some of the ways OSINT can be used to generate intelligence:</p>

            <ul>
                <li>To provide insights into cyber attacks</li>
                <li>To detect potential data exposures</li>
                <li>To evaluate existing defenses</li>
                <li>To identify unknown vulnerabilities</li>
            </ul>

            <p>Collecting intelligence is sometimes part of the vulnerability management process. Security teams might
                use OSINT to develop profiles of potential targets and make data driven decisions on improving their
                defenses.</p>

            <h3>OSINT Tools</h3>
            <p>There's an enormous amount of open-source information online. Finding relevant information that can be
                used to gather intelligence is a challenge. Information can be gathered from a variety of sources, such
                as search engines, social media, discussion boards, blogs, and more. Several tools also exist that can
                be used in your intelligence gathering process. Here are just a few examples of tools that you can
                explore:</p>

            <ul>
                <li><a href="https://www.virustotal.com/">VirusTotal</a> is a service that allows anyone to analyze
                    suspicious files, domains, URLs, and IP addresses for malicious content.</li>
                <li><a href="https://attack.mitre.org/">MITRE ATT&CK®</a> is a knowledge base of adversary tactics and
                    techniques based on real-world observations.</li>
                <li><a href="https://osintframework.com/">OSINT Framework</a> is a web-based interface where you can
                    find OSINT tools for almost any kind of source or platform.</li>
                <li><a href="https://haveibeenpwned.com/">Have I been Pwned</a> is a tool that can be used to search for
                    breached email accounts.</li>
            </ul>

            <p>There are numerous other OSINT tools that can be used to find specific types of information. Remember,
                information can be gathered from a variety of sources. Ultimately, it's your responsibility to
                thoroughly research any available information that's relevant to the problem you’re trying to solve.</p>

            <h3>Key Takeaways</h3>
            <p>Gathering information and intelligence are important aspects of cybersecurity. OSINT is used to make
                evidence-based decisions that can be used to prevent attacks. There’s so much information available,
                which is why it's important for security professionals to be skilled with searching for information.
                Having familiarity with popular OSINT tools and resources will make your research easier when gathering
                information and collecting intelligence.</p>

    </article>
</section>

<section class="main-section" id="topic533">
    <h2>Approaches to vulnerability scanning </h2>
    <article class="main-article">
        <h2>Understanding Vulnerability Scanners</h2>
        <p>Cyber attacks can sometimes be prevented with the right information, which starts with knowing where your
            systems are vulnerable. Previously, you learned about a vulnerability assessment, which is the internal
            review process of an organization's security systems. An organization performs vulnerability assessments to
            identify weaknesses and prevent attacks. Vulnerability scanning tools are commonly used to simulate threats
            by finding vulnerabilities in an attack surface. They also help security teams take proactive steps towards
            implementing their remediation strategy.</p>

        <h3>What is a Vulnerability Scanner?</h3>
        <p>A vulnerability scanner is software that automatically compares known vulnerabilities and exposures against
            the technologies on the network. In general, these tools scan systems to find misconfigurations or
            programming flaws.</p>

        <p>Scanning tools are used to analyze each of the five attack surfaces that you learned about in the video about
            the defense in depth strategy:</p>

        <ul>
            <li>Perimeter layer, like authentication systems that validate user access</li>
            <li>Network layer, which is made up of technologies like network firewalls and others</li>
            <li>Endpoint layer, which describes devices on a network, like laptops, desktops, or servers</li>
            <li>Application layer, which involves the software that users interact with</li>
            <li>Data layer, which includes any information that’s stored, in transit, or in use</li>
        </ul>

        <p>When a scan of any layer begins, the scanning tool compares the findings against databases of security
            threats. At the end of the scan, the tool flags any vulnerabilities that it finds and adds them to its
            reference database. Each scan adds more information to the database, helping the tool be more accurate in
            its analysis.</p>

        <p><strong>Note:</strong> Vulnerability databases are also routinely updated by the company that designed the
            scanning software.</p>

        <h3>Performing Scans</h3>
        <p>Vulnerability scanners are meant to be non-intrusive. Meaning, they don’t break or take advantage of a system
            like an attacker would. Instead, they simply scan a surface and alert you to any potentially unlocked doors
            in your systems.</p>

        <p><strong>Note:</strong> While vulnerability scanners are non-intrusive, there are instances when a scan can
            inadvertently cause issues, like crash a system.</p>

        <p>There are a few different ways that these tools are used to scan a surface. Each approach corresponds to the
            pathway a threat actor might take. Next, you can explore each type of scan to get a clearer picture of this.
        </p>

        <h4>External vs. Internal</h4>
        <p>External and internal scans simulate an attacker's approach.</p>

        <p><strong>External scans</strong> test the perimeter layer outside of the internal network. They analyze
            outward facing systems, like websites and firewalls. These kinds of scans can uncover vulnerable things like
            vulnerable network ports or servers.</p>

        <p><strong>Internal scans</strong> start from the opposite end by examining an organization's internal systems.
            For example, this type of scan might analyze application software for weaknesses in how it handles user
            input.</p>

        <h4>Authenticated vs. Unauthenticated</h4>
        <p>Authenticated and unauthenticated scans simulate whether or not a user has access to a system.</p>

        <p><strong>Authenticated scans</strong> might test a system by logging in with a real user account or even with
            an admin account. These service accounts are used to check for vulnerabilities, like broken access controls.
        </p>

        <p><strong>Unauthenticated scans</strong> simulate external threat actors that do not have access to your
            business resources. For example, a scan might analyze file shares within the organization that are used to
            house internal-only documents. Unauthenticated users should receive "access denied" results if they tried
            opening these files. However, a vulnerability would be identified if you were able to access a file.</p>

        <h4>Limited vs. Comprehensive</h4>
        <p>Limited and comprehensive scans focus on particular devices that are accessed by internal and external users.
        </p>

        <p><strong>Limited scans</strong> analyze particular devices on a network, like searching for misconfigurations
            on a firewall.</p>

        <p><strong>Comprehensive scans</strong> analyze all devices connected to a network. This includes operating
            systems, user databases, and more.</p>

        <p><strong>Pro tip:</strong> Discovery scanning should be done prior to limited or comprehensive scans.
            Discovery scanning is used to get an idea of the computers, devices, and open ports that are on a network.
        </p>

        <h3>Key Takeaways</h3>
        <p>Finding vulnerabilities requires thinking of all possibilities. Vulnerability scans vary depending on the
            surfaces that an organization is evaluating. Usually, seasoned security professionals lead the effort of
            configuring and performing these types of scans to create a profile of a company’s security posture.
            However, analysts also play an important role in the process. The results of a vulnerability scan often lead
            to renewed compliance efforts, procedural changes, and system patching. Understanding the objectives of
            common types of vulnerability scans will help you participate in these proactive security exercises whenever
            possible.</p>

        <p><strong>Tip:</strong> To explore vulnerability scanner software commonly used in the cybersecurity industry,
            in your preferred browser enter search terms similar to “popular vulnerability scanner software” and/or
            “open source vulnerability scanner software used in cybersecurity”.</p>

    </article>
</section>

<section class="main-section" id="topic534">
    <h2> The importance of updates

    </h2>
    <article class="main-article">
        <h2>The Importance of Software Updates in Cybersecurity</h2>
        <p>At some point in time, you may have wondered, “Why do my devices constantly need updating?” For consumers,
            updates provide improvements to performance, stability, and even new features! But from a security
            standpoint, they serve a specific purpose. Updates allow organizations to address security vulnerabilities
            that can place their users, devices, and networks at risk.</p>

        <p>In a video, you learned that updates fit into every security team’s remediation strategy. They usually take
            place after a vulnerability assessment, which is the internal review process of an organization's security
            systems. In this reading, you’ll learn what updates do, how they’re delivered, and why they’re important to
            cybersecurity.</p>

        <h3>Patching Gaps in Security</h3>
        <p>An outdated computer is a lot like a house with unlocked doors. Malicious actors use these gaps in security
            the same way, to gain unauthorized access. Software updates are similar to locking the doors to keep them
            out.</p>

        <p>A patch update is a software and operating system update that addresses security vulnerabilities within a
            program or product. Patches usually contain bug fixes that address common security vulnerabilities and
            exposures.</p>

        <p><strong>Note:</strong> Ideally, patches address common vulnerabilities and exposures before malicious hackers
            find them. However, patches are sometimes developed as a result of a zero-day, which is an exploit that was
            previously unknown.</p>

        <h3>Common Update Strategies</h3>
        <p>When software updates become available, clients and users have two installation options:</p>

        <ul>
            <li><strong>Manual updates</strong></li>
            <li><strong>Automatic updates</strong></li>
        </ul>

        <p>As you’ll learn, each strategy has both benefits and disadvantages.</p>

        <h4>Manual Updates</h4>
        <p>A manual deployment strategy relies on IT departments or users obtaining updates from the developers. Home
            office or small business environments might require you to find, download, and install updates yourself. In
            enterprise settings, the process is usually handled with a configuration management tool. These tools offer
            a range of options to deploy updates, like to all clients on your network or a select group of users.</p>

        <p><strong>Advantage:</strong> An advantage of manual update deployment strategies is control. That can be
            useful if software updates are not thoroughly tested by developers, leading to instability issues.</p>

        <p><strong>Disadvantage:</strong> A drawback to manual update deployments is that critical updates can be
            forgotten or disregarded entirely.</p>

        <h4>Automatic Updates</h4>
        <p>An automatic deployment strategy takes the opposite approach. With this option, finding, downloading, and
            installing updates can be done by the system or application.</p>

        <p><strong>Pro tip:</strong> The Cybersecurity and Infrastructure Security Agency (CISA) recommends using
            automatic options whenever they’re available.</p>

        <p>Advantage: An advantage to automatic updates is that the deployment process is simplified. It also keeps
            systems and software current with the latest, critical patches.</p>

        <p>Disadvantage: A drawback to automatic updates is that instability issues can occur if the patches were not
            thoroughly tested by the vendor. This can result in performance problems and a poor user experience.</p>

        <h3>End-of-life Software</h3>
        <p>Sometimes updates are not available for a certain type of software known as end-of-life (EOL) software. All
            software has a lifecycle. It begins when it’s produced and ends when a newer version is released. At that
            point, developers must allocate resources to the newer versions, which leads to EOL software. While the
            older software is still useful, the manufacturer no longer supports it.</p>

        <p><strong>Note:</strong> Patches and updates are very different from upgrades. Upgrades refer to completely new
            versions of hardware or software that can be purchased.</p>

        <p><strong>CISA recommends discontinuing the use of EOL software</strong> because it poses an unfixable risk to
            systems. But, this recommendation is not always followed. Replacing EOL technology can be costly for
            businesses and individual users.</p>

        <p>The risks that EOL software presents continues to grow as more connected devices enter the marketplace. For
            example, there are billions of Internet of Things (IoT) devices, like smart light bulbs, connected to home
            and work networks. In some business settings, all an attacker needs is a single unpatched device to gain
            access to the network and cause problems.</p>

        <h3>Key Takeaways</h3>
        <p>Updating software and patching vulnerabilities is an important practice that everyone should participate in.
            Unfortunately, that’s not always the case. Many of the biggest cyber attacks in the world might have been
            prevented if systems were kept updated. One example is the WannaCry attack of 2017. The attack affected
            computers in more than 150 countries and caused an estimated $4 billion dollars in damages. Researchers have
            since found that WannaCry could have been prevented if the infected systems were up-to-date with a security
            patch that was made available months before the attack. Keeping software updated requires effort. However,
            the benefits they provide make them worthwhile.</p>

        <p><strong>Tip:</strong> To explore vulnerability scanner software commonly used in the cybersecurity industry,
            in your preferred browser enter search terms similar to “popular vulnerability scanner software” and/or
            “open source vulnerability scanner software used in cybersecurity”.</p>

    </article>
</section>

<section class="main-section" id="topic535">
    <h2>Penetration testing </h2>
    <article class="main-article">
        <h2>Penetration Testing in Cybersecurity</h2>
        <p>An effective security plan relies on regular testing to find an organization's weaknesses. Previously, you
            learned that vulnerability assessments, the internal review process of an organization's security systems,
            are used to design defense strategies based on system weaknesses. In this reading, you'll learn how security
            teams evaluate the effectiveness of their defenses using penetration testing.</p>

        <h3>Penetration Testing</h3>
        <p>A penetration test, or pen test, is a simulated attack that helps identify vulnerabilities in systems,
            networks, websites, applications, and processes. The simulated attack in a pen test involves using the same
            tools and techniques as malicious actors in order to mimic a real life attack. Since a pen test is an
            authorized attack, it is considered to be a form of ethical hacking. Unlike a vulnerability assessment that
            finds weaknesses in a system's security, a pen test exploits those weaknesses to determine the potential
            consequences if the system breaks or gets broken into by a threat actor.</p>

        <p>For example, the cybersecurity team at a financial company might simulate an attack on their banking app to
            determine if there are weaknesses that would allow an attacker to steal customer information or illegally
            transfer funds. If the pen test uncovers misconfigurations, the team can address them and improve the
            overall security of the app.</p>

        <p><strong>Note:</strong> Organizations that are regulated by PCI DSS, HIPAA, or GDPR must routinely perform
            penetration testing to maintain compliance standards.</p>

        <h3>Learning from Varied Perspectives</h3>
        <p>These authorized attacks are performed by pen testers who are skilled in programming and network
            architecture. Depending on their objectives, organizations might use a few different approaches to
            penetration testing:</p>

        <ul>
            <li><strong>Red team tests</strong> simulate attacks to identify vulnerabilities in systems, networks, or
                applications.</li>
            <li><strong>Blue team tests</strong> focus on defense and incident response to validate an organization's
                existing security systems.</li>
            <li><strong>Purple team tests</strong> are collaborative, focusing on improving the security posture of the
                organization by combining elements of red and blue team exercises.</li>
        </ul>

        <p>Red team tests are commonly performed by independent pen testers who are hired to evaluate internal systems.
            Although, cybersecurity teams may also have their own pen testing experts. Regardless of the approach,
            penetration testers must make an important decision before simulating an attack: How much access and
            information do I need?</p>

        <h3>Penetration Testing Strategies</h3>
        <p>There are three common penetration testing strategies:</p>

        <ul>
            <li><strong>Open-box testing</strong> is when the tester has the same privileged access that an internal
                developer would have—information like system architecture, data flow, and network diagrams.</li>
            <li><strong>Closed-box testing</strong> is when the tester has little to no access to internal
                systems—similar to a malicious hacker.</li>
            <li><strong>Partial knowledge testing</strong> is when the tester has limited access and knowledge of an
                internal system—for example, a customer service representative.</li>
        </ul>

        <p>Closed box testers tend to produce the most accurate simulations of a real-world attack. Nevertheless, each
            strategy produces valuable results by demonstrating how an attacker might infiltrate a system and what
            information they could access.</p>

        <h3>Becoming a Penetration Tester</h3>
        <p>Penetration testers are in-demand in the fast growing field of cybersecurity. All of the skills you’re
            learning in this program can help you advance towards a career in pen testing:</p>

        <ul>
            <li>Network and application security</li>
            <li>Experience with operating systems, like Linux</li>
            <li>Vulnerability analysis and threat modeling</li>
            <li>Detection and response tools</li>
            <li>Programming languages, like Python and BASH</li>
            <li>Communication skills</li>
        </ul>

        <p>Programming skills are very helpful in penetration testing because it's often performed on software and IT
            systems. With enough practice and dedication, cybersecurity professionals at any level can develop the
            skills needed to be a pen tester.</p>

        <h3>Bug Bounty Programs</h3>
        <p>Organizations commonly run bug bounty programs which offer freelance pen testers financial rewards for
            finding and reporting vulnerabilities in their products. Bug bounties are great opportunities for amateur
            security professionals to participate and grow their skills.</p>

        <p><strong>Pro tip:</strong> HackerOne is a community of ethical hackers where you can find active bug bounties
            to participate in.</p>

        <h3>Key Takeaways</h3>
        <p>A major risk for organizations is malicious hackers breaking into their systems. Penetration testing is
            another way for organizations to secure their systems. Security teams use these simulated attacks to get a
            clearer picture of weaknesses in their defenses. There’s a growing need for specialized security
            professionals in this field. Even if you start out assisting with these activities, there’s plenty of
            opportunities to grow and learn the skills to be a pen tester.</p>
    </article>
</section>
<section class="main-section" id="topic536">
    <h2>Approach cybersecurity with an attacker mindset</h2>
    <article class="main-article">
        <h2>Applying an Attacker Mindset in Cybersecurity</h2>
        <p>Cybersecurity is a continuously changing field. It's a fast-paced environment where new threats and
            innovative technologies can disrupt your plans at a moment's notice. As a security professional, it’s up to
            you to be prepared by anticipating change.</p>

        <h3>Being Prepared for Anything</h3>
        <p>Having a plan should things go wrong is important. But how do you figure out what to plan for? In this field,
            teams often conduct simulations of things that can go wrong as part of their vulnerability management
            strategy. One way this is done is by applying an attacker mindset to the weaknesses they discover.</p>

        <p>Applying an attacker mindset is a lot like conducting an experiment. It's about causing problems in a
            controlled environment and evaluating the outcome to gain insights. Adopting an attacker mindset is a
            beneficial skill in security because it offers a different perspective about the challenges you're trying to
            solve. The insights you gain can be valuable when it's time to establish a security plan or modify an
            existing one.</p>

        <img src="resource/owasp2.png" id="img" alt="">

        <h3>Simulating Threats</h3>
        <p>One method of applying an attacker mindset is using attack simulations. These activities are normally
            performed in one of two ways: proactively and reactively. Both approaches share a common goal, which is to
            make systems safer.</p>

        <ul>
            <li><strong>Proactive simulations</strong> assume the role of an attacker by exploiting vulnerabilities and
                breaking through defenses. This is sometimes called a red team exercise.</li>
            <li><strong>Reactive simulations</strong> assume the role of a defender responding to an attack. This is
                sometimes called a blue team exercise.</li>
        </ul>

        <p>Each kind of simulation is a team effort that you might be involved with as an analyst.</p>

        <h3>Scanning for Trouble</h3>
        <p>You might recall that a vulnerability scanner is software that automatically compares existing common
            vulnerabilities and exposures against the technologies on the network. Vulnerability scanners are frequently
            used in the field. Security teams employ a variety of scanning techniques to uncover weaknesses in their
            defenses. Reactive simulations often rely on the results of a scan to weigh the risks and determine ways to
            remediate a problem.</p>

        <p>For example, a team conducting a reactive simulation might perform an external vulnerability scan of their
            network. The entire exercise might follow the steps you learned in a video about vulnerability assessments:
        </p>

        <ol>
            <li><strong>Identification:</strong> A vulnerable server is flagged because it's running an outdated
                operating system (OS).</li>
            <li><strong>Vulnerability analysis:</strong> Research is done on the outdated OS and its vulnerabilities.
            </li>
            <li><strong>Risk assessment:</strong> After doing your due diligence, the severity of each vulnerability is
                scored and the impact of not fixing it is evaluated.</li>
            <li><strong>Remediation:</strong> Finally, the information that you’ve gathered can be used to address the
                issue.</li>
        </ol>

        <p>During an activity like this, you’ll often produce a report of your findings. These can be brought to the
            attention of service providers or your supervisors. Clearly communicating the results of these exercises to
            others is an important skill to develop as a security professional.</p>

        <h3>Finding Innovative Solutions</h3>
        <p>Many security controls that you’ve learned about were created as a reactive response to risks. That’s because
            criminals are continually looking for ways to bypass existing defenses. Effectively applying an attacker
            mindset will require you to stay knowledgeable of security trends and emerging technologies.</p>

        <p><strong>Pro tip:</strong> Resources like NISTs National Vulnerability Database (NVD) can help you remain
            current on common vulnerabilities.</p>

        <h3>Key Takeaways</h3>
        <p>Vulnerability assessments are an important part of security risk planning. As an analyst, you’ll likely
            participate in proactive and reactive simulations of these activities. Preparing yourself by researching
            common vulnerabilities only goes so far. It’s equally important that you stay informed about new
            technologies to be able to think with an innovative mindset.</p>

    </article>
</section>

<section class="main-section" id="topic537">
    <h2> Types of threat actors</h2>
    <article class="main-article">
        <h2>Understanding Threat Actors and Attack Surfaces in Cybersecurity</h2>
        <p>Anticipating attacks is an important skill you’ll need to be an effective security professional. Developing
            this skill requires you to have an open and flexible mindset about where attacks can come from. Previously,
            you learned about attack surfaces, which are all the potential vulnerabilities that a threat actor could
            exploit.</p>

        <h3>Threat Actors</h3>
        <p>A threat actor is any person or group who presents a security risk. This broad definition refers to people
            inside and outside an organization. It also includes individuals who intentionally pose a threat, and those
            that accidentally put assets at risk. That’s a wide range of people!</p>

        <p>Threat actors are normally divided into five categories based on their motivations:</p>

        <ul>
            <li><strong>Competitors:</strong> refers to rival companies who pose a threat because they might benefit
                from leaked information.</li>
            <li><strong>State actors:</strong> are government intelligence agencies.</li>
            <li><strong>Criminal syndicates:</strong> refer to organized groups of people who make money from criminal
                activity.</li>
            <li><strong>Insider threats:</strong> can be any individual who has or had authorized access to an
                organization’s resources.</li>
            <li><strong>Shadow IT:</strong> refers to individuals who use technologies that lack IT governance.</li>
        </ul>

        <img src="resource/hacker.png" id="img" alt="">

        <h3>Types of Hackers</h3>
        <p>Because the formal definition of a hacker is broad, the term can be a bit ambiguous. In security, it applies
            to three types of individuals based on their intent:</p>

        <ul>
            <li><strong>Unauthorized hackers:</strong> individuals who use their programming skills to commit crimes.
            </li>
            <li><strong>Authorized, or ethical, hackers:</strong> individuals who use their programming skills to
                improve an organization's overall security.</li>
            <li><strong>Semi-authorized hackers:</strong> individuals who might violate ethical standards, but are not
                considered malicious.</li>
        </ul>

        <h3>Advanced Persistent Threats (APTs)</h3>
        <p>Many malicious hackers find their way into a system, cause trouble, and then leave. But on some occasions,
            threat actors stick around. These kinds of events are known as advanced persistent threats, or APTs.</p>

        <p>An advanced persistent threat (APT) refers to instances when a threat actor maintains unauthorized access to
            a system for an extended period of time. The term is mostly associated with nation states and
            state-sponsored actors.</p>

        <h3>Access Points</h3>
        <p>Each threat actor has a unique motivation for targeting an organization's assets. Keeping them out takes more
            than knowing their intentions and capabilities. It’s also important to recognize the types of attack vectors
            they’ll use.</p>

        <p>For the most part, threat actors gain access through one of these attack vector categories:</p>

        <ul>
            <li>Direct access</li>
            <li>Removable media</li>
            <li>Social media platforms</li>
            <li>Email</li>
            <li>Wireless networks</li>
            <li>Cloud services</li>
            <li>Supply chains</li>
        </ul>

        <p>Any of these attack vectors can provide access to a system. Recognizing a threat actor’s intentions can help
            you determine which access points they might target and what ultimate goals they could have.</p>

        <h3>Key Takeaways</h3>
        <p>Defending an attack surface starts with thinking like a threat actor. As a security professional, it’s
            important to understand why someone would pose a threat to organizational assets. This includes recognizing
            that every threat actor isn’t intentionally out to cause harm.</p>

        <p>It’s equally important to recognize the ways in which a threat actor might gain access to a system. Matching
            intentions with attack vectors is an invaluable skill as you continue to develop an attacker mindset.</p>

    </article>
</section>

<section class="main-section" id="topic538">
    <h2>Fortify against brute force cyber attacks </h2>
    <article class="main-article">
        <h2>Understanding Brute Force Attacks and Prevention Measures</h2>
        <p>Usernames and passwords are one of the most common and important security controls in use today. They’re like
            the door lock that organizations use to restrict access to their networks, services, and data. But a major
            issue with relying on login credentials as a critical line of defense is that they’re vulnerable to being
            stolen and guessed by attackers.</p>

        <h3>A Matter of Trial and Error</h3>
        <p>One way of opening a closed lock is trying as many combinations as possible. Threat actors sometimes use
            similar tactics to gain access to an application or a network.</p>

        <p>Attackers use a variety of tactics to find their way into a system:</p>

        <ul>
            <li>Simple brute force attacks</li>
            <li>Dictionary attacks</li>
            <li>Reverse brute force attacks</li>
            <li>Credential stuffing</li>
        </ul>

        <h3>Tools of the Trade</h3>
        <p>There are so many combinations that can be used to create a single set of login credentials. Instead of
            dedicating the time to do this manually, attackers often use software to do the guess work for them. These
            are some common brute forcing tools:</p>

        <ul>
            <li>Aircrack-ng</li>
            <li>Hashcat</li>
            <li>John the Ripper</li>
            <li>Ophcrack</li>
            <li>THC Hydra</li>
        </ul>

        <h3>Prevention Measures</h3>
        <p>Organizations defend against brute force attacks with a combination of technical and managerial controls.
            Each makes cracking defense systems through brute force less likely:</p>

        <ul>
            <li>Hashing and salting</li>
            <li>Multi-factor authentication (MFA)</li>
            <li>CAPTCHA</li>
            <li>Password policies</li>
        </ul>

        <h4>Hashing and Salting</h4>
        <p>Hashing converts information into a unique value that can then be used to determine its integrity. Salting is
            an additional safeguard that’s used to strengthen hash functions.</p>

        <h4>Multi-factor Authentication (MFA)</h4>
        <p>MFA is a security measure that requires a user to verify their identity in two or more ways to access a
            system or network.</p>

        <h4>CAPTCHA</h4>
        <p>CAPTCHA asks users to complete a simple test that proves they are human and not software that’s trying to
            brute force a password.</p>

        <h4>Password Policy</h4>
        <p>Organizations use managerial controls to standardize good password practices across their business, creating
            more possible password combinations.</p>

        <p>The purpose of each of these requirements is to create more possible password combinations, lengthening the
            amount of time it takes an attacker to find one that will work.</p>

        <p><em>Key takeaways:</em> Brute force attacks are simple yet reliable ways to gain unauthorized access to
            systems. Recognizing the tactics and tools used to conduct a brute force attack is the first step towards
            stopping attackers.</p>

    </article>
</section>

<section class="main-section" id="topic539">
    <h2>Glossary terms from module 3 </h2>
    <article class="main-article">
        <h2>Terms and Definitions from Course 5, Module 3</h2>
        <dl>
            <dt>Advanced Persistent Threat (APT)</dt>
            <dd>An instance when a threat actor maintains unauthorized access to a system for an extended period of
                time.</dd>

            <dt>Attack Surface</dt>
            <dd>All the potential vulnerabilities that a threat actor could exploit.</dd>

            <dt>Attack Tree</dt>
            <dd>A diagram that maps threats to assets.</dd>

            <dt>Attack Vector</dt>
            <dd>The pathways attackers use to penetrate security defenses.</dd>

            <dt>Bug Bounty</dt>
            <dd>Programs that encourage freelance hackers to find and report vulnerabilities.</dd>

            <dt>Common Vulnerabilities and Exposures (CVE®) List</dt>
            <dd>An openly accessible dictionary of known vulnerabilities and exposures.</dd>

            <dt>Common Vulnerability Scoring System (CVSS)</dt>
            <dd>A measurement system that scores the severity of a vulnerability.</dd>

            <dt>CVE Numbering Authority (CNA)</dt>
            <dd>An organization that volunteers to analyze and distribute information on eligible CVEs.</dd>

            <dt>Defense in Depth</dt>
            <dd>A layered approach to vulnerability management that reduces risk.</dd>

            <dt>Exploit</dt>
            <dd>A way of taking advantage of a vulnerability.</dd>

            <dt>Exposure</dt>
            <dd>A mistake that can be exploited by a threat.</dd>

            <dt>Hacker</dt>
            <dd>Any person who uses computers to gain access to computer systems, networks, or data.</dd>

            <dt>MITRE</dt>
            <dd>A collection of non-profit research and development centers.</dd>

            <dt>Security Hardening</dt>
            <dd>The process of strengthening a system to reduce its vulnerability and attack surface.</dd>

            <dt>Threat Actor</dt>
            <dd>Any person or group who presents a security risk.</dd>

            <dt>Vulnerability</dt>
            <dd>A weakness that can be exploited by a threat.</dd>

            <dt>Vulnerability Assessment</dt>
            <dd>The internal review process of a company’s security systems.</dd>

            <dt>Vulnerability Management</dt>
            <dd>The process of finding and patching vulnerabilities.</dd>

            <dt>Vulnerability Scanner</dt>
            <dd>Software that automatically compares existing common vulnerabilities and exposures against the
                technologies on the network.</dd>

            <dt>Zero-day</dt>
            <dd>An exploit that was previously unknown.</dd>
        </dl>

    </article>
</section>


<section class="main-section" id="Module 54">
    <h2>Module 4</h2>
</section>
<br> <br>


<section class="main-section" id="topic541">
    <h2>Social engineering tactics</h2>
    <article class="main-article">
        <p>Social engineering attacks are a popular choice among threat actors. That’s because it’s often easier to
            trick people into providing them with access, information, or money than it is to exploit a software or
            network vulnerability. <br><br>

            As you might recall, social engineering is a manipulation technique that exploits human error to gain
            private information, access, or valuables. It's an umbrella term that can apply to a broad range of attacks.
            Each technique is designed to capitalize on the trusting nature of people and their willingness to help. In
            this reading, you will learn about specific social engineering tactics to watch out for. You’ll also learn
            ways that organizations counter these threats.</p>
        <h2>Social Engineering Risks</h2>
        <img src="resource/m4.png" id="img" alt="">
        <p>
            Social engineering is a form of deception that takes advantage of the way people think. It preys on people’s
            natural feelings of curiosity, generosity, and excitement. Threat actors turn those feelings against their
            targets by affecting their better judgment. Social engineering attacks can be incredibly harmful because of
            how easy they can be to accomplish.
        </p>
        <p>
            One of the highest-profile social engineering attacks that occurred in recent years was the Twitter Hack of
            2020. During that incident, a group of hackers made phone calls to Twitter employees pretending to be from
            the IT department. Using this basic scam, the group managed to gain access to the organization’s network and
            internal tools. This allowed them to take over the accounts of high-profile users, including politicians,
            celebrities, and entrepreneurs.
        </p>
        <p>
            Attacks like this are just one example of the chaos threat actors can create using basic social engineering
            techniques. These attacks present serious risks because they don’t require sophisticated computer skills to
            perform. Defending against them requires a multi-layered approach that combines technological controls with
            user awareness.
        </p>
        <h3>Signs of an Attack</h3>
        <p>
            Oftentimes, people are unable to tell that an attack is happening until it's too late. Social engineering is
            such a dangerous threat because it typically allows attackers to bypass technological defenses that are in
            their way. Although these threats are difficult to prevent, recognizing the signs of social engineering is a
            key to reducing the likelihood of a successful attack.
        </p>
        <p>
            These are common types of social engineering to watch out for:
        </p>
        <ul>
            <li>Baiting</li>
            <li>Phishing</li>
            <li>Quid pro quo</li>
            <li>Tailgating</li>
            <li>Watering hole</li>
        </ul>


        <p>
            Attackers might use any of these techniques to gain unauthorized access to an organization. Everyone is
            vulnerable to them, from entry-level employees to senior executives. However, you can reduce the risks of
            social engineering attacks at any business by teaching others what to expect.
        </p>
        <h3>Encouraging Caution</h3>
        <p>
            Spreading awareness usually starts with comprehensive security training. When it comes to social
            engineering, there are three main areas to focus on when teaching others:
        </p>
        <ul>
            <li>Stay alert of suspicious communications and unknown people, especially when it comes to email.</li>
            <li>Be cautious about sharing information, especially over social media.</li>
            <li>Control curiosity when something seems too good to be true.</li>
        </ul>
        <p>
            Implementing technologies like firewalls, multi-factor authentication (MFA), block lists, email filtering,
            and others helps layers the defenses should someone make a mistake.
        </p>
        <p>
            Ideally, security training extends beyond employees. Educating customers about social engineering threats is
            also a key to mitigating these threats. And security analysts play an important part in promoting safe
            practices. For example, a big part of an analyst's job is testing systems and documenting best practices for
            others at an organization to follow.
        </p>
        <h3>Key Takeaways</h3>
        <p>
            People’s willingness to help one another and their trusting nature is what makes social engineering such an
            appealing tactic for criminals. It just takes one act of kindness or a momentary lapse in judgment for an
            attack to work. Criminals go to great lengths to make their attacks difficult to detect. They rely on a
            variety of manipulation techniques to trick their targets into granting them access. For that reason,
            implementing effective controls and recognizing the signs of an attack go a long way towards preventing
            threats.
        </p>

    </article>
</section>

<section class="main-section" id="topic542">
    <h2> Types of phishing</h2>
    <article class="main-article">
        <h2>Phishing Tactics</h2>
        <p>
            Phishing is one of the most common types of social engineering, which are manipulation techniques that
            exploit human error to gain private information, access, or valuables. Previously, you learned how phishing
            is the use of digital communications to trick people into revealing sensitive data or deploying malicious
            software.
        </p>
        <img src="resource/phishingg.png" id="img" alt="Sensitive assets being taken from a computer by various fish hooks">
        <h3>The Origins of Phishing</h3>
        <p>
            Phishing has been around since the early days of the internet. It can be traced back to the 1990s when
            people across the world were coming online for the first time. Malicious actors realized that the internet
            gave them a level of anonymity to commit their crimes.
        </p>
        <h4>Early Persuasion Tactics</h4>
        <p>
            One of the earliest instances of phishing was aimed at a popular chat service called AOL Instant Messenger
            (AIM). Users of the service began receiving emails asking them to verify their accounts or provide personal
            billing information. The users were unaware that these messages were sent by malicious actors pretending to
            be service providers.
        </p>
        <p>
            During the AIM attacks, malicious actors carefully crafted emails that appeared to come directly from AOL.
            The messages used official logos, colors, and fonts to trick unsuspecting users into sharing their
            information and account details.
        </p>
        <h3>How Phishing Has Evolved</h3>
        <p>
            Phishing continued evolving at the turn of the century as businesses and newer technologies began entering
            the digital landscape. In the early 2000s, e-commerce and online payment systems started to become popular
            alternatives to traditional marketplaces, presenting new opportunities for attackers to commit crimes.
        </p>
        <h4>Common Types of Phishing</h4>
        <ul>
            <li>Email phishing: Attackers send messages pretending to be a trusted person or entity.</li>
            <li>Smishing: Phishing using Short Message Service (SMS).</li>
            <li>Vishing: Trick targets into providing personal information over the phone.</li>
            <li>Spear phishing: Specifically targeting individuals.</li>
            <li>Whaling: Targeting high-ranking executives.</li>
        </ul>
        <p>
            Since the early days of phishing, email attacks remain the most common types used. Email phishing evolved
            from tricking people into sharing access credentials to infecting computer systems with malicious software.
            In late 2003, attackers created fraudulent websites resembling businesses like eBay and PayPal™, launching
            mass phishing campaigns against e-commerce and banking sites.
        </p>
        <img src="resource/phisingg2.png" id="img" alt="Social media profiles being taken off of a computer">
        <h3>Recent Trends</h3>
        <p>
            Starting in the 2010s, attackers shifted towards targeted phishing attempts. One type of targeted phishing
            is angler phishing, where attackers impersonate customer service representatives on social media to
            intercept complaints and trick customers into sharing sensitive information.
        </p>
        <h3>Key Takeaways</h3>
        <p>
            Phishing tactics have become very sophisticated over the years. Unfortunately, there isn't a perfect
            solution that prevents these attacks from happening. Spreading awareness and informing others about social
            engineering, like phishing, is crucial. As a security professional, you may be responsible for helping
            others identify forms of social engineering, like phishing, and creating training programs that educate
            employees about these topics.
        </p>
    </article>
</section>

<section class="main-section" id="topic543">
    <h2>An introduction to malware </h2>
    <article class="main-article">
        <h2>Types of Malware</h2>

        <p>Previously, you learned that malware is software designed to harm devices or networks. Since its first
            appearance on personal computers decades ago, malware has developed into a variety of strains. Being able to
            identify different types of malware and understand the ways in which they are spread will help you stay
            alert and be informed as a security professional.</p>
        <img src="resource/malware.png" alt="Icons of different types of malware">
        <h3>Virus</h3>
        <p>A virus is malicious code written to interfere with computer operations and cause damage to data and
            software. It must be installed by the target user before it can spread itself.</p>
        <h3>Worm</h3>
        <p>A worm is malware that can duplicate and spread itself across systems on its own. It also requires
            installation by the target user but can spread independently.</p>
        <h3>Trojan</h3>
        <p>A trojan, or Trojan horse, is malware that appears as a legitimate file or program. It tricks users into
            downloading and installing it, enabling various malicious activities.</p>
        <h3>Adware</h3>
        <p>Adware is legitimate software used to display digital advertisements in applications. However, malicious
            adware, classified as potentially unwanted applications (PUAs), can cause device slowdown or install other
            unwanted software.</p>
        <h3>Spyware</h3>
        <p>Spyware gathers and sells information without consent. It's hidden in bundleware, additional software
            packaged with other applications, and is considered a PUA.</p>
        <h3>Scareware</h3>
        <p>Scareware frightens users into infecting their own devices by displaying fake warnings that seem to come from
            legitimate companies.</p>
        <h3>Fileless Malware</h3>
        <p>Fileless malware resides in memory and doesn't need user installation. It uses legitimate programs already
            installed to infect a computer.</p>
        <h3>Rootkits</h3>
        <p>Rootkits provide remote administrative access to a computer. They're often spread through droppers and
            loaders disguised as legitimate files.</p>
        <h3>Botnet</h3>
        <p>A botnet is a collection of infected computers controlled by a single threat actor. Various malware types are
            used to spread the initial infection.</p>
        <h3>Ransomware</h3>
        <p>Ransomware encrypts an organization's data and demands payment for decryption. It's a growing threat that can
            cause significant damage.</p>

    </article>
</section>

<section class="main-section" id="topic544">
    <h2> Prevent injection attacks </h2>
    <article class="main-article">
        <h2>SQL Injection and Prevention</h2>
        <p>Previously, you learned that Structured Query Language (SQL) is a programming language used to create,
            interact with, and request information from a database. SQL is one of the most common programming languages
            used to interact with databases because it is widely supported by a range of database products. <br><br>

            As you might recall, malicious SQL injection is a type of attack that executes unexpected queries on a
            database. Threat actors perform SQL injections to modify, delete, or steal information from databases. A SQL
            injection is a common attack vector that is used to gain unauthorized access to web applications. Due to the
            language's popularity with developers, SQL injections are regularly listed in the OWASP® Top 10 because
            developers tend to focus on making their applications work correctly rather than protecting their products
            from injection.
            <br><br>
            In this reading, you'll learn about SQL queries and how they are used to request information from a
            database. You will also learn about the three classes of SQL injection attacks used to manipulate vulnerable
            queries. You will also learn ways to identify when websites are vulnerable and ways to address those gaps.
            <br>
        </p>
        <h3>SQL Queries</h3>
        <p>Structured Query Language (SQL) is used to interact with databases, organizing data in tables and executing
            queries to retrieve, insert, update, or delete information.</p>
        <h3>SQL Injection Categories</h3>
        <p>There are three main categories of SQL injection:</p>
        <ul>
            <li><strong>In-band:</strong> Uses the same communication channel to launch the attack and gather results.
            </li>
            <li><strong>Out-of-band:</strong> Uses a different communication channel to launch the attack and gather
                results, but is uncommon.</li>
            <li><strong>Inferential:</strong> Occurs when an attacker interprets results by analyzing the system's
                behavior.</li>
        </ul>
        <h3>Injection Prevention</h3>
        <p>Preventing SQL injection attacks involves escaping user inputs to prevent unintended code execution.
            Techniques include:</p>
        <ul>
            <li><strong>Prepared statements:</strong> Execute SQL statements before passing them to a database.</li>
            <li><strong>Input sanitization:</strong> Remove user input that could be interpreted as code.</li>
            <li><strong>Input validation:</strong> Ensure user input meets system expectations.</li>
        </ul>
        <p>Collaboration with application developers is key to addressing vulnerabilities and implementing preventive
            measures against SQL injection attacks.</p>
        <p>OWASP's SQL injection detection techniques can be a useful resource for investigating vulnerabilities.</p>

    </article>
</section>

<section class="main-section" id="topic545">
    <h2>Traits of an effective threat model </h2>
    <article class="main-article">

        <h2>Threat Modeling and Application Security</h2>
        <h3>Why application security matters</h3>
        <p>Applications have become an essential part of many organizations' success. For example, web-based
            applications allow customers from anywhere in the world to connect with businesses, their partners, and
            other customers.</p>
        <p>Mobile applications have also changed the way people access the digital world. Smartphones are often the main
            way that data is exchanged between users and a business. The volume of data being processed by applications
            makes securing them a key to reducing risk for everyone who’s connected.</p>
        <p>For example, say an application uses Java-based logging libraries with the Log4Shell vulnerability
            (CVE-2021-44228). If it's not patched, this vulnerability can allow remote code execution that an attacker
            can use to gain full access to your system from anywhere in the world. If exploited, a critical
            vulnerability like this can impact millions of devices.</p>
        <h3>Defending the application layer</h3>
        <p>Defending the application layer requires proper testing to uncover weaknesses that can lead to risk. Threat
            modeling is one of the primary ways to ensure that an application meets security requirements. A DevSecOps
            team, which stands for development, security, and operations, usually performs these analyses.</p>
        <p>A typical threat modeling process is performed in a cycle:</p>
        <ul>
            <li>Define the scope</li>
            <li>Identify threats</li>
            <li>Characterize the environment</li>
            <li>Analyze threats</li>
            <li>Mitigate risks</li>
            <li>Evaluate findings</li>
        </ul>
        <h3>Common frameworks</h3>
        <p>When performing threat modeling, there are multiple methods that can be used, such as:</p>
        <ul>
            <li>STRIDE</li>
            <li>PASTA</li>
            <li>Trike</li>
            <li>VAST</li>
        </ul>
        <p>Organizations might use any one of these to gather intelligence and make decisions to improve their security
            posture. Ultimately, the “right” model depends on the situation and the types of risks an application might
            face.</p>
        <h4>STRIDE</h4>
        <p>STRIDE is a threat-modeling framework developed by Microsoft. It’s commonly used to identify vulnerabilities
            in six specific attack vectors. The acronym represents each of these vectors: spoofing, tampering,
            repudiation, information disclosure, denial of service, and elevation of privilege.</p>
        <h4>PASTA</h4>
        <p>The Process of Attack Simulation and Threat Analysis (PASTA) is a risk-centric threat modeling process
            developed by two OWASP leaders and supported by a cybersecurity firm called VerSprite. Its main focus is to
            discover evidence of viable threats and represent this information as a model. PASTA's evidence-based design
            can be applied when threat modeling an application or the environment that supports that application. Its
            seven stage process consists of various activities that incorporate relevant security artifacts of the
            environment, like vulnerability assessment reports.</p>
        <h4>Trike</h4>
        <p>Trike is an open source methodology and tool that takes a security-centric approach to threat modeling. It's
            commonly used to focus on security permissions, application use cases, privilege models, and other elements
            that support a secure environment.</p>
        <h4>VAST</h4>
        <p>The Visual, Agile, and Simple Threat (VAST) Modeling framework is part of an automated threat-modeling
            platform called ThreatModeler®. Many security teams opt to use VAST as a way of automating and streamlining
            their threat modeling assessments.</p>
        <h3>Participating in threat modeling</h3>
        <p>Threat modeling is often performed by experienced security professionals, but it’s almost never done alone.
            This is especially true when it comes to securing applications. Programs are complex systems responsible for
            handling a lot of data and processing a variety of commands from users and other systems.</p>
        <p>One of the keys to threat modeling is asking the right questions:</p>
        <ul>
            <li>What are we working on?</li>
            <li>What kinds of things can go wrong?</li>
            <li>What are we doing about it?</li>
            <li>Have we addressed everything?</li>
            <li>Did we do a good job?</li>
        </ul>
        <p>It takes time and practice to learn how to work with things like data flow diagrams and attack trees.
            However, anyone can learn to be an effective threat modeler. Regardless of your level of experience,
            participating in one of these exercises always starts with simply asking the right questions.</p>
        <h3>Key takeaways</h3>
        <p>Many people rely on software applications in their day to day lives. Securing the applications that people
            use has never been more important. Threat modeling is one of the main ways to determine whether security
            controls are in place to protect data privacy. Building the skills required to lead a threat modeling
            activity is a matter of practice. However, even a security analyst with little experience can be a valuable
            contributor to the process. It all starts with applying an attacker mindset and thinking critically about
            how data is handled.</p>


    </article>
</section>

<section class="main-section" id="topic546">
    <h2>Glossary terms from module 4 </h2>
    <article class="main-article">
        <h2>Terms and Definitions from Course 5, Module 4</h2>
        <p><strong>Angler phishing:</strong> A technique where attackers impersonate customer service representatives on
            social media</p>
        <p><strong>Advanced persistent threat (APT):</strong> Instances when a threat actor maintains unauthorized
            access to a system for an extended period of time</p>
        <p><strong>Adware:</strong> A type of legitimate software that is sometimes used to display digital
            advertisements in applications</p>
        <p><strong>Attack tree:</strong> A diagram that maps threats to assets</p>
        <p><strong>Baiting:</strong> A social engineering tactic that tempts people into compromising their security</p>
        <p><strong>Botnet:</strong> A collection of computers infected by malware that are under the control of a single
            threat actor, known as the “bot-herder"</p>
        <p><strong>Cross-site scripting (XSS):</strong> An injection attack that inserts code into a vulnerable website
            or web application</p>
        <p><strong>Cryptojacking:</strong> A form of malware that installs software to illegally mine cryptocurrencies
        </p>
        <p><strong>DOM-based XSS attack:</strong> An instance when malicious script exists in the webpage a browser
            loads</p>
        <p><strong>Dropper:</strong> A type of malware that comes packed with malicious code which is delivered and
            installed onto a target system</p>
        <p><strong>Fileless malware:</strong> Malware that does not need to be installed by the user because it uses
            legitimate programs that are already installed to infect a computer</p>
        <p><strong>Hacker:</strong> Any person or group who uses computers to gain unauthorized access to data</p>
        <p><strong>Identity and access management (IAM):</strong> A collection of processes and technologies that helps
            organizations manage digital identities in their environment</p>
        <p><strong>Injection attack:</strong> Malicious code inserted into a vulnerable application</p>
        <p><strong>Input validation:</strong> Programming that validates inputs from users and other programs</p>
        <p><strong>Intrusion detection system (IDS):</strong> An application that monitors system activity and alerts on
            possible intrusions</p>
        <p><strong>Loader:</strong> A type of malware that downloads strains of malicious code from an external source
            and installs them onto a target system</p>
        <p><strong>Malware:</strong> Software designed to harm devices or networks</p>
        <p><strong>Process of Attack Simulation and Threat Analysis (PASTA):</strong> A popular threat modeling
            framework that’s used across many industries</p>
        <p><strong>Phishing:</strong> The use of digital communications to trick people into revealing sensitive data or
            deploying malicious software</p>
        <p><strong>Phishing kit:</strong> A collection of software tools needed to launch a phishing campaign</p>
        <p><strong>Prepared statement:</strong> A coding technique that executes SQL statements before passing them onto
            the database</p>
        <p><strong>Potentially unwanted application (PUA):</strong> A type of unwanted software that is bundled in with
            legitimate programs which might display ads, cause device slowdown, or install other software</p>
        <p><strong>Quid pro quo:</strong> A type of baiting used to trick someone into believing that they’ll be
            rewarded in return for sharing access, information, or money</p>
        <p><strong>Ransomware:</strong> Type of malicious attack where attackers encrypt an organization’s data and
            demand payment to restore access</p>
        <p><strong>Reflected XSS attack:</strong> An instance when malicious script is sent to a server and activated
            during the server’s response</p>
        <p><strong>Rootkit:</strong> Malware that provides remote, administrative access to a computer</p>
        <p><strong>Scareware:</strong> Malware that employs tactics to frighten users into infecting their device</p>
        <p><strong>Smishing:</strong> The use of text messages to trick users to obtain sensitive information or to
            impersonate a known source</p>
        <p><strong>Social engineering:</strong> A manipulation technique that exploits human error to gain private
            information, access, or valuables</p>
        <p><strong>Spear phishing:</strong> A malicious email attack targeting a specific user or group of users,
            appearing to originate from a trusted source</p>
        <p><strong>Spyware:</strong> Malware that’s used to gather and sell information without consent</p>
        <p><strong>SQL (Structured Query Language):</strong> A programming language used to create, interact with, and
            request information from a database</p>
        <p><strong>SQL injection:</strong> An attack that executes unexpected queries on a database</p>
        <p><strong>Stored XSS attack:</strong> An instance when malicious script is injected directly on the server</p>
        <p><strong>Tailgating:</strong> A social engineering tactic in which unauthorized people follow an authorized
            person into a restricted area</p>
        <p><strong>Threat:</strong> Any circumstance or event that can negatively impact assets</p>
        <p><strong>Threat actor:</strong> Any person or group who presents a security risk</p>
        <p><strong>Threat modeling:</strong> The process of identifying assets, their vulnerabilities, and how each is
            exposed to threats</p>
        <p><strong>Trojan horse:</strong> Malware that looks like a legitimate file or program</p>
        <p><strong>Vishing:</strong> The exploitation of electronic voice communication to obtain sensitive information
            or to impersonate a known source</p>
        <p><strong>Watering hole attack:</strong> A type of attack when a threat actor compromises a website frequently
            visited by a specific group of users</p>
        <p><strong>Whaling:</strong> A category of spear phishing attempts that are aimed at high-ranking executives in
            an organization</p>
        <p><strong>Web-based exploits:</strong> Malicious code or behavior that’s used to take advantage of coding flaws
            in a web application.</p>

    </article>
</section>


<section class="main-section" id="Course 6">
    <h2 id="cs2">Course 6</h2>
</section>


<section class="main-section" id="Module 61">
    <h2>Module 1</h2>
</section>
<br> <br>


<section class="main-section" id="topic611">
    <h2>Roles in response </h2>
    <article class="main-article">
        <h2>Command, Control, and Communication</h2>
        <p><strong>Command:</strong> Having the appropriate leadership and direction to oversee the response.</p>
        <p><strong>Control:</strong> Managing technical aspects during incident response, coordinating resources, and
            assigning tasks.</p>
        <p><strong>Communication:</strong> Keeping stakeholders informed.</p>

        <h2>Roles in CSIRTs</h2>
        <p><strong>Security Analyst:</strong> Continuously monitoring an environment for security threats, analyzing and
            triaging alerts, escalating or resolving alerts.</p>
        <p><strong>Technical Lead:</strong> Managing technical aspects of incident response, determining root cause,
            creating and implementing strategies for containment, eradication, and recovery.</p>
        <p><strong>Incident Coordinator:</strong> Coordinating with relevant departments during a security incident,
            ensuring open and clear communication, managing incident status.</p>

        <h2>Security Operations Center (SOC)</h2>
        <p>A SOC is dedicated to monitoring networks, systems, and devices for security threats or attacks.</p>

        <h3>SOC Organization</h3>

        <img src="resource/tier.png" id="img" alt="">
        <p><strong>Tier 1 SOC Analyst:</strong> Monitoring alerts, creating and closing alerts, escalating tickets.</p>
        <p><strong>Tier 2 SOC Analyst:</strong> Conducting deeper investigations, configuring and refining security
            tools, reporting to SOC Lead.</p>
        <p><strong>Tier 3 SOC Lead:</strong> Managing team operations, performing advanced detection techniques,
            reporting to SOC Manager.</p>
        <p><strong>SOC Manager:</strong> Hiring, training, evaluating team members, creating performance metrics,
            communicating findings to stakeholders.</p>

        <h3>Other Roles</h3>
        <p><strong>Forensic Investigators:</strong> Collecting, preserving, analyzing digital evidence related to
            security incidents.</p>
        <p><strong>Threat Hunters:</strong> Detecting, analyzing, defending against new and advanced cybersecurity
            threats.</p>

        <h2>Key Takeaways</h2>
        <p>Recognizing the organizational structure of CSIRTs and SOCs helps understand incident response lifecycles and
            responsibilities of different security roles.</p>

    </article>
</section>

<section class="main-section" id="topic612">
    <h2>Overview of detection tools </h2>
    <article class="main-article">
        <h2>Why You Need Detection Tools</h2>
        <p>Detection tools, like home security systems, help organizations protect their networks and systems against
            unwanted and unauthorized access by continuously monitoring for suspicious activity and triggering alerts
            when necessary.</p>

        <h2>Detection Tools</h2>
        <p>As a security analyst, you'll encounter IDS, IPS, and EDR detection tools. Here's a comparison chart:</p>
        <table>
            <tr>
                <th>Capability</th>
                <th>IDS</th>
                <th>IPS</th>
                <th>EDR</th>
            </tr>
            <tr>
                <td>Detects malicious activity</td>
                <td>✓</td>
                <td>✓</td>
                <td>✓</td>
            </tr>
            <tr>
                <td>Prevents intrusions</td>
                <td>N/A</td>
                <td>✓</td>
                <td>✓</td>
            </tr>
            <tr>
                <td>Logs activity</td>
                <td>✓</td>
                <td>✓</td>
                <td>✓</td>
            </tr>
            <tr>
                <td>Generates alerts</td>
                <td>✓</td>
                <td>✓</td>
                <td>✓</td>
            </tr>
            <tr>
                <td>Performs behavioral analysis</td>
                <td>N/A</td>
                <td>N/A</td>
                <td>✓</td>
            </tr>
        </table>

        <h3>Overview of IDS tools</h3>
        <p>An Intrusion Detection System (IDS) monitors system activity and alerts on possible intrusions, providing
            continuous monitoring to detect potential malicious activity.</p>

        <h3>Overview of IPS tools</h3>
        <p>An Intrusion Prevention System (IPS) monitors and takes action to stop intrusive activity, preventing and
            minimizing the effects of intrusions by modifying access controls.</p>

        <h3>Overview of EDR tools</h3>
        <p>Endpoint Detection and Response (EDR) tools monitor endpoint devices for malicious activity, collecting and
            analyzing endpoint system data to identify and respond to threats, often using behavioral analysis and
            automation.</p>

        <h2>Key Takeaways</h2>
        <p>Detection tools like IDS, IPS, and EDR help organizations gain awareness of activity in their environments,
            providing the ability to detect, log, alert, and stop potential malicious activity.</p>
    </article>
</section>

<section class="main-section" id="topic613">
    <h2>Overview of SIEM technology </h2>
    <article class="main-article">
        <h2>SIEM Advantages</h2>
        <p>SIEM tools provide several advantages for security teams:</p>
        <ul>
            <li>Access to event data</li>
            <li>Monitoring, detecting, and alerting</li>
            <li>Log storage</li>
        </ul>

        <h2>The SIEM Process</h2>
        <p>The SIEM process consists of three critical steps:</p>
        <ol>
            <li>Collect and aggregate data</li>
            <li>Normalize data</li>
            <li>Analyze data</li>
        </ol>

        <h3>Collect and Aggregate Data</h3>
        <img src="resource/siem1.png" id="img" alt="">
        <p>During this step, event data is collected from various sources and aggregated in one location. Parsing may
            occur to extract and map data fields and values for easier interpretation.</p>

        <h3>Normalize Data</h3>
        <img src="resource/siem2.png" id="img" alt="">
        <p>Data collected from different sources is transformed into a standard, structured format through
            normalization, making it easily searchable.</p>

        <h3>Analyze Data</h3>
        <p>In this final step, SIEM tools analyze the data using detection logic, such as rules and conditions. Alerts
            are generated if any log activity matches a rule, facilitating investigation by cybersecurity teams.</p>

        <h2>SIEM Tools</h2>
        <p>Commonly used SIEM tools in the cybersecurity industry include:</p>
        <ul>
            <li>AlienVault® OSSIM™</li>
            <li>Chronicle</li>
            <li>Elastic</li>
            <li>Exabeam</li>
            <li>IBM QRadar® Security Intelligence Platform</li>
            <li>LogRhythm</li>
            <li>Splunk</li>
        </ul>

        <h2>Key Takeaways</h2>
        <p>By understanding how SIEM tools work and the process involved, security analysts can contribute effectively
            to incident detection and response efforts, aiding in analyzing log data, identifying threats, and improving
            security posture.</p>

    </article>
</section>

<section class="main-section" id="topic614">
    <h2>Glossary terms from module 1
    </h2>
    <article class="main-article">
        <h2>Terms and Definitions</h2>
        <dl>
            <dt>Computer security incident response teams (CSIRT)</dt>
            <dd>A specialized group of security professionals that are trained in incident management and response.</dd>

            <dt>Documentation</dt>
            <dd>Any form of recorded content that is used for a specific purpose.</dd>

            <dt>Endpoint detection and response (EDR)</dt>
            <dd>An application that monitors an endpoint for malicious activity.</dd>

            <dt>Event</dt>
            <dd>An observable occurrence on a network, system, or device.</dd>

            <dt>False negative</dt>
            <dd>A state where the presence of a threat is not detected.</dd>

            <dt>False positive</dt>
            <dd>An alert that incorrectly detects the presence of a threat.</dd>

            <dt>Incident</dt>
            <dd>An occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality,
                integrity, or availability of information or an information system; or constitutes a violation or
                imminent threat of violation of law, security policies, security procedures, or acceptable use policies.
            </dd>

            <dt>Incident handler’s journal</dt>
            <dd>A form of documentation used in incident response.</dd>

            <dt>Incident response plan</dt>
            <dd>A document that outlines the procedures to take in each step of incident response.</dd>

            <dt>Intrusion detection system (IDS)</dt>
            <dd>An application that monitors system activity and alerts on possible intrusions.</dd>

            <dt>Intrusion prevention system (IPS)</dt>
            <dd>An application that monitors system activity for intrusive activity and takes action to stop the
                activity.</dd>

            <dt>National Institute of Standards and Technology (NIST) Incident Response Lifecycle</dt>
            <dd>A framework for incident response consisting of four phases: Preparation; Detection and Analysis;
                Containment, Eradication, and Recovery; and Post-incident activity.</dd>

            <dt>Playbook</dt>
            <dd>A manual that provides details about any operational action.</dd>

            <dt>Security information and event management (SIEM)</dt>
            <dd>An application that collects and analyzes log data to monitor critical activities in an organization.
            </dd>

            <dt>Security operations center (SOC)</dt>
            <dd>An organizational unit dedicated to monitoring networks, systems, and devices for security threats or
                attacks.</dd>

            <dt>Security orchestration, automation, and response (SOAR)</dt>
            <dd>A collection of applications, tools, and workflows that uses automation to respond to security events.
            </dd>

            <dt>True negative</dt>
            <dd>A state where there is no detection of malicious activity.</dd>

            <dt>True positive</dt>
            <dd>An alert that correctly detects the presence of an attack.</dd>
        </dl>

    </article>
</section>


<section class="main-section" id="Module 62">
    <h2>Module 2</h2>
</section>
<br> <br>


<section class="main-section" id="topic621">
    <h2>Maintain awareness with network monitoring</h2>
    <article class="main-article">
        <h2>Network Monitoring</h2>
        <p>Network communication can be noisy! Events like sending an email, streaming a video, or visiting a website
            all produce network communications in the form of network traffic and network data. As a reminder, network
            traffic is the amount of data that moves across a network. It can also include the type of data that is
            transferred, such as HTTP. Network data is the data that's transmitted between devices on a network.</p>
        <p>Network monitoring is essential in maintaining situational awareness of any activity on a network. By
            collecting and analyzing network traffic, organizations can detect suspicious network activity. But before
            networks can be monitored, you must know exactly what to monitor. In this reading, you'll learn more about
            the importance of network monitoring, ways to monitor your network, and network monitoring tools.</p>

        <h3>Know your network</h3>
        <p>As you’ve learned, networks connect devices, and devices then communicate and exchange data using network
            protocols. Network communications provide information about connections such as source and destination IP
            addresses, amount of data transferred, date and time, and more. This information can be valuable for
            security professionals when developing a baseline of normal or expected behavior.</p>
        <img src="resource/baseline.png" id="img">
        <p>A baseline is a reference point that’s used for comparison. You've probably encountered or used baselines at
            some point. For example, a grocery amount for a personal budget is an example of a baseline that can be used
            to help identify any patterns or changes in spending habits. In security, baselines help establish a
            standard of expected or normal behavior for systems, devices, and networks. Essentially, by knowing the
            baseline of normal network behavior, you'll be better able to identify abnormal network behavior.</p>

        <h3>Monitor your network</h3>
        <p>Once you’ve determined a baseline, you can monitor a network to identify any deviations from that baseline.
            Monitoring involves examining network components to detect unusual activities, such as large and unusual
            data transfers. Here are examples of network components that can be monitored to detect malicious activity:
        </p>

        <h4>Flow analysis</h4>
        <p>Flow refers to the movement of network communications and includes information related to packets, protocols,
            and ports. Malicious actors can use protocols and ports that are not commonly associated to maintain
            communications between the compromised system and their own machine. Organizations must know which ports
            should be open and approved for connections, and watch out for any mismatches between ports and their
            associated protocols.</p>

        <h4>Packet payload information</h4>
        <p>Network packets contain components related to the transmission of the packet. This includes details like
            source and destination IP address, and the packet payload information, which is the actual data that’s
            transmitted. Organizations can monitor the payload information of packets to uncover unusual activity, such
            as sensitive data transmitting outside of the network, which could indicate a possible data exfiltration
            attack.</p>

        <h4>Temporal patterns</h4>
        <p>Network packets contain information relating to time. Through network monitoring, organizations can promptly
            detect network intrusions and work to prevent them from happening by securing network components.</p>

        <h3>Protect your network</h3>
        <p>In this program, you’ve learned about security operations centers (SOC) and their role in monitoring systems
            against security threats and attacks. Organizations may deploy a network operations center (NOC), which is
            an organizational unit that monitors the performance of a network and responds to any network disruption,
            such as a network outage.</p>

        <img src="resource/baseline2.png" id="img" alt="">

        <p>Security analysts monitor networks to identify any signs of potential security incidents known as indicators
            of compromise (IoC) and protect networks from threats or attacks. To do this, they must understand the
            environment that network communications travel through so that they can identify deviations in network
            traffic.</p>

        <h3>Network monitoring tools</h3>
        <p>Network monitoring can be automated or performed manually. Some common network monitoring tools can include:
        </p>

        <ul>
            <li><strong>Intrusion detection systems (IDS):</strong> monitor system activity and alert on possible
                intrusions.</li>
            <li><strong>Network protocol analyzers:</strong> also known as packet sniffers, are tools designed to
                capture and analyze data traffic within a network.</li>
        </ul>

        <p><strong>Key takeaways:</strong> Monitoring and protecting networks from intrusions and attacks are key
            responsibilities of security professionals. You can’t protect what you don’t know. As a security analyst,
            you’ll need to know the components of a network and the communications that happen on it, so you can better
            protect it. Baselines provide a way to understand network traffic by uncovering common patterns which help
            in identifying any deviations from the expected traffic patterns. Tools like intrusion detection systems and
            network protocol analyzers support efforts in monitoring network activities.</p>

    </article>
</section>

<section class="main-section" id="topic622">
    <h2>Learn more about packet captures </h2>
    <article class="main-article">
        <h2>The Basics of Network Analysis</h2>
        <p>The role of security analysts involves monitoring and analyzing network traffic flows. One way to do this is
            by generating packet captures and then analyzing the captured traffic to identify unusual activity on a
            network.</p>
        <p>Previously in the program, you learned that a data packet is a basic unit of information that travels from
            one device to another within a network. Detecting network intrusions begins at the packet level. That's
            because packets form the basis of information exchange over a network. Each time you perform an activity on
            the internet—like visiting a website—packets are sent and received between your computer and the website’s
            server. These packets are what help transmit information through a network. For example, when uploading an
            image to a website, the data gets broken up into multiple packets, which then get routed to the intended
            destination and reassembled upon delivery.</p>

        <p>In cybersecurity, packets provide valuable information that helps add context to events during
            investigations. Understanding the transfer of information through packets will not only help you develop
            insight on network activity, it will also help you identify abnormalities and better defend networks from
            attacks.</p>

        <h3>Packets</h3>
        <p>Packets contain three components: the header, the payload, and the footer. Here’s a description of each of
            these components.</p>

        <h4>Header</h4>
        <p>Headers provide information that’s used to route packets to their destination. This includes information
            about the source and destination IP addresses, packet length, protocol, packet identification numbers, and
            more.
            <img src="resource/gh.png" id="img" alt="">
        </p>

        <h4>Payload</h4>
        <p>The payload component directly follows the header and contains the actual data being delivered. For example,
            the payload of a packet containing an uploaded image would be the image itself.</p>

        <h4>Footer</h4>
        <p>The footer, also known as the trailer, is located at the end of a packet. It provides error-checking
            information to determine if data has been corrupted. Most protocols, such as the Internet Protocol (IP), do
            not use footers.</p>

        <h3>Network Protocol Analyzers</h3>
        <p>Network protocol analyzers (packet sniffers) are tools designed to capture and analyze data traffic within a
            network. Examples of network protocol analyzers include tcpdump, Wireshark, and TShark.</p>
        <img src="resource/gf.png" id="img" alt="">

        <h4>How network protocol analyzers work</h4>
        <p>Network protocol analyzers use both software and hardware capabilities to capture network traffic and display
            it for security analysts to examine and analyze. Here’s how:</p>

        <ul>
            <li>Packets must be collected from the network via the Network Interface Card (NIC), which is hardware that
                connects computers to a network. NICs receive and transmit network traffic, but by default they only
                listen to network traffic that’s addressed to them. To capture all network traffic that is sent over the
                network, a NIC must be switched to a mode that has access to all visible network data packets.</li>
            <li>The network protocol analyzer collects the network traffic in raw binary format and converts it into a
                human-readable format for analysis.</li>
        </ul>

        <h4>Capturing Packets</h4>
        <p>Packet sniffing is the practice of capturing and inspecting data packets across a network. A packet capture
            (p-cap) is a file containing data packets intercepted from an interface or network. Packet captures can be
            viewed and further analyzed using network protocol analyzers.</p>

        <p>P-cap files can come in many formats depending on the packet capture library that’s used. You should be
            familiar with libraries such as Libpcap, WinPcap, Npcap, and PCAPng.</p>

        <h3>Key Takeaways</h3>
        <p>Network protocol analyzers are helpful investigative tools that provide insight into the activity happening
            on a network. As an analyst, you'll use network protocol analyzer tools to view and analyze packet capture
            files to better understand network communications and defend against intrusions.</p>

    </article>
</section>


<section class="main-section" id="topic623">
    <h2>Investigate packet details</h2>
    <article class="main-article">
        <!DOCTYPE html>
        <html lang="en">

        <head>
            <meta charset="UTF-8">
            <meta name="viewport" content="width=device-width, initial-scale=1.0">
            <title>Wireshark and Packet Analysis</title>
        </head>

        <body>
            <h2>Wireshark and Packet Analysis</h2>
            <p>So far, you've learned about how network protocol analyzers (packet sniffers) intercept network
                communications. You've also learned how you can analyze packet captures (p-caps) to gain insight into
                the activity happening on a network. As a security analyst, you'll use your packet analysis skills to
                inspect network packets and identify suspicious activity during investigations.</p>

            <h3>Internet Protocol (IP)</h3>
            <p>Packets form the foundation of data exchange over a network, which means that detection begins at the
                packet level. The Internet Protocol (IP) includes a set of standards used for routing and addressing
                data packets as they travel between devices on a network. IP operates as the foundation for all
                communications over the internet.</p>

            <p>IP ensures that packets reach their destinations. There are two versions of IP that you will find in use
                today: IPv4 and IPv6. Both versions use different headers to structure packet information.</p>

            <h4>IPv4</h4>
            <p>IPv4 is the most commonly used version of IP. There are thirteen fields in the header:</p>
            <ul>
                <li><strong>Version:</strong> This field indicates the IP version. For an IPv4 header, IPv4 is used.
                </li>
                <li><strong>Internet Header Length (IHL):</strong> This field specifies the length of the IPv4 header
                    including any Options.</li>
                <li><strong>Type of Service (ToS):</strong> This field provides information about packet priority for
                    delivery.</li>
                <li><strong>Total Length:</strong> This field specifies the total length of the entire IP packet
                    including the header and the data.</li>
                <li><strong>Identification:</strong> Packets that are too large to send are fragmented into smaller
                    pieces. This field specifies a unique identifier for fragments of an original IP packet so that they
                    can be reassembled once they reach their destination.</li>
                <li><strong>Flags:</strong> This field provides information about packet fragmentation including whether
                    the original packet has been fragmented and if there are more fragments in transit.</li>
                <li><strong>Fragment Offset:</strong> This field is used to identify the correct sequence of fragments.
                </li>
                <li><strong>Time to Live (TTL):</strong> This field limits how long a packet can be circulated in a
                    network, preventing packets from being forwarded by routers indefinitely.</li>
                <li><strong>Protocol:</strong> This field specifies the protocol used for the data portion of the
                    packet.</li>
                <li><strong>Header Checksum:</strong> This field specifies a checksum value which is used for
                    error-checking the header.</li>
                <li><strong>Source Address:</strong> This field specifies the source address of the sender.</li>
                <li><strong>Destination Address:</strong> This field specifies the destination address of the receiver.
                </li>
                <li><strong>Options:</strong> This field is optional and can be used to apply security options to a
                    packet.</li>
            </ul>
            <!-- Insert the IPv4 header image here -->
            <img src="resource/a.png" id="img" alt="">

            <h4>IPv6</h4>
            <p>IPv6 adoption has been increasing because of its large address space. There are eight fields in the
                header:</p>
            <ul>
                <li><strong>Version:</strong> This field indicates the IP version. For an IPv6 header, IPv6 is used.
                </li>
                <li><strong>Traffic Class:</strong> This field is similar to the IPv4 Type of Service field. The Traffic
                    Class field provides information about the packet's priority or class to help with packet delivery.
                </li>
                <li><strong>Flow Label:</strong> This field identifies the packets of a flow. A flow is the sequence of
                    packets sent from a specific source.</li>
                <li><strong>Payload Length:</strong> This field specifies the length of the data portion of the packet.
                </li>
                <li><strong>Next Header:</strong> This field indicates the type of header that follows the IPv6 header
                    such as TCP.</li>
                <li><strong>Hop Limit:</strong> This field is similar to the IPv4 Time to Live field. The Hop Limit
                    limits how long a packet can travel in a network before being discarded.</li>
                <li><strong>Source Address:</strong> This field specifies the source address of the sender.</li>
                <li><strong>Destination Address:</strong> This field specifies the destination address of the receiver.
                </li>
            </ul>
            <!-- Insert the IPv6 header image here -->
            <img src="resource/b.png" id="img" alt="">

            <h3>Wireshark</h3>
            <p>Wireshark is an open-source network protocol analyzer. It uses a graphical user interface (GUI), which
                makes it easier to visualize network communications for packet analysis purposes. Wireshark has many
                features to explore that are beyond the scope of this course. You'll focus on how to use basic filtering
                to isolate network packets so that you can find what you need.</p>
            <img src="resource/c.png" id="img" alt="">

            <h4>Display filters</h4>
            <p>Wireshark's display filters let you apply filters to packet capture files. This is helpful when you are
                inspecting packet captures with large volumes of information. Display filters will help you find
                specific information that's most relevant to your investigation. You can filter packets based on
                information such as protocols, IP addresses, ports, and virtually any other property found in a packet.
                Here, you'll focus on display filtering syntax and filtering for protocols, IP addresses, and ports.</p>

            <h4>Comparison operators</h4>
            <p>You can use different comparison operators to locate specific header fields and values. Comparison
                operators can be expressed using either abbreviations or symbols.</p>

            <table>
                <h2>Comparison Operators Table</h2>

                <tr>
                    <th>Operator type</th>
                    <th>Symbol</th>
                    <th>Abbreviation</th>
                </tr>
                <tr>
                    <td>Equal</td>
                    <td>==</td>
                    <td>eq</td>
                </tr>
                <tr>
                    <td>Not equal</td>
                    <td>!=</td>
                    <td>ne</td>
                </tr>
                <tr>
                    <td>Greater than</td>
                    <td>&gt;</td>
                    <td>gt</td>
                </tr>
                <tr>
                    <td>Less than</td>
                    <td>&lt;</td>
                    <td>lt</td>
                </tr>
                <tr>
                    <td>Greater than or equal to</td>
                    <td>&gt;=</td>
                    <td>ge</td>
                </tr>
                <tr>
                    <td>Less than or equal to</td>
                    <td>&lt;=</td>
                    <td>le</td>
                </tr>

            </table>


            <h4>Contains operator</h4>
            <p>The contains operator is used to filter packets that contain an exact match of a string of text.</p>
            <!-- Insert the contains operator example here -->
            <img src="resource/d.png" id="img" alt="">

            <h4>Matches operator</h4>
            <p>The matches operator is used to filter packets based on the regular expression (regex) that's specified.
            </p>
            <!-- Insert the matches operator example here -->

            <h4>Filter toolbar</h4>
            <p>You can apply filters to a packet capture using Wireshark's filter toolbar.</p>
            <img src="resource/e.png" id="img" alt="">
            <!-- Insert the filter toolbar example here -->

            <h4>Filter for protocols</h4>
            <p>Protocol filtering is one of the simplest ways you can use display filters. You can simply enter the name
                of the protocol to filter.</p>
            <!-- Insert the protocol filtering example here -->
            <ul>
                <li>dns</li>
                <li>http</li>
                <li>ftp</li>
                <li>ssh</li>
                <li>arp</li>
                <li>telnet</li>
                <li>icmp</li>
            </ul>

            <h4>Filter for an IP address</h4>
            <p>You can use display filters to locate packets with a specific IP address.</p>
            <!-- Insert the IP address filtering example here -->
            <p>For example, if you would like to filter packets that contain a specific IP address use
                <code>ip.addr</code>, followed by a space, the equal <code>==</code> comparison operator, and the IP
                address. Here is an example of a display filter that filters for the IP address
                <code>172.21.224.2</code>:
            </p>
            <p><code>ip.addr == 172.21.224.2</code></p>
            <p>To filter for packets originating from a specific source IP address, you can use the <code>ip.src</code>
                filter. Here is an example that looks for the <code>10.10.10.10</code> source IP address:</p>
            <p><code>ip.src == 10.10.10.10</code></p>
            <p>To filter for packets delivered to a specific destination IP address, you can use the <code>ip.dst</code>
                filter. Here is an example that searches for the <code>4.4.4.4</code> destination IP address:</p>
            <p><code>ip.dst == 4.4.4.4</code></p>


            <h4>Filter for a MAC address</h4>
            <p>You can also filter packets according to the Media Access Control (MAC) address.</p>
            <!-- Insert the MAC address filtering example here -->
            <h4>Here's an example:</h4>
            <code>

            eth.addr == 00:70:f4:23:18:c4</code>

            <h4>Filter for ports</h4>
            <p>Port filtering is used to filter packets based on port numbers.</p>
            <!-- Insert the port filtering example here -->

            <h4>Follow streams</h4>
            <p>Wireshark provides a feature that lets you filter for packets specific to a protocol and view streams.
            </p>
            <img src="resource/f.png" id="img" alt="">
            <!-- Insert the follow streams example here -->

            <h3>Key takeaways</h3>
            <p>In this reading, you explored basic display filters with Wireshark. Packet analysis is an essential skill
                that you will continue to develop over time in your cybersecurity journey. Put your skills to practice
                in the upcoming activity and explore investigating the details of a packet capture file using Wireshark!
            </p>

    </article>
</section>

<section class="main-section" id="topic624">
    <h2>Overview of tcpdump </h2>
    <article class="main-article">
        <p>As a security analyst, you’ll use network protocol analyzers to help defend against any network intrusions.
            Previously, you learned the following terms related to network monitoring and analysis:</p>
        <ul>
            <li>A network protocol analyzer (packet sniffer) is a tool designed to capture and analyze data traffic
                within a network.</li>
            <li>Packet sniffing is the practice of capturing and inspecting data packets across a network.</li>
        </ul>
        <p>In this reading, you'll learn more about tcpdump, a network protocol analyzer that can be used to capture and
            view network communications.</p>
        <h2>What is tcpdump?</h2>
        <p>Tcpdump is a command-line network protocol analyzer. Recall that a command-line interface (CLI) is a
            text-based user interface that uses commands to interact with the computer.</p>
        <p>Tcpdump is used to capture network traffic. This traffic can be saved to a packet capture (p-cap), which is a
            file containing data packets intercepted from an interface or network. The p-cap file can be accessed,
            analyzed, or shared at a later time. Analysts use tcpdump for a variety of reasons, from troubleshooting
            network issues to identifying malicious activity. Tcpdump comes pre-installed in many Linux distributions
            and can also be installed on other Unix-based operating systems such as macOS®.</p>
        <p><strong>Note:</strong> It's common for network traffic to be encrypted, which means data is encoded and
            unreadable. Inspecting the network packets might require decrypting the data using the appropriate private
            keys.</p>
        <h2>Capturing packets with tcpdump</h2>
        <p>Previously in this program, you learned that a Linux root user (or superuser) has elevated privileges to
            modify the system. You also learned that the sudo command temporarily grants elevated permissions to
            specific users in Linux. Like many other packet sniffing tools, you’ll need to have administrator-level
            privileges to capture network traffic using tcpdump. This means you will need to either be logged in as the
            root user or have the ability to use the sudo command. Here is a breakdown of the tcpdump syntax for
            capturing packets:</p>
        <p><code>sudo tcpdump [-i interface] [option(s)] [expression(s)]</code></p>
        <ul>
            <li>The <code>sudo tcpdump</code> command begins running tcpdump using elevated permissions as sudo.</li>
            <li>The <code>-i</code> parameter specifies the network interface to capture network traffic. You must
                specify a network interface to capture from to begin capturing packets. For example, if you specify
                <code>-i any</code> you’ll sniff traffic from all network interfaces on the system.
            </li>
            <li>The option(s) are optional and provide you with the ability to alter the execution of the command. The
                expression(s) are a way to further filter network traffic packets so that you can isolate network
                traffic. You’ll learn more about option(s) and expression(s) in the next section.</li>
        </ul>
        <p><strong>Note:</strong> Before you can begin capturing network traffic, you must identify which network
            interface you'll want to use to capture packets from. You can use the <code>-D</code> flag to list the
            network interfaces available on a system.</p>
        <h2>Options</h2>
        <p>With tcpdump, you can apply options, also known as flags, to the end of commands to filter network traffic.
            Short options are abbreviated and represented by a hyphen and a single character like <code>-i</code>. Long
            options are spelled out using a double hyphen like <code>--interface</code>. Tcpdump has over fifty options
            that you can explore using the manual page. Here, you’ll examine a couple of essential tcpdump options
            including how to write and read packet capture files.</p>
        <p><strong>Note:</strong> Options are case sensitive. For example, a lowercase <code>-w</code> is a separate
            option with a different use than the option with an uppercase <code>-W</code>.</p>
        <p><strong>Note:</strong> tcpdump options that are written using short options can be written with or without a
            space between the option and its value. For example, <code>sudo tcpdump -i any -c 3</code> and
            <code>sudo tcpdump -iany -c3</code> are equivalent commands.
        </p>
        <h3>-w</h3>
        <p>Using the <code>-w</code> flag, you can write or save the sniffed network packets to a packet capture file
            instead of just printing it out in the terminal. This is very useful because you can refer to this saved
            file for later analysis. In this command, tcpdump is capturing network traffic from all network interfaces
            and saving it to a packet capture file named <code>packetcapture.pcap</code>:</p>
        <p><code>sudo tcpdump -i any -w packetcapture.pcap</code></p>
        <h3>-r</h3>
        <p>Using the <code>-r</code> flag, you can read a packet capture file by specifying the file name as a
            parameter. Here is an example of a tcpdump command that reads a file called <code>packetcapture.pcap</code>:
        </p>
        <p><code>sudo tcpdump -r packetcapture.pcap</code></p>
        <h3>-v</h3>
        <p>As you’ve learned, packets contain a lot of information. By default, tcpdump will not print out all of a
            packet's information. This option, which stands for verbose, lets you control how much packet information
            you want tcpdump to print out.</p>
        <p>There are three levels of verbosity you can use depending on how much packet information you want tcpdump to
            print out. The levels are <code>-v</code>, <code>-vv</code>, and <code>-vvv</code>. The level of verbosity
            increases with each added v. The verbose option can be helpful if you’re looking for packet information like
            the details of a packet’s IP header fields. Here’s an example of a tcpdump command that reads the
            <code>packetcapture.pcap</code> file with verbosity:
        </p>
        <p><code>sudo tcpdump -r packetcapture.pcap -v</code></p>
        <h3>-c</h3>
        <p>The <code>-c</code> option stands for count. This option lets you control how many packets tcpdump will
            capture. For example, specifying <code>-c 1</code> will only print out one single packet, whereas
            <code>-c 10</code> prints out 10 packets. This example is telling tcpdump to only capture the first three
            packets it sniffs from any network interface:
        </p>
        <p><code>sudo tcpdump -i any -c 3</code></p>
        <h3>-n</h3>
        <p>By default, tcpdump will perform name resolution. This means that tcpdump automatically converts IP addresses
            to names. It will also resolve ports to commonly associated services that use these ports. This can be
            problematic because tcpdump isn’t always accurate in name resolution. For example, tcpdump can capture
            traffic from port 80 and automatically translates port 80 to HTTP in the output. However, this is misleading
            because port 80 isn’t always going to be using HTTP; it could be using a different protocol.</p>
        <p>Additionally, name resolution uses what’s known as a reverse DNS lookup. A reverse DNS lookup is a query that
            looks for the domain name associated with an IP address. If you perform a reverse DNS lookup on an
            attacker’s system, they might be alerted that you are investigating them through their DNS records.</p>
        <p>Using the <code>-n</code> flag disables this automatic mapping of numbers to names and is considered to be
            best practice when sniffing or analyzing traffic. Using <code>-n</code> will not resolve hostnames, whereas
            <code>-nn</code> will not resolve both hostnames or ports. Here’s an example of a tcpdump command that reads
            the <code>packetcapture.pcap</code> file with verbosity and disables name resolution:
        </p>
        <p><code>sudo tcpdump -r packetcapture.pcap -v -n</code></p>
        <p><strong>Pro tip:</strong> You can combine options together. For example, <code>-v</code> and <code>-n</code>
            can be combined as <code>-vn</code>. But, if an option accepts a parameter right after it like
            <code>-c 1</code> or <code>-r capture.pcap</code> then you can’t combine other options to it.
        </p>
        <h2>Expressions</h2>
        <p>Using filter expressions in tcpdump commands is also optional, but knowing how and when to use filter
            expressions can be helpful during packet analysis. There are many ways to use filter expressions.</p>
        <p>If you want to specifically search for network traffic by protocol, you can use filter expressions to isolate
            network packets. For example, you can filter to find only IPv6 traffic using the filter expression
            <code>ip6</code>.
        </p>
        <p>You can also use boolean operators like <code>and</code>, <code>or</code>, or <code>not</code> to further
            filter network traffic for specific IP addresses, ports, and more. The example below reads the
            <code>packetcapture.pcap</code> file and combines two expressions <code>ip</code> and <code>port 80</code>
            using the <code>and</code> boolean operator:
        </p>
        <p><code>sudo tcpdump -r packetcapture.pcap -n 'ip and port 80'</code></p>
        <p><strong>Pro tip:</strong> You can use single or double quotes to ensure that tcpdump executes all of the
            expressions. You can also use parentheses to group and prioritize different expressions. Grouping
            expressions is helpful for complex or lengthy commands. For example, the command
            <code>ip and (port 80 or port 443)</code> tells tcpdump to prioritize executing the filters enclosed in the
            parentheses before filtering for IPv4.
        </p>
        <h2>Interpreting output</h2>
        <p>Once you run a command to capture packets, tcpdump will print the output of the command as the sniffed
            packets. In the output, tcpdump prints one line of text for each packet with each line beginning with a
            timestamp. Here’s an example of a command and output for a single TCP packet:</p>
        <p><code>sudo tcpdump -i any -v -c 1</code></p>
        <p>This command tells tcpdump to capture packets on <code>-i any</code> network interface. The option
            <code>-v</code> prints out the packet with detailed information and the option <code>-c 1</code> prints out
            only one packet. Here is the output of this command:
        </p>
        <img src="resource/tcpd.png" id="img"
            alt="Output of a tcpdump command with labels for the timestamp, source IP, source port, destination IP, and destination port." />
        <ul>
            <li><strong>Timestamp:</strong> The output begins with the timestamp, which starts with hours, minutes,
                seconds, and fractions of a second.</li>
            <li><strong>Source IP:</strong> The packet’s origin is provided by its source IP address.</li>
            <li><strong>Source port:</strong> This port number is where the packet originated.</li>
            <li><strong>Destination IP:</strong> The destination IP address is where the packet is being transmitted to.
            </li>
            <li><strong>Destination port:</strong> This port number is where the packet is being transmitted to.</li>
        </ul>
        <p>The remaining output contains details of the TCP connection including flags and sequence number. The options
            information is additional packet information that the <code>-v</code> option has provided.</p>
        <h2>Key takeaways</h2>
        <p>In security, you’ll likely encounter using network protocol analyzer tools like tcpdump. It’s important to be
            equipped with the knowledge of capturing, filtering, and interpreting network packets on the command line.
        </p>
    </article>
</section>

<section class="main-section" id="topic625">
    <h2>Glossary terms from module 2</h2>
    <article class="main-article">
        <table>
            <tr>
                <th>Term</th>
                <th>Definition</th>
            </tr>
            <tr>
                <td>Command and control (C2)</td>
                <td>The techniques used by malicious actors to maintain communications with compromised systems</td>
            </tr>
            <tr>
                <td>Command-line interface (CLI)</td>
                <td>A text-based user interface that uses commands to interact with the computer</td>
            </tr>
            <tr>
                <td>Data exfiltration</td>
                <td>Unauthorized transmission of data from a system</td>
            </tr>
            <tr>
                <td>Data packet</td>
                <td>A basic unit of information that travels from one device to another within a network</td>
            </tr>
            <tr>
                <td>Indicators of compromise (IoC)</td>
                <td>Observable evidence that suggests signs of a potential security incident</td>
            </tr>
            <tr>
                <td>Internet Protocol (IP)</td>
                <td>A set of standards used for routing and addressing data packets as they travel between devices on a
                    network</td>
            </tr>
            <tr>
                <td>Intrusion detection systems (IDS)</td>
                <td>An application that monitors system activity and alerts on possible intrusions</td>
            </tr>
            <tr>
                <td>Media Access Control (MAC) Address</td>
                <td>A unique alphanumeric identifier that is assigned to each physical device on a network</td>
            </tr>
            <tr>
                <td>National Institute of Standards and Technology (NIST) Incident Response Lifecycle</td>
                <td>A framework for incident response consisting of four phases: Preparation; Detection and Analysis;
                    Containment, Eradication and Recovery; and Post-incident activity</td>
            </tr>
            <tr>
                <td>Network data</td>
                <td>The data that’s transmitted between devices on a network</td>
            </tr>
            <tr>
                <td>Network protocol analyzer (packet sniffer)</td>
                <td>A tool designed to capture and analyze data traffic within a network</td>
            </tr>
            <tr>
                <td>Network traffic</td>
                <td>The amount of data that moves across a network</td>
            </tr>
            <tr>
                <td>Network Interface Card (NIC)</td>
                <td>Hardware that connects computers to a network</td>
            </tr>
            <tr>
                <td>Packet capture (p-cap)</td>
                <td>A file containing data packets intercepted from an interface or network</td>
            </tr>
            <tr>
                <td>Packet sniffing</td>
                <td>The practice of capturing and inspecting data packets across a network</td>
            </tr>
            <tr>
                <td>Playbook</td>
                <td>A manual that provides details about any operational action</td>
            </tr>
            <tr>
                <td>Root user (or superuser)</td>
                <td>A user with elevated privileges to modify the system</td>
            </tr>
            <tr>
                <td>Sudo</td>
                <td>A command that temporarily grants elevated permissions to specific users</td>
            </tr>
            <tr>
                <td>tcpdump</td>
                <td>A command-line network protocol analyzer</td>
            </tr>
            <tr>
                <td>Wireshark</td>
                <td>An open-source network protocol analyzer</td>
            </tr>
        </table>
    </article>
</section>


<section class="main-section" id="Module 63">
    <h2>Module 3</h2>
</section>
<br> <br>


<section class="main-section" id="topic631">
    <h2>Cybersecurity incident detection methods</h2>
    <article class="main-article">

        <h2>Methods of Detection</h2>

        <p><strong>Threat hunting</strong></p>
        <p>Threats evolve and attackers advance their tactics and techniques. Automated, technology-driven detection can
            be limited in keeping up to date with the evolving threat landscape. Human-driven detection like threat
            hunting combines the power of technology with a human element to discover hidden threats left undetected by
            detection tools.</p>
        <p><strong>Threat intelligence</strong></p>
        <p>Organizations can improve their detection capabilities by staying updated on the evolving threat landscape
            and understanding the relationship between their environment and malicious actors. One way to understand
            threats is by using threat intelligence, which is evidence-based threat information that provides context
            about existing or emerging threats.</p>
        <p><strong>Cyber deception</strong></p>
        <p>Cyber deception involves techniques that deliberately deceive malicious actors with the goal of increasing
            detection and improving defensive strategies. Honeypots are an example of an active cyber defense mechanism
            that uses deception technology.</p>
        <p><strong>Key takeaways</strong></p>
        <p>Various detection methods can be implemented to identify and locate security events in an environment. It’s
            essential for organizations to use a variety of detection methods, tools, and technologies to adapt to the
            ever evolving threat landscape and better protect assets.</p>


    </article>
</section>

<section class="main-section" id="topic632">
    <h2>Indicators of compromise</h2>
    <article class="main-article">

        <h2>Indicators of Compromise</h2>

        <p>Indicators of compromise (IoCs) are observable evidence that suggests signs of a potential security incident.
            IoCs chart specific pieces of evidence that are associated with an attack, like a file name associated with
            a type of malware. You can think of an IoC as evidence that points to something that's already happened,
            like noticing that a valuable has been stolen from inside of a car.</p>

        <p>Indicators of attack (IoA) are the series of observed events that indicate a real-time incident. IoAs focus
            on identifying the behavioral evidence of an attacker, including their methods and intentions.</p>

        <p>Essentially, IoCs help to identify the who and what of an attack after it's taken place, while IoAs focus on
            finding the why and how of an ongoing or unknown attack. For example, observing a process that makes a
            network connection is an example of an IoA. The filename of the process and the IP address that the process
            contacted are examples of the related IoCs.</p>

        <p><strong>Note:</strong> Indicators of compromise are not always a confirmation that a security incident has
            happened. IoCs may be the result of human error, system malfunctions, and other reasons not related to
            security.</p>

        <h2>Pyramid of Pain</h2>

        <p>Not all indicators of compromise are equal in the value they provide to security teams. It’s important for
            security professionals to understand the different types of indicators of compromise so that they can
            quickly and effectively detect and respond to them. This is why security researcher David J. Bianco created
            the concept of the Pyramid of Pain, with the goal of improving how indicators of compromise are used in
            incident detection.</p>

        <p>A triangle divided into six tiers outlines six indicators of compromise each with a corresponding level of
            difficulty.</p>
        <img src="resource/pyramid.png" id="img" alt="">

        <p>The Pyramid of Pain captures the relationship between indicators of compromise and the level of difficulty
            that malicious actors experience when indicators of compromise are blocked by security teams. It lists the
            different types of indicators of compromise that security professionals use to identify malicious activity.
        </p>

        <p>Each type of indicator of compromise is separated into levels of difficulty. These levels represent the
            “pain” levels that an attacker faces when security teams block the activity associated with the indicator of
            compromise. For example, blocking an IP address associated with a malicious actor is labeled as easy because
            malicious actors can easily use different IP addresses to work around this and continue with their malicious
            efforts. If security teams are able to block the IoCs located at the top of the pyramid, the more difficult
            it becomes for attackers to continue their attacks. Here’s a breakdown of the different types of indicators
            of compromise found in the Pyramid of Pain.</p>

        <ul>
            <li><strong>Hash values:</strong> Hashes that correspond to known malicious files. These are often used to
                provide unique references to specific samples of malware or to files involved in an intrusion.</li>
            <li><strong>IP addresses:</strong> An internet protocol address like 192.168.1.1</li>
            <li><strong>Domain names:</strong> A web address such as www.google.com</li>
            <li><strong>Network artifacts:</strong> Observable evidence created by malicious actors on a network. For
                example, information found in network protocols such as User-Agent strings.</li>
            <li><strong>Host artifacts:</strong> Observable evidence created by malicious actors on a host. A host is
                any device that’s connected on a network. For example, the name of a file created by malware.</li>
            <li><strong>Tools:</strong> Software that’s used by a malicious actor to achieve their goal. For example,
                attackers can use password cracking tools like John the Ripper to perform password attacks to gain
                access into an account.</li>
            <li><strong>Tactics, techniques, and procedures (TTPs):</strong> This is the behavior of a malicious actor.
                Tactics refer to the high-level overview of the behavior. Techniques provide detailed descriptions of
                the behavior relating to the tactic. Procedures are highly detailed descriptions of the technique. TTPs
                are the hardest to detect.</li>
        </ul>

        <h2>Key takeaways</h2>

        <p>Indicators of compromise and indicators of attack are valuable sources of information for security
            professionals when it comes to detecting incidents. The Pyramid of Pain is a concept that can be used to
            understand the different types of indicators of compromise and the value they have in detecting and stopping
            malicious activity.</p>


    </article>
</section>

<section class="main-section" id="topic633">
    <h2>Analyze indicators of compromise with investigative tools</h2>
    <article class="main-article">

        <h2>Adding Context to Investigations</h2>

        <p>You've learned about the Pyramid of Pain which describes the relationship between indicators of compromise
            and the level of difficulty that malicious actors experience when indicators of compromise are blocked by
            security teams. You also learned about different types of IoCs, but as you know, not all IoCs are equal.
            Malicious actors can manage to evade detection and continue compromising systems despite having their
            IoC-related activity blocked or limited.</p>

        <p>For example, identifying and blocking a single IP address associated with malicious activity does not provide
            a broader insight on an attack, nor does it stop a malicious actor from continuing their activity. Focusing
            on a single piece of evidence is like fixating on a single section of a painting: You miss out on the bigger
            picture.</p>

        <img src="resource/wa.png" id="img" alt="A woman observes a single section of a large painting.">

        <p>Security analysts need a way to expand the use of IoCs so that they can add context to alerts. Threat
            intelligence is evidence-based threat information that provides context about existing or emerging threats.
            By accessing additional information related to IoCs, security analysts can expand their viewpoint to observe
            the bigger picture and construct a narrative that helps inform their response actions.</p>

        <img src="resource/wb.png" id="img" alt="A woman views a large painting of an elephant in its entirety.">

        <p>By adding context to an IoC—for instance, identifying other artifacts related to the suspicious IP address,
            such as suspicious network communications or unusual processes—security teams can start to develop a
            detailed picture of a security incident. This context can help security teams detect security incidents
            faster and take a more informed approach in their response.</p>

        <h3>The Power of Crowdsourcing</h3>

        <p>Crowdsourcing is the practice of gathering information using public input and collaboration. Threat
            intelligence platforms use crowdsourcing to collect information from the global cybersecurity community.
            Traditionally, an organization's response to incidents was performed in isolation. A security team would
            receive and analyze an alert, and then work to remediate it without additional insights on how to approach
            it. Without crowdsourcing, attackers can perform the same attacks against multiple organizations.</p>

        <img src="resource/wc.png" id="img" alt="An attacker successfully attacks five different organizations.">

        <p>With crowdsourcing, organizations harness the knowledge of millions of other cybersecurity professionals,
            including cybersecurity product vendors, government agencies, cloud providers, and more. Crowdsourcing
            allows people and organizations from the global cybersecurity community to openly share and access a
            collection of threat intelligence data, which helps to continuously improve detection technologies and
            methodologies.</p>

        <p>Examples of information-sharing organizations include Information Sharing and Analysis Centers (ISACs), which
            focus on collecting and sharing sector-specific threat intelligence to companies within specific industries
            like energy, healthcare, and others. Open-source intelligence (OSINT) is the collection and analysis of
            information from publicly available sources to generate usable intelligence. OSINT can also be used as a
            method to gather information related to threat actors, threats, vulnerabilities, and more.</p>

        <p>This threat intelligence data is used to improve the detection methods and techniques of security products,
            like detection tools or anti-virus software. For example, attackers often perform the same attacks on
            multiple targets with the hope that one of them will be successful. Once an organization detects an attack,
            they can immediately publish the attack details, such as malicious files, IP addresses, or URLs, to tools
            like VirusTotal. This threat intelligence can then help other organizations defend against the same attack.
        </p>

        <img src="resource/wd.png" id="img"
            alt="An attacker is prevented from attacking organizations due to crowdsourced threat intelligence.">

        <h3>VirusTotal</h3>

        <p><a href="https://www.virustotal.com/">VirusTotal</a> is a service that allows anyone to analyze suspicious
            files, domains, URLs, and IP addresses for malicious content. VirusTotal also offers additional services and
            tools for enterprise use. This reading focuses on the VirusTotal website, which is available for free and
            non-commercial use.</p>

        <p>It can be used to analyze suspicious files, IP addresses, domains, and URLs to detect cybersecurity threats
            such as malware. Users can submit and check artifacts, like file hashes or IP addresses, to get VirusTotal
            reports, which provide additional information on whether an IoC is considered malicious or not, how that IoC
            is connected or related to other IoCs in the dataset, and more.</p>

        <img src="resource/we.png" id="img" alt="A screenshot of the VirusTotal home page.">

        <p>Here is a breakdown of the reports summary:</p>

        <img src="resource/wf.png" id="img" alt="A screenshot of a VirusTotal reports summary.">

        <ul>
            <li><strong>Detection:</strong> The Detection tab provides a list of third-party security vendors and their
                detection verdicts on an IoC. For example, vendors can list their detection verdict as malicious,
                suspicious, unsafe, and more.</li>
            <li><strong>Details:</strong> The Details tab provides additional information extracted from a static
                analysis of the IoC. Information such as different hashes, file types, file sizes, headers, creation
                time, and first and last submission information can all be found in this tab.</li>
            <li><strong>Relations:</strong> The Relations tab provides related IoCs that are somehow connected to an
                artifact, such as contacted URLs, domains, IP addresses, and dropped files if the artifact is an
                executable.</li>
            <li><strong>Behavior:</strong> The Behavior tab contains information related to the observed activity and
                behaviors of an artifact after executing it in a controlled or sandboxed environment. This information
                includes tactics and techniques detected, network communications, registry and file systems actions,
                processes, and more.</li>
            <li><strong>Community:</strong> The Community tab is where members of the VirusTotal community, such as
                security professionals or researchers, can leave comments and insights about the IoC.</li>
            <li><strong>Vendors’ ratio and community score:</strong> The score displayed at the top of the report is the
                vendors’ ratio. The vendors’ ratio shows how many security vendors have flagged the IoC as malicious
                overall. Below this score, there is also the community score, based on the inputs of the VirusTotal
                community. The more detections a file has and the higher its community score is, the more likely that
                the file is malicious.</li>
        </ul>

        <p><strong>Note:</strong> Data uploaded to VirusTotal will be publicly shared with the entire VirusTotal
            community. Be careful of what you submit, and make sure you do not upload personal information.</p>

        <h3>Other Tools</h3>

        <p>There are other investigative tools that can be used to analyze IoCs. These tools can also share the data
            that's uploaded to them to the security community.</p>

        <p><a href="https://virusscan.jotti.org/">Jotti malware scan</a> is a free service that lets you scan suspicious
            files with several antivirus programs. There are some limitations to the number of files that you can
            submit.</p>

        <p><a href="https://urlscan.io/">Urlscan.io</a> is a free service that scans and analyzes URLs and provides a
            detailed report summarizing the URL information.</p>

        <p><a href="https://www.capesandbox.com/">CAPE Sandbox</a> is an open source service used to automate the
            analysis of suspicious files. Using an isolated environment, malicious files such as malware are analyzed
            and a comprehensive report outlines the malware behavior.</p>

        <p><a href="https://bazaar.abuse.ch/">MalwareBazaar</a> is a free repository for malware samples. Malware
            samples are a great source of threat intelligence that can be used for research purposes.</p>

        <h2>Key Takeaways</h2>

        <p>As a security analyst, you'll analyze IoCs. It's important to understand how adding context to investigations
            can help improve detection capabilities and make informed and effective decisions.</p>


    </article>
</section>

<section class="main-section" id="topic634">
    <h2>Best practices for effective documentation </h2>
    <article class="main-article">

        <h2>Documentation benefits</h2>

        <p>You’ve already learned about many types of security documentation, including playbooks, final reports, and
            more. As you’ve also learned, effective documentation has three benefits:</p>

        <ol>
            <li><strong>Transparency</strong></li>
            <li><strong>Standardization</strong></li>
            <li><strong>Clarity</strong></li>
        </ol>

        <h3>Transparency</h3>

        <p>In security, transparency is critical for demonstrating compliance with regulations and internal processes,
            meeting insurance requirements, and for legal proceedings. Chain of custody is the process of documenting
            evidence possession and control during an incident lifecycle. Chain of custody is an example of how
            documentation produces transparency and an audit trail.</p>

        <h3>Standardization</h3>

        <p>Standardization through repeatable processes and procedures supports continuous improvement efforts, helps
            with knowledge transfer, and facilitates the onboarding of new team members. Standards are references that
            inform how to set policies.</p>

        <p>You have learned how NIST provides various security frameworks that are used to improve security measures.
            Likewise, organizations set up their own standards to meet their business needs. An example of documentation
            that establishes standardization is an incident response plan, which is a document that outlines the
            procedures to take in each step of incident response. Incident response plans standardize an organization’s
            response process by outlining procedures in advance of an incident. By documenting an organization’s
            incident response plan, you create a standard that people follow, maintaining consistency with repeatable
            processes and procedures.</p>

        <h3>Clarity</h3>

        <p>Ideally, all documentation provides clarity to its audience. Clear documentation helps people quickly access
            the information they need so they can take necessary action. Security analysts are required to document the
            reasoning behind any action they take so that it’s clear to their team why an alert was escalated or closed.
        </p>

        <h2>Best practices</h2>

        <p>As a security professional, you’ll need to apply documentation best practices in your career. Here are some
            general guidelines to remember:</p>

        <ul>
            <li><strong>Know your audience</strong></li>
            <li><strong>Be concise</strong></li>
            <li><strong>Update regularly</strong></li>
        </ul>

        <h3>Know your audience</h3>

        <p>Before you start creating documentation, consider your audience and their needs. For instance, an incident
            summary written for a security operations center (SOC) manager will be written differently than one that's
            drafted for a chief executive officer (CEO). The SOC manager can understand technical security language but
            a CEO might not. Tailor your document to meet your audience’s needs.</p>

        <h3>Be concise</h3>

        <p>You might be tasked with creating long documentation, such as a report. But when documentation is too long,
            people can be discouraged from using it. To ensure that your documentation is useful, establish the purpose
            immediately. This helps people quickly identify the objective of the document. For example, executive
            summaries outline the major facts of an incident at the beginning of a final report. This summary should be
            brief so that it can be easily skimmed to identify the key findings.</p>

        <h3>Update regularly</h3>

        <p>In security, new vulnerabilities are discovered and exploited constantly. Documentation must be regularly
            reviewed and updated to keep up with the evolving threat landscape. For example, after an incident has been
            resolved, a comprehensive review of the incident can identify gaps in processes and procedures that require
            changes and updates. By regularly updating documentation, security teams stay well informed and incident
            response plans stay updated.</p>

        <h2>Key takeaways</h2>

        <p>Effective documentation produces benefits for everyone in an organization. Knowing how to create
            documentation is an essential skill to have as a security analyst. As you continue in your journey to become
            a security professional, be sure to consider these practices for creating effective documentation.</p>


    </article>
</section>

<section class="main-section" id="topic635">
    <h2>The triage process </h2>
    <article class="main-article">
        <h2>Triage Process</h2>

        <p>Incidents can have the potential to cause significant damage to an organization. Security teams must respond
            quickly and efficiently to prevent or limit the impact of an incident before it becomes too late. Triage is
            the prioritizing of incidents according to their level of importance or urgency. The triage process helps
            security teams evaluate and prioritize security alerts and allocate resources effectively so that the most
            critical issues are addressed first.</p>

        <h3>Receive and assess</h3>

        <p>During this first step of the triage process, a security analyst receives an alert from an alerting system
            like an intrusion detection system (IDS). You might recall that an IDS is an application that monitors
            system activity and alerts on possible intrusions. The analyst then reviews the alert to verify its validity
            and ensure they have a complete understanding of the alert.</p>

        <p>This involves gathering as much information as possible about the alert, including details about the activity
            that triggered the alert, the systems and assets involved, and more. Here are some questions to consider
            when verifying the validity of an alert:</p>

        <ul>
            <li>Is the alert a false positive?</li>
            <li>Was this alert triggered in the past? If so, how was it resolved?</li>
            <li>Is the alert triggered by a known vulnerability?</li>
            <li>What is the severity of the alert?</li>
        </ul>

        <h3>Assign priority</h3>

        <p>Once the alert has been properly assessed and verified as a genuine security issue, it needs to be
            prioritized accordingly. Incidents differ in their impact, size, and scope, which affects the response
            efforts. To manage time and resources, security teams must prioritize how they respond to various incidents
            because not all incidents are equal. Here are some factors to consider when determining the priority of an
            incident:</p>

        <ul>
            <li>Functional impact</li>
            <li>Information impact</li>
            <li>Recoverability</li>
        </ul>

        <h3>Collect and analyze</h3>

        <p>The final step of the triage process involves the security analyst performing a comprehensive analysis of the
            incident. Analysis involves gathering evidence from different sources, conducting external research, and
            documenting the investigative process. The goal of this step is to gather enough information to make an
            informed decision to address it. Depending on the severity of the incident, escalation to a level two
            analyst or a manager might be required. Level two analysts and managers might have more knowledge on using
            advanced techniques to address the incident.</p>

        <h2>Benefits of triage</h2>

        <p>By prioritizing incidents based on their potential impact, you can reduce the scope of impact to the
            organization by ensuring a timely response. Here are some benefits that triage has for security teams:</p>

        <ul>
            <li>Resource management</li>
            <li>Standardized approach</li>
        </ul>

        <h2>Key takeaways</h2>

        <p>Triage allows security teams to prioritize incidents according to their level of importance or urgency. The
            triage process is important in ensuring that an organization meets their incident response goals. As a
            security professional, you will likely utilize triage to effectively respond to and resolve security
            incidents.</p>


    </article>
</section>

<section class="main-section" id="topic636">
    <h2>Business continuity considerations</h2>
    <article class="main-article">

        <h2>Business Continuity Planning</h2>

        <p>Security teams must be prepared to minimize the impact that security incidents can have on their normal
            business operations. When an incident occurs, organizations might experience significant disruptions to the
            functionality of their systems and services. Prolonged disruption to systems and services can have serious
            effects, causing legal, financial, and reputational damages. Organizations can use business continuity
            planning so that they can remain operational during any major disruptions.</p>

        <p>Similar to an incident response plan, a business continuity plan (BCP) is a document that outlines the
            procedures to sustain business operations during and after a significant disruption. A BCP helps
            organizations ensure that critical business functions can resume or can be quickly restored when an incident
            occurs.</p>

        <p>Entry level security analysts aren't typically responsible for the development and testing of a BCP. However,
            it's important that you understand how BCPs provide organizations with a structured way to respond and
            recover from security incidents.</p>

        <p><strong>Note:</strong> Business continuity plans are not the same as disaster recovery plans. Disaster
            recovery plans are used to recover information systems in response to a major disaster. These disasters can
            range from hardware failure to the destruction of facilities from a natural disaster, like a flood.</p>

        <h3>Consider the impacts of ransomware to business continuity</h3>

        <p>Impacts of a security incident such as ransomware can be devastating for business operations. Ransomware
            attacks targeting critical infrastructure such as healthcare can have the potential to cause significant
            disruption. Depending on the severity of a ransomware attack, the accessibility, availability, and delivery
            of essential healthcare services can be impacted. For example, ransomware can encrypt data, resulting in
            disabled access to medical records, which prevents healthcare providers from accessing patient records. At a
            larger scale, security incidents that target the assets, systems, and networks of critical infrastructure
            can also undermine national security, economic security, and the health and safety of the public. For this
            reason, BCPs help to minimize interruptions to operations so that essential services can be accessed.</p>

        <h3>Recovery strategies</h3>

        <p>When an outage occurs due to a security incident, organizations must have some sort of a functional recovery
            plan set to resolve the issue and get systems fully operational. BCPs can include strategies for recovery
            that focus on returning to normal operations. Site resilience is one example of a recovery strategy.</p>

        <h4>Site resilience</h4>

        <p>Resilience is the ability to prepare for, respond to, and recover from disruptions. Organizations can design
            their systems to be resilient so that they can continue delivering services despite facing disruptions. An
            example is site resilience, which is used to ensure the availability of networks, data centers, or other
            infrastructure when a disruption happens. There are three types of recovery sites used for site resilience:
        </p>

        <ul>
            <li><strong>Hot sites:</strong> A fully operational facility that is a duplicate of an organization's
                primary environment. Hot sites can be activated immediately when an organization's primary site
                experiences failure or disruption.</li>
            <li><strong>Warm sites:</strong> A facility that contains a fully updated and configured version of the hot
                site. Unlike hot sites, warm sites are not fully operational and available for immediate use but can
                quickly be made operational when a failure or disruption occurs.</li>
            <li><strong>Cold sites:</strong> A backup facility equipped with some of the necessary infrastructure
                required to operate an organization's site. When a disruption or failure occurs, cold sites might not be
                ready for immediate use and might need additional work to be operational.</li>
        </ul>

        <h2>Key takeaways</h2>

        <p>Security incidents have the potential to seriously disrupt business operations. Having the right plans in
            place is essential so that organizations can continue to function. Business continuity plans help
            organizations understand the impact that serious security incidents can have on their operations and work to
            mitigate these impacts so that regular operations can resume.</p>


    </article>
</section>

<section class="main-section" id="topic637">
    <h2>Post-incident review </h2>
    <article class="main-article">

        <h2>Post-Incident Activity</h2>

        <p>The Post-incident activity phase of the NIST Incident Response Lifecycle is the process of reviewing an
            incident to identify areas for improvement during incident handling.</p>

        <img src="resource/four.png" alt="Four phases of the NIST Incident Response Lifecycle">

        <h3>Lessons Learned</h3>

        <p>After an organization has successfully contained, eradicated, and recovered from an incident, the incident
            comes to a close. However, this doesn’t mean that the work of security professionals is complete. Incidents
            provide organizations and their security teams with an opportunity to learn from what happened and
            prioritize ways to improve the incident handling process.</p>

        <p>This is typically done through a lessons learned meeting, also known as a post-mortem. A lessons learned
            meeting includes all involved parties after a major incident. Depending on the scope of an incident,
            multiple meetings can be scheduled to gather sufficient data. The purpose of this meeting is to evaluate the
            incident in its entirety, assess the response actions, and identify any areas of improvement. It provides an
            opportunity for an organization and its people to learn and improve, not to assign blame. This meeting
            should be scheduled no later than two weeks after an incident has been successfully remediated.</p>

        <p>Not all incidents require their own lessons learned meeting; the size and severity of an incident will
            dictate whether the meeting is necessary. However, major incidents, such as ransomware attacks, should be
            reviewed in a dedicated lessons learned meeting. This meeting consists of all parties who participated in
            any aspect of the incident response process.</p>

        <h4>Recommendations</h4>

        <p>Lessons learned meetings provide opportunities for growth and improvement. For example, security teams can
            identify errors in response actions, gaps in processes and procedures, or ineffective security controls. A
            lessons learned meeting should result in a list of prioritized actions or actionable recommendations meant
            to improve an organization’s incident handling processes and overall security posture. This ensures that
            organizations are implementing the lessons they’ve learned after an incident so that they are not vulnerable
            to experiencing the same incident in the future. Examples of changes that can be implemented include
            updating and improving playbook instructions or implementing new security tools and technologies.</p>

        <h3>Final Report</h3>

        <p>Throughout this course, you explored the importance that documentation has in recording details during the
            incident response lifecycle. At a minimum, incident response documentation should describe the incident by
            covering the 5 W's of incident investigation: who, what, where, why, and when. The details that are captured
            during incident response are important for developing additional documents during the end of the lifecycle.
        </p>

        <p>One of the most essential forms of documentation that gets created during the end of an incident is the final
            report. The final report provides a comprehensive review of an incident. Final reports are not standardized,
            and their formats can vary across organizations. Additionally, multiple final reports can be created
            depending on the audience it’s written for.</p>

        <h4>Key Takeaways</h4>

        <p>Post-incident actions represent the end of the incident response lifecycle. This phase provides the
            opportunity for security teams to meet, evaluate the response actions, make recommendations for improvement,
            and develop the final report.</p>


    </article>
</section>

<section class="main-section" id="topic638">
    <h2>Glossary terms from module 3</h2>
    <article class="main-article">

        <h2>Terms and Definitions from Course 6, Module 3</h2>

        <ul>
            <li><strong>Analysis:</strong> The investigation and validation of alerts</li>
            <li><strong>Broken chain of custody:</strong> Inconsistencies in the collection and logging of evidence in
                the chain of custody</li>
            <li><strong>Business continuity plan (BCP):</strong> A document that outlines the procedures to sustain
                business operations during and after a significant disruption</li>
            <li><strong>Chain of custody:</strong> The process of documenting evidence possession and control during an
                incident lifecycle</li>
            <li><strong>Containment:</strong> The act of limiting and preventing additional damage caused by an incident
            </li>
            <li><strong>Crowdsourcing:</strong> The practice of gathering information using public input and
                collaboration</li>
            <li><strong>Detection:</strong> The prompt discovery of security events</li>
            <li><strong>Documentation:</strong> Any form of recorded content that is used for a specific purpose</li>
            <li><strong>Eradication:</strong> The complete removal of the incident elements from all affected systems
            </li>
            <li><strong>Final report:</strong> Documentation that provides a comprehensive review of an incident</li>
            <li><strong>Honeypot:</strong> A system or resource created as a decoy vulnerable to attacks with the
                purpose of attracting potential intruders</li>
            <li><strong>Incident response plan:</strong> A document that outlines the procedures to take in each step of
                incident response</li>
            <li><strong>Indicators of attack (IoA):</strong> The series of observed events that indicate a real-time
                incident</li>
            <li><strong>Indicators of compromise (IoC):</strong> Observable evidence that suggests signs of a potential
                security incident</li>
            <li><strong>Intrusion detection system (IDS):</strong> An application that monitors system activity and
                alerts on possible intrusions</li>
            <li><strong>Lessons learned meeting:</strong> A meeting that includes all involved parties after a major
                incident</li>
            <li><strong>Open-source intelligence (OSINT):</strong> The collection and analysis of information from
                publicly available sources to generate usable intelligence</li>
            <li><strong>Playbook:</strong> A manual that provides details about any operational action</li>
            <li><strong>Post-incident activity:</strong> The process of reviewing an incident to identify areas for
                improvement during incident handling</li>
            <li><strong>Recovery:</strong> The process of returning affected systems back to normal operations</li>
            <li><strong>Resilience:</strong> The ability to prepare for, respond to, and recover from disruptions</li>
            <li><strong>Standards:</strong> References that inform how to set policies</li>
            <li><strong>Threat hunting:</strong> The proactive search for threats on a network</li>
            <li><strong>Threat intelligence:</strong> Evidence-based threat information that provides context about
                existing or emerging threats</li>
            <li><strong>Triage:</strong> The prioritizing of incidents according to their level of importance or urgency
            </li>
            <li><strong>VirusTotal:</strong> A service that allows anyone to analyze suspicious files, domains, URLs,
                and IP addresses for malicious content</li>
        </ul>


    </article>
</section>


<section class="main-section" id="Module 64">
    <h2>Module 4</h2>
</section>
<br> <br>


<section class="main-section" id="topic641">
    <h2>Best practices for log collection and management</h2>
    <article class="main-article">

        <h2>Log Management Best Practices</h2>

        <p>In this reading, you’ll examine some best practices related to log management, storage, and protection.
            Understanding the best practices related to log collection and management will help improve log searches and
            better support your efforts in identifying and resolving security incidents.</p>

        <h3>Logs</h3>

        <p>Data sources such as devices generate data in the form of events. A log is a record of events that occur
            within an organization's systems. Logs contain log entries and each entry details information corresponding
            to a single event that happened on a device or system. Originally, logs served the sole purpose of
            troubleshooting common technology issues. For example, error logs provide information about why an
            unexpected error occurred and help to identify the root cause of the error so that it can be fixed. Today,
            virtually all computing devices produce some form of logs that provide valuable insights beyond
            troubleshooting.</p>

        <p>Security teams access logs from logging receivers like SIEM tools which consolidate logs to provide a central
            repository for log data. Security professionals use logs to perform log analysis, which is the process of
            examining logs to identify events of interest. Logs help uncover the details surrounding the 5 W's of
            incident investigation: who triggered the incident, what happened, when the incident took place, where the
            incident took place, and why the incident occurred.</p>

        <h3>Types of logs</h3>

        <p>Depending on the data source, different log types can be produced. Here’s a list of some common log types
            that organizations should record:</p>

        <ul>
            <li>Network: Network logs are generated by network devices like firewalls, routers, or switches.</li>
            <li>System: System logs are generated by operating systems like Chrome OS™, Windows, Linux, or macOS®.</li>
            <li>Application: Application logs are generated by software applications and contain information relating to
                the events occurring within the application such as a smartphone app.</li>
            <li>Security: Security logs are generated by various devices or systems such as antivirus software and
                intrusion detection systems. Security logs contain security-related information such as file deletion.
            </li>
            <li>Authentication: Authentication logs are generated whenever authentication occurs such as a successful
                login attempt into a computer.</li>
        </ul>

        <h3>Log details</h3>

        <p>Generally, logs contain a date, time, location, action, and author of the action. Logs contain information
            and can be adjusted to contain even more information. Verbose logging records additional, detailed
            information beyond the default log recording.</p>

        <p>Here is an example of the same log above but logged as verbose:</p>

        <p>Login Event [2022/11/16 05:45:15.892673] auth_performer.cc:470 User1 Authenticated successfully from device1
            (192.168.1.2)</p>

        <h3>Log management</h3>

        <p>Because all devices produce logs, it can quickly become overwhelming for organizations to keep track of all
            the logs that are generated. To get the most value from your logs, you need to choose exactly what to log,
            how to access it easily, and keep it secure using log management. Log management is the process of
            collecting, storing, analyzing, and disposing of log data.</p>

        <h4>What to log</h4>

        <p>The most important aspect of log management is choosing what to log. Organizations are different, and their
            logging requirements can differ too. It's important to consider which log sources are most likely to contain
            the most useful information depending on your event of interest.</p>

        <p>The issue with overlogging</p>

        <p>From a security perspective, it can be tempting to log everything. This is the most common mistake
            organizations make. Just because it can be logged, doesn't mean it needs to be logged. Storing excessive
            amounts of logs can have many disadvantages with some SIEM tools.</p>

        <h4>Log retention</h4>

        <p>Organizations might operate in industries with regulatory requirements. For example, some regulations require
            organizations to retain logs for set periods of time and organizations can implement log retention practices
            in their log management policy.</p>

        <h4>Log protection</h4>

        <p>Along with management and retention, the protection of logs is vital in maintaining log integrity. It’s not
            unusual for malicious actors to modify logs in attempts to mislead security teams and to even hide their
            activity.</p>

        <p>Storing logs in a centralized log server is a way to maintain log integrity. When logs are generated, they
            get sent to a dedicated server instead of getting stored on a local machine. This makes it more difficult
            for attackers to access logs because there is a barrier between the attacker and the log location.</p>

        <h3>Key takeaways</h3>

        <p>It's important to understand how to properly collect, store, and protect logs because they are integral to
            incident investigations. Having a detailed plan for log management helps improve the usefulness of logs and
            resource efficiency.</p>


    </article>
</section>

<section class="main-section" id="topic642">
    <h2>Overview of log file formats</h2>
    <article class="main-article">

        <h2>Log Formats Review</h2>

        <p>You’ve learned about how logs record events that happen on a network, or system. In security, logs provide
            key details about activities that occurred across an organization, like who signed into an application at a
            specific point in time. As a security analyst, you’ll use log analysis, which is the process of examining
            logs to identify events of interest. It’s important to know how to read and interpret different log formats
            so that you can uncover the key details surrounding an event and identify unusual or malicious activity. In
            this reading, you’ll review the following log formats:</p>

        <ul>
            <li>JSON</li>
            <li>Syslog</li>
            <li>XML</li>
            <li>CSV</li>
            <li>CEF</li>
        </ul>

        <h3>JavaScript Object Notation (JSON)</h3>

        <p>JavaScript Object Notation (JSON) is a file format that is used to store and transmit data. JSON is known for
            being lightweight and easy to read and write. It is used for transmitting data in web technologies and is
            also commonly used in cloud environments. JSON syntax is derived from JavaScript syntax. If you are familiar
            with JavaScript, you might recognize that JSON contains components from JavaScript including:</p>

        <ul>
            <li>Key-value pairs</li>
            <li>Commas</li>
            <li>Double quotes</li>
            <li>Curly brackets</li>
            <li>Square brackets</li>
        </ul>

        <h4>Key-value pairs</h4>

        <p>A key-value pair is a set of data that represents two linked items: a key and its corresponding value. A
            key-value pair consists of a key followed by a colon, and then followed by a value. An example of a
            key-value pair is "Alert": "Malware".</p>

        <p>Note: For readability, it is recommended that key-value pairs contain a space before or after the colon that
            separates the key and value.</p>

        <h4>Commas</h4>

        <p>Commas are used to separate data. For example: "Alert": "Malware", "Alert code": 1090, "severity": 10.</p>

        <h4>Double quotes</h4>

        <p>Double quotes are used to enclose text data, which is also known as a string, for example: "Alert":
            "Malware". Data that contains numbers is not enclosed in quotes, like this: "Alert code": 1090.</p>

        <h4>Curly brackets</h4>

        <p>Curly brackets enclose an object, which is a data type that stores data in a comma-separated list of
            key-value pairs. Objects are often used to describe multiple properties for a given key. JSON log entries
            start and end with a curly bracket. In this example, User is the object that contains multiple properties:
        </p>

        <pre>
        "User"
        { 
            "id": "1234", 
            "name": "user",
            "role": "engineer"
        }
        </pre>

        <h4>Square brackets</h4>

        <p>Square brackets are used to enclose an array, which is a data type that stores data in a comma-separated
            ordered list. Arrays are useful when you want to store data as an ordered collection, for example:
            ["Administrators", "Users", "Engineering"].</p>

        <h3>Syslog</h3>

        <p>Syslog is a standard for logging and transmitting data. It can be used to refer to any of its three different
            capabilities:</p>

        <ul>
            <li>Protocol</li>
            <li>Service</li>
            <li>Log format</li>
        </ul>

        <h4>Syslog log example</h4>

        <p>Here is an example of a syslog entry that contains all three components: a header, followed by
            structured-data, and a message:</p>

        <pre>&lt;236&gt;1 2022-03-21T01:11:11.003Z virtual.machine.com evntslog - ID01 [user@32473 iut="1" eventSource="Application" eventID="9999"] 
        This is a log entry!</pre>

        <h5>Header</h5>

        <p>The header contains details like the timestamp; the hostname, which is the name of the machine that sends the
            log; the application name; and the message ID.</p>

        <ul>
            <li>Timestamp: The timestamp in this example is 2022-03-21T01:11:11.003Z, where 2022-03-21 is the date in
                YYYY-MM-DD format. T is used to separate the date and the time. 01:11:11.003 is the 24-hour format of
                the time and includes the number of milliseconds 003. Z indicates the timezone, which is Coordinated
                Universal Time (UTC).</li>
            <li>Hostname: virtual.machine.com</li>
            <li>Application: evntslog</li>
            <li>Message ID: ID01</li>
        </ul>

        <h5>Structured-data</h5>

        <p>The structured-data portion of the log entry contains additional logging information. This information is
            enclosed in square brackets and structured in key-value pairs.</p>

        <h5>Message</h5>

        <p>The message contains a detailed log message about the event.</p>

        <h5>Priority (PRI)</h5>

        <p>The priority (PRI) field indicates the urgency of the logged event and is contained within angle brackets.
        </p>

        <h3>XML (eXtensible Markup Language)</h3>

        <p>XML (eXtensible Markup Language) is a language and a format used for storing and transmitting data. XML is a
            native file format used in Windows systems. XML syntax uses tags, elements, and attributes.</p>

        <h4>Tags</h4>

        <p>XML uses tags to store and identify data. Tags are pairs that must contain a start tag and an end tag.</p>

        <h4>Elements</h4>

        <p>XML elements include both the data contained inside of a tag and the tags itself. All XML entries must
            contain at least one root element.</p>

        <h4>Attributes</h4>

        <p>XML elements can also contain attributes. Attributes are used to provide additional information about
            elements.</p>

        <h3>CSV (Comma Separated Value)</h3>

        <p>CSV (Comma Separated Value) uses commas to separate data values.</p>

        <h3>CEF (Common Event Format)</h3>

        <p>Common Event Format (CEF) is a log format that uses key-value pairs to structure data and identify fields and
            their corresponding values. The CEF syntax is defined as containing several fields.</p>

        <p>Fields are all separated with a pipe character |. However, anything in the Extension part of the CEF log
            entry must be written in a key-value format.</p>

        <h4>Key takeaways</h4>

        <p>There is no standard format used in logging, and many different log formats exist. As a security analyst, you
            will analyze logs that originate from different sources. Knowing how to interpret different log formats will
            help you determine key information that you can use to support your investigations.</p>
    </article>
</section>

<section class="main-section" id="topic643">
    <h2>Detection tools and techniques</h2>
    <article class="main-article">

        <h2>Intrusion Detection Systems Overview</h2>

        <p>In this reading, you’ll examine the different types of intrusion detection system (IDS) technologies and the
            alerts they produce. You’ll also explore the two common detection techniques used by detection systems.
            Understanding the capabilities and limitations of IDS technologies and their detection techniques will help
            you interpret security information to identify, analyze, and respond to security events.</p>

        <h3>Host-based Intrusion Detection System</h3>

        <p>A host-based intrusion detection system (HIDS) is an application that monitors the activity of the host on
            which it's installed. A HIDS is installed as an agent on a host. A host is also known as an endpoint, which
            is any device connected to a network like a computer or a server.</p>

        <p>Typically, HIDS agents are installed on all endpoints and used to monitor and detect security threats. A HIDS
            monitors internal activity happening on the host to identify any unauthorized or abnormal behavior. If
            anything unusual is detected, such as the installation of an unauthorized application, the HIDS logs it and
            sends out an alert.</p>

        <p>In addition to monitoring inbound and outbound traffic flows, HIDS can have additional capabilities, such as
            monitoring file systems, system resource usage, user activity, and more.</p>

        <img src="resource/dete.png" alt="Host-based intrusion detection system diagram">

        <h3>Network-based Intrusion Detection System</h3>

        <p>A network-based intrusion detection system (NIDS) is an application that collects and monitors network
            traffic and network data. NIDS software is installed on devices located at specific parts of the network
            that you want to monitor. The NIDS application inspects network traffic from different devices on the
            network. If any malicious network traffic is detected, the NIDS logs it and generates an alert.</p>

        <img src="resource/dete2.png" alt="Network-based intrusion detection system diagram">

        <p>Using a combination of HIDS and NIDS to monitor an environment can provide a multi-layered approach to
            intrusion detection and response. HIDS and NIDS tools provide a different perspective on the activity
            occurring on a network and the individual hosts that are connected to it. This helps provide a comprehensive
            view of the activity happening in an environment.</p>

        <h3>Detection Techniques</h3>

        <p>Detection systems can use different techniques to detect threats and attacks. The two types of detection
            techniques that are commonly used by IDS technologies are signature-based analysis and anomaly-based
            analysis.</p>

        <h4>Signature-based Analysis</h4>

        <p>Signature analysis, or signature-based analysis, is a detection method that is used to find events of
            interest. A signature is a pattern that is associated with malicious activity. Signatures can contain
            specific patterns like a sequence of binary numbers, bytes, or even specific data like an IP address.</p>

        <p>Previously, you explored the Pyramid of Pain, which is a concept that prioritizes the different types of
            indicators of compromise (IoCs) associated with an attack or threat, such as IP addresses, tools, tactics,
            techniques, and more. IoCs and other indicators of attack can be useful for creating targeted signatures to
            detect and block attacks.</p>

        <p>Different types of signatures can be used depending on which type of threat or attack you want to detect. For
            example, an anti-malware signature contains patterns associated with malware. This can include malicious
            scripts that are used by the malware. IDS tools will monitor an environment for events that match the
            patterns defined in this malware signature. If an event matches the signature, the event gets logged and an
            alert is generated.</p>

        <h4>Anomaly-based Analysis</h4>

        <p>Anomaly-based analysis is a detection method that identifies abnormal behavior. There are two phases to
            anomaly-based analysis: a training phase and a detection phase. In the training phase, a baseline of normal
            or expected behavior must be established. Baselines are developed by collecting data that corresponds to
            normal system behavior. In the detection phase, the current system activity is compared against this
            baseline. Activity that happens outside of the baseline gets logged, and an alert is generated.</p>

        <h4>Key Takeaways</h4>

        <p>IDS technologies are an essential security tool that you will encounter in your security journey. To recap, a
            NIDS monitors an entire network, whereas a HIDS monitors individual endpoints. IDS technologies generate
            different types of alerts. Lastly, IDS technologies use different detection techniques like signature-based
            or anomaly-based analysis to identify malicious activity.</p>


    </article>
</section>

<section class="main-section" id="topic644">
    <h2>Overview of Suricata</h2>
    <article class="main-article">

        <h2>Introduction to Suricata</h2>

        <p>Suricata is an open-source intrusion detection system, intrusion prevention system, and network analysis
            tool.</p>

        <h3>Suricata Features</h3>

        <p>There are three main ways Suricata can be used:</p>

        <ul>
            <li>Intrusion detection system (IDS)</li>
            <li>Intrusion prevention system (IPS)</li>
            <li>Network security monitoring (NSM)</li>
        </ul>

        <h3>Rules</h3>

        <p>Rules or signatures are used to identify specific patterns, behavior, and conditions of network traffic that
            might indicate malicious activity. Signatures consist of three components:</p>

        <ul>
            <li>Action</li>
            <li>Header</li>
            <li>Rule options</li>
        </ul>

        <p>Here's an example of a Suricata signature:</p>

        <img src="resource/suricata.png" alt="Suricata signature">

        <h4>Custom Rules</h4>

        <p>Although Suricata comes with pre-written rules, it is highly recommended that you modify or customize the
            existing rules to meet your specific security requirements. Creating custom rules helps to tailor detection
            and monitoring, minimizing false positive alerts.</p>

        <h3>Configuration File</h3>

        <p>Before detection tools are deployed, you must properly configure their settings. Suricata's configuration
            file is suricata.yaml, which uses the YAML file format for syntax and structure.</p>

        <h3>Log Files</h3>

        <p>There are two log files that Suricata generates when alerts are triggered:</p>

        <ul>
            <li>eve.json</li>
            <li>fast.log</li>
        </ul>

        <p>The eve.json file contains detailed information and metadata about the events and alerts generated by
            Suricata, while the fast.log file records minimal alert information.</p>

        <h3>Key Takeaways</h3>

        <p>Understanding Suricata's features, rules syntax, and the importance of configuration is essential for
            deploying and maintaining IDS tools. Writing effective rules and configuring detection technologies will
            improve detection capability and network visibility.</p>

        <!-- <h3>Resources for More Information</h3>
        
        <p>If you would like to learn more about Suricata, check out the following resources:</p>
        
        <ul>
          <li><a href="#">Suricata user guide</a></li>
          <li><a href="#">Rule management</a></li>
          <li><a href="#">Rule performance analysis</a></li>
          <li><a href="#">Suricata threat hunting webinar</a></li>
          <li><a href="#">Introduction to writing Suricata rules</a></li>
          <li><a href="#">Eve.json jq examples</a></li>
        </ul> -->


    </article>
</section>

<section class="main-section" id="topic645">
    <h2>Log sources and log ingestion</h2>
    <article class="main-article">

        <h2>SIEM Process Overview</h2>

        <p>Previously, you covered the SIEM process. As a refresher, the process consists of three steps:</p>

        <ol>
            <li>Collect and aggregate data: SIEM tools collect event data from various data sources.</li>
            <li>Normalize data: Event data that's been collected becomes normalized. Normalization converts data into a
                standard format so that data is structured in a consistent way and becomes easier to read and search.
                While data normalization is a common feature in many SIEM tools, it's important to note that SIEM tools
                vary in their data normalization capabilities.</li>
            <li>Analyze data: After the data is collected and normalized, SIEM tools analyze and correlate the data to
                identify common patterns that indicate unusual activity.</li>
        </ol>

        <p>This reading focuses on the first step of this process, the collection and aggregation of data.</p>

        <h2>Log Ingestion</h2>
        <img src="resource/log.png" id="img" alt="">

        <p>Data is required for SIEM tools to work effectively. SIEM tools must first collect data using log ingestion.
            Log ingestion is the process of collecting and importing data from log sources into a SIEM tool. Data comes
            from any source that generates log data, like a server.</p>

        <p>In log ingestion, the SIEM creates a copy of the event data it receives and retains it within its own
            storage. This copy allows the SIEM to analyze and process the data without directly modifying the original
            source logs. The collection of event data provides a centralized platform for security analysts to analyze
            the data and respond to incidents. This event data includes authentication attempts, network activity, and
            more.</p>

        <h3>Log Forwarders</h3>

        <p>There are many ways SIEM tools can ingest log data. For instance, you can manually upload data or use
            software to help collect data for log ingestion. Manually uploading data may be inefficient and
            time-consuming because networks can contain thousands of systems and devices. Hence, it's easier to use
            software that helps collect data.</p>

        <p>A common way that organizations collect log data is to use log forwarders. Log forwarders are software that
            automate the process of collecting and sending log data. Some operating systems have native log forwarders.
            If you are using an operating system that does not have a native log forwarder, you would need to install a
            third-party log forwarding software on a device. After installing it, you'd configure the software to
            specify which logs to forward and where to send them. For example, you can configure the logs to be sent to
            a SIEM tool. The SIEM tool would then process and normalize the data. This allows the data to be easily
            searched, explored, correlated, and analyzed.</p>

        <p>Note: Many SIEM tools utilize their own proprietary log forwarders. SIEM tools can also integrate with
            open-source log forwarders. Choosing the right log forwarder depends on many factors such as the specific
            requirements of your system or organization, compatibility with your existing infrastructure, and more.</p>

        <h3>Key Takeaways</h3>

        <p>SIEM tools require data to be effective. As a security analyst, you will utilize SIEM tools to access events
            and analyze logs when you're investigating an incident. In your security career, you may even be tasked with
            configuring a SIEM to collect log data. It's important that you understand how data is ingested into SIEM
            tools because this enables you to understand where log sources come from which can help you identify the
            source of a security incident.</p>

        <h3>Resources</h3>

        <p>Here are some resources if you’d like to learn more about the log ingestion process for Splunk and Chronicle:
        </p>

        <ul>
            <li><a href="#">Guide on getting data into Splunk</a></li>
            <li><a href="#">Guide on data ingestion into Chronicle</a></li>
        </ul>

        <p>Pro tip: Later on in this module, you'll use Splunk Cloud to upload data, perform basic searches on the data,
            and answer a series of questions. Follow the instructions in the Follow-along guide for Splunk sign-up to
            complete the following before you begin using Splunk. To get started with Splunk quickly, sign up now! The
            verification email might take a while to arrive.</p>


    </article>
</section>

<section class="main-section" id="topic646">
    <h2>Search methods with SIEM tools</h2>
    <article class="main-article">

        <h2>Splunk Searches</h2>

        <p>As you’ve learned, Splunk has its own querying language called Search Processing Language (SPL). SPL is used
            to search and retrieve events from indexes using Splunk’s Search & Reporting app. An SPL search can contain
            many different commands and arguments. For example, you can use commands to transform your search results
            into a chart format or filter results for specific information.</p>

        <p><strong>Splunk Cloud's search page:</strong></p>
        <img src="resource/splunkim.png" id="img" alt="">

        <p>Here is an example of a basic SPL search that is querying an index for a failed event:</p>

        <code>index=main fail</code>

        <ul>
            <li><code>index=main:</code> This is the beginning of the search command that tells Splunk to retrieve
                events from an index named main. An index stores event data that's been collected and processed by
                Splunk.</li>
            <li><code>fail:</code> This is the search term. This tells Splunk to return any event that contains the term
                fail.</li>
        </ul>

        <p>Knowing how to effectively use SPL has many benefits. It helps shorten the time it takes to return search
            results. It also helps you obtain the exact results you need from various data sources. SPL supports many
            different types of searches that are beyond the scope of this reading. If you would like to learn more about
            SPL, explore Splunk's <a href="#">Search Reference</a>.</p>

        <h3>Pipes</h3>

        <p>Previously, you might have learned about how piping is used in the Linux bash shell. As a refresher, piping
            sends the output of one command as the input to another command.</p>

        <p>SPL also uses the pipe character | to separate the individual commands in the search. It's also used to chain
            commands together so that the output of one command combines into the next command. This is useful because
            you can refine data in various ways to get the results you need using a single command.</p>

        <p>Here is an example of two commands that are piped together:</p>

        <code>index=main fail | chart count by host</code>

        <ul>
            <li><code>index=main fail:</code> This is the beginning of the search command that tells Splunk to retrieve
                events from an index named main for events containing the search term fail.</li>
            <li><code>|:</code> The pipe character separates and chains the two commands <code>index=main</code> and
                <code>chart count by host</code>. This means that the output of the first command
                <code>index=main</code> is used as the input of the second command <code>chart count by host</code>.
            </li>
            <li><code>chart count by host:</code> This command tells Splunk to transform the search results by creating
                a chart according to the count or number of events. The argument <code>by host</code> tells Splunk to
                list the events by host, which are the names of the devices the events come from. This command can be
                helpful in identifying hosts with excessive failure counts in an environment.</li>
        </ul>

        <h3>Wildcard</h3>

        <p>A wildcard is a special character that can be substituted with any other character. A wildcard is usually
            symbolized by an asterisk character *. Wildcards match characters in string values. In Splunk, the wildcard
            that you use depends on the command that you are using the wildcard with. Wildcards are useful because they
            can help find events that contain data that is similar but not entirely identical.</p>

        <p>Here is an example of using a wildcard to expand the search results for a search term:</p>

        <code>index=main fail*</code>

        <ul>
            <li><code>index=main:</code> This command retrieves events from an index named main.</li>
            <li><code>fail*:</code> The wildcard after fail represents any character. This tells Splunk to search for
                all possible endings that contain the term fail. This expands the search results to return any event
                that contains the term fail such as “failed” or “failure”.</li>
        </ul>

        <p><strong>Pro tip:</strong> Double quotations are used to specify a search for an exact phrase or string. For
            example, if you want to only search for events that contain the exact phrase login failure, you can enclose
            the phrase in double quotations "login failure". This search will match only events that contain the exact
            phrase login failure and not other events that contain the words failure or login separately.</p>

        <h2>Chronicle Searches</h2>

        <p>In Chronicle, you can search for events using the Search field. You can also use Procedural Filtering to
            apply filters to a search to further refine the search results. For example, you can use Procedural
            Filtering to include or exclude search results that contain specific information relating to an event type
            or log source. There are two types of searches you can perform to find events in Chronicle, a Unified Data
            Mode (UDM) Search or a Raw Log Search.</p>

        <p><strong>Chronicle's home page:</strong></p>
        <img src="resource/splunkim1.png" id="img" alt="">

        <h3>Unified Data Model (UDM) Search</h3>

        <p>The UDM Search is the default search type used in Chronicle. You can perform a UDM search by typing your
            search, clicking on “Search,” and selecting “UDM Search.” Through a UDM Search, Chronicle searches security
            data that has been ingested, parsed, and normalized. A UDM Search retrieves search results faster than a Raw
            Log Search because it searches through indexed and structured data that’s normalized in UDM.</p>

        <img src="resource/splunkim2.png" id="img" alt="">

        <p>A UDM Search retrieves events formatted in UDM and these events contain UDM fields. There are many different
            types of UDM fields that can be used to query for specific information from an event. Discussing all of
            these UDM fields is beyond the scope of this reading, but you can learn more about UDM fields by exploring
            Chronicle's <a href="#">UDM field list</a>.</p>

        <p>Know that all UDM events contain a set of common fields including:</p>

        <ul>
            <li>Entities: Entities are also known as nouns. All UDM events must contain at least one entity. This field
                provides additional context about a device, user, or process that’s involved in an event. For example, a
                UDM event that contains entity information includes the details of the origin of an event such as the
                hostname, the username, and IP address of the event.</li>
            <li>Event metadata: This field provides a basic description of an event, including what type of event it is,
                timestamps, and more.</li>
            <li>Network metadata: This field provides information about network-related events and protocol details.
            </li>
            <li>Security results: This field provides the security-related outcome of events. An example of a security
                result can be an antivirus software detecting and quarantining a malicious file by reporting "virus
                detected and quarantined."</li>
        </ul>

        <p>Here’s an example of a simple UDM search that uses the event metadata field to locate events relating to user
            logins:</p>

        <code>metadata.event_type = “USER_LOGIN”</code>

        <ul>
            <li><code>metadata.event_type = “USER_LOGIN”:</code> This UDM field <code>metadata.event_type</code>
                contains information about the event type. This includes information like timestamp, network connection,
                user authentication, and more. Here, the event type specifies USER_LOGIN, which searches for events
                relating to authentication.</li>
        </ul>

        <p>Using just the metadata fields, you can quickly start searching for events. As you continue practicing
            searching in Chronicle using UDM Search, you will encounter more fields. Try using these fields to form
            specific searches to locate different events.</p>

        <h3>Raw Log Search</h3>

        <p>If you can't find the information you are searching for through the normalized data, using a Raw Log Search
            will search through the raw, unparsed logs. You can perform a Raw Log Search by typing your search, clicking
            on “Search,” and selecting “Raw Log Search.” Because it is searching through raw logs, it takes longer than
            a structured search. In the Search field, you can perform a Raw Log Search by specifying information like
            usernames, filenames, hashes, and more. Chronicle will retrieve events that are associated with the search.
        </p>

        <p><strong>Pro tip:</strong> Raw Log Search supports the use of regular expressions, which can help you narrow
            down a search to match on specific patterns.</p>

        <h3>Key Takeaways</h3>

        <p>SIEM tools like Splunk and Chronicle have their own methods for searching and retrieving event data. As a
            security analyst, it's important to understand how to leverage these tools to quickly and efficiently find
            the information you need. This will allow you to explore data in ways that support detecting threats, as
            well as rapidly responding to security incidents.</p>


    </article>
</section>

<section class="main-section" id="topic647">
    <h2>Glossary terms from module 4</h2>
    <article class="main-article">

        <h2>Anomaly-based analysis:</h2>
        <p>A detection method that identifies abnormal behavior.</p>

        <h2>Array:</h2>
        <p>A data type that stores data in a comma-separated ordered list.</p>

        <h2>Common Event Format (CEF):</h2>
        <p>A log format that uses key-value pairs to structure data and identify fields and their corresponding values.
        </p>

        <h2>Configuration file:</h2>
        <p>A file used to configure the settings of an application.</p>

        <h2>Endpoint:</h2>
        <p>Any device connected on a network.</p>

        <h2>Endpoint detection and response (EDR):</h2>
        <p>An application that monitors an endpoint for malicious activity.</p>

        <h2>False positive:</h2>
        <p>An alert that incorrectly detects the presence of a threat.</p>

        <h2>Host-based intrusion detection system (HIDS):</h2>
        <p>An application that monitors the activity of the host on which it’s installed.</p>

        <h2>Intrusion detection systems (IDS):</h2>
        <p>An application that monitors system activity and alerts on possible intrusions.</p>

        <h2>Key-value pair:</h2>
        <p>A set of data that represents two linked items: a key, and its corresponding value.</p>

        <h2>Log:</h2>
        <p>A record of events that occur within an organization’s systems.</p>

        <h2>Log analysis:</h2>
        <p>The process of examining logs to identify events of interest.</p>

        <h2>Log management:</h2>
        <p>The process of collecting, storing, analyzing, and disposing of log data.</p>

        <h2>Logging:</h2>
        <p>The recording of events occurring on computer systems and networks.</p>

        <h2>Network-based intrusion detection system (NIDS):</h2>
        <p>An application that collects and monitors network traffic and network data.</p>

        <h2>Object:</h2>
        <p>A data type that stores data in a comma-separated list of key-value pairs.</p>

        <h2>Search Processing Language (SPL):</h2>
        <p>Splunk’s query language.</p>

        <h2>Security information and event management (SIEM):</h2>
        <p>An application that collects and analyzes log data to monitor critical activities in an organization.</p>

        <h2>Signature:</h2>
        <p>A pattern that is associated with malicious activity.</p>

        <h2>Signature analysis:</h2>
        <p>A detection method used to find events of interest.</p>

        <h2>Suricata:</h2>
        <p>An open-source intrusion detection system, intrusion prevention system, and network analysis tool.</p>

        <h2>Telemetry:</h2>
        <p>The collection and transmission of data for analysis.</p>

        <h2>Wildcard:</h2>
        <p>A special character that can be substituted with any other character.</p>

        <h2>YARA-L:</h2>
        <p>A computer language used to create rules for searching through ingested log data.</p>

        <h2>Zero-day:</h2>
        <p>An exploit that was previously unknown.</p>


    </article>
</section>


<section class="main-section" id="Course 7">
    <h2 id="cs2">Course 7</h2>
</section>


<section class="main-section" id="Module 71">
    <h2>Module 1</h2>
</section>
<br> <br>


<section class="main-section" id="topic711">
    <h2> Get to know Python </h2>
    <article class="main-article">
        <h1>How programming works</h1>
        <p>Programming is a process that can be used to create a specific set of instructions for a computer to execute
            tasks. Computer programs exist everywhere. Computers, cell phones, and many other electronic devices are all
            given instructions by computer programs.</p>
        <p>There are multiple programming languages used to create computer programs. Python is one of these.
            Programming languages are converted to binary numbers, which are a series of 0s and 1s that represent the
            operations that the computer's central processing unit (CPU) should perform. Each instruction corresponds to
            a specific operation, such as adding two numbers or loading a value from memory.</p>
        <p>It would be very time-consuming for humans to communicate this way. Programming languages like Python make it
            easier to write code because you can use less syntax when instructing computers to perform complex
            processes.</p>
        <h1>Using Python to program</h1>
        <p>Python is a general purpose programming language that can be used to solve a variety of problems. For
            example, it can be used to build websites, perform data analysis, and automate tasks.</p>
        <p>Python code must be converted through an interpreter before the computer can process it. An interpreter is a
            computer program that translates Python code into runnable instructions line by line.</p>
        <h1>Python versions</h1>
        <p>There are multiple versions of Python. In this course, you are using Python 3. While using Python, it's
            important to keep track of the version you're using. There are differences in the syntax of each version.
            Syntax refers to the rules that determine what is correctly structured in a computing language.</p>
        <h1>Python in cybersecurity</h1>
        <p>In cybersecurity, Python is used especially for automation. Automation is the use of technology to reduce
            human and manual effort to perform common and repetitive tasks. These are some specific areas of
            cybersecurity in which Python might be used to automate specific tasks:</p>
        <ul>
            <li>Log analysis</li>
            <li>Malware analysis</li>
            <li>Access control list management</li>
            <li>Intrusion detection</li>
            <li>Compliance checks</li>
            <li>Network scanning</li>
        </ul>
        <h1>Key takeaways</h1>
        <p>Python is a programming language, or in other words, a language used to create instructions for a computer to
            complete tasks. Programming languages are converted to binary numbers that a machine can understand. It's
            important to be aware that there are multiple versions of Python, and they have differences in syntax.
            Python is especially useful in cybersecurity for automating repetitive tasks.</p>

    </article>
</section>


<section class="main-section" id="topic712">
    <h2>Python environments </h2>
    <article class="main-article">
        <h1>Notebooks</h1>
        <p>One way to write Python code is through a notebook. In this course, you'll interact with Python through
            notebooks. A notebook is an online interface for writing, storing, and running code. They also allow you to
            document information about the code. Notebook content either appears in a code cell or markdown cell.</p>
        <h2>Code cells</h2>
        <p>Code cells are meant for writing and running code. A notebook provides a mechanism for running these code
            cells. Often, this is a play button located within the cell. When you run the code, its output appears after
            the code.</p>
        <h2>Markdown cells</h2>
        <p>Markdown cells are meant for describing the code. They allow you to format text in the markdown language.
            Markdown language is used for formatting plain text in text editors and code editors. For example, you might
            indicate that text should be in a certain header style.</p>
        <h1>Common notebook environments</h1>
        <p>Two common notebook environments are <a href="#">Jupyter Notebook</a> and <a href="#">Google
                Colaboratory</a>. They allow you to run several programming languages, including Python.</p>
        <h1>Integrated development environments (IDEs)</h1>
        <p>Another option for writing Python code is through an integrated development environment (IDE), or a software
            application for writing code that provides editing assistance and error correction tools. Integrated
            development environments include a graphical user interface (GUI) that provides programmers with a variety
            of options to customize and build their programs.</p>
        <h1>Command line</h1>
        <p>The command line is another environment that allows you to run Python programs. Previously, you learned that
            a command-line interface (CLI) is a text-based user interface that uses commands to interact with the
            computer. By entering commands into the command line, you can access all files and directories saved on your
            hard drive, including files containing Python code you want to run. You can also use the command line to
            open a file editor and create a new Python file.</p>
        <h1>Key takeaways</h1>
        <p>Security analysts can access Python through a variety of environments, including notebooks, integrated
            development environments, and the command line. In this course, you'll use notebooks, which are online
            interfaces for interacting with code. Notebooks contain code cells for writing and running code as well as
            markdown cells for plain text descriptions.</p>
    </article>
</section>

<section class="main-section" id="topic713">
    <h2>More about data types </h2>
    <article class="main-article">
        <h1>Python Data Types</h1>
        <h2>String</h2>
        <p>In Python, string data is data consisting of an ordered sequence of characters. Characters in a string may
            include letters, numbers, symbols, and spaces. These characters must be placed within quotation marks. These
            are all valid strings:</p>
        <ul>
            <li>"updates needed"</li>
            <li>"20%"</li>
            <li>"5.0"</li>
            <li>"35"</li>
            <li>"**/**/**"</li>
            <li>"" (empty string)</li>
        </ul>
        <p>You can use the <code>print()</code> function to display a string.</p>
        <p>Example:</p>
        <pre><code>print("updates needed")
        </code></pre>
        <p>The code prints "updates needed".</p>
        <h2>List</h2>
        <p>In Python, list data is a data structure that consists of a collection of data in sequential form. Lists
            elements can be of any data type, such as strings, integers, Booleans, or even other lists. The elements of
            a list are placed within square brackets, and each element is separated by a comma.</p>
        <p>Example:</p>
        <pre><code>print([12, 36, 54, 1, 7])
        </code></pre>
        <p>This displays a list containing the integers 12, 36, 54, 1, and 7.</p>
        <h2>Integer</h2>
        <p>In Python, integer data is data consisting of a number that does not include a decimal point.</p>
        <p>Example:</p>
        <pre><code>print(5)
        </code></pre>
        <p>This code displays the integer 5.</p>
        <h2>Float</h2>
        <p>Float data is data consisting of a number with a decimal point.</p>
        <p>Example:</p>
        <pre><code>print(1.2 + 2.8)
        </code></pre>
        <p>The output is 4.0.</p>
        <h2>Boolean</h2>
        <p>Boolean data is data that can only be one of two values: either True or False.</p>
        <p>Example:</p>
        <pre><code>print(True)
        print(9 &gt; 10)
        </code></pre>
        <p>The first code displays the Boolean value of True. The second code evaluates to False because 9 is not
            greater than 10.</p>
        <h2>Additional Data Types</h2>
        <h3>Tuple</h3>
        <p>Tuple data is a data structure that consists of a collection of data that cannot be changed. Like lists,
            tuples can contain elements of varying data types.</p>
        <h3>Dictionary</h3>
        <p>Dictionary data consists of one or more key-value pairs. Each key is mapped to a value. A colon is placed
            between the key and value, and commas separate key-value pairs. The dictionary is placed within curly
            brackets.</p>
        <h3>Set</h3>
        <p>Set data consists of an unordered collection of unique values. Elements in a set are always placed within
            curly brackets and are separated by a comma.</p>
        <h2>Key Takeaways</h2>
        <p>It's important for security analysts who program in Python to be familiar with various Python data types. The
            data types that you will work with in this course are string, list, integer, float, and Boolean. Additional
            data types include tuple, dictionary, and set. Each data type has its own purpose and syntax.</p>
    </article>
</section>

<section class="main-section" id="topic714">
    <h2>Assign and reassign variables in Python</h2>
    <article class="main-article">
        <h1>Variables in Python</h1>
        <h2>What are variables?</h2>
        <p>In a programming language, a variable is a container that stores data. It's a named storage location in a
            computer's memory that can hold a value. The value that is stored in a variable can change.</p>
        <h2>Working with variables</h2>
        <h3>Assigning and reassigning variables</h3>
        <p>If you want to create a variable called username and assign it a value of "nzhao", place the variable to the
            left of the equals sign and its value to the right:</p>
        <pre><code># Assign 'username'
        username = "nzhao"
        </code></pre>
        <p>If you later reset this username to "zhao2", you still refer to that variable container as username.</p>
        <pre><code># Reassign 'username'
        username = "zhao2"
        </code></pre>
        <p>Although the contents have changed from "nzhao" to "zhao2", the variable username remains the same.</p>
        <h3>Assigning variables to variables</h3>
        <p>Using a similar process, you can also assign variables to other variables.</p>
        <pre><code># Assign a variable to another variable
        username = "nzhao"
        old_username = username
        </code></pre>
        <p>Because username contains the string value of "nzhao" and old_username contains the value of username,
            old_username now contains a value of "nzhao".</p>
        <h3>Best practices for naming variables</h3>
        <ul>
            <li>Use only letters, numbers, and underscores in variable names.</li>
            <li>Start a variable name with a letter or underscore. Do not start it with a number.</li>
            <li>Remember that variable names in Python are case-sensitive.</li>
            <li>Don't use Python’s built-in keywords or functions for variable names.</li>
        </ul>
        <h3>Stylistic guidelines</h3>
        <ul>
            <li>Separate two or more words with underscores.</li>
            <li>Avoid variables with similar names.</li>
            <li>Avoid unnecessarily long names for variables.</li>
            <li>Names should describe the data and not be random words.</li>
        </ul>
        <h2>Key takeaways</h2>
        <p>It's important for security analysts to have a fundamental understanding of variables. Variables are
            containers of data. They are assigned values and can also be reassigned other values or variables. It's
            helpful to remember the best practices for naming variables in order to create more functional, readable
            code.</p>
    </article>
</section>

<section class="main-section" id="topic715">
    <h2>More on conditionals in Python</h2>
    <article class="main-article">
        <h1>Conditional Statements in Python</h1>
        <h2>How conditional statements work</h2>
        <p>A conditional statement evaluates code to determine whether it meets a specific set of conditions. When a
            condition is met, it evaluates to a Boolean value of True and performs specified actions. When the condition
            isn’t met, it evaluates a Boolean value of False and doesn’t perform the specified actions.</p>
        <h2>if statements</h2>
        <h3>The header of an if statement</h3>
        <p>The first line of an if statement is the header. It starts with the keyword if followed by the condition.</p>
        <h3>The body of an if statement</h3>
        <p>After the header comes the body, which specifies the actions to perform when the condition evaluates to True.
            The body must be indented.</p>
        <h2>Continuing conditionals with else and elif</h2>
        <h3>else statements</h3>
        <p>else precedes a code section that only evaluates when all preceding conditions within the conditional
            statement evaluate to False.</p>
        <h3>elif statements</h3>
        <p>elif precedes a condition that is only evaluated when previous conditions evaluate to False. Multiple elif
            statements can follow if. </p>
        <h2>Logical operators for multiple conditions</h2>
        <h3>and</h3>
        <p>The and operator requires both conditions on either side of the operator to evaluate to True.</p>
        <h3>or</h3>
        <p>The or operator requires only one of the conditions on either side of the operator to evaluate to True.</p>
        <h3>not</h3>
        <p>The not operator negates a given condition.</p>
        <h2>Key takeaways</h2>
        <p>It’s important for security analysts to be familiar with conditional statements. Conditional statements
            require the if keyword. You can also use else and elif when working with conditionals to specify additional
            actions to take. The logical operators and, or, and not are also useful when writing conditionals.</p>
    </article>
</section>

<section class="main-section" id="topic716">
    <h2>More on loops in Python</h2>
    <article class="main-article">
        <h1>Iterative Statements in Python</h1>
        <h2>for loops</h2>
        <p>If you need to iterate through a specified sequence, you should use a for loop.</p>
        <h3>Syntax of a for loop</h3>
        <p>The syntax of a for loop consists of a loop header and a loop body:</p>
        <ul>
            <li><strong>Loop Header:</strong> Begins with the keyword <code>for</code>, followed by the loop variable
                and the sequence to iterate through, ending with a colon (<code>:</code>).</li>
            <li><strong>Loop Body:</strong> Contains the actions to perform with each iteration, indented beneath the
                loop header.</li>
        </ul>
        <h3>Example:</h3>
        <pre><code>for i in ["elarson", "bmoreno", "tshah", "sgilmore"]:
            print(i)
        </code></pre>
        <h2>while loops</h2>
        <p>If you want a loop to iterate based on a condition, you should use a while loop.</p>
        <h3>Syntax of a while loop</h3>
        <p>The syntax of a while loop consists of the loop header and the loop body:</p>
        <ul>
            <li><strong>Loop Header:</strong> Begins with the keyword <code>while</code>, followed by the condition that
                determines when the loop terminates, ending with a colon (<code>:</code>).</li>
            <li><strong>Loop Body:</strong> Contains the actions to perform with each iteration, indented beneath the
                loop header.</li>
        </ul>
        <h3>Example:</h3>
        <pre><code>i = 1
        while i < 5:
            print(i)
            i = i + 1
        </code></pre>
        <h2>Using break and continue</h2>
        <p>You can use the <code>break</code> and <code>continue</code> keywords to control the execution of loops.</p>
        <h3>break</h3>
        <p>Use <code>break</code> to exit a loop prematurely based on a condition:</p>
        <pre><code>computer_assets = ["laptop1", "desktop20", "smartphone03"]
        for asset in computer_assets:
            if asset == "desktop20":
                break
            print(asset)
        </code></pre>
        <h3>continue</h3>
        <p>Use <code>continue</code> to skip an iteration based on a condition:</p>
        <pre><code>computer_assets = ["laptop1", "desktop20", "smartphone03"]
        for asset in computer_assets:
            if asset == "desktop20":
                continue
            print(asset)
        </code></pre>
        <h2>Infinite loops</h2>
        <p>If a loop doesn't have an exit condition, it becomes an infinite loop. Press CTRL-C or CTRL-Z to stop it.</p>
        <h2>Key Takeaways</h2>
        <ul>
            <li>Security analysts use iterative statements to automate tasks.</li>
            <li><code>for</code> loops iterate through sequences, while <code>while</code> loops iterate based on
                conditions.</li>
            <li><code>break</code> exits a loop prematurely, and <code>continue</code> skips an iteration.</li>
            <li>Watch out for infinite loops, which can lead to program hang-ups.</li>
        </ul>
    </article>
</section>

<section class="main-section" id="topic717">
    <h2>Glossary terms from module 1 </h2>
    <article class="main-article">
        <h1>Course 7, Module 1: Terms and Definitions</h1>
        <table>
            <tr>
                <th>Term</th>
                <th>Definition</th>
            </tr>
            <tr>
                <td>Automation</td>
                <td>The use of technology to reduce human and manual effort to perform common and repetitive tasks</td>
            </tr>
            <tr>
                <td>Boolean data</td>
                <td>Data that can only be one of two values: either True or False</td>
            </tr>
            <tr>
                <td>Command-line interface</td>
                <td>A text-based user interface that uses commands to interact with the computer</td>
            </tr>
            <tr>
                <td>Comment</td>
                <td>A note programmers make about the intention behind their code</td>
            </tr>
            <tr>
                <td>Conditional statement</td>
                <td>A statement that evaluates code to determine if it meets a specified set of conditions</td>
            </tr>
            <tr>
                <td>Data type</td>
                <td>A category for a particular type of data item</td>
            </tr>
            <tr>
                <td>Dictionary data</td>
                <td>Data that consists of one or more key-value pairs</td>
            </tr>
            <tr>
                <td>Float data</td>
                <td>Data consisting of a number with a decimal point</td>
            </tr>
            <tr>
                <td>Integer data</td>
                <td>Data consisting of a number that does not include a decimal point</td>
            </tr>
            <tr>
                <td>Integrated development environment (IDE)</td>
                <td>A software application for writing code that provides editing assistance and error correction tools
                </td>
            </tr>
            <tr>
                <td>Interpreter</td>
                <td>A computer program that translates Python code into runnable instructions line by line</td>
            </tr>
            <tr>
                <td>Iterative statement</td>
                <td>Code that repeatedly executes a set of instructions</td>
            </tr>
            <tr>
                <td>List data</td>
                <td>Data structure that consists of a collection of data in sequential form</td>
            </tr>
            <tr>
                <td>Loop variable</td>
                <td>A variable that is used to control the iterations of a loop</td>
            </tr>
            <tr>
                <td>Notebook</td>
                <td>An online interface for writing, storing, and running code</td>
            </tr>
            <tr>
                <td>Programming</td>
                <td>A process that can be used to create a specific set of instructions for a computer to execute tasks
                </td>
            </tr>
            <tr>
                <td>Set data</td>
                <td>Data that consists of an unordered collection of unique values</td>
            </tr>
            <tr>
                <td>String data</td>
                <td>Data consisting of an ordered sequence of characters</td>
            </tr>
            <tr>
                <td>Syntax</td>
                <td>The rules that determine what is correctly structured in a computing language</td>
            </tr>
            <tr>
                <td>Tuple data</td>
                <td>Data structure that consists of a collection of data that cannot be changed</td>
            </tr>
            <tr>
                <td>Type error</td>
                <td>An error that results from using the wrong data type</td>
            </tr>
            <tr>
                <td>Variable</td>
                <td>A container that stores data</td>
            </tr>
        </table>
    </article>
</section>


<section class="main-section" id="Module 72">
    <h2>Module 2</h2>
</section>
<br> <br>


<section class="main-section" id="topic721">
    <h2> Python functions in cybersecurity </h2>
    <article class="main-article">
        <h1>Functions in Cybersecurity</h1>
        <p>A function is a section of code that can be reused in a program. Functions are important in Python because
            they allow you to automate repetitive parts of your code. In cybersecurity, you will likely adopt some
            processes that you will often repeat.</p>
        <p>When working with security logs, you will often encounter tasks that need to be repeated. For example, if you
            were responsible for finding malicious login activity based on failed login attempts, you might have to
            repeat the process for multiple logs.</p>
        <p>To work around that, you could define a function that takes a log as its input and returns all potentially
            malicious logins. It would be easy to apply this function to different logs.</p>
        <h2>Defining a function</h2>
        <p>In Python, you'll work with built-in functions and user-defined functions. Built-in functions are functions
            that exist within Python and can be called directly. The <code>print()</code> function is an example of a
            built-in function.</p>
        <p>User-defined functions are functions that programmers design for their specific needs. To define a function,
            you need to include a function header and the body of your function.</p>
        <h3>Function header</h3>
        <p>The function header is what tells Python that you are starting to define a function. For example, if you want
            to define a function that displays an "investigate activity" message, you can include this function header:
        </p>
        <pre><code>def display_investigation_message():
                </code></pre>
        <p>The <code>def</code> keyword is placed before a function name to define a function. In this case, the name of
            that function is <code>display_investigation_message</code>.</p>
        <p>The parentheses that follow the name of the function and the colon (<code>:</code>) at the end of the
            function header are also essential parts of the syntax.</p>
        <p><strong>Pro tip:</strong> When naming a function, give it a name that indicates what it does. This will make
            it easier to remember when calling it later.</p>
        <h3>Function body</h3>
        <p>The body of the function is an indented block of code after the function header that defines what the
            function does. The indentation is very important when writing a function because it separates the definition
            of a function from the rest of the code.</p>
        <p>To add a body to your definition of the <code>display_investigation_message()</code> function, add an
            indented line with the <code>print()</code> function. Your function definition becomes the following:</p>
        <pre><code>def display_investigation_message():
                    print("investigate activity")
                </code></pre>
        <h2>Calling a function</h2>
        <p>After defining a function, you can use it as many times as needed in your code. Using a function after
            defining it is referred to as calling a function. To call a function, write its name followed by
            parentheses. So, for the function you previously defined, you can use the following code to call it:</p>
        <pre><code>display_investigation_message()
                </code></pre>
        <p>Although you'll use functions in more complex ways as you expand your understanding, the following code
            provides an introduction to how the <code>display_investigation_message()</code> function might be part of a
            larger section of code. You can run it and analyze its output:</p>
        <pre><code>def display_investigation_message():
                    print("investigate activity")
                
                application_status = "potential concern"
                email_status = "okay"
                
                if application_status == "potential concern":
                    print("application_log:")
                    display_investigation_message()
                
                if email_status == "potential concern":
                    print("email log:")
                    display_investigation_message()
                </code></pre>
        <p>The <code>display_investigation_message()</code> function is used twice within the code. It will print
            "investigate activity" messages about two different logs when the specified conditions evaluate to True. In
            this example, only the first conditional statement evaluates to True, so the message prints once.</p>
        <p>This code calls the function from within conditionals, but you might call a function from a variety of
            locations within the code.</p>
        <p><strong>Note:</strong> Calling a function inside of the body of its function definition can create an
            infinite loop. This happens when it is not combined with logic that stops the function call when certain
            conditions are met. For example, in the following function definition, after you first call
            <code>func1()</code>, it will continue to call itself and create an infinite loop:</p>
        <pre><code>def func1():
                    func1()
                </code></pre>
    </article>
</section>

<section class="main-section" id="topic722">
    <h2>Functions and variables</h2>
    <article class="main-article">
        <h1>Working with Variables in Functions</h1>
        <p>Working with variables in functions requires an understanding of both parameters and arguments. The terms
            parameters and arguments have distinct uses when referring to variables in a function. Additionally, if you
            want the function to return output, you should be familiar with return statements.</p>
        <h2>Parameters</h2>
        <p>A parameter is an object that is included in a function definition for use in that function. When you define
            a function, you create variables in the function header. They can then be used in the body of the function.
            In this context, these variables are called parameters. For example, consider the following function:</p>
        <pre><code>def remaining_login_attempts(maximum_attempts, total_attempts):
                    print(maximum_attempts - total_attempts)
                </code></pre>
        <p>This function takes in two variables, <code>maximum_attempts</code> and <code>total_attempts</code>, and uses
            them to perform a calculation. In this example, <code>maximum_attempts</code> and
            <code>total_attempts</code> are parameters.</p>
        <h2>Arguments</h2>
        <p>In Python, an argument is the data brought into a function when it is called. When calling
            <code>remaining_login_attempts</code> in the following example, the integers 3 and 2 are considered
            arguments:</p>
        <pre><code>remaining_login_attempts(3, 2)
                </code></pre>
        <p>These integers pass into the function through the parameters that were identified when defining the function.
            In this case, those parameters would be <code>maximum_attempts</code> and <code>total_attempts</code>. 3 is
            in the first position, so it passes into <code>maximum_attempts</code>. Similarly, 2 is in the second
            position and passes into <code>total_attempts</code>.</p>
        <h2>Return Statements</h2>
        <p>When defining functions in Python, you use return statements if you want the function to return output. The
            <code>return</code> keyword is used to return information from a function.</p>
        <p>The <code>return</code> keyword appears in front of the information that you want to return. In the following
            example, it is before the calculation of how many login attempts remain:</p>
        <pre><code>def remaining_login_attempts(maximum_attempts, total_attempts):
                    return maximum_attempts - total_attempts
                </code></pre>
        <p>Note: The <code>return</code> keyword is not a function, so you should not place parentheses after it.</p>
        <p>Return statements are useful when you want to store what a function returns inside of a variable to use
            elsewhere in the code. For example, you might use this variable for calculations or within conditional
            statements. In the following example, the information returned from the call to
            <code>remaining_login_attempts</code> is stored in a variable called <code>remaining_attempts</code>. Then,
            this variable is used in a conditional that prints a "Your account is locked" message when
            <code>remaining_attempts</code> is less than or equal to 0. You can run this code to explore its output:</p>
        <pre><code>def remaining_login_attempts(maximum_attempts, total_attempts):
                    return maximum_attempts - total_attempts
                
                remaining_attempts = remaining_login_attempts(3, 3)
                if remaining_attempts <= 0:
                    print("Your account is locked")
                </code></pre>
        <p>In this example, the message prints because the calculation in the function results in 0.</p>
        <p>Note: When Python encounters a return statement, it executes this statement and then exits the function. If
            there are lines of code that follow the return statement within the function, they will not be run. The
            previous example didn't contain any lines of code after the return statement, but this might apply in other
            functions, such as one containing a conditional statement.</p>
        <h2>Global and Local Variables</h2>
        <p>To better understand how functions interact with variables, you should know the difference between global and
            local variables.</p>
        <h3>Global Variables</h3>
        <p>A global variable is a variable that is available throughout the entire program. Global variables are
            assigned outside of a function definition. Whenever that variable is called, whether inside or outside a
            function, it will return the value it is assigned.</p>
        <p>For example, you might assign the following variable at the beginning of your code:</p>
        <pre><code>device_id = "7ad2130bd"
                </code></pre>
        <p>Throughout the rest of your code, you will be able to access and modify the <code>device_id</code> variable
            in conditionals, loops, functions, and other syntax.</p>
        <h3>Local Variables</h3>
        <p>A local variable is a variable assigned within a function. These variables cannot be called or accessed
            outside of the body of a function. Local variables include parameters as well as other variables assigned
            within a function definition.</p>
        <p>In the following function definition, <code>total_string</code> and <code>name</code> are local variables:
        </p>
        <pre><code>def greet_employee(name):
                    total_string = "Welcome" + name
                    return total_string
                </code></pre>
        <p>The variable <code>total_string</code> is a local variable because it's assigned inside of the function. The
            parameter <code>name</code> is a local variable because it is also created when the function is defined.</p>
        <p>Whenever you call a function, Python creates these variables temporarily while the function is running and
            deletes them from memory after the function stops running.</p>
        <p>This means that if you call the <code>greet_employee()</code> function with an argument and then use the
            <code>total_string</code> variable outside of this function, you'll get an error.</p>
        <h3>Best Practices for Global and Local Variables</h3>
        <p>When working with variables and functions, it is very important to make sure that you only use a certain
            variable name once, even if one is defined globally and the other is defined locally.</p>
        <p>When using global variables inside functions, functions can access the values of a global variable. You can
            run the following example to explore this:</p>
        <pre><code>username = "elarson"
                
                def identify_user():
                    print(username)
                
                identify_user()
                </code></pre>
        <p>The code block returns "elarson" even though that name isn't defined locally. The function accesses the
            global variable. If you wanted the <code>identify_user()</code> function to accommodate other usernames, you
            would have to reassign the global <code>username</code> variable outside of the function. This isn't good
            practice. A better way to pass different values into a function is to use a parameter instead of a global
            variable.</p>
        <p>There's something else to consider too. If you reuse the name of a global variable within a function, it will
            create a new local variable with that name. In other words, there will be both a global variable with that
            name and a local variable with that name, and they'll have different values. You can consider the following
            code block:</p>
        <pre><code>username = "elarson"
                print("1:" + username)
                
                def greet():
                    username = "bmoreno"
                    print("2:" + username)
                
                greet()
                print("3:" + username)
                </code></pre>
        <p>The first print statement occurs before the function, and Python returns the value of the global
            <code>username</code> variable, "elarson". The second print statement is within the function, and it returns
            the value of the local <code>username</code> variable, which is "bmoreno". But this doesn't change the value
            of the global variable, and when <code>username</code> is printed a third time after the function call, it's
            still "elarson".</p>
        <p>Due to this complexity, it's best to avoid combining global and local variables within functions.</p>
        <h2>Key Takeaways</h2>
        <p>Working with variables in functions requires understanding various concepts. A parameter is an object that is
            included in a function definition for use in that function, an argument is the data brought into a function
            when it is called, and the <code>return</code> keyword is used to return information from a function.
            Additionally, global variables are variables accessible throughout the program, and local variables are
            parameters and variables assigned within a function that aren't usable outside of a function. It's important
            to make sure your variables all have distinct names, even if one is a local variable and the other is a
            global variable.</p>
    </article>
</section>

<section class="main-section" id="topic723">
    <h2> Work with built-in functions </h2>
    <article class="main-article">
        <h1>Built-in Functions in Python</h1>
        <p>Built-in functions are powerful tools in Python that allow you to perform tasks with one simple command.
            Let's explore some of these functions:</p>
        <h2>print()</h2>
        <p>The <code>print()</code> function outputs a specified object to the screen. It takes in any number of
            arguments, separated by a comma, and prints all of them. For example:</p>
        <pre><code>month = "September"
                print("Investigate failed login attempts during", month, "if more than", 100)
                </code></pre>
        <h2>type()</h2>
        <p>The <code>type()</code> function returns the data type of its argument. It helps you keep track of the data
            types of variables to avoid errors throughout your code. For example, you could use:</p>
        <pre><code>print(type("security"))
                </code></pre>
        <h2>Passing One Function into Another</h2>
        <p>When working with functions like <code>type()</code>, you often need to pass them through
            <code>print()</code> if you want to output the data type to the screen. For example:</p>
        <pre><code>print(type("This is a string"))
                </code></pre>
        <h2>max() and min()</h2>
        <p>The <code>max()</code> function returns the largest numeric input passed into it, while the
            <code>min()</code> function returns the smallest numeric input passed into it. For example:</p>
        <pre><code>time_list = [12, 2, 32, 19, 57, 22, 14]
                print(min(time_list))
                print(max(time_list))
                </code></pre>
        <h2>sorted()</h2>
        <p>The <code>sorted()</code> function sorts the components of a list or any iterable. It sorts them in ascending
            order by default. For example:</p>
        <pre><code>time_list = [12, 2, 32, 19, 57, 22, 14]
                print(sorted(time_list))
                </code></pre>
        <p>The <code>sorted()</code> function does not change the original iterable. For instance:</p>
        <pre><code>time_list = [12, 2, 32, 19, 57, 22, 14]
                print(sorted(time_list))
                print(time_list)
                </code></pre>
        <p>Remember, the <code>sorted()</code> function cannot take lists or strings that have elements of more than one
            data type.</p>
        <h2>Key Takeaways</h2>
        <ul>
            <li>The <code>print()</code> function prints its arguments to the screen.</li>
            <li>The <code>type()</code> function returns the data type of its argument.</li>
            <li>The <code>min()</code> and <code>max()</code> functions return the smallest and largest values of an
                iterable respectively.</li>
            <li>The <code>sorted()</code> function organizes its argument.</li>
        </ul>
    </article>
</section>

<section class="main-section" id="topic724">
    <h2> Import modules and libraries in Python </h2>
    <article class="main-article">
        <h1>Importing Modules in Python</h1>
        <p>Python provides the flexibility to import modules from the Python Standard Library as well as external
            libraries. Let's delve into how to work with these modules:</p>
        <h2>The Python Standard Library</h2>
        <p>The Python Standard Library comprises various modules that cater to different tasks. You can import these
            modules to leverage their functionalities. For instance:</p>
        <ul>
            <li>The <code>re</code> module for pattern searching in log files</li>
            <li>The <code>csv</code> module for working with .csv files</li>
            <li>The <code>glob</code> and <code>os</code> modules for interacting with the command line</li>
            <li>The <code>time</code> and <code>datetime</code> modules for handling timestamps</li>
            <li>The <code>statistics</code> module for statistical calculations</li>
        </ul>
        <p>To import these modules, you use the <code>import</code> keyword. For example, to calculate the mean of a
            list of values using the <code>statistics</code> module:</p>
        <pre><code>import statistics
                monthly_failed_attempts = [20, 17, 178, 33, 15, 21, 19, 29, 32, 15, 25, 19]
                mean_failed_attempts = statistics.mean(monthly_failed_attempts)
                print("mean:", mean_failed_attempts)
                </code></pre>
        <h2>External Libraries</h2>
        <p>In addition to the Python Standard Library, you can download and use external libraries like Beautiful Soup
            (<code>bs4</code>) and NumPy (<code>numpy</code>) for specific tasks. These libraries need to be installed
            before you can use them.</p>
        <p>For example, to install NumPy, you can run:</p>
        <pre><code>%pip install numpy
                </code></pre>
        <p>After installing, you can import NumPy in your Python code:</p>
        <pre><code>import numpy
                </code></pre>
        <p>Once imported, you can use the functions and features provided by these libraries to enhance your Python
            programs.</p>
    </article>
</section>

<section class="main-section" id="topic725">
    <h2> Ensure proper syntax and readability in Python </h2>
    <article class="main-article">
        <h1>Python Syntax and Readability</h1>
        <p>Understanding Python syntax and ensuring code readability are essential for writing clean and maintainable
            code. Let's explore some important aspects:</p>
        <h2>Comments</h2>
        <p>Comments provide valuable insights into the code's intentions. They can be single-line or multi-line:</p>
        <h3>Single-line comments:</h3>
        <pre><code># Print elements of 'computer_assets' list
                
                computer_assets = ["laptop1", "desktop20", "smartphone03"]
                
                for asset in computer_assets:
                
                    print(asset)
                </code></pre>
        <h3>Multi-line comments:</h3>
        <pre><code># remaining_login_attempts() function takes two integer parameters,
                
                # the maximum login attempts allowed and the total attempts made,
                
                # and it returns an integer representing remaining login attempts
                
                def remaining_login_attempts(maximum_attempts, total_attempts):
                
                    return maximum_attempts - total_attempts
                </code></pre>
        <h2>Correct Indentation</h2>
        <p>Indentation ensures code readability and proper execution. The PEP 8 style guide recommends using four spaces
            for indentation:</p>
        <pre><code>count = 0
                
                login_status = True
                
                while login_status == True:
                
                    print("Try again.")
                
                    count = count + 1
                
                    if count == 4:
                
                        login_status = False
                </code></pre>
        <h2>Maintaining Correct Syntax</h2>
        <p>Correct syntax is crucial for preventing errors. Pay attention to data types and colons in headers:</p>
        <h3>Data Types:</h3>
        <ul>
            <li>Place string data in quotation marks.</li>
            <li>Do not add quotation marks around integer, float, or Boolean data types.</li>
            <li>Place lists in brackets and separate the elements with commas.</li>
        </ul>
        <h3>Colons in Headers:</h3>
        <pre><code># The header of a function definition must end with a colon
                
                def remaining_login_attempts(maximum_attempts, total_attempts):
                
                    return maximum_attempts - total_attempts
                </code></pre>
        <h2>Key Takeaways</h2>
        <ul>
            <li>Follow the PEP 8 style guide for code readability.</li>
            <li>Use comments to explain code intentions.</li>
            <li>Maintain correct indentation for readability and execution.</li>
            <li>Be aware of common syntax issues to prevent errors.</li>
        </ul>
    </article>
</section>

<section class="main-section" id="topic726">
    <h2> Glossary terms from module 2 </h2>
    <article class="main-article">
        <h1>Python Terminology</h1>
        <table border="1">
            <tr>
                <th>Term</th>
                <th>Definition</th>
            </tr>
            <tr>
                <td>Argument (Python)</td>
                <td>The data brought into a function when it is called</td>
            </tr>
            <tr>
                <td>Built-in function</td>
                <td>A function that exists within Python and can be called directly</td>
            </tr>
            <tr>
                <td>Comment</td>
                <td>A note programmers make about the intention behind their code</td>
            </tr>
            <tr>
                <td>Function</td>
                <td>A section of code that can be reused in a program</td>
            </tr>
            <tr>
                <td>Global variable</td>
                <td>A variable that is available through the entire program</td>
            </tr>
            <tr>
                <td>Indentation</td>
                <td>Space added at the beginning of a line of code</td>
            </tr>
            <tr>
                <td>Library</td>
                <td>A collection of modules that provide code users can access in their programs</td>
            </tr>
            <tr>
                <td>Local variable</td>
                <td>A variable assigned within a function</td>
            </tr>
            <tr>
                <td>Module</td>
                <td>A Python file that contains additional functions, variables, classes, and any kind of runnable code
                </td>
            </tr>
            <tr>
                <td>Parameter (Python)</td>
                <td>An object that is included in a function definition for use in that function</td>
            </tr>
            <tr>
                <td>PEP 8 style guide</td>
                <td>A resource that provides stylistic guidelines for programmers working in Python</td>
            </tr>
            <tr>
                <td>Python Standard Library</td>
                <td>An extensive collection of Python code that often comes packaged with Python</td>
            </tr>
            <tr>
                <td>Return statement</td>
                <td>A Python statement that executes inside a function and sends information back to the function call
                </td>
            </tr>
            <tr>
                <td>Style guide</td>
                <td>A manual that informs the writing, formatting, and design of documents</td>
            </tr>
            <tr>
                <td>User-defined function</td>
                <td>A function that programmers design for their specific needs</td>
            </tr>
        </table>
    </article>
</section>


<section class="main-section" id="Module 73">
    <h2>Module 3</h2>
</section>
<br> <br>


<section class="main-section" id="topic731">
    <h2> Strings and the security analyst </h2>
    <article class="main-article">
        <h1>Working with Strings in Python</h1>
        <h2>String data in a security setting</h2>
        <p>As an analyst, string data is one of the most common data types you will encounter in Python. String data is
            data consisting of an ordered sequence of characters. It's used to store any type of information you don't
            need to manipulate mathematically (such as through division or subtraction). In a cybersecurity context,
            this includes IP addresses, usernames, URLs, and employee IDs.</p>
        <p>You'll need to work with these strings in a variety of ways. For example, you might extract certain parts of
            an IP address, or you might verify whether usernames meet required criteria.</p>
        <h2>Working with indices in strings</h2>
        <h3>Indices</h3>
        <p>An index is a number assigned to every element in a sequence that indicates its position. With strings, this
            means each character in the string has its own index.</p>
        <p>Indices start at 0. For example, you might be working with this string containing a device ID: "h32rb17". The
            following table indicates the index for each character in this string:</p>
        <table border="1">
            <tr>
                <th>Character</th>
                <th>Index</th>
            </tr>
            <tr>
                <td>h</td>
                <td>0</td>
            </tr>
            <tr>
                <td>3</td>
                <td>1</td>
            </tr>
            <tr>
                <td>2</td>
                <td>2</td>
            </tr>
            <tr>
                <td>r</td>
                <td>3</td>
            </tr>
            <tr>
                <td>b</td>
                <td>4</td>
            </tr>
            <tr>
                <td>1</td>
                <td>5</td>
            </tr>
            <tr>
                <td>7</td>
                <td>6</td>
            </tr>
        </table>
        <p>You can also use negative numbers as indices. This is based on their position relative to the last character
            in the string:</p>
        <table border="1">
            <tr>
                <th>Character</th>
                <th>Index</th>
            </tr>
            <tr>
                <td>h</td>
                <td>-7</td>
            </tr>
            <tr>
                <td>3</td>
                <td>-6</td>
            </tr>
            <tr>
                <td>2</td>
                <td>-5</td>
            </tr>
            <tr>
                <td>r</td>
                <td>-4</td>
            </tr>
            <tr>
                <td>b</td>
                <td>-3</td>
            </tr>
            <tr>
                <td>1</td>
                <td>-2</td>
            </tr>
            <tr>
                <td>7</td>
                <td>-1</td>
            </tr>
        </table>
        <h3>Bracket notation</h3>
        <p>Bracket notation refers to the indices placed in square brackets. You can use bracket notation to extract a
            part of a string. For example, the first character of the device ID might represent a certain characteristic
            of the device. If you want to extract it, you can use bracket notation for this:</p>
        <p><code>"h32rb17"[0]</code></p>
        <p>This device ID might also be stored within a variable called device_id. You can apply the same bracket
            notation to the variable:</p>
        <p><code>device_id = "h32rb17"</code></p>
        <p><code>device_id[0]</code></p>
        <p>In both cases, bracket notation outputs the character h when this bracket notation is placed inside a
            <code>print()</code> function. You can observe this by running the following code:</p>
        <pre><code>device_id = "h32rb17"
                print("h32rb17"[0])
                print(device_id[0])
                </code></pre>
        <p>You can also take a slice from a string. When you take a slice from a string, you extract more than one
            character from it. It's often done in cybersecurity contexts when you’re only interested in a specific part
            of a string. For example, this might be certain numbers in an IP address or certain parts of a URL.</p>
        <p>In the device ID example, you might need the first three characters to determine a particular quality of the
            device. To do this, you can take a slice of the string using bracket notation. You can run this line of code
            to observe that it outputs "h32":</p>
        <p><code>print("h32rb17"[0:3])</code></p>
        <p>Note: The slice starts at the 0 index, but the second index specified after the colon is excluded. This means
            the slice ends one position before index 3, which is at index 2.</p>
        <h2>String functions and methods</h2>
        <p>The <code>str()</code> and <code>len()</code> functions are useful for working with strings. You can also
            apply methods to strings, including the <code>.upper()</code>, <code>.lower()</code>, and
            <code>.index()</code> methods. A method is a function that belongs to a specific data type.</p>
        <h3><code>str()</code> and <code>len()</code></h3>
        <p>The <code>str()</code> function converts its input object into a string. As an analyst, you might use this in
            security logs when working with numerical IDs that aren't going to be used with mathematical processes.
            Converting an integer to a string gives you the ability to search through it and extract slices from it.</p>
        <p>Consider the example of an employee ID 19329302 that you need to convert into a string. You can use the
            following line of code to convert it into a string and store it in a variable:</p>
        <pre><code>string_id = str(19329302)</code></pre>
        <p>The second function you learned for strings is the <code>len()</code> function, which returns the number of
            elements in an object.</p>
        <p>As an example, if you want to verify that a certain device ID conforms to a standard of containing seven
            characters, you can use the <code>len()</code> function and a conditional. When you run the following code,
            it will print a message if "h32rb17" has seven characters:</p>
        <pre><code>device_id_length = len("h32rb17")
                if device_id_length == 7:
                   print("The device ID has 7 characters.")</code></pre>
        <h3><code>.upper()</code> and <code>.lower()</code></h3>
        <p>The <code>.upper()</code> method returns a copy of the string with all of its characters in uppercase. For
            example, you can change this department name to all uppercase by running the code
            <code>"Information Technology".upper()</code>. It would return the string "INFORMATION TECHNOLOGY".</p>
        <p>Meanwhile, the <code>.lower()</code> method returns a copy of the string in all lowercase characters.
            <code>"Information Technology".lower()</code> would return the string "information technology".</p>
        <h3><code>.index()</code></h3>
        <p>The <code>.index()</code> method finds the first occurrence of the input in a string and returns its
            location. For example, this code uses the <code>.index()</code> method to find the first occurrence of the
            character "r" in the device ID "h32rb17":</p>
        <pre><code>print("h32rb17".index("r"))</code></pre>
        <p>The <code>.index()</code> method returns 3 because the first occurrence of the character "r" is at index 3.
        </p>
        <p>In other cases, the input may not be found. When this happens, Python returns an error. For instance, the
            code <code>print("h32rb17".index("a"))</code> returns an error because "a" is not in the string "h32rb17".
        </p>
        <p>Also note that if a string contains more than one instance of a character, only the first one will be
            returned. For instance, the device ID "r45rt46" contains two instances of "r". You can run the following
            code to explore its output:</p>
        <pre><code>print("r45rt46".index("r"))</code></pre>
        <p>The output is 0 because <code>.index()</code> returns only the first instance of "r", which is at index 0.
            The instance of "r" at index 3 is not returned.</p>
        <h3>Finding substrings with <code>.index()</code></h3>
        <p>A substring is a continuous sequence of characters within a string. For example, "llo" is a substring of
            "hello".</p>
        <p>The <code>.index()</code> method can also be used to find the index of the first occurrence of a substring.
            It returns the index of the first character in that substring. Consider this example that finds the first
            instance of the user "tshah" in a string:</p>
        <pre><code>tshah_index = "tsnow, tshah, bmoreno - updated".index("tshah")
                print(tshah_index)</code></pre>
        <p>The <code>.index()</code> method returns the index 7, which is where the substring "tshah" starts.</p>
        <p>Note: When using the <code>.index()</code> method to search for substrings, you need to be careful. In the
            previous example, you want to locate the instance of "tshah". If you search for just "ts", Python will
            return 0 instead of 7 because "ts" is also a substring of "tsnow".</p>
    </article>
</section>


<section class="main-section" id="topic732">
    <h2> Lists and the security analyst

    </h2>
    <article class="main-article">
        <h1>Lists and the Security Analyst</h1>
        <h2>List data in a security setting</h2>
        <p>As a security analyst, you'll frequently work with lists in Python. List data is a data structure that
            consists of a collection of data in sequential form. You can use lists to store multiple elements in a
            single variable. A single list can contain multiple data types.</p>
        <p>In a cybersecurity context, lists might be used to store usernames, IP addresses, URLs, device IDs, and data.
        </p>
        <p>Placing data within a list allows you to work with it in a variety of ways. For example, you might iterate
            through a list of device IDs using a for loop to perform the same actions for all items in the list. You
            could incorporate a conditional statement to only perform these actions if the device IDs meet certain
            conditions.</p>
        <h2>Working with indices in lists</h2>
        <h3>Indices</h3>
        <p>Like strings, you can work with lists through their indices, and indices start at 0. In a list, an index is
            assigned to every element in the list.</p>
        <p>This table contains the index for each element in the list ["elarson", "fgarcia", "tshah", "sgilmore"]:</p>
        <table border="1">
            <tr>
                <th>Element</th>
                <th>Index</th>
            </tr>
            <tr>
                <td>elarson</td>
                <td>0</td>
            </tr>
            <tr>
                <td>fgarcia</td>
                <td>1</td>
            </tr>
            <tr>
                <td>tshah</td>
                <td>2</td>
            </tr>
            <tr>
                <td>sgilmore</td>
                <td>3</td>
            </tr>
        </table>
        <h3>Bracket notation</h3>
        <p>Similar to strings, you can use bracket notation to extract elements or slices in a list. To extract an
            element from a list, after the list or the variable that contains a list, add square brackets that contain
            the index of the element. The following example extracts the element with an index of 2 from the variable
            username_list and prints it. You can run this code to examine what it outputs:</p>
        <pre><code>username_list = ["elarson", "fgarcia", "tshah", "sgilmore"]
                print(username_list[2])
                </code></pre>
        <p>The code returns a sublist of ["elarson", "fgarcia"]. This is because the element at index 0, "elarson", is
            included in the slice, but the element at index 2, "tshah", is excluded. The slice ends one element before
            this index.</p>
        <h3>Changing the elements in a list</h3>
        <p>Unlike strings, you can also use bracket notation to change elements in a list. This is because a string is
            immutable and cannot be changed after it is created and assigned a value, but lists are not immutable.</p>
        <p>To change a list element, use similar syntax as you would use when reassigning a variable, but place the
            specific element to change in bracket notation after the variable name. For example, the following code
            changes the element at index 1 of the username_list variable to "bmoreno".</p>
        <pre><code>print(["elarson", "fgarcia", "tshah", "sgilmore"][2])
                </code></pre>
        <p>This code has updated the element at index 1 from "fgarcia" to "bmoreno".</p>
        <h2>List methods</h2>
        <p>List methods are functions that are specific to the list data type. These include the .insert(), .remove(),
            .append() and .index().</p>
        <h3>.insert()</h3>
        <p>The .insert() method adds an element in a specific position inside a list. It has two parameters. The first
            is the index where you will insert the new element, and the second is the element you want to insert.</p>
        <p>You can run the following code to explore how this method can be used to insert a new username into a
            username list:</p>
        <pre><code>username_list = ["elarson", "fgarcia", "tshah", "sgilmore"]
                print(username_list[0:2])
                </code></pre>
        <p>Because the first parameter is 2 and the second parameter is "wjaffrey", "wjaffrey" is inserted at index 2,
            which is the third position. The other list elements are shifted one position in the list. For example,
            "tshah" was originally located at index 2 and now is located at index 3.</p>
        <h3>.remove()</h3>
        <p>The .remove() method removes the first occurrence of a specific element in a list. It has only one parameter,
            the element you want to remove.</p>
        <p>The following code removes "elarson" from the username_list:</p>
        <pre><code>username_list = ["elarson", "fgarcia", "tshah", "sgilmore"]
                print("Before changing an element:", username_list)
                username_list[1] = "bmoreno"
                print("After changing an element:", username_list)
                </code></pre>
        <p>This code removes "elarson" from the list. The elements that follow "elarson" are all shifted one position
            closer to the beginning of the list.</p>
        <p>Note: If there are two of the same element in a list, the .remove() method only removes the first instance of
            that element and not all occurrences.</p>
        <h3>.append()</h3>
        <p>The .append() method adds input to the end of a list. Its one parameter is the element you want to add to the
            end of the list.</p>
        <p>For example, you could use .append() to add "btang" to the end of the username_list:</p>
        <pre><code>username_list = ["elarson", "fgarcia", "tshah", "sgilmore"]
                print("Before changing an element:", username_list)
                username_list[1] = "bmoreno"
                print("After changing an element:", username_list)
                </code></pre>
        <p>This code places "btang" at the end of the username_list, and all other elements remain in their original
            positions.</p>
        <p>The .append() method is often used with for loops to populate an empty list with elements. You can explore
            how this works with the following code:</p>
        <pre><code>username_list = ["elarson", "bmoreno", "wjaffrey", "tshah", "sgilmore"]
                print("Before removing an element:", username_list)
                username_list.remove("elarson")
                print("After removing an element:", username_list)
                </code></pre>
        <p>Before the for loop, the numbers_list variable does not contain any elements. When it is printed, the empty
            list is displayed. Then, the for loop iterates through a sequence of numbers and uses the .append() method
            to add each of these numbers to numbers_list. After the loop, when the numbers_list variable is printed, it
            displays these numbers.</p>
        <h3>.index()</h3>
        <p>Similar to the .index() method used for strings, the .index() method used for lists finds the first
            occurrence of an element in a list and returns its index. It takes the element you're searching for as an
            input.</p>
        <p>Using the username_list variable, you can use the .index() method to find the index of the username "tshah":
        </p>
        <pre><code>username_list = ["bmoreno", "wjaffrey", "tshah", "sgilmore"]
                print("Before appending an element:", username_list)
                username_list.append("btang")
                print("After appending an element:", username_list)
                </code></pre>
        <p>Because the index of "tshah" is 2, it outputs this number.</p>
        <p>Similar to the .index() method used for strings, it only returns the index of the first occurrence of a list
            item. So if the username "tshah" were repeated twice, it would return the index of the first instance, and
            not the second.</p>
        <h2>Key takeaways</h2>
        <p>Python offers a lot of ways to work with lists. Bracket notation allows you to extract elements and slices
            from lists and also to alter them. List methods allow you to alter lists in a variety of ways. The .insert()
            and .append() methods add elements to lists while the .remove() method allows you to remove them. The
            .index() method allows you to find the index of an element in a list.</p>
    </article>
</section>

<section class="main-section" id="topic733">
    <h2> More about regular expressions

    </h2>
    <article class="main-article">
        <h1>Basics of Regular Expressions</h1>
        <p>A regular expression (regex) is a sequence of characters that forms a pattern. You can use these in Python to
            search for a variety of patterns. This could include IP addresses, emails, or device IDs.</p>
        <p>To access regular expressions and related functions in Python, you need to import the re module first. You
            should use the following line of code to import the re module:</p>
        <pre><code>import re</code></pre>
        <p>Regular expressions are stored in Python as strings. Then, these strings are used in re module functions to
            search through other strings. There are many functions in the re module, but you will explore how regular
            expressions work through re.findall(). The re.findall() function returns a list of matches to a regular
            expression. It requires two parameters. The first is the string containing the regular expression pattern,
            and the second is the string you want to search through.</p>
        <p>The patterns that comprise a regular expression consist of alphanumeric characters and special symbols. If a
            regular expression pattern consists only of alphanumeric characters, Python will review the specified string
            for matches to this pattern and return them. In the following example, the first parameter is a regular
            expression pattern consisting only of the alphanumeric characters "ts". The second parameter, "tsnow, tshah,
            bmoreno", is the string it will search through. You can run the following code to explore what it returns:
        </p>
        <pre><code>import re
                re.findall("ts", "tsnow, tshah, bmoreno")</code></pre>
        <p>The output is a list of only two elements, the two matches to "ts": ['ts', 'ts'].</p>
        <p>If you want to do more than search for specific strings, you must incorporate special symbols into your
            regular expressions.</p>
        <h2>Regular Expression Symbols</h2>
        <h3>Symbols for Character Types</h3>
        <p>You can use a variety of symbols to form a pattern for your regular expression. Some of these symbols
            identify a particular type of character. For example, \w matches with any alphanumeric character.</p>
        <p>Note: The \w symbol also matches with the underscore ( _ ).</p>
        <p>You can run this code to explore what re.findall() returns when applying the regular expression of "\w" to
            the device ID of "h32rb17".</p>
        <pre><code>import re
                re.findall("\w", "h32rb17")</code></pre>
        <p>Because every character within this device ID is an alphanumeric character, Python returns a list with seven
            elements. Each element represents one of the characters in the device ID.</p>
        <p>You can use these additional symbols to match to specific kinds of characters:</p>
        <ul>
            <li><code>.</code> matches to all characters, including symbols</li>
            <li><code>\d</code> matches to all single digits [0-9]</li>
            <li><code>\s</code> matches to all single spaces</li>
            <li><code>\.</code> matches to the period character</li>
        </ul>
        <p>The following code searches through the same device ID as the previous example but changes the regular
            expression pattern to "\d". When you run it, it will return a different list:</p>
        <pre><code>import re
                re.findall("\d", "h32rb17")</code></pre>
        <p>This time, the list contains only four elements. Each element is one of the numeric digits in the string.</p>
        <h3>Symbols to Quantify Occurrences</h3>
        <p>Other symbols quantify the number of occurrences of a specific character in the pattern. In a regular
            expression pattern, you can add them after a character or a symbol identifying a character type to specify
            the number of repetitions that match to the pattern.</p>
        <p>For example, the + symbol represents one or more occurrences of a specific character. In the following
            example, the pattern places it after the "\d" symbol to find matches to one or more occurrences of a single
            digit:</p>
        <pre><code>import re
                re.findall("\d+", "h32rb17")</code></pre>
        <p>With the regular expression "\d+", the list contains the two matches of "32" and "17".</p>
        <p>Another symbol used to quantify the number of occurrences is the * symbol. The * symbol represents zero, one,
            or more occurrences of a specific character. The following code substitutes the * symbol for the + used in
            the previous example. You can run it to examine the difference:</p>
        <pre><code>import re
                re.findall("\d*", "h32rb17")</code></pre>
        <p>Because it also matches to zero occurrences, the list now contains empty strings for the characters that were
            not single digits.</p>
        <p>If you want to indicate a specific number of repetitions to allow, you can place this number in curly
            brackets ({ }) after the character or symbol. In the following example, the regular expression pattern
            "\d{2}" instructs Python to return all matches of exactly two single digits in a row from a string of
            multiple device IDs:</p>
        <pre><code>import re
                re.findall("\d{2}", "h32rb17 k825t0m c2994eh")</code></pre>
        <p>Because it is matching to two repetitions, when Python encounters a single digit, it checks whether there is
            another one following it. If there is, Python adds the two digits to the list and goes on to the next digit.
            If there isn't, it proceeds to the next digit without adding the first digit to the list.</p>
        <p>You can also specify a range within the curly brackets by separating two numbers with a comma. The first
            number is the minimum number of repetitions and the second number is the maximum number of repetitions. The
            following example returns all matches that have between one and three repetitions of a single digit:</p>
        <pre><code>import re
                re.findall("\d{1,3}", "h32rb17 k825t0m c2994eh")</code></pre>
        <p>The returned list contains elements of one digit like "0", two digits like "32" and three digits like "825".
        </p>
        <h2>Constructing a Pattern</h2>
        <p>Constructing a regular expression requires you to break down the pattern you're searching for into smaller
            chunks and represent those chunks using the symbols you've learned. Consider an example of a string that
            contains multiple pieces of information about employees at an organization. For each employee, the following
            string contains their employee ID, their username followed by a colon (:), their attempted logins for the
            day, and their department:</p>
        <pre><code>employee_logins_string = "1001 bmoreno: 12 Marketing 1002 tshah: 7 Human Resources 1003 sgilmore: 5 Finance"</code></pre>
        <p>Your task is to extract the username and the login attempts, without the employee's ID number or department.
        </p>
        <p>To complete this task with regular expressions, you need to break down what you're searching for into smaller
            components. In this case, those components are the varying number of characters in a username, a colon, a
            space, and a varying number of single digits. The corresponding regular expression symbols are \w+, :, \s,
            and \d+ respectively. Using these symbols as your regular expression, you can run the following code to
            extract the strings:</p>
        <pre><code>import re
                pattern = "\w+:\s\d+"
                employee_logins_string = "1001 bmoreno: 12 Marketing 1002 tshah: 7 Human Resources 1003 sgilmore: 5 Finance"
                print(re.findall(pattern, employee_logins_string))</code></pre>
        <p>Note: Working with regular expressions can carry the risk of returning unneeded information or excluding
            strings that you want to return. Therefore, it's useful to test your regular expressions.</p>
        <h2>Key Takeaways</h2>
        <p>Regular expressions allow you to search through strings to find matches to specific patterns. You can use
            regular expressions by importing the re module. This module contains multiple functions, including
            re.findall(), which returns all matches to a pattern in the form of a list. To form a pattern, you use
            characters and symbols. Symbols allow you to specify types of characters and to quantify how many
            repetitions of a character or type of character can occur in the pattern.</p>

    </article>
</section>

<section class="main-section" id="topic734">
    <h2> Glossary terms from module 3 </h2>
    <article class="main-article">
        <h1>Terms and Definitions from Course 7, Module 3</h1>
        <ul>
            <li><strong>Algorithm:</strong> A set of rules that solve a problem</li>
            <li><strong>Bracket notation:</strong> The indices placed in square brackets</li>
            <li><strong>Debugging:</strong> The practice of identifying and fixing errors in code</li>
            <li><strong>Immutable:</strong> An object that cannot be changed after it is created and assigned a value
            </li>
            <li><strong>Index:</strong> A number assigned to every element in a sequence that indicates its position
            </li>
            <li><strong>List concatenation:</strong> The concept of combining two lists into one by placing the elements
                of the second list directly after the elements of the first list</li>
            <li><strong>List data:</strong> Data structure that consists of a collection of data in sequential form</li>
            <li><strong>Method:</strong> A function that belongs to a specific data type</li>
            <li><strong>Regular expression (regex):</strong> A sequence of characters that forms a pattern</li>
            <li><strong>String concatenation:</strong> The process of joining two strings together</li>
            <li><strong>String data:</strong> Data consisting of an ordered sequence of characters</li>
            <li><strong>Substring:</strong> A continuous sequence of characters within a string</li>
        </ul>
    </article>
</section>


<section class="main-section" id="Module 74">
    <h2>Module 4</h2>
</section>
<br> <br>


<section class="main-section" id="topic741">
    <h2> Essential Python components for automation </h2>
    <article class="main-article">
        <h1>Automating Tasks in Python</h1>
        <p>Automation is the use of technology to reduce human and manual effort to perform common and repetitive tasks.
            As a security analyst, you will primarily use Python to automate tasks.</p>
        <p>You have encountered multiple examples of how to use Python for automation in this course, including
            investigating logins, managing access, and updating devices.</p>
        <p>Automating cybersecurity-related tasks requires understanding the following Python components that you've
            worked with in this course:</p>
        <ul>
            <li><strong>Variables:</strong> A container that stores data.</li>
            <li><strong>Conditional statements:</strong> Statements that evaluate code to determine if it meets a
                specified set of conditions.</li>
            <li><strong>Iterative statements:</strong> Code that repeatedly executes a set of instructions.</li>
            <li><strong>Functions:</strong> Sections of code that can be reused in a program.</li>
            <li><strong>Techniques for working with strings:</strong> Including bracket notation, functions, and methods
                like str(), len(), and .index().</li>
            <li><strong>Techniques for working with lists:</strong> Including bracket notation and methods like
                .insert(), .remove(), .append(), and .index().</li>
        </ul>
        <h2>Example: Counting Logins Made by a Flagged User</h2>
        <p>As one example, you may find that you need to investigate the logins of a specific user who has been flagged
            for unusual activity. Specifically, you are responsible for counting how many times this user has logged in
            for the day.</p>
        <p>To automate the investigation, you'll need to incorporate a for loop, conditional statement, and a counter
            variable.</p>
        <h2>Working with Files in Python</h2>
        <p>Another essential component of automating cybersecurity-related tasks in Python is understanding how to work
            with files. Security-related data will often be initially found in log files, which can be .txt or .csv
            files.</p>
        <p>You can easily extract data from .txt and .csv files, as well as convert them into other file formats.</p>
        <p>Coming up, you'll learn how to import, read from, and write to files, as well as how to structure the
            information contained in files.</p>
        <h2>Key Takeaways</h2>
        <p>It is important for security analysts to be able to automate tasks in Python. This requires knowledge of
            fundamental Python concepts, including variables, conditional statements, iterative statements, and
            techniques for working with strings and lists. In addition, the ability to work with files is also essential
            for automation in Python.</p>
    </article>
</section>

<section class="main-section" id="topic742">
    <h2>Import files into Python </h2>
    <article class="main-article">
        <h1>Working with Files in Cybersecurity</h1>
        <p>Security analysts may need to access a variety of files when working in Python. Many of these files will be
            logs, which record events that occur within an organization's systems.</p>
        <p>For instance, logs might contain information on login attempts or software application issues, which analysts
            may need to investigate.</p>
        <h2>Opening Files in Python</h2>
        <p>To open a file in Python for reading, you can use the <code>open()</code> function:</p>
        <pre><code>with open("update_log.txt", "r") as file:

                    <img src="resource/python56.png" id="img" alt="">
                    # Code to work with the file
                </code></pre>
        <p>The <code>with</code> keyword manages resources and errors when working with files. The <code>open()</code>
            function opens the specified file, and the <code>as</code> keyword assigns the opened file to a variable.
        </p>
        <p>The second parameter of <code>open()</code> specifies the mode of file access. For reading, it's "r".</p>
        <h2>Reading Files in Python</h2>
        <p>After opening a file, you can read its contents using the <code>.read()</code> method:</p>
        <pre><code>with open("update_log.txt", "r") as file:
                    updates = file.read()
                
                print(updates)
                </code></pre>
        <p>The <code>.read()</code> method converts the file contents into a string. Once read, you can perform
            operations on the string as needed.</p>
        <h2>Writing Files in Python</h2>
        <p>To write to a file, use the <code>open()</code> function with mode "w" for writing or "a" for appending:</p>
        <pre><code>line = "jrafael,192.168.243.140,4:56:27,True"
                
                with open("access_log.txt", "a") as file:
                    file.write(line)
                </code></pre>
        <p>The <code>.write()</code> method is used to write string data to the file. With "w", the file contents are
            replaced; with "a", new data is appended to the end.</p>
        <p>It's important for security analysts to be able to import files into Python and then read from or write to
            them. Understanding file operations is essential for effective automation and analysis tasks.</p>
    </article>
</section>

<section class="main-section" id="topic743">
    <h2>Explore debugging techniques </h2>
    <article class="main-article">
        <h1>Types of Errors</h1>
        <p>It's a normal part of developing code in Python to encounter errors. Understanding the three main types of
            errors can help:</p>
        <ol>
            <li><strong>Syntax errors:</strong> These involve invalid usage of the programming language. They occur when
                there is a mistake with the Python syntax itself.</li>
            <li><strong>Logic errors:</strong> These result when the logic used in code produces unintended results. The
                code will not behave as expected, but it is still valid to the interpreter.</li>
            <li><strong>Exceptions:</strong> These involve code that cannot be executed even though it is syntactically
                correct. They occur for various reasons, such as undefined variables or functions.</li>
        </ol>
        <h2>Syntax Errors</h2>
        <p>A syntax error is identified by the Python interpreter when there is an issue with the syntax of the code.
            Common examples include missing punctuation marks.</p>
        <p>For example:</p>
        <pre><code>1 message = "You are debugging a syntax error
                2 print(message)
                </code></pre>
        <p>This code will produce a "SyntaxError: EOL while scanning string literal" because a quotation mark is missing
            at the end of the string.</p>
        <h2>Logic Errors</h2>
        <p>Logic errors occur when the code does not produce the expected outcome due to faulty logic. These errors may
            not generate error messages but result in incorrect behavior.</p>
        <p>For example:</p>
        <pre><code>1 login_attempts = 5
                2 if login_attempts >= 5:
                3    print("User has not reached maximum number of login attempts.")
                4 else:
                    print("User has reached maximum number of login attempts.")
                </code></pre>
        <p>Although there are five login attempts, the output incorrectly states that the user has not reached the
            maximum.</p>
        <h2>Exceptions</h2>
        <p>Exceptions are errors that occur during code execution. They include errors like <em>NameError</em>,
            <em>IndexError</em>, <em>TypeError</em>, and <em>FileNotFound</em>.</p>
        <p>For example:</p>
        <pre><code>1 username = "elarson"
                2 month = "March"
                3 total_logins = 75
                4 failed_logins = 18
                5 print("Login report for", username, "in", month)
                6 print("Total logins:", total_logins)
                7 print("Failed logins:", failed_logins)
                8 print("Unusual logins:", unusual_logins)
                </code></pre>
        <p>This code will produce a "NameError" because the variable <code>unusual_logins</code> is not assigned a
            value.</p>
        <h1>Debugging Strategies</h1>
        <p>When dealing with errors, the Python interpreter outputs error messages to identify the issues. Here are some
            strategies for debugging:</p>
        <ol>
            <li><strong>Debuggers:</strong> Integrated Development Environments (IDEs) offer debugging tools to locate
                and fix errors. Debuggers use breakpoints and variable tracking to assist in error detection.</li>
            <li><strong>Use Print Statements:</strong> Adding print statements at various locations in the code helps
                identify the source of errors. This strategy helps track the flow of execution and variable values.</li>
        </ol>
        <p>By employing these strategies, developers can effectively identify and fix errors in Python code.</p>
    </article>
</section>

<section class="main-section" id="topic744">
    <h2> Explore debugging techniques </h2>
    <article class="main-article">
        <h1>Types of Errors in Python</h1>
        <p>It's normal to encounter errors while developing code in Python. Understanding the three main types of errors
            can help you effectively debug your code. These types include syntax errors, logic errors, and exceptions.
        </p>
        <h2>Syntax Errors</h2>
        <p>A syntax error occurs due to invalid usage of Python syntax. Common examples include missing punctuation
            marks or incorrect indentation. When encountering a syntax error, the Python interpreter will provide an
            error message indicating the location and nature of the error.</p>
        <p>For example:</p>
        <pre><code>message = "You are debugging a syntax error
                print(message)
                </code></pre>
        <p>This code results in a "SyntaxError: EOL while scanning string literal" due to a missing closing quotation
            mark.</p>
        <h2>Logic Errors</h2>
        <p>Logic errors occur when the logic used in code produces unintended results. Unlike syntax errors, logic
            errors may not produce error messages but lead to incorrect program behavior.</p>
        <p>For example:</p>
        <pre><code>login_attempts = 5
                if login_attempts >= 5:
                    print("User has not reached maximum number of login attempts.")
                else:
                    print("User has reached maximum number of login attempts.")
                </code></pre>
        <p>This code contains a logic error where it incorrectly outputs that the user has not reached the maximum
            number of login attempts.</p>
        <h2>Exceptions</h2>
        <p>An exception is an error that prevents code execution, even if it's syntactically correct. Common exceptions
            include <code>NameError</code>, <code>IndexError</code>, <code>TypeError</code>, and
            <code>FileNotFoundError</code>. These errors are accompanied by specific error messages to aid in debugging.
        </p>
        <p>For example:</p>
        <pre><code>username = "elarson"
                month = "March"
                total_logins = 75
                failed_logins = 18
                print("Login report for", username, "in", month)
                print("Total logins:", total_logins)
                print("Failed logins:", failed_logins)
                print("Unusual logins:", unusual_logins)
                </code></pre>
        <p>This code results in a <code>NameError</code> due to the use of the undefined variable
            <code>unusual_logins</code>.</p>
        <h1>Debugging Strategies</h1>
        <p>Debugging is an essential skill for resolving errors in Python code. Here are some strategies to help you
            debug effectively:</p>
        <h2>Debuggers</h2>
        <p>Integrated Development Environments (IDEs) often include debuggers, which help locate errors in code.
            Debuggers allow you to set breakpoints and inspect variable values during runtime.</p>
        <h2>Use Print Statements</h2>
        <p>Incorporate temporary print statements strategically to identify the source of errors. Print relevant
            information at different points in the code to trace the flow and values of variables.</p>
        <p>For example:</p>
        <pre><code>new_users = ["sgilmore", "bmoreno"]
                approved_users = ["bmoreno", "tshah", "elarson"]
                def add_users():
                    for user in new_users:
                        print("line 5 - inside for loop")
                        if user in approved_users:
                            print("line 7 - inside if statement")
                            print(user,"already in list")
                        print("line 9 - before .append method")
                        approved_users.append(user)
                add_users()
                print(approved_users)
                </code></pre>
        <p>Strategically placed print statements can help identify the flow of execution and isolate logic errors.</p>
    </article>
</section>

<section class="main-section" id="topic745">
    <h2> Glossary terms from module 4 </h2>
    <article class="main-article">
        <h1>Terms and Definitions from Course 7, Module 4</h1>
        <ul>
            <li><strong>Automation:</strong> The use of technology to reduce human and manual effort to perform common
                and repetitive tasks</li>
            <li><strong>Conditional statement:</strong> A statement that evaluates code to determine if it meets a
                specified set of conditions</li>
            <li><strong>Debugger:</strong> A software tool that helps to locate the source of an error and assess its
                causes</li>
            <li><strong>Debugging:</strong> The practice of identifying and fixing errors in code</li>
            <li><strong>Exception:</strong> An error that involves code that cannot be executed even though it is
                syntactically correct</li>
            <li><strong>File path:</strong> The location of a file or directory</li>
            <li><strong>Function:</strong> A section of code that can be reused in a program</li>
            <li><strong>Integrated development environment (IDE):</strong> A software application for writing code that
                provides editing assistance and error correction tools</li>
            <li><strong>Iterative statement:</strong> Code that repeatedly executes a set of instructions</li>
            <li><strong>Log:</strong> A record of events that occur within an organization's systems</li>
            <li><strong>Logic error:</strong> An error that results when the logic used in code produces unintended
                results</li>
            <li><strong>Parsing:</strong> The process of converting data into a more readable format</li>
            <li><strong>Syntax error:</strong> An error that involves invalid usage of a programming language</li>
            <li><strong>Variable:</strong> A container that stores data</li>
        </ul>
    </article>
</section>


<section class="main-section" id="Course 8">
    <h2 id="cs2">Course 8</h2>
</section>


<section class="main-section" id="Module 81">
    <h2>Module 1</h2>
</section>
<br> <br>

<section class="main-section" id="topic811">
    <h2>Data and asset classification</h2>
    <article class="main-article">
        <h1>Classifying for Safety</h1>
        <p>Security professionals classify data types to properly protect organizations from cyber attacks. Here are
            common data types:</p>
        <ul>
            <li><strong>Public data:</strong> Already accessible to the public and requires minimal security
                protections.</li>
            <li><strong>Private data:</strong> Information that should be kept from the public and poses a serious risk
                if accessed without authorization.</li>
            <li><strong>Sensitive data:</strong> Must be protected from unauthorized access to prevent financial and
                reputational damage.</li>
            <li><strong>Confidential data:</strong> Important for ongoing business operations and often requires limited
                access and non-disclosure agreements.</li>
        </ul>
        <h2>Asset Classification</h2>
        <p>Asset classification labels assets based on sensitivity and importance to an organization:</p>
        <ul>
            <li><strong>Low-level assets:</strong> Public data, readily available to the public without significant
                negative impact if compromised.</li>
            <li><strong>High-level assets:</strong> Sensitive and confidential data, with potential for significant
                negative impact on the organization if leaked publicly.</li>
        </ul>
        <p>Understanding different data and asset classification types is crucial for prioritizing data protection
            efforts and implementing appropriate security measures.</p>
    </article>
</section>

<section class="main-section" id="topic812">
    <h2>Disaster recovery and business continuity</h2>
    <article class="main-article">
        <h1>The Importance of Business Continuity and Disaster Recovery Plans</h1>
        <p>Security professionals play a crucial role in protecting a company's data and assets. However, security
            incidents can occur despite preventive measures. Business continuity and disaster recovery plans are
            essential to minimize the impact of such incidents on an organization's operations.</p>
        <h2>Identify and Protect</h2>
        <p>Creating business continuity and disaster recovery plans is the final step in a four-part process:</p>
        <ol>
            <li>The security team identifies the assets requiring protection.</li>
            <li>They assess potential threats to those assets.</li>
            <li>Tools and processes are implemented to detect threats.</li>
            <li>The business continuity and disaster recovery plans are developed.</li>
        </ol>
        <h2>Business Continuity Plan</h2>
        <p>A business continuity plan helps sustain business operations during and after disruptions. Here are four
            essential steps:</p>
        <ol>
            <li>Conduct a business impact analysis.</li>
            <li>Identify, document, and implement steps for recovering critical business functions.</li>
            <li>Organize a business continuity team comprising members from various departments.</li>
            <li>Conduct training for the business continuity team to prepare for different risk scenarios.</li>
        </ol>
        <h2>Disaster Recovery Plan</h2>
        <p>A disaster recovery plan outlines steps to minimize the impact of security incidents and resolve threats. Key
            steps include:</p>
        <ol>
            <li>Implementing recovery strategies for software and hardware.</li>
            <li>Identifying applications and data that may be affected by a security incident.</li>
        </ol>
        <h2>Key Takeaways</h2>
        <p>Business continuity and disaster recovery plans are vital for maintaining an organization's security posture.
            They ensure that business operations can continue even in the face of security incidents.</p>
    </article>
</section>


<section class="main-section" id="topic813">
    <h2>Juliana's story: Asset protection</h2>
    <article class="main-article">

        <h1>Juliana's Story: Asset Protection</h1>
        <p>Meet Juliana Soto, who recently completed an online cybersecurity certificate program and was hired as a
            cybersecurity analyst for Right-On-Time Payment Solutions, a fictional payment processing company allowing
            individuals to transfer money to friends and family. Right-On-Time also allows companies to accept payments
            from customers or organizations.</p>
        <p>In this reading, you will begin a three-part journey that follows Juliana as she takes on new roles and
            responsibilities within the cybersecurity team of her new company.</p>
        <h2>Understanding Important Assets</h2>
        <p>Juliana decides that one of her first objectives is to gain a better understanding of the most important
            assets to the company by reviewing various company reading materials that will help her learn what is most
            valuable to them. On her first day, she is given reading materials to help her familiarize herself with the
            company. She learns that customers must create unique usernames and passwords and provide their full name or
            company name to sign up for the service as an individual. Business customers can also sign up for the
            service if they provide their employee identification number (EIN). Finally, customers must enter their bank
            account information or debit card number for payments to be accepted.</p>
        <p>Juliana discovers that this company handles a lot of personally identifiable information (PII) from its
            customers. This kind of information is considered sensitive data. Unauthorized access to it can lead to
            significant damage to the organization’s finances, its customers, and its reputation. Juliana realizes that
            the most important asset to this company is customer data.</p>
        <h2>Information Lifecycle Strategy</h2>
        <p>After finishing the required onboarding materials, she decides to put together an information lifecycle
            strategy. She learned about this when completing her online cybersecurity certificate program.</p>
        <ol>
            <li>The first step in the information lifecycle is to identify the important assets to the company,
                including sensitive customer information such as PII, financial information, social security numbers,
                and EINs.</li>
            <li>The second step is to assess the security measures in place to protect the identified assets and review
                the company’s information security policies. There are different components to this step, ranging from
                vulnerability scanning to reviewing processes and procedures that are already in place. Juliana is new
                to the company and might not be ready to conduct vulnerability scans.</li>
            <li>The third step of the information lifecycle is to protect the identified assets of the organization.
                Once again, this is only Juliana’s first day on the job. She asks her supervisor if she can observe a
                more senior security analyst for a day. This will give her the opportunity to learn how the security
                team monitors the company’s systems and network.</li>
            <li>The last step of the security lifecycle is to monitor the security processes that have been implemented
                to protect the organization’s assets. She contacts her supervisor and gives them a detailed report of
                what she has learned on her first day. She requests to finish her day by monitoring a few of the systems
                that are in place. Her supervisor is impressed with her initiative and prepares Juliana to monitor the
                security systems. What a great first day for Juliana!</li>
        </ol>
        <h2>Key Takeaways</h2>
        <p>Identifying the important assets of a company is a key security analyst responsibility. Once you identify the
            assets, it can be helpful to follow the information lifecycle strategy to help ensure those assets are being
            protected effectively. Reviewing a company’s security policies will also help an analyst understand what is
            important to the company and how the analyst should be protecting that data.</p>

    </article>
</section>


<section class="main-section" id="topic814">
    <h2>Glossary terms from module 1</h2>
    <article class="main-article">
        <h1>Key Security Definitions</h1>
        <ul>
            <li><strong>Business Continuity Plan (BCP):</strong> A document that outlines the procedures to sustain
                business operations during and after a significant disruption</li>
            <li><strong>Confidential Data:</strong> Data that often has limits on the number of people who have access
                to it</li>
            <li><strong>Disaster Recovery Plan:</strong> A plan that allows an organization’s security team to outline
                the steps needed to minimize the impact of a security incident</li>
            <li><strong>Private Data:</strong> Information that should be kept from the public</li>
            <li><strong>Public Data:</strong> Data that is already accessible to the public and poses a minimal risk to
                the organization if viewed or shared by others</li>
            <li><strong>Security Mindset:</strong> The ability to evaluate risk and constantly seek out and identify the
                potential or actual breach of a system, application, or data</li>
            <li><strong>Sensitive Data:</strong> A type of data that includes personally identifiable information (PII),
                sensitive personally identifiable information (SPII), and protected health information (PHI)</li>
        </ul>

    </article>
</section>


<section class="main-section" id="Module 82">
    <h2>Module 2</h2>
</section>
<br> <br>


<section class="main-section" id="topic821">
    <h2>Escalate with a purpose</h2>
    <article class="main-article">
        <h1>Security Incident Escalation</h1>
        <p>Security incident escalation is the process of identifying a potential security incident and transferring it
            to a more experienced department or team member. As a security analyst, you’ll be expected to recognize
            potential issues and report them to the appropriate person.</p>

        <h2>Notification of Breaches</h2>
        <p>Many countries have breach notification laws that require companies to notify individuals of security
            breaches involving personally identifiable information (PII). It's important for security analysts to be
            aware of these laws.</p>

        <h2>Low-level Security Issues</h2>
        <p>Low-level security issues are risks that do not expose PII but still need to be investigated further.
            Examples include failed login attempts and unauthorized software downloads.</p>

        <h2>The Escalation Process</h2>
        <p>Every company has unique escalation protocols detailing who should be notified and how incidents should be
            escalated. Security analysts should be aware of these protocols and escalate both small and large security
            issues accordingly.</p>

    </article>
</section>


<section class="main-section" id="topic822">
    <h2>Recognize roles and responsibilities during escalation</h2>
    <article class="main-article">
        <h1>Roles in Incident Escalation</h1>
        <h2>Data Owners</h2>
        <p>A data owner decides who can access, edit, use, or destroy specific information and is accountable for the
            classification, protection, access, and use of company data.</p>

        <h2>Data Controllers</h2>
        <p>Data controllers determine the procedure and purpose for processing data and ensure compliance with relevant
            security and privacy regulations.</p>

        <h2>Data Processors</h2>
        <p>Data processors are responsible for processing data on behalf of data controllers and installing security
            measures to protect the data.</p>

        <h2>Data Custodians</h2>
        <p>Data custodians assign and remove access to data, implement security controls, create policies for data
            storage and transmission, and monitor data security.</p>

        <h2>Data Protection Officers (DPOs)</h2>
        <p>Data protection officers monitor internal compliance with data protection procedures, advise on data
            protection obligations, and conduct assessments to ensure data security measures are adequate.</p>

        <h2>Key Takeaways</h2>
        <p>Incident escalation involves various members of a security team acting together. Entry-level analysts should
            understand the roles and responsibilities of different team members, which helps in recognizing which
            incidents should be reported to whom.</p>

    </article>
</section>

<section class="main-section" id="topic823">
    <h2>Escalation timing</h2>
    <article class="main-article">
        <h1>Role in Incident Escalation</h1>
        <h2>Your Decisions Matter</h2>
        <p>As an entry-level security analyst, your role is crucial in identifying and escalating potential security
            incidents to the appropriate team members, helping to prevent major security breaches.</p>

        <h2>Trust Your Instincts and Ask Questions</h2>
        <p>Confidence in decision-making is important, but it's also crucial to ask questions and seek clarification
            when necessary. Understanding the organization's escalation policy is key to making informed decisions.</p>

        <h2>All Security Events Are Not Equal</h2>
        <p>Recognizing the importance of different assets and data within the organization helps prioritize incidents.
            Incidents impacting essential business operations should take precedence over those that do not.</p>

        <h2>Quick Escalation Tips</h2>
        <ul>
            <li>Familiarize yourself with the organization's escalation policy.</li>
            <li>Always follow the policy guidelines.</li>
            <li>Don't hesitate to ask questions for clarification.</li>
        </ul>

        <h2>Key Takeaways</h2>
        <p>Understanding and following the organization's escalation policy is essential for an entry-level security
            analyst. It helps in identifying, prioritizing, and escalating security incidents effectively.</p>

    </article>
</section>

<section class="main-section" id="topic824">
    <h2>Juliana's story: Attention to detail</h2>
    <article class="main-article">
        <h1>Juliana's Security Incident Handling</h1>
        <p>Juliana, the cybersecurity analyst at Right-On-Time Payment Solutions, demonstrates attention to detail and
            adherence to the escalation policy in handling security incidents:</p>

        <h2>Accomplishments on the First Day</h2>
        <ul>
            <li>Reviewed company information to understand important assets</li>
            <li>Identified handling of PII data from customers</li>
            <li>Developed an information security lifecycle strategy</li>
            <li>Started monitoring security systems</li>
        </ul>

        <h2>Handling Security Incidents</h2>
        <p>Juliana responds to alerts of suspicious activities:</p>
        <ul>
            <li>10 failed login attempts: Recognizes the significance based on the escalation policy and escalates
                accordingly.</li>
            <li>Attempted compromise of bank information system: Identifies the urgency due to the sensitivity of
                customer data and follows the escalation policy meticulously.</li>
        </ul>

        <h2>Supervisor's Impression</h2>
        <p>Juliana's supervisor acknowledges her initiative and adherence to guidelines in handling security incidents.
        </p>

        <h2>Key Takeaways</h2>
        <ul>
            <li>Attention to detail is crucial for monitoring and following escalation policies.</li>
            <li>Understanding the organization's assets helps in prioritizing incident escalations.</li>
        </ul>

    </article>
</section>

<section class="main-section" id="topic825">
    <h2>Glossary terms from module 2</h2>
    <article class="main-article">
        <h1>Course 8, Module 2: Terms and Definitions</h1>
        <dl>
            <dt>Data controller:</dt>
            <dd>A person that determines the procedure and purpose for processing data.</dd>

            <dt>Data processor:</dt>
            <dd>A person that is responsible for processing data on behalf of the data controller.</dd>

            <dt>Data protection officer (DPO):</dt>
            <dd>An individual that is responsible for monitoring the compliance of an organization's data protection
                procedures.</dd>

            <dt>Escalation policy:</dt>
            <dd>A set of actions that outlines who should be notified when an incident alert occurs and how that
                incident should be handled.</dd>

            <dt>Improper usage:</dt>
            <dd>An incident type that occurs when an employee of an organization violates the organization’s acceptable
                use policies.</dd>

            <dt>Incident escalation:</dt>
            <dd>The process of identifying a potential security incident, triaging it, and handing it off to a more
                experienced team member.</dd>

            <dt>Malware infection:</dt>
            <dd>An incident type that occurs when malicious software designed to disrupt a system infiltrates an
                organization’s computers or network.</dd>

            <dt>Unauthorized access:</dt>
            <dd>An incident type that occurs when an individual gains digital or physical access to a system or an
                application without permission.</dd>
        </dl>

    </article>
</section>


<section class="main-section" id="Module 83">
    <h2>Module 3</h2>
</section>
<br> <br>


<section class="main-section" id="topic831">
    <h2>The purpose and impact of stakeholders

    </h2>
    <article class="main-article">
        <h1>Stakeholders in Security: Reading</h1>
        <p>Who are stakeholders?</p>
        <p>A stakeholder is defined as an individual or group that has an interest in any decision or activity of an
            organization. A big part of what you’ll do as a security analyst is report your findings to various security
            stakeholders.</p>

        <p>Levels of stakeholders</p>
        <p>There are many levels of stakeholders within larger organizations. As an entry-level analyst, you might only
            communicate directly with a few of them. Although you might not communicate with all of the security
            stakeholders in an organization, it’s important to have an understanding of who key stakeholders are:</p>
        <ul>
            <li>A cybersecurity risk manager</li>
            <li>A Chief Executive Officer (CEO)</li>
            <li>A Chief Financial Officer (CFO)</li>
            <li>A Chief Information Security Officer (CISO)</li>
            <li>An operations manager</li>
        </ul>
        <p>CFOs and CISOs are focused on the big picture, like the potential financial burden of a security incident,
            whereas other roles like operations managers are more focused on the impact on day-to-day operations.
            Although you will rarely interact directly with high-level security stakeholders, it’s still important to
            recognize their relevance.</p>

        <p>Stakeholder communications for entry-level analysts</p>
        <p>Two examples of security stakeholders with whom you might regularly communicate are operations managers and
            risk managers. When you report to these stakeholders, you'll need to clearly communicate the current
            security issue and its possible causes.</p>

        <p>From one stakeholder to the next</p>
        <p>Operations managers and risk managers are stakeholders who rely on entry-level analysts and other team
            members to keep them informed of security events in day-to-day operations. These stakeholders commonly
            report back to the CISOs and CFOs to give a broader narrative of the organization's overall security
            picture.</p>

        <p>Key takeaways</p>
        <p>Stakeholders play a major role in ensuring the security of an organization. Entry-level analysts should have
            a foundational understanding of the different levels of security stakeholders within an organization.</p>

    </article>
</section>

<section class="main-section" id="topic832">
    <h2>Communicate effectively with stakeholders</h2>
    <article class="main-article">
        <h1>Effective Communication with Security Stakeholders</h1>
        <h2>Get to the Point</h2>
        <p>Security stakeholders have roles and responsibilities that are time-sensitive and impact the business.
            Therefore, it's crucial that any communications they receive, and the actions they need to take, are clear.
            To get to the point in your communications, consider:</p>
        <ul>
            <li>What do I want this person to know?</li>
            <li>Why is it important for them to know it?</li>
            <li>When do they need to take action?</li>
            <li>How do I explain the situation in a non-technical manner?</li>
        </ul>

        <h2>Follow the Protocols</h2>
        <p>When joining a security team, learn about the different protocols and procedures for communicating with
            stakeholders and other members of the organization. Ensure you know what applications and forms of
            communications are acceptable before initiating communication.</p>

        <h2>Communicate with Impact</h2>
        <p>Interact with lower-level stakeholders, like operations managers or security risk managers, who are
            interested in day-to-day operations. Address relevant information that relates to their daily
            responsibilities, such as anomalies in data logs that you are escalating.</p>

        <h2>Communication Methods</h2>
        <p>Choose communication channels based on the type of information you’re sharing:</p>
        <ul>
            <li>Instant messaging</li>
            <li>Emailing</li>
            <li>Video calling</li>
            <li>Phone calls</li>
            <li>Sharing a spreadsheet of data</li>
            <li>Sharing a slideshow presentation</li>
        </ul>
        <p>Each situation helps you determine the best means of communication.</p>

        <h2>Key Takeaways</h2>
        <ul>
            <li>Communicate only information that is specific to stakeholders' interests and impacts their role in the
                company.</li>
            <li>Be mindful of the type of information you’re communicating to determine the best method of
                communication.</li>
        </ul>

    </article>
</section>
<section class="main-section" id="topic833">
    <h2>Create visual dashboards for impactful cybersecurity communications</h2>
    <article class="main-article">
        <h1>Using Visual Dashboards for Effective Communication</h1>
        <h2>Using Visuals to Communicate Effectively</h2>
        <p>Security is about protecting a company from threats that can affect its reputation and finances. Clear
            communications between stakeholders are crucial for responding to threats quickly and effectively. Visuals
            help provide decision-makers with actionable information to identify potential risks to the organization's
            security posture.</p>

        <h2>Visual Dashboards</h2>
        <p>A visual dashboard displays various types of data quickly in one place. They are useful tools for
            communicating stories about security events, especially those involving numbers and data. Dashboards can
            range from simple to complex, depending on the information being communicated.</p>
        <p><strong>Pro tip:</strong> Programs like Google Sheets and Apache OpenOffice can be used to create visual
            dashboards.</p>

        <h2>When to Use Visual Communication</h2>
        <p>Security is often a team effort, and effective communication is essential. Sometimes, it's best to use
            visuals to communicate complex information, such as results from internal audits or data analysis. Visual
            dashboards are particularly effective when communicating information involving numbers and data.</p>

        <h2>Key Takeaways</h2>
        <ul>
            <li>Be clear and concise when communicating with stakeholders.</li>
            <li>Visual dashboards are effective for communicating information involving numbers and data.</li>
        </ul>

    </article>
</section>
<section class="main-section" id="topic834">
    <h2>Juliana’s story: Effective communication

    </h2>
    <article class="main-article">
        <h1>Communicating with Stakeholders after Incidents</h1>

        <h2>Communicating about Incident #1</h2>
        <p>One incident involved an employee being locked out of their account due to multiple failed login attempts.
            Juliana's manager was asked to provide a report reviewing how many departments have experienced locked
            employee accounts due to failed login attempts over the last month. Juliana decided to create a visual
            dashboard to represent the data, focusing on numbers such as the number of employees locked out of their
            accounts in the last month. This dashboard made it easier for high-level stakeholders to review the incident
            and determine a course of action.</p>

        <h2>Communicating about Incident #2</h2>
        <p>The second incident involved an attacker almost compromising a system that stores customers’ private data.
            The Chief Information Security Officer (CISO) requested more information about this incident, including a
            detailed report on what processes and procedures worked well during the attack and what could be revised.
            Juliana put together a detailed document with timelines explaining what happened and included her thoughts
            on potential improvements. This report was shared with the manager for review.</p>

        <h2>Key Takeaways</h2>
        <ul>
            <li>Communications for stakeholders should focus on what matters to them most.</li>
            <li>Recognize the preferences of each stakeholder to determine the best method of communication.</li>
        </ul>

    </article>
</section>

<section class="main-section" id="topic835">
    <h2>
        Glossary terms from module 3
    </h2>
    <article class="main-article">
        <h1>Terms and Definitions from Course 8, Module 3</h1>

        <h2>Stakeholder</h2>
        <p>An individual or a group that has an interest in any decision or activity of an organization.</p>

        <h2>Visual Dashboard</h2>
        <p>A way of displaying various types of data quickly in one place.</p>

    </article>
</section>


<section class="main-section" id="Module 84">
    <h2>Module 4</h2>
</section>
<br> <br>


<section class="main-section" id="topic841">
    <h2>Strategies for engaging with the cybersecurity community</h2>
    <article class="main-article">
        <h1>Staying Engaged with the Cybersecurity Community</h1>

        <h2>Security Organizations and Conferences</h2>
        <p>Attending security conferences and joining organizations gives you the opportunity to gain knowledge from
            seasoned professionals who are constantly seeking out new ways to improve on their security strategies and
            techniques.</p>

        <h3>Find the Right Organization</h3>
        <p>What security organization should you join? This question depends on your specific interest in security. Are
            you someone who wants to focus on reacting to security incidents or preventing them from happening? Are you
            interested in forensic security or data logging? Do you have aspirations of being a CISO one day? It’s
            important to have a clear understanding of what your interests are before you narrow down your search for a
            cybersecurity organization or conference.</p>

        <h3>Begin the Search</h3>
        <p>Once you understand what your interests are, do a web search for organizations or conferences in your area.
            For example, you can type in “incident response cybersecurity conferences in my area.” This search will give
            you a list of cybersecurity conferences focused on incident response. If you’re interested in forensic
            security, you can type “forensic security organizations in my area” or a similar phrase into your web search
            engine. No matter what your interests are, you can do a web search online to find a cybersecurity
            organization or conference focused on that area.</p>

        <h3>Use Social Media</h3>
        <p>Social media is another great way to find cybersecurity organizations or conferences. LinkedIn®, for example,
            is a social media platform that connects business professionals with one another. You can use LinkedIn® to
            find security groups or organizations to join. In the LinkedIn® search bar, you can try search queries such
            as:</p>
        <ul>
            <li>“Incident response cybersecurity groups”</li>
            <li>“Organizations for cybersecurity analysts”</li>
        </ul>
        <p>Be aware of social engineering while using social media to connect with other professionals in the security
            industry.</p>

        <h3>Mailing Lists for Security</h3>
        <p>Another great way to stay connected with the security industry is to sign up for different cybersecurity
            mailing lists. These mailing lists send out information periodically on various security topics. The
            Cybersecurity & Infrastructure Security Agency (CISA) offers two cybersecurity mailing lists for you to
            join:</p>
        <ul>
            <li>A list focused on security threat information, best practices for cybersecurity, and analysis from
                CISA’s domestic and international security partners</li>
            <li>A list providing weekly summaries of new vulnerabilities that might pose a risk to an organization’s
                network</li>
        </ul>

        <h2>Key Takeaways</h2>
        <p>Attackers are always developing new ways to compromise corporate and personal data from users. Cybersecurity
            organizations and conferences are a great way for security professionals to stay up-to-date on the latest
            news, tools, and trends in the industry. Be sure to find organizations that align with your security
            interests.</p>

    </article>
</section>
<section class="main-section" id="topic842">
    <h2>Connect with other cybersecurity professionals</h2>
    <article class="main-article">
        <h1>Tips for Engaging with the Cybersecurity Community</h1>

        <h2>LinkedIn® with CISOs</h2>
        <p>It’s a great idea to follow Chief Information Security Officers (CISOs) on LinkedIn®. CISOs are responsible
            for being up-to-date on all aspects of security, making their insights valuable. By following CISOs on
            social media, you can discover useful tips and relevant news that can help progress your cybersecurity
            career.</p>

        <h2>Finding Other Security Professionals on LinkedIn®</h2>
        <p>LinkedIn® is an excellent platform to connect with other security professionals, whether they're entry-level
            analysts or seasoned experts. When reaching out to connect with someone, ensure your message is well-written
            and provides a clear reason for wanting to connect. Using a conversational tone and avoiding spelling and
            grammatical errors can make your message more engaging and credible.</p>

        <h3>Example LinkedIn® Message:</h3>
        <p>“Hi, Tim. I recently completed the Google Cybersecurity Certificate program, and I’d like to connect with
            other security professionals. It seems like you have a lot of experience in the security industry that I can
            learn from. Let’s keep in touch!”</p>

        <h2>Key Takeaways</h2>
        <ul>
            <li>Attackers are continually evolving, making it crucial to stay ahead of the latest trends in security.
            </li>
            <li>Connecting with cybersecurity professionals on social media, particularly CISOs, can provide valuable
                insights and information.</li>
            <li>When reaching out to connect with others on LinkedIn®, ensure your message is clear, engaging, and free
                of errors.</li>
        </ul>

    </article>
</section>
<section class="main-section" id="topic843">
    <h2>Glossary terms from module 4</h2>
    <article class="main-article">
        <h1>OWASP Top 10</h1>
        <p>The OWASP Top 10 is a globally recognized standard awareness document that lists the top 10 most critical
            security risks to web applications.</p>
    </article>
</section>


<section class="main-section" id="Module 85">
    <h2>Module 5</h2>
</section>
<br> <br>


<section class="main-section" id="topic851">
    <h2>Tips for finding and applying for a job </h2>
    <article class="main-article">
        <h1>Job Search Resources</h1>
        <h2>ZipRecruiter</h2>
        <p><a href="https://www.ziprecruiter.com/">ZipRecruiter</a> is a popular website for job seekers and employers
            worldwide. It helps connect job seekers with available roles in their industry. You can fill out specific
            geographical and work preference questions to get matched with opportunities and upload your resume on the
            platform.</p>
        <h2>Indeed</h2>
        <p><a href="https://www.indeed.com/">Indeed</a> is another popular website that connects job seekers with
            available roles. You can search for jobs using keywords, company names, or job titles, and specify your
            preferred job location. Uploading your resume on Indeed allows recruiters to reach out to you if your
            profile matches a job opportunity.</p>
        <h2>Monster®</h2>
        <p><a href="https://www.monster.com/">Monster</a> is a frequently used website internationally that helps
            connect job seekers with available roles. Similar to other job search sites, you can search for roles and
            specify your preferred location. Uploading your resume to Monster enables recruiters to contact you if your
            profile aligns with a job opportunity.</p>
        <h2>LinkedIn®</h2>
        <p><a href="https://www.linkedin.com/">LinkedIn</a> is a professional networking site where you can find jobs in
            the cybersecurity field. Visit the "jobs" tab and enter your preferred job location and title. LinkedIn also
            provides insights into company culture, values, and community initiatives, helping you assess if a company
            is the right fit for you.</p>

    </article>
</section>

<section class="main-section" id="topic852">
    <h2>The interview process</h2>
    <article class="main-article">
        <h1>Preparing for the Interview Process</h1>
        <h2>Getting Contacted by a Recruiter</h2>
        <p>After applying for a job, you might receive a call, email, or message from a recruiter expressing interest in
            your application. Reply promptly to show your interest.</p>
        <h2>Preliminary Interview or Phone Screening</h2>
        <p>The first step is often a preliminary interview, which could be conducted over the phone, in person, or via
            video call. Prepare questions to ask about the role and the company, and send a thank-you email to the
            recruiter afterward.</p>
        <h2>Additional Interviews</h2>
        <p>If you pass the preliminary interview, you may be invited for multiple additional interviews, including
            meetings with the hiring manager and other team members. Always send thank-you notes after each round of
            interviews.</p>
        <h2>Final Offer</h2>
        <p>Upon receiving a job offer, decide whether to accept it or negotiate for better terms. Ask for time to make
            your decision if needed.</p>
        <h2>Building Perseverance</h2>
        <p>If you don't get the job, express appreciation for the opportunity and ask for feedback. Stay resilient in
            your job search.</p>
        <h2>Key Takeaways</h2>
        <p>Interviews are opportunities to learn more about the job and company. Prepare thoroughly and persevere in
            your job search to build your career in cybersecurity.</p>

    </article>
</section>
<section class="main-section" id="topic853">
    <h2>Prepare for technical interviews</h2>
    <article class="main-article">

        <h1>Preparing for Technical Interviews in Cybersecurity</h1>
        <h2>What are Technical Interviews?</h2>
        <p>Technical interviews in cybersecurity focus on assessing your knowledge of specific tools and concepts
            relevant to the field.</p>
        <h2>Python</h2>
        <p>Basic knowledge of Python is often expected in cybersecurity roles. Python is valued for its ease of use and
            extensive libraries, particularly for automation tasks.</p>
        <h2>General Techniques</h2>
        <p>Demonstrating familiarity with security frameworks like the NIST Cybersecurity Framework and understanding
            network security concepts are important during technical interviews.</p>
        <p>Writing down the question before answering can help ensure you address all parts of the question and provide
            a structured response.</p>
        <h2>Possible Technical Interview Questions</h2>
        <ul>
            <li><strong>What is the TCP/IP model?</strong><br>
                Answer: The TCP/IP model is a framework for organizing and transmitting data across a network.</li>
            <li><strong>What is the OSI model?</strong><br>
                Answer: The OSI model describes the seven layers used for computer communication and data transmission.
            </li>
            <li><strong>What are SIEM tools and their purpose?</strong><br>
                Answer: SIEM tools, or Security Information and Event Management tools, are used to identify and analyze
                security threats, risks, and vulnerabilities.</li>
        </ul>
        <h2>Key Takeaways</h2>
        <p>Technical interviews provide an opportunity to showcase your cybersecurity skills, including coding
            abilities. Preparation and enthusiasm for learning and applying cybersecurity concepts are essential for
            success in technical interviews.</p>

    </article>
</section>
<section class="main-section" id="topic854">
    <h2>Apply the STAR method during interviews</h2>
    <article class="main-article">
        <h1>Using the STAR Method in Interviews</h1>
        <h2>The STAR Method</h2>
        <p>When interviewing for a job, it can be challenging to convey the right details about your professional
            history and skills to your interviewers. Using the STAR method can help you share your success stories
            effectively and strategically. STAR stands for Situation, Task, Action, and Result. Using this method
            enables you to describe potential challenges you faced in previous roles and gives you the opportunity to
            show how you thoughtfully approached solving those problems from start to finish.</p>
        <h3>Situation</h3>
        <p>The situation is the project you worked on or a challenge that you had to overcome. Fully describing the
            situation allows the interviewer to gain a clear understanding of the challenge you had to overcome.</p>
        <h3>Task</h3>
        <p>The task outlines the key responsibilities or role you played in solving the challenge described in the
            situation phase of the STAR method. Specifying what the task is provides clarity about what your objectives
            were in this scenario.</p>
        <h3>Action</h3>
        <p>The action describes the exact steps you took to resolve the challenging situation you described in the
            beginning of the STAR method. Employers want employees who can think fast and make decisions that help solve
            problems.</p>
        <h3>Result</h3>
        <p>Finally, sharing the result of your challenge or example shows the employers how the situation was resolved
            as a direct result of the actions you took. Positive results show an employer that you are someone who has
            demonstrated an ability to successfully resolve issues.</p>
        <h2>Key Takeaways</h2>
        <ul>
            <li>The STAR method stands for Situation, Task, Action, and Result.</li>
            <li>Using this method helps you communicate to an employer an example of a challenge you faced in the
                workplace.</li>
            <li>Remember to use one of your success stories when using the STAR method on an interview.</li>
            <li>Being able to demonstrate an ability to overcome any type of challenge is a great trait to show off
                during an interview.</li>
            <li>Since cybersecurity is such a team-driven industry, effective communication during interviews is
                crucial.</li>
        </ul>
        <img src="resource/star.png" alt="STAR Method">

    </article>
</section>
<section class="main-section" id="topic855">
    <h2>Prepare for interviews</h2>
    <article class="main-article">
        <h1>Preparing for Job Interviews in Cybersecurity</h1>
        <h2>Prepare for the Introductory Call</h2>
        <p>It’s important to showcase your best self in the introductory phone call. In this conversation, you’ll talk
            with the recruiter or hiring manager about yourself, your work or training experience, and why you want the
            job. Be prepared to discuss your salary requirements.</p>
        <h2>Do Your Research</h2>
        <p>Make sure you’ve done your research on the company. When asked why you’d be a good fit for the job, employers
            want to know why you’re interested in cybersecurity and why you want to work specifically at their company.
        </p>
        <h2>Prepare for the Second Round</h2>
        <p>Your second-round interview will focus more on what you can offer as an entry-level security analyst. Review
            your accomplishments in the security industry, and if you have no prior experience, discuss what you’ve
            learned in this certificate program.</p>
        <h2>Panel Interview</h2>
        <p>During the panel interview, engage with each panelist and give them your full attention. Address the whole
            panel when answering questions. Remember that the team brought you in for the interview for a reason, so
            showcase your knowledge and ability to work well with a team.</p>
        <h2>More Resources to Help You Prepare</h2>
        <ul>
            <li><a href="https://careers.google.com/interview/">Interview tips from Google</a>: This resource provides
                best practices and advice on how to prepare and ace your interviews at Google.</li>
            <li><a href="https://askjan.org/topics/Interviewing.cfm">Interviewing techniques for persons with
                    disabilities</a>: This resource offers helpful advice on navigating the interview process for
                individuals with disabilities.</li>
        </ul>
        <h2>Key Takeaways</h2>
        <p>Preparation for your first interview is very important, so be sure to do your research and practice for the
            introductory call. Don’t worry if you don’t have prior security experience. Instead, rely on the information
            and skill sets you’ve gained from completing this certificate program.</p>

    </article>
</section>

<section class="main-section" id="topic856">
    <h2>Prepare for interviews with Interview Warmup</h2>
    <article class="main-article">
        <h1>Interview Warmup for Cybersecurity</h1>
        <p>Interview Warmup is a tool designed to help you practice answering interview questions to become more
            confident and comfortable throughout the interview process.</p>
        <h2>A Practice Question on Interview Warmup</h2>
        <p>Get started by following these steps to start a five-question practice interview related to cybersecurity:
        </p>
        <ol>
            <li>Go to <a
                    href="https://grow.google/certificates/interview-warmup/">grow.google/certificates/interview-warmup/</a>.
            </li>
            <li>Click Start practicing.</li>
            <li>Select Cybersecurity to open an additional menu.</li>
            <li>Click Start.</li>
        </ol>

        <img src="resource/interviewwarmup.png" id="img" alt="">
        <p>The interview lasts about 10 minutes and includes two background questions, one behavioral question, and two
            technical questions. You are encouraged to try as many practice interviews as you want.</p>
        <p>You can also review complete lists of <a href="#">cybersecurity interview questions</a> or <a
                href="#">general interview questions</a> if you'd like to focus on a particular topic.</p>
        <h2>How It Works</h2>
        <p>Interview Warmup asks you interview questions to practice answering verbally. Your answers will be
            transcribed in real time, allowing you to review how you responded. In addition, Interview Warmup's machine
            learning algorithm can detect insights that can help you learn more about your answers and improve the way
            you communicate.</p>
        <p>Here are a few examples of questions Interview Warmup might ask:</p>
        <ul>
            <li>What are your career goals for the next five years?</li>
            <li>What processes can you use to ensure user data is protected?</li>
            <li>Name two types of common cybersecurity attacks?</li>
            <li>What are two internal factors that can increase the chances of security risks?</li>
            <li>What do security information and event management tools enable security analysts to do?</li>
            <li>In Python, what’s the difference between break and continue?</li>
        </ul>
        <p>Here are some of the insights that Interview Warmup provides:</p>
        <ul>
            <li>Talking points: The tool lets you know which topics you covered in your answer, such as your experience,
                skills, and goals. You’ll also be able to view other topics that you might want to consider covering.
            </li>
            <li>Most-used words: The tool highlights the words you used most often and suggests synonyms to broaden your
                word choices.</li>
            <li>Job-related terms: The tool highlights the words you used that are related to the role or industry in
                which you are preparing to work. You’ll also be able to view an entire list of job-related terms that
                you might want to consider including in your answer.</li>
        </ul>
        <p>Interview Warmup gives you the space to practice and prepare for interviews on your own. Your responses will
            be visible only to you, and they won’t be graded or judged.</p>
        <h2>Key Takeaways</h2>
        <p>Practicing for interviews is an important skill for your career in cybersecurity. Using Interview Warmup can
            help you practice interview questions and receive feedback in real time. As you practice, you will gain
            confidence and be able to prepare more polished responses for common interview questions.</p>

    </article>
</section>
<section class="main-section" id="topic857">
    <h2>Learn more about developing an elevator pitch</h2>
    <article class="main-article">
        <h1>Elevator Pitch for Cybersecurity Professionals</h1>
        <p>An elevator pitch is a brief summary of your experience, skills, and background that should be communicated
            in 60 seconds or fewer. Use it to sell yourself as a professional to potential employers.</p>
        <h2>Provide an Introduction</h2>
        <p>Start by introducing yourself and giving a brief overview of your professional background. Mention some past
            roles and skills used for those roles that can translate to success in the security field.</p>
        <h2>Describe Your Career Interests and Transferable Skills</h2>
        <p>Clarify that cybersecurity is your desired career and highlight transferable skills such as problem-solving,
            communication, and time management.</p>
        <h2>Express Your Excitement</h2>
        <p>Share your passion for the field and why you want to work in the industry. Talk about your goals and how you
            want to contribute to defending against threats.</p>
        <h2>Communicate Your Interest in the Company</h2>
        <p>Explain why you are interested in the company, not just the role. Show that you've done your research and
            establish a rapport with the interviewer.</p>
        <h2>Key Takeaways</h2>
        <p>Creating an elevator pitch is a great tool to quickly share who you are. Use it to introduce yourself to
            career and business connections, and even in other situations like meeting new friends or colleagues.</p>

    </article>
</section>
<section class="main-section" id="topic858">
    <h2>Tips for interviewing remotely

    </h2>
    <article class="main-article">
        <h1>Tips for Remote Interviews</h1>
        <p>A remote interview is an interview conducted virtually using video platform software. This type of interview
            provides an opportunity to connect with hiring managers and recruiters, even if you are not able to meet
            with them in person. Remote interviews also present challenges that in-person interviews do not, such as
            issues related to technology, lighting, and sound.</p>
        <h2>Test your technology</h2>
        <p>The first tip is to test the technology you’ll be using for the video. Different companies use different
            video platform software to host their remote interviews. Typically, the recruiter or hiring manager will
            reach out to you over the phone or email to share information about which software will be used for the
            interview.</p>
        <p>Once you find out which software the company you’re interviewing with uses, you should download that
            software, if you don't have it already. Next, it's important to test your computer’s camera and microphone
            to ensure they work well with the video platform software a day or two before the interview. This allows you
            to resolve any technical issues you might have. Be mindful of how to mute and unmute your microphone, just
            in case there is noise in your environment that you do not want the interviewer to hear. It’s also important
            to talk with the recruiter or hiring manager about a backup plan if the technology does not cooperate when
            it's time for the interview.</p>
        <p>You’ll also want to test any technologies you need to use to ensure you are ready to interview, such as the
            closed caption feature on the app. Employers are typically happy to accommodate your needs if you're using
            assistive technology or need specific accommodations. If your internet service is not fast enough to allow
            for a video interview, you can request a phone interview instead.</p>
        <h2>Practice communicating through video</h2>
        <p>Communicating through video can be a challenge because there is a slight sound delay. The sound delay can
            make it difficult to know how long to wait for someone to stop speaking and for you to start. If you don’t
            have experience communicating through video, consider practicing with friends and family before the remote
            interview. This will help you learn how pauses affect video communication.</p>
        <h2>Create a professional background</h2>
        <p>Review your video background before the interview. Typically, you should avoid having an unorganized
            background or any objects that might distract the interviewer. When interviewing remotely, ensure that your
            area is well lit. You might want to rearrange your desk or furniture to ensure good lighting.</p>
        <p>Always try to have light behind your camera so that it will shine on your face. If you can’t position your
            desk next to a window or don’t have enough light coming from the window, consider using artificial light.
        </p>
        <p>Additionally, you should do your best to limit background noise and use a headset, if possible.</p>
        <h2>Dress appropriately</h2>
        <p>It’s a good idea to research the company you’re interviewing with to determine which type of interview outfit
            is suitable. You might need to wear formal business attire during your remote interview for a particular
            role and company, whereas for another position, more casual clothing might be appropriate. Typically, it is
            better to overdress than to underdress, especially for more traditional businesses.</p>
        <h2>Look at the interviewer when speaking</h2>
        <p>When communicating through video, try to look at the interviewer when speaking instead of at the camera.
            Looking at the interviewer can give them the feeling that you’re engaged in the conversation and focused on
            what they’re saying.</p>
        <h2>Sign in early</h2>
        <p>Before the interview, test your technology. This will help you feel confident that everything will work.
            However, technology and software can be unpredictable. If possible, sign in to your remote interview early
            to ensure everything is working properly.</p>
        <p>Signing in early also indicates to your interviewer that you respect their time and are a punctual person.
        </p>
        <h2>Key takeaways</h2>
        <p>Follow the tips in this reading to become more confident with the remote interviewing process. Always test
            your technology before the interview to ensure it works well with the video platform software being used for
            the interview.</p>

    </article>
</section>
<section class="main-section" id="topic859">
    <h2>Glossary terms from module 5</h2>
    <article class="main-article">
        <h2>Terms from Course 8, Module 5</h2>
        <h4>Rapport</h4>
        <p>A friendly relationship in which the people involved understand each other’s ideas and communicate well with
            each other.</p>
        <h4>STAR Method</h4>
        <p>An interview technique used to answer behavioral and situational questions.</p>
        <h4>Elevator Pitch</h4>
        <p>A brief summary of your experience, skills, and background.</p>

    </article>
</section>

</main>