Lecture 1: Situational Awareness (SA)

• Definition: Situational Awareness is "the perception of the elements in the

environment within a volume of time and space, the comprehension of their
meaning, and the projection of their status in the near future" (M. Endsley, 1988).

• Three Levels of SA:

1. Level 1: Perception: Perceiving the status, attributes, and dynamics of

relevant elements (e.g., seeing a red light).

2. Level 2: Comprehension: Synthesizing disjointed elements to understand

the current situation (e.g., understanding the red light means stop).

3. Level 3: Projection: Predicting the future status of elements (e.g., predicting

traffic will stop).

• Cyber Situational Awareness: Applying SA to the cyber domain to perceive the

environment, understand the security context, and project future events (e.g.,
recognizing slow traffic as a potential DDoS attack).

• OODA Loop (John Boyd): A decision-making cycle often applied in Security

Operations Centers (SOCs).

o Observe: Gather data (logs, alerts).

o Orient: Analyze context (vulnerabilities, business impact).

o Decide: Formulate a plan.

o Act: Execute the plan.

• Cyber Threat Intelligence (CTI): Evidence-based knowledge about adversaries,

including their motivations, intent, capabilities, and enabling environments.

o CTI Lifecycle:

1. Planning/Direction: Setting goals.

2. Collection: Gathering raw data.

3. Processing: Normalizing data.

4. Analysis: Creating actionable intelligence.

5. Dissemination: Sharing reports.

6. Feedback: Reviewing effectiveness.

 • Key Frameworks:

o MITRE ATT&CK: A knowledge base of adversary Tactics (Goals), Techniques

(Methods), and Procedures.

o Pyramid of Pain: Illustrates the difficulty for adversaries when indicators are
blocked.

▪ Easy to change: Hash values, IP addresses, Domain names.

▪ Hard to change: Network/Host artifacts, Tools.

▪ Tough to change: TTPs (Tactics, Techniques, and Procedures).

Lecture 2: Intruder Behaviour & TCP Basics

• Classes of Intruders:

o Masquerader: An outsider who penetrates access controls to use a

legitimate account.

o Misfeasor: An insider (legitimate user) who misuses privileges.

o Clandestine User: An individual who seizes supervisory control to suppress

audit collection.

• Skill Levels:

o Apprentice (Script-kiddies): Use existing tools, low technical skill.

o Journeyman: Can modify tools and find new vulnerabilities similar to known
ones.

o Master (APT/State-Sponsored): Create new tools, discover zero-days, highly

persistent.

• Cyber Kill Chain (Lockheed Martin):

1. Reconnaissance: Selection of targets.

2. Weaponization: Coupling a RAT with an exploit.

3. Delivery: Transmitting the weapon (e.g., phishing).

4. Exploitation: Triggering the exploit code.

5. Installation: Installing the backdoor.

 6. Command & Control (C2): Establishing remote control.

7. Actions on Objectives: Data exfiltration, encryption, etc.

• TCP Basics:

o 3-Way Handshake:

1. Client sends SYN (Seq = x).

2. Server sends SYN/ACK (Seq = y, Ack = x+1).

3. Client sends ACK (Seq = x+1, Ack = y+1).

o Termination: Uses FIN packets.

o Sequence Number: Tracks the order of data bytes.

o Acknowledgement Number: The next sequence number expected by the

receiver.

Lecture 3: Network Traffic Analysis

• Encapsulation: Data is wrapped with headers as it descends the protocol stack

(Application $\rightarrow$ Transport $\rightarrow$ Network $\rightarrow$ Link).

Shutterstock
 • Key Headers:

o IP Header: Contains Source/Dest IP, IHL (Header Length), Protocol (1=ICMP,

6=TCP, 17=UDP), and Fragment Offset.

o TCP Header: Contains Ports, Sequence/Ack Numbers, Window Size, and

Flags.

• TCP Flags:

o SYN (0x02): Synchronize sequence numbers (initiate connection).

o ACK (0x10): Acknowledge data.

o FIN (0x01): Finish connection.

o RST (0x04): Reset connection (abort).

o PUSH (0x08): Push data to application immediately.

o URG (0x20): Urgent pointer.

• Fragmentation:

o Occurs when packet size > MTU (Maximum Transmission Unit, usually 1500
bytes).

o Managed via Fragment Offset and Flags (DF = Don't Fragment, MF = More
Fragments).

• tcpdump Filters:

o tcp[13] & 0x02 != 0: Captures packets with SYN flag set.

o ip[0] & 0xf0: Inspects IP version.

Lecture 4: IDS and Prevention

• Intrusion Detection System (IDS): Monitors network/system activities for

malicious acts or policy violations.

• Detection Methodologies:

o Misuse Detection (Signature-based): Matches traffic against a database of

known attack signatures.

▪ Pros: Low false positives for known attacks.

 ▪ Cons: Cannot detect unknown (zero-day) attacks.

o Anomaly Detection (Behavior-based): Compares traffic to a "normal"

baseline.

▪ Pros: Can detect new attacks.

▪ Cons: High false positive rate (legitimate behavior can be anomalous).

• IDS vs. IPS:

o IDS: Passive; alerts and logs but does not stop the packet.

o IPS (Prevention): Inline; can block/drop packets actively.

• Evasion Techniques:

o Insertion: Sending packets the IDS sees but the target rejects (confusing the
IDS).

o Evasion: Sending packets the IDS rejects/misses but the target accepts.

o Obfuscation: Encoding data (e.g., URL encoding) to bypass string matching

signatures.

Lecture 5: Snort

• Overview: Open-source, rule-based NIDS/IPS.

• Modes:

1. Sniffer: Displays packets (snort -v).

2. Packet Logger: Saves packets to disk (snort -l).

3. NIDS: Performs detection using [Link] (snort -c).

• Architecture:

o Packet Decoder $\rightarrow$ Preprocessors $\rightarrow$ Detection

Engine $\rightarrow$ Output.

o Preprocessors: Normalize traffic (e.g., Frag3 for fragmentation, Stream5 for

TCP stream reassembly) to defeat evasion attempts.

• Rule Structure:
 o action protocol source_ip source_port -> dest_ip dest_port (options)

o Example: alert tcp any any -> [Link]/24 80 (msg:"Web Attack";

content:"/admin"; sid:10001;)

Lecture 6: Basic Intrusion Analysis

• Port Scanning Types:

o TCP SYN Scan (Half-open): Sends SYN. If SYN/ACK received $\rightarrow$

Open. Sender replies with RST to close without full connection. Stealthier.

o TCP Connect Scan: Full 3-way handshake. Logged by the target application.

o TCP ACK Scan: Used to map firewall rules. If RST received $\rightarrow$
Unfiltered (reached host). If no response $\rightarrow$ Filtered (blocked).

o UDP Scan: Sends empty UDP packet. If ICMP Port Unreachable received
$\rightarrow$ Closed. If no response $\rightarrow$ Open/Filtered.

• Analysis:

o Look for patterns in flags (e.g., many SYNs without ACKs).

o SQL Worms: often scan port 1433 (MSSQL).

Lecture 7: Intrusion Analysis with Wireshark

• Wireshark Features:

o Follow TCP Stream: Reconstructs the application-layer data (ASCII) from

captured packets.

o Expert Info: Highlights warnings like retransmissions (network congestion or

packet loss) and malformed packets.

o Export Objects: Allows extraction of files (images, binaries, HTML) from

HTTP/SMB streams.

• Malware Analysis:

o Capture traffic $\rightarrow$ Export Object (e.g., suspicious EXE)

$\rightarrow$ Calculate Hash (MD5/SHA256) $\rightarrow$ Search hash on
VirusTotal.
Lecture 8: Honeypots

• Definition: A security resource whose value lies in being probed, attacked, or

compromised.

• Purpose:

o Distraction: Waste attacker's time.

o Intelligence: Gather data on new TTPs.

o Detection: Any interaction with a honeypot is likely unauthorized (high

fidelity alert).

• Interaction Levels:

o Low-Interaction: Emulates services/responses (scripts). Low risk, limited

data.

o High-Interaction: Real OS/Services. High risk (attacker can use it to launch

further attacks), rich data (captures zero-days, rootkits).

• Honeytokens: Fake digital entities (e.g., a fake AWS key, a fake database entry) left
as bait. Usage triggers an alarm.

Lecture 9: SIEM (Security Information and Event Management)

• Components:

o SIM (Information Management): Long-term storage, analysis, and reporting

of log data.

o SEM (Event Management): Real-time monitoring, correlation of events, and

notification.

• Core Functions:

o Aggregation: Collecting logs from various sources (firewalls, servers,

routers).

o Normalization: Converting different log formats into a common schema.

o Correlation: Linking multiple events to identify a security incident (e.g., 5

failed logins + 1 successful login = Brute Force).
 o Retention: Storing data for compliance and forensics.

Lecture 10: Incident Handling

• Incident Response (IR) Lifecycle (CREST/NIST model):

1. Prepare: Risk assessment, tooling, playbooks, training.

2. Respond:

▪ Triage/Identification: determining if an incident occurred.

▪ Containment: Limiting damage (e.g., isolating a host).

▪ Eradication: Removing the threat (e.g., deleting malware).

▪ Recovery: Restoring systems to normal operation.

3. Follow Up: Post-incident review, lessons learned.

• Teams:

o SOC (Security Operations Center): Centralized unit dealing with security

issues (monitoring/defending).

o CSIRT (Computer Security Incident Response Team): Focuses on

responding to incidents.

o CERT (Computer Emergency Response Team): Often a national or industry-

wide coordination center.