How the lab works
Type your name once at the top and press Save name. It locks after that, so use the same name every time. Your progress saves on this device.
- Two tracks. Easy lists the answer choices in each question and shows a cheat sheet above each topic. Hard shows neither and uses subtler situations, so you type the term yourself. You can switch any time on a day tab. Your progress stays and both tracks lead to the same certificate.
- Streak topics. You get fresh questions until you get 3 right in a row. A wrong answer sends the streak back to 0.
- Show me an example. A short animated walkthrough with different details. It is free and counted in your progress.
- Printing. The Certificate tab prints your status any time. If you are not done, it prints a page marked INCOMPLETE with each day, your numbers, and a verification code. That page counts for partial credit. When every day is complete you get your certificate instead.
Social engineering tactics
| Tactic | How to spot it |
|---|---|
| pretexting | A made-up story that makes the request sound routine |
| authority | It seems to come from someone with power |
| intimidation | A threat of trouble if you refuse |
| consensus | Everyone else already did it |
| scarcity | Only a few are left |
| familiarity | Friendship or a shared past |
| urgency | A deadline with no time to think |
Adversaries and attack phases
| Adversary | Clue |
|---|---|
| script kiddie | low skill, borrowed tools, wants attention |
| hacktivist | a cause or message |
| insider | already has legitimate access |
| cyberterrorist | wants fear and serious disruption |
| transnational criminal organization | organized crime for profit across borders |
Phases in order: reconnaissance (gather information), initial access (the first way in), persistence (a way back in later), lateral movement (move to other systems), taking action (do what they came to do), evading detection (hide the tracks).
Risk and what to do about it
Rating = likelihood x severity. A control that lowers likelihood or severity lowers the rating. The rating left over is the residual risk.
| Strategy | Meaning |
|---|---|
| avoid | stop the risky activity |
| transfer | someone else pays, like insurance |
| mitigate | reduce the likelihood or the impact |
| accept | knowingly live with it |
Controls: type and function
| preventative | detective | corrective | |
|---|---|---|---|
| physical | lock, fence | camera | replace a broken door |
| technical | firewall rule | intrusion alert | restore from backup |
| managerial | training, policy | log review | update the policy after an incident |
Ask two questions. What is it made of? (a real device, software, or a policy) What does it do? (stop it, notice it, or repair it)
Physical attacks
| Attack | Key difference |
|---|---|
| tailgating | Follows closely, and the authorized person does not know |
| piggybacking | The authorized person knowingly lets you in |
| shoulder surfing | Watches while it is typed or shown |
| dumpster diving | Searches discarded trash |
| card cloning | Copies badge data onto another card |
Fixes and detection controls
| Problem | Fix |
|---|---|
| vehicles reach the building | bollards |
| people follow others in | access control vestibule |
| power flickers | UPS |
| unknown USB drives get plugged in | disable USB ports |
| a key cannot be switched off | card reader |
| people beside the screen can read it | privacy screen |
| papers left on desks | clean desk policy |
| people do not know what to watch for | security awareness training |
Detection controls: a camera records, a guard patrols or is posted, a motion sensor alerts when movement starts, and employee awareness means trained people who notice and report.
Badge logs and impossible travel
Find the walking time between the two doors. Find the time between the two swipes. If the gap is shorter than the walking time, one person could not have made both, so a badge may be cloned.
Unit 1 terms for Thursday
| Term | Meaning |
|---|---|
| phishing, vishing, smishing | a deceptive mass email, phone call, or text |
| brute force | tries every possibility on one account |
| credential stuffing | reuses leaked username and password pairs |
| password spraying | one password across many accounts |
| evil twin | a lookalike Wi-Fi network |
| voice cloning | AI copies a real person's voice |
| multifactor authentication | two or more different kinds of proof |
| money mule | moves money for a scammer |
Defense in depth layers: human, physical, network, device, application, data.