Create a new lesson recap called lesson_3.html. This lesson covers the following content: Chapter Title Slide

Vulnerabilities, Threats and Risk
All activity is subject to a degree of risk
Risk can be defined as:




In order to manage risk proportionally we must quantify risk
We can do this:
Qualitatively
Quantitatively
We cannot eliminate risk entirely
Instead we must reduce risk to an acceptable level





* ISO 31000 risk management standard
Risk: The effect of uncertainty on objectives *
Content with Half Vertical Image

Calculating Risk
Likelihood
X
Impact
Vulnerability
=
Threat
+
A weakness in an asset
An event or actor which could exploit a vulnerability
An event or actor which could exploit a vulnerability
RISK

Gap Analysis
Where we want to be
Where we are
GAP

Recording Risk
Risk
A measure of threats, vulnerabilities, impact, and probability
Risk Registers
Risk description
Severity
Owner of the risk item
Identified mitigations
Often utilize heat maps

Responding To Risk
Risk management strategies
Describe the proactive and systematic approaches used to:
identify
assess
prioritize
mitigate risks to minimize their negative impacts
Risk responses
Identify how risk items are managed

Residual Risk
Residual Risk
The amount of risk left after mitigations are implemented
Risk cannot be fully eliminated
Risk Appetite
Acceptable levels of risk
Varies from one organization to another
Sometimes defined in a formal risk appetite statement

Attack Surface
The possible routes to reach and compromise a system
Can be viewed through three lenses
Physical
Logical
Human
What are the routes into our building is there free movement once inside?
What IP ranges and ports are exposed to the internet and can someone explore the network freely once inside?
Can our employees be discovered and are they vulnerable to compromise?
Content with Half Vertical Image

Threat Vectors
Being able to reach the attack surface is one thing
But achieving an effect requires
A vulnerability
A mechanism to exploit that vulnerability
Vulnerable software
Insecure protocols
Insecure supply chain
Humans vulnerable to coercion
Content with Half Vertical Image

Social Engineering
Just like machines humans have weaknesses that can be exploited
Empathy
Fear
Not fitting in
Kindness
Respect for (perceived) authority
Helping people is natural
Holding a door open
Bending the rules
Voice and video calls put us on the spot
Content with Half Vertical Image

Social Engineering Types - 1
Phishing
Email disguised as legitimate
May contain link or attachment
Pharming
Redirecting traffic to a cloned site by abusing DNS
Vishing
Using the telephone to manipulate a call handler
Effective when internal voip system can be used
Smishing
Using SMS to impersonate a trusted contact
Content with Half Vertical Image

Social Engineering Types - 2
Typosquatting
Registering a domain that is very similar to a legitimate one
Business Email Compromise
By compromising a trusted third party the attackers email will look completely convincing
Watering Hole attack
Hacking a site we know the target uses and waiting for them to visit
Could steal credentials or deliver malware
Content with Half Vertical Image

Deep Fakes
Explain that the prompt will typically show the relative path, hiding the path to home in place of a tilde.

This is revealed by the use of pwd which returns the “absolute path”.

Hands-On Exercise
Assisted Lab: Using SET to Perform Social Engineering
CompTIA
LABS

Cryptography
Chapter 5
Chapter Title Slide

Encryption is a powerful but mostly invisible tool we use to
Authenticate people and systems
Verify the authenticity of messages, people and systems
Protect sensitive message content
We use encryption every minute of everyday
In order to use encryption securely we must be familiar with some basic terminology and concepts connected to modern encryption schemes
Dance like nobody's watching - encrypt like everyone is!
Content with Half Horizonatl Image

Cryptographic Terminology
Most cryptographic system has four components
Cipher
Key
Plaintext
Ciphertext
Some systems use one or two keys
Symmetric
Asymmetric
Some are “one way” systems
These are called “Hashing Algorithms”
Used for authentication and authenticity
Content with Half Vertical Image

Crypto Confidentiality
When we encrypt a message we provide confidentiality
This prevents unauthorised people and systems reading communications
Alice
Bob
Eve
Content with Half Vertical Image

Here to help me explain encryption are…
Alice
Bob
Eve
You will hear Cyber security and Networking professionals refer to Alice, Bob and Eve when describing networking or cryptographic concepts
It’s a kind of convention in the industry!
Alice and Bob want to talk over some untrusted medium
Eve wants to listen in
She is an eavesdropper

Encryption and Decryption - Symmetric
Alice
Bob
Eve
Symmetric systems one key to encrypt and decrypt messages
Encryption provides confidentiality of message content
Alice and Bob agree on a cipher and a key to use
Alice combines her plaintext with a cipher and key to produce ciphertext
She sends the ciphertext to Bob
Bob decrypts the message using the same key as Alice to get the plaintext
Eve cannot read the contents without the key
Plaintext
AES
Plaintext
AES

Symmetric Ciphers
Alice
Bob
Eve
Symmetric ciphers are
fast
easy for devices to work with
use small keys
But…
Symmetric ciphers suffer from the “Key Distribution Problem”
Plaintext
AES
Plaintext
AES

Symmetric Ciphers
Alice
Bob
Eve
Earlier we assumed that Alice and Bob had agreed on a cipher and key
But we didn’t stop to ask how they did this…
If they used the same communications method to distribute the keys then Eve would have them too!
Plaintext
AES
Plaintext
AES
AES

lesson_3.html

@@ -0,0 +1,267 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Lesson 3 Recap | Security+ QuickCheat Pro</title>
+    <script src="https://cdn.tailwindcss.com"></script>
+    <script src="https://unpkg.com/feather-icons"></script>
+    <style>
+        @media print {
+            .no-print {
+                display: none !important;
+            }
+            body {
+                padding: 0;
+                margin: 0;
+                background: white;
+                color: black;
+            }
+            .print-section {
+                page-break-inside: avoid;
+            }
+        }
+        .info-card {
+            background: linear-gradient(145deg, #f1f5f9, #e2e8f0);
+            border-radius: 0.5rem;
+        }
+        .risk-formula {
+            font-family: monospace;
+            background-color: #f3f4f6;
+            padding: 0.5rem;
+            border-radius: 0.25rem;
+        }
+    </style>
+</head>
+<body class="bg-gray-50 text-gray-800 font-sans">
+    <div class="container mx-auto px-4 py-8 max-w-4xl">
+        <!-- Header -->
+        <header class="mb-8 text-center no-print">
+            <h1 class="text-4xl font-bold text-primary mb-2">Lesson 3 Recap</h1>
+            <p class="text-lg text-secondary">Vulnerabilities, Threats, Risk & Cryptography</p>
+            <div class="flex justify-center gap-4 mt-4">
+                <button onclick="window.print()" class="px-6 py-2 bg-primary text-white rounded-lg hover:bg-blue-700 transition flex items-center">
+                    <i data-feather="printer" class="mr-2"></i> Print Guide
+                </button>
+                <a href="index.html" class="px-6 py-2 bg-secondary text-white rounded-lg hover:bg-green-700 transition flex items-center">
+                    <i data-feather="arrow-left" class="mr-2"></i> Back to Main
+                </a>
+            </div>
+        </header>
+
+        <!-- Main Content -->
+        <main class="bg-white shadow-lg rounded-lg p-6 print:p-0">
+            <!-- Risk Fundamentals Section -->
+            <section class="mb-10 print-section">
+                <h2 class="text-2xl font-bold text-primary border-b-2 border-primary pb-2 mb-4 flex items-center">
+                    <i data-feather="alert-triangle" class="mr-2"></i> Risk Fundamentals
+                </h2>
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-6">
+                    <div>
+                        <h3 class="font-semibold text-secondary mb-2">Risk Definition (ISO 31000)</h3>
+                        <blockquote class="bg-gray-50 p-4 rounded-lg italic">
+                            "The effect of uncertainty on objectives"
+                        </blockquote>
+                        <ul class="list-disc pl-5 mt-4 space-y-2">
+                            <li>All activity is subject to some degree of risk</li>
+                            <li>We cannot eliminate risk entirely</li>
+                            <li>Goal is to reduce risk to acceptable levels</li>
+                        </ul>
+                    </div>
+                    <div class="info-card p-4">
+                        <h3 class="font-semibold text-secondary mb-2">Risk Calculation Formula</h3>
+                        <div class="text-center my-4">
+                            <div class="risk-formula inline-block">
+                                Likelihood × Impact × Vulnerability
+                            </div>
+                            <div class="mt-2 text-sm">OR</div>
+                            <div class="risk-formula inline-block">
+                                Threat + Vulnerability
+                            </div>
+                        </div>
+                        <div class="grid grid-cols-2 gap-2 mt-4">
+                            <div>
+                                <h4 class="font-semibold text-sm">Vulnerability</h4>
+                                <p class="text-sm">Weakness in an asset</p>
+                            </div>
+                            <div>
+                                <h4 class="font-semibold text-sm">Threat</h4>
+                                <p class="text-sm">Actor/event that could exploit vulnerability</p>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </section>
+
+            <!-- Risk Management Section -->
+            <section class="mb-10 print-section">
+                <h2 class="text-2xl font-bold text-primary border-b-2 border-primary pb-2 mb-4 flex items-center">
+                    <i data-feather="shield" class="mr-2"></i> Risk Management
+                </h2>
+                <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
+                    <div class="bg-gray-50 p-4 rounded-lg">
+                        <h3 class="font-semibold text-secondary mb-2">Gap Analysis</h3>
+                        <p class="mb-2">The difference between:</p>
+                        <ul class="list-disc pl-5 space-y-1">
+                            <li>Current security posture</li>
+                            <li>Desired security posture</li>
+                        </ul>
+                    </div>
+                    <div class="bg-gray-50 p-4 rounded-lg">
+                        <h3 class="font-semibold text-secondary mb-2">Risk Registers</h3>
+                        <ul class="list-disc pl-5 space-y-1">
+                            <li>Risk description</li>
+                            <li>Severity rating</li>
+                            <li>Risk owner</li>
+                            <li>Mitigation strategies</li>
+                            <li>Often uses heat maps</li>
+                        </ul>
+                    </div>
+                    <div class="bg-gray-50 p-4 rounded-lg">
+                        <h3 class="font-semibold text-secondary mb-2">Residual Risk</h3>
+                        <ul class="list-disc pl-5 space-y-1">
+                            <li>Risk remaining after controls</li>
+                            <li>Cannot be fully eliminated</li>
+                            <li>Risk Appetite varies by organization</li>
+                            <li>May have formal risk appetite statement</li>
+                        </ul>
+                    </div>
+                </div>
+            </section>
+
+            <!-- Attack Surface Section -->
+            <section class="mb-10 print-section">
+                <h2 class="text-2xl font-bold text-primary border-b-2 border-primary pb-2 mb-4 flex items-center">
+                    <i data-feather="target" class="mr-2"></i> Attack Surface & Threat Vectors
+                </h2>
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-6">
+                    <div>
+                        <h3 class="font-semibold text-secondary mb-2">Attack Surface Lenses</h3>
+                        <div class="bg-gray-50 p-4 rounded-lg">
+                            <div class="mb-3">
+                                <h4 class="font-semibold">Physical</h4>
+                                <p class="text-sm">Building access, movement controls</p>
+                            </div>
+                            <div class="mb-3">
+                                <h4 class="font-semibold">Logical</h4>
+                                <p class="text-sm">Exposed IPs, ports, network access</p>
+                            </div>
+                            <div>
+                                <h4 class="font-semibold">Human</h4>
+                                <p class="text-sm">Employee discoverability, vulnerability</p>
+                            </div>
+                        </div>
+                    </div>
+                    <div>
+                        <h3 class="font-semibold text-secondary mb-2">Threat Vectors</h3>
+                        <div class="bg-gray-50 p-4 rounded-lg">
+                            <ul class="list-disc pl-5 space-y-2">
+                                <li>Vulnerable software components</li>
+                                <li>Insecure network protocols</li>
+                                <li>Insecure supply chain elements</li>
+                                <li>Humans vulnerable to coercion</li>
+                                <li>Requires both vulnerability and exploit mechanism</li>
+                            </ul>
+                        </div>
+                    </div>
+                </div>
+            </section>
+
+            <!-- Social Engineering Section -->
+            <section class="mb-10 print-section">
+                <h2 class="text-2xl font-bold text-primary border-b-2 border-primary pb-2 mb-4 flex items-center">
+                    <i data-feather="user" class="mr-2"></i> Social Engineering
+                </h2>
+                <div class="bg-yellow-50 p-4 rounded-lg border border-yellow-200 mb-6">
+                    <h3 class="font-semibold text-yellow-600 mb-2">Human Vulnerabilities</h3>
+                    <div class="grid grid-cols-2 md:grid-cols-3 gap-2">
+                        <span class="bg-white px-3 py-1 rounded-full text-center text-sm">Empathy</span>
+                        <span class="bg-white px-3 py-1 rounded-full text-center text-sm">Fear</span>
+                        <span class="bg-white px-3 py-1 rounded-full text-center text-sm">Fitting In</span>
+                        <span class="bg-white px-3 py-1 rounded-full text-center text-sm">Kindness</span>
+                        <span class="bg-white px-3 py-1 rounded-full text-center text-sm">Respect for Authority</span>
+                        <span class="bg-white px-3 py-1 rounded-full text-center text-sm">Helpfulness</span>
+                    </div>
+                </div>
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-6">
+                    <div>
+                        <h3 class="font-semibold text-secondary mb-2">Social Engineering Types - 1</h3>
+                        <div class="bg-gray-50 p-4 rounded-lg">
+                            <ul class="list-disc pl-5 space-y-2">
+                                <li><strong>Phishing:</strong> Fraudulent emails appearing legitimate</li>
+                                <li><strong>Pharming:</strong> DNS abuse to redirect to fake sites</li>
+                                <li><strong>Vishing:</strong> Phone-based manipulation</li>
+                                <li><strong>Smishing:</strong> SMS/text message scams</li>
+                            </ul>
+                        </div>
+                    </div>
+                    <div>
+                        <h3 class="font-semibold text-secondary mb-2">Social Engineering Types - 2</h3>
+                        <div class="bg-gray-50 p-4 rounded-lg">
+                            <ul class="list-disc pl-5 space-y-2">
+                                <li><strong>Typosquatting:</strong> Fake domains similar to real ones</li>
+                                <li><strong>Business Email Compromise:</strong> Compromised trusted accounts</li>
+                                <li><strong>Watering Hole:</strong> Compromising frequently visited sites</li>
+                                <li><strong>Deep Fakes:</strong> Synthetic media for deception</li>
+                            </ul>
+                        </div>
+                    </div>
+                </div>
+            </section>
+
+            <!-- Cryptography Section -->
+            <section class="print-section">
+                <h2 class="text-2xl font-bold text-primary border-b-2 border-primary pb-2 mb-4 flex items-center">
+                    <i data-feather="lock" class="mr-2"></i> Cryptography Fundamentals
+                </h2>
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-6">
+                    <div>
+                        <h3 class="font-semibold text-secondary mb-2">Cryptographic Components</h3>
+                        <div class="bg-gray-50 p-4 rounded-lg">
+                            <ul class="list-disc pl-5 space-y-2">
+                                <li><strong>Cipher:</strong> Algorithm for encryption/decryption</li>
+                                <li><strong>Key:</strong> Secret value that controls cipher operations</li>
+                                <li><strong>Plaintext:</strong> Original readable message</li>
+                                <li><strong>Ciphertext:</strong> Encrypted message</li>
+                            </ul>
+                            <div class="mt-4">
+                                <h4 class="font-semibold">Types of Cryptography</h4>
+                                <ul class="list-disc pl-5 space-y-1">
+                                    <li><strong>Symmetric:</strong> Single shared key</li>
+                                    <li><strong>Asymmetric:</strong> Public/private key pairs</li>
+                                    <li><strong>Hashing:</strong> One-way transformations</li>
+                                </ul>
+                            </div>
+                        </div>
+                    </div>
+                    <div>
+                        <h3 class="font-semibold text-secondary mb-2">Symmetric Encryption</h3>
+                        <div class="bg-gray-50 p-4 rounded-lg">
+                            <div class="text-center mb-4">
+                                <p class="font-semibold">Alice → [Plaintext + Cipher + Key] → Ciphertext → Bob</p>
+                                <p class="font-semibold">Bob → [Ciphertext + Same Key] → Plaintext</p>
+                            </div>
+                            <ul class="list-disc pl-5 space-y-2">
+                                <li>Fast and efficient for devices</li>
+                                <li>Uses smaller keys than asymmetric</li>
+                                <li>Suffers from key distribution problem</li>
+                                <li>Example: AES (Advanced Encryption Standard)</li>
+                            </ul>
+                        </div>
+                    </div>
+                </div>
+            </section>
+        </main>
+
+        <!-- Footer -->
+        <footer class="mt-12 text-center text-sm text-gray-500 no-print">
+            <p>Lesson 3 Recap - Security+ QuickCheat Pro</p>
+            <p class="mt-1">For optimal printing, use Chrome/Firefox and select "Background graphics" in print settings</p>
+        </footer>
+    </div>
+
+    <script>
+        feather.replace();
+    </script>
+</body>
+</html>