Connected systems
Follow the packet. Understand the systems that connect and protect us.
Application Layer Protocol
Application-layer command traffic uses protocols already common in the environment.
ARP and local address resolution
Understand IPv4 local address resolution, the gateway’s role, and why an ARP entry is a forwarding clue rather than authenticated identity.
Automated Exfiltration
Automated exfiltration repeatedly transfers collected information without requiring manual action for each item.
Cloud computing
Understand cloud services through their operating model, resource lifecycle, and the identity, data, and recovery decisions that remain with customers.
Cloud identity and permissions
Review effective cloud permissions, delegation, workload credentials, and permission-changing actions rather than trusting role names or network location.
Cloud security architecture
Map cloud data paths and management authority together, then design identity boundaries, logging, keys, and recovery around the critical workflows.
Cloud shared responsibility
Assign ownership for each cloud control using the specific service boundary, then verify customer configuration instead of relying solely on provider assurance.
Cloud storage security
Verify storage access through identities, resource policies, delegated links, encryption keys, logging, and recovery rather than equating encryption with privacy.
Communication Through Removable Media
Removable-media communication relays commands or results through physical storage between compromised systems.
Computer networking
Follow a browser request to understand network paths, switches, routers, and the difference between connectivity and permission.
Container security
Review image provenance and runtime authority together, including capabilities, host mounts, secrets, resource limits, and the shared host boundary.
Cross-Origin Resource Sharing (CORS)
Understand cross-origin browser response access, preflights, and credential behavior without confusing CORS with API authorization or CSRF protection.
Data Encoding
Data encoding transforms command traffic into another representation.
Data Obfuscation
Data obfuscation disguises command traffic so simple content signatures are less useful.
Data Transfer Size Limits
Transfer size limits split or constrain outgoing data to avoid simple volume thresholds.
Database hardening
Reduce database exposure through narrowly scoped application identities, protected administration, maintained configuration, and tested data recovery.
DHCP
Learn how DHCP assigns IPv4 configuration, how leases affect investigations, and why obtaining an address does not authenticate a network.
Domain Name System
Follow a DNS lookup through resolvers, authoritative servers, and caches, and learn why a resolved name is not proof that a service is trustworthy.
Dynamic Resolution
Dynamic resolution changes how command destinations are found over time.
Email protocols and authentication
Separate email submission, relay, mailbox access, and sender-domain authentication while assessing message content and business requests independently.
Encrypted Channel
Encrypted command channels conceal instruction content from network observers.
Exfiltration Over Alternative Protocol
Exfiltration over an alternative protocol transfers collected data through a route separate from the main control channel.
Exfiltration Over C2 Channel
Exfiltration over a command channel sends collected data through the same communications used for remote control.
Exfiltration Over Other Network Medium
Exfiltration over another network medium uses a path different from the primary managed network.
Exfiltration Over Physical Medium
Physical-medium exfiltration moves information out through storage or another physical device.
Exfiltration Over Web Service
Web-service exfiltration transfers data through a legitimate online provider.
Fallback Channels
Fallback channels let command traffic move to an alternate communication path when the preferred route fails.
Firewalls
Understand traffic-policy enforcement, stateful inspection, rule ownership, and why permitting a connection does not authorize its application actions.
FTP, FTPS, and SFTP
Compare FTP, FTPS, and SFTP by their protocols, identity verification, protected paths, and automation requirements before migrating a file-transfer workflow.
HTTP and HTTPS
Understand HTTP requests, methods, responses, and status codes while separating web semantics from encryption and application authorization.
HTTP security headers
Verify browser security policy on delivered responses, choosing appropriate headers and testing CDN, error-page, and content-type behavior.
HTTP status codes
Interpret HTTP status classes with response content, permission context, and actual state changes instead of treating success codes as security verdicts.
HTTP Strict Transport Security (HSTS)
Explain how browsers learn HTTPS-only policy, why redirects differ, and how subdomain coverage and preload choices affect deployment and recovery.
IaaS, PaaS, and SaaS
Compare IaaS, PaaS, and SaaS through concrete maintenance, identity, application, and data responsibilities rather than treating the labels as complete contracts.
ICMP, ping, and traceroute
Interpret ping and traceroute as limited observations, accounting for filtering, response behavior, and differences between reachability and service health.
Identity and access management
Coordinate human and workload identities through creation, authentication, permission review, role changes, and complete removal of obsolete access.
Identity federation and SSO
Understand identity-provider trust, validated assertions, relying-party audiences, and the application permissions that remain after single sign-on.
IDS and IPS
Distinguish detection from inline prevention, assess sensor visibility, and turn a network alert into a testable investigation rather than an automatic verdict.
Infrastructure as code security
Review infrastructure definitions, rendered plans, deployment authority, sensitive state, and runtime drift as parts of one controlled change workflow.
Ingress Tool Transfer
Ingress tool transfer brings additional files into an already-accessed environment.
IP addresses
Learn what IPv4 and IPv6 addresses identify, how private addressing works, and why an address in a log is not a person's identity.
IPv4
Read IPv4 addresses with their actual prefixes, allocation context, and translation history rather than relying on historical address classes.
IPv6
Understand IPv6 address scope and neighbor behavior, and review dual-stack exposure without assuming IPv4 controls cover every path.
Kerberos
Follow Kerberos ticket-based authentication, protect service identities and keys, and distinguish valid authentication evidence from resource authorization.
Kubernetes security
Assess orchestration authority, workload identities, admission rules, secrets, and enforced network controls rather than treating namespaces as complete isolation.
LANs, WANs, and other network scopes
Use LAN, WAN, campus, and wireless network labels to explain scope while drawing the actual trust and access boundaries separately.
LDAP and directory services
Understand directory access, protected queries, narrowly scoped service accounts, and how membership changes can affect authorization across applications.
MAC addresses
Understand local-link MAC addressing and switch learning while avoiding permanent-device or human-identity claims from a single address.
Microservices security
Keep service identity, propagated user context, and resource authorization distinct across gateways and internal service calls.
Model Context Protocol (MCP) security
Treat AI tool servers as execution boundaries, constrain credentials and inputs, and distinguish untrusted tool text from authorized user instructions.
Multi-Stage Channels
Multi-stage channels use different communication routes for separate parts of an operation.
Network access-control lists
Evaluate a complete flow against ordered network rules, including direction, return traffic, and platform-specific default behavior.
Network address translation
Understand address and port translation, shared public addresses, and the records needed to connect an external observation to an internal flow.
Network devices
Identify forwarding, wireless, translation, and security functions by configuration, then protect the infrastructure’s management and maintenance paths.
Network segmentation
Design meaningful security zones, define necessary communication, and verify that enforcement matches the boundaries drawn in the network diagram.
Network topologies
Read physical and logical network diagrams together, including redundant paths, security enforcement, and shared failure dependencies.
Non-Application Layer Protocol
Lower-layer command traffic uses protocols outside the ordinary application-layer paths a defender may expect.
Non-Standard Port
Nonstandard-port communication pairs a protocol with an unexpected port.
OSI and TCP/IP models
Use OSI and TCP/IP layers to explain a browser request and separate physical, addressing, transport, and application problems.
Ports and services
Understand transport ports, service conventions, connection context, and why an open port cannot establish which application is safe.
Privileged access
Control administrative authority with scoped elevation, attributable accounts, emergency procedures, and review of human and automation privileges.
Protocol Tunneling
Protocol tunneling carries one communications stream inside another protocol.
Proxy
Investigate relayed connections by linking upstream and downstream traffic, process ownership, and authorized proxy roles without assuming every intermediary is malicious.
Public, private, and hybrid cloud
Distinguish public, private, hybrid, and multi-cloud arrangements while mapping their actual identity, connectivity, data, and operational boundaries.
Rate limiting and abuse controls
Design abuse limits around identity, resource cost, bursts, and concurrent work, then verify their effects on both attackers and legitimate users.
Remote Access Tools
Remote access tool abuse uses legitimate management software for unauthorized interactive control.
Retrieval-augmented generation (RAG) security
Protect document ingestion, retrieval permissions, provenance, and cached answers so grounding an AI response does not become a new disclosure path.
Routing and switching
Follow local and remote traffic to understand MAC-based switching, IP routing, gateways, and the evidence each forwarding stage provides.
Routing protocols
Understand learned reachability, route-selection policy, and how routing changes can alter availability, inspection paths, and security assumptions.
SASE and security service edge
Evaluate SASE and SSE through required traffic paths, identity enforcement, service coverage, visibility, and failure behavior instead of product labels.
Scheduled Transfer
Scheduled transfer moves data at chosen times or intervals.
Serverless function security
Secure function triggers, per-workload permissions, event validation, retries, and resource costs within the provider/customer responsibility boundary.
SNMP and network management
Protect infrastructure monitoring and administration through restricted reachability, suitable SNMP security, credential ownership, and useful change records.
Software-defined WAN
Understand policy-based wide-area path selection and review centralized management, failover, segmentation, and the security effects of alternate routes.
Subnetting and CIDR
Understand CIDR prefixes and IPv4 subnet boundaries through a small /24-to-/26 example, including what subnetting cannot enforce.
TCP and UDP
Compare streams and datagrams through application requirements, failure handling, and the evidence needed to understand a network exchange.
Time synchronization
Build reliable chronology by distinguishing event, receipt, and ingestion times, recording clock drift, and preserving original timestamps.
Traffic Signaling
Traffic signaling activates hidden behavior after a particular network pattern or value is received.
Transfer Data to Cloud Account
Cross-account cloud transfer moves data to another account through provider features.
Transmission Control Protocol
Understand TCP connections, ordered streams, retransmissions, and why a successful handshake cannot prove an application action succeeded.
User Datagram Protocol
Learn how UDP datagrams differ from a stream, why applications choose them, and which reliability and security questions remain above the transport.
Variable-length subnet masks
Plan different-sized IPv4 subnets with aligned prefixes, non-overlapping ranges, and room for growth instead of assigning every segment the same block.
Virtual private networks
Evaluate VPN protection through tunnel endpoints, authentication, routing, device condition, and the resources reachable after connection.
VLANs
Understand VLAN broadcast separation, access and trunk roles, and how inter-VLAN routing and management paths affect the actual security boundary.
Web cache security
Separate public and personalized responses, align cache keys with response-changing inputs, and test permission changes through the real delivery path.
Web Service
Web-service command traffic relays instructions through a legitimate online service.
Webhook security
Verify event authenticity and freshness, bind events to local records, and handle duplicate or reordered webhook deliveries without repeated business effects.
WebSocket security
Protect continuing WebSocket sessions through origin checks, action-level permissions, revocation, message validation, and connection-aware resource limits.
Wireless security
Evaluate wireless authentication, client isolation, network identity, and access-point management rather than trusting a familiar SSID or standard label.
Zero trust
Understand resource-focused access decisions, identity and device evidence, and how zero trust works alongside existing controls.