CyberOps Associate: Module 1 – The Danger

1.0 Introduction

1.0.1 First Time in This Course

CyberOps Associate v1.0 covers knowledge and skills needed to successfully handle the tasks, duties, and responsibilities of an associate-level Security Analyst working in a Security Operations Center (SOC).

Upon completion of the CyberOps Associate v1.0 course, students will be able to perform the following tasks:

• Install virtual machines to create a safe environment for implementing and analyzing cybersecurity threat events.
• Explain the role of the Cybersecurity Operations Analyst in the enterprise.
• Explain the Windows Operating System features and characteristics needed to support cybersecurity analyses.
• Explain the features and characteristics of the Linux Operating System.
• Analyze the operation of network protocols and services.
• Explain the operation of the network infrastructure.
• Classify the various types of network attacks.
• Use network monitoring tools to identify attacks against network protocols and services.
• Explain how to prevent malicious access to computer networks, hosts, and data.
• Explain the impacts of cryptography on network security monitoring.
• Explain how to investigate endpoint vulnerabilities and attacks.
• Evaluate network security alerts.
• Analyze network intrusion data to identify compromised hosts and vulnerabilities.
• Apply incident response models to manage network security incidents.

1.0.2 Student Resources

There are a number of tools and resources that are available to you that will help you in your journey as you develop your CyberOps skills and prepare for job opportunities.

Lab Environment

In this course, two virtual machines (VM) are used: CyberOps Workstation and Security Onion. These VMs provide all of the applications and latest security monitoring and network intrusion analysis capabilities needed for the course.

The minimum RAM memory requirement to run CyberOps Workstation virtual machines is 1 GB. However, for the Security Onion virtual machine, 4 GB RAM is recommended. The RAM memory recommendation on Security Onion VM allows the services, such as network security monitoring (NSM), to function properly.

Installation labs are available in the course and provide detailed steps to properly set up your VMs and the lab environment.

About Security Onion

Security Onion is developed by Security Onion Solutions. Security Onion is made available under GPL license. This course uses provides basic training in the use of Security Onion to validate the objectives of this course. For further training needs, visit the Security Onion Solutions developer site.

Packet Tracer

Packet Tracer simulates the internal workings of a network and is used in this course. Download and install the latest version of Packet Tracer here: Packet Tracer Resources.

If you are new to Packet Tracer, take this FREE, short, online course now: Introduction to Packet Tracer Course.

You can use your smartphone, tablet, or desktop to access your course; however, Packet Tracer activities, as well as some other activities, quizzes, and exams are best experienced using a PC.

Join Our Communities

Connect with and get help from other Networking Academy students from around the world with our Cisco Networking Academy Facebook page.

Network with your peers at our Cisco Networking Academy LinkedIn page.

Get a Job!

Access Career Resources specifically tailored to help NetAcad students to be successful in the workplace.

Find great job opportunities with Cisco and Cisco partners. Register now with Talent Bridge.

Getting industry certification is a guarantee to employers that you have the technical skills to do the job. Check out our Certifications and Vouchers page.

More Courses

Choose a course, practice what you learn, and become an IT professional. Check out our Course Catalog.

1.0.3 Ethical Hacking Statement

The Cisco Networking Academy Program is focused on creating the global problem solvers needed to build, scale, secure, and defend the networks that are used in our businesses and daily lives. The need for well-trained cybersecurity specialists continues to grow at an exponential rate. Training to become a cybersecurity specialist requires in depth understanding and exposure to how cyber attacks occur, as well as how they are detected and prevented. These skills will naturally also include learning the techniques that threat actors use to circumvent data, privacy, and computer and network security.

In this course, learners will use tools and techniques in a “sandboxed”, virtual machine environment that allows them to create, implement, monitor, and detect various types of cyber attacks. The hands-on training is performed in this environment so that students can gain the necessary skills and knowledge needed to thwart these and future cyber attacks. Security holes and vulnerabilities that are created in this course should only be used in an ethical manner and only in this “sandboxed” virtual environment. Experimentation with these tools, techniques, and resources outside of the provided sandboxed virtual environment is at the discretion of the instructor and local institution. If the learner has any doubt about which computer systems and networks are part of the sandboxed virtual environment, they should contact their instructor prior to any experimentation.

Unauthorized access to data, computer, and network systems is a crime in many jurisdictions and often is accompanied by severe consequences, regardless of the perpetrator’s motivations. It is the learner’s responsibility, as the user of this material, to be cognizant of and compliant with computer use laws.

1.0.4. Why Should I Take this Module?

Have you ever had something stolen? Perhaps you have had a wallet stolen or had your house robbed. Not only do you need to protect your physical property, you need to protect your information! Who is stealing information and why are they doing it? Maybe it is an individual just seeing if they are able to hack the information. Often it is for financial gain. There are many reasons. Keep reading this module to find out more about the threats and threat actors responsible for these attacks.

1.0.5 What Will I Learn in this Module?

Module Title: The Danger

Module Objective: Explain why networks and data are attacked.

1.0.6 Class Activity – Top Hacker Shows Us How It’s Done

In this class activity, you will view a TED Talk video that discusses various security vulnerabilities. You will also research one of the vulnerabilities mentioned in the video.

1.0.6 Class Activity – Top Hacker Shows Us How It is Done

1.1 War Stories

1.1.1 Hijacked People

Sarah stopped by her favorite coffee shop to grab her afternoon drink. She placed her order, paid the clerk, and waited while the baristas worked furiously to fulfill the backup of orders. Sarah pulled out her phone, opened the wireless client, and connected to what she assumed was the coffee shop’s free wireless network.

However, sitting in a corner of the store, a hacker had just set up an open “rogue” wireless hotspot posing as the coffee shop’s wireless network. When Sarah logged onto her bank’s website, the hacker hijacked her session and gained access to her bank accounts. Another term for rogue wireless hotspots is “evil twin” hotspots.

Search the internet on “evil twin hotspots” to learn more about this security threat.

1.1.2 Ransomed Companies

Rashid, an employee in the finance department of a major publicly held corporation, receives an email from his CEO with an attached PDF. The PDF is about the company’s third quarter earnings. Rashid does not remember his department creating the PDF. His curiosity is piqued, so he opens the attachment.

The same scenario plays out across the organization as dozens of other employees are successfully enticed to click the attachment. When the PDF opens, ransomware is installed on the employees’ computers and begins the process of gathering and encrypting corporate data. The goal of the attackers is financial gain, because they hold the company’s data for ransom until they are paid.

1.1.3 Targeted Nations

Some of today’s malware is so sophisticated and expensive to create that security experts believe only a nation state or group of nations could possibly have the influence and funding to create it. Such malware can be targeted to attack a nation’s vulnerable infrastructure, such as the water system or power grid.

This was the purpose of the Stuxnet worm, which infected USB drives. These drives were carried by five Iranian component vendors into a secure facility that they supported. Stuxnet was designed to infiltrate Windows operating systems and then target Step 7 software. Step 7 was developed by Siemens for their programmable logic controllers (PLCs). Stuxnet was looking for a specific model of the Siemens PLCs that controls the centrifuges in uranium processing facilities. The worm was transmitted from the infected USB drives into the PLCs and eventually damaged many of these centrifuges.

Zero Days, a film released in 2016, documents what is known about the development and deployment of the Stuxnet targeted malware attack. Search for Zero Days to find the film or information about the film.

1.1.4 Video – Anatomy of an Attack

Watch this video to view details of a complex attack.

1.1.5 Lab – Installing the Virtual Machines

In this lab, you will install VirtualBox on your personal computer. You will then download and install the CyberOps Workstation Virtual Machine (VM).

1.1.5 Lab – Installing the Virtual Machines

1.1.6 Lab – Cybersecurity Case Studies

In this lab, you will analyze the given cases and answer questions about them.

1.1.6 Lab – Cybersecurity Case Studies

1.2 Threat Actors

1.2.1 Threat Actors

Threat actors include, but are not limited to, amateurs, hacktivists, organized crime groups, state-sponsored, and terrorist groups. Threat actors are individuals or groups of individuals who perform cyberattacks. Cyberattacks are intentional malicious acts meant to negatively impact another individual or organization.

1.2.2 How Secure is the Internet of Things?

The Internet of Things (IoT) is all around us and quickly expanding. We are just beginning to reap the benefits of the IoT. New ways to use connected things are being developed daily. The IoT helps individuals connect things to improve their quality of life. For example, many people are now using connected wearable devices to track their fitness activities. How many devices do you currently own that connect to your home network or the internet?

How secure are these devices? For example, who wrote the firmware? Did the programmer pay attention to security flaws? Is your connected home thermostat vulnerable to attacks? What about your digital video recorder (DVR)? If security vulnerabilities are found, can firmware in the device be patched to eliminate the vulnerability? Many devices on the internet are not updated with the latest firmware. Some older devices were not even developed to be updated with patches. These two situations create opportunity for threat actors and security risks for the owners of these devices.

In October 2016, a DDoS attack against the domain name provider Dyn took down many popular websites. The attack came from a large number of webcams, DVRs, routers, and other IoT devices that had been compromised by malicious software. These devices formed a “botnet” that was controlled by hackers. This botnet was used to create an enormous DDoS attack that disabled essential internet services. Dyn has posted a blog to explain the attack and their reaction to it. Search on “Dyn Analysis Summary of Friday October 21 Attack” to learn more about this record-breaking attack.

For an explanation of the dangers of not securing IoT devices, search for Avi Rubin’s TED talk, “All Your Devices can be Hacked.” Dr. Rubin is a Professor of Computer Science at Johns Hopkins University.

1.2.3 Lab – Learning the Details of Attacks

In this lab, you will research and analyze IoT application vulnerabilities.

1.2.3 Lab – Learning the Details of Attacks

1.3 Threat Impact

1.3.1 PII, PHI, and PSI

The economic impact of cyberattacks is difficult to determine with precision. However, it is estimated that businesses will lose over $5 trillion annually by 2024 due to cyberattacks.

Personally identifiable information (PII) is any information that can be used to positively identify an individual. Examples of PII include:

• Name
• Social security number
• Birthdate
• Credit card numbers
• Bank account numbers
• Government issued ID
• Address information (street, email, phone numbers)

One of the more lucrative goals of cybercriminals is obtaining lists of PII that can then be sold on the dark web. The dark web can only be accessed with special software and is used by cybercriminals to shield their activities. Stolen PII can be used to create fake financial accounts, such as credit cards and short-term loans.

A subset of PII is protected health information (PHI). The medical community creates and maintains electronic medical records (EMRs) that contain PHI. In the U.S., handling of PHI is regulated by the Health Insurance Portability and Accountability Act (HIPAA). In the European Union the General Data Protection Regulation (GDPR) protects a broad range of personal information in including health records.

Personal security information (PSI) is another type of PII. This information includes usernames, passwords, and other security-related information that individuals use to access information or services on the network. According to a 2019 report by Verizon, the second most common way that threat actors breached a network was by using stolen PSI.

Most hacks on companies and organizations that have been reported in the news involved stolen PII or PHI. Recent examples are:

• In 2019, an online graphic design tool website experienced a data breach in which PII for approximately 137 million users was viewed by hackers with user details for 4 million accounts appearing on the internet.
• In 2020, a major Chinese social media company was hacked resulting in theft of PII, including phone numbers, stolen from 172 million users. The theft did not include passwords, so the data was available for a low price on the internet.
• In 2019, a company that makes games that are played on Facebook was hacked and the PII of 218 million users was stolen.

1.3.2 Lost Competitive Advantage

Companies are increasingly worried about corporate espionage in cyberspace. The loss of intellectual property to competitors is a serious concern. An additional major concern is the loss of trust that comes when a company is unable to protect its customers’ personal data. The loss of competitive advantage may come from this loss of trust rather than another company or country stealing trade secrets.

1.3.3 Politics and National Security

It is not just businesses that get hacked. In February 2016, a hacker published the personal information of 20,000 U.S. Federal Bureau of Investigation (FBI) employees and 9,000 U.S. Department of Homeland Security (DHS) employees. The hacker was apparently politically motivated.

The Stuxnet worm was specifically designed to impede Iran’s progress in enriching uranium that could be used in a nuclear weapon. Stuxnet is a prime example of a network attack motivated by national security concerns. Cyberwarfare is a serious possibility. State-supported hacker warriors can cause disruption and destruction of vital services and resources within an enemy nation. The internet has become essential as a medium for commercial and financial activities. Disruption of these activities can devastate a nation’s economy. Controllers, similar to those attacked by Stuxnet, also are used to control the flow of water at dams and the switching of electricity on the power grid. Attacks on such controllers can have dire consequences.

1.3.4 Lab – Visualizing the Black Hats

In this lab, you will research and analyze cybersecurity incidents to create scenarios how organizations can prevent or mitigate an attack.

1.3.4 Lab – Visualizing the Black Hats

1.4 The Danger Summary

1.4.1 What Did I Learn in this Module?

War Stories

Threat actors can hijack banking sessions and other personal information by using “evil twin” hotspots. Threat actors can target companies, as in the example where opening a pdf on the company computer can install ransomware. Entire nations can be targeted. This occurred in the Stuxnet malware attack.

Threat Actors

Threat actors include, but are not limited to, amateurs, hacktivists, organized crime groups, state sponsored, and terrorist groups. The amateur may have little to no skill and often use information found on the internet to launch attacks. Hacktivists are hackers who protest against a variety of political and social ideas. Much of the hacking activity is motivated by financial gain. Nation states are interested in using cyberspace for industrial espionage. Theft of intellectual property can give a country a significant advantage in international trade. As the Internet of Things (IoT) expands, webcams, routers, and other devices in our homes are also under attack.

Threat Impact

It is estimated that businesses will lose over $5 trillion annually by 2024 due to cyberattacks. Personally identifiable information (PII), protected health information (PHI), and personal security information (PSI) are forms of protected information that are often stolen. A company can lose its competitive advantage when this information is stolen, including trade secrets. Also, customers lose trust in the company’s ability to protect their data. Governments have also been victims of hacking.