Cybersecurity
- Your security mindset allows you to protect all levels of assets.
- So having a security mindset helps analysts defend against the constant pressure from attackers.
- Having a strong security mindset can help set you apart from other candidates as you prepare to enter the security profession.
- using fictitious emails to evaluate security awareness at the company.
- after a security incident has taken place
- in case a security incident does occur
When a security event results in a data breach, it is categorized as a security incident. (資料外洩; 資安事故)
if it was compromised (如果受到入侵/危害)
Intellectual property (智財)
They can have a significantly negative impact on an organization if leaked publicly. (嚴重的負面影響;公開洩漏)
Examples of confidential data include proprietary information such as trade secrets, financial records, and sensitive government data. (專利資訊;商業秘密;財務紀錄)
Access to confidential data sometimes involves the signing of non-disclosure agreements (NDAs)
This data classification type is important for an organization’s ongoing business operations (持續營運)
Unauthorized access to sensitive data can cause significant damage to an organization’s finances and reputation. (未授權存取;重大損害;聲譽)
personally identifiable information (PII), sensitive personally identifiable information (SPII), and protected health information (PHI)
Public data, Private data, Sensitive data, Confidential data
If an individual gains unauthorized access to private data(個人;未經授權存取)
Private data is information that should be kept from the public. (不可公開)
threats, risks, and vulnerabilities that are posed by social engineering attacks, such as phishing (由社交工程造成的...)
such as intellectual property, trade secrets, PII, and even financial information (智慧財產;商業機密;財務資訊)
helps you prepare for the worst-case scenario, even if it doesn't happen(對...做準備；最糟情況)
cybersecurity profession（網路安全職業）
cybersecurity professionals（網路安全專家）
refine your understanding of key security concepts（精進/改進）
Writing code that assigns security incident tickets to the appropriate cybersecurity team based on its priority level. (寫程式依據優先等級分派資安事故單給合適的資安小組)
This results in DNS resolvers sending large responses to (導致)
which can lead to significant issues like unplanned downtime (導致; 重大問題; 意外停機)
can access restricted information (限制性的)
Security professionals are often tasked with reviewing log files(被要求/要負責/通常的任務)
Automate cybersecurity tasks with Python
removing usernames that match specific criteria from an access list.（特定標準）
Make sure your browser is up to date with the latest version(確認瀏覽器是最新的版本)
it might be used to determine whether or not to lock an account. (是否鎖定帳戶)
checks whether someone is allowed to access a particular file (是否...; 存取特定檔案)
improve efficiency; allow it to work effectively (提高效率; 有效運作)
use Python code to reduce the manual effort needed to manage an access control list(人工作業; )
Throughout this certificate you will use Qwiklabs and Jupyter Notebooks to complete hands-on activities（整個認證課程中；實作）
Security analysts can access Python through a variety of environments（各種環境）
The fast.log file is used for basic logging and alerting and is considered a legacy file format（視為...；傳統）
The Network-based IDS application inspects network traffic from different devices on the network（檢查/審視）
When suspicious or unusual network activity is detected（可疑的；不尋常的）
IDS (Intrusion Detection System) is an application that monitors activity and alerts on possible intrusions.（監視活動；可能入侵的告警）
Detection requires data, and this data can come from various data sources.（各種的）
It’s important to know how to read and interpret different log formats so that you can uncover the key details surrounding an event and identify unusual or malicious activity.（解讀；發掘；查明；不尋常）
logs provide key details about activities that occurred across an organization（發生）
logs record events that happen on a network, or system.（發生）
intrusion detection systems; intrusion prevent systems (IDS;IPS)
investigating an alert involving a possible network intrusion（網路入侵）
When an outage occurs due to a security incident（發生資安事件的停機）
Business Continuity Plan（BCP 營運持續計畫）
the three letters in the CIA triad stand for confidentiality, integrity, and availability（資安鐵三角；機密性；完整性；可用性）
ensure that you complete a thorough analysis so that you have enough information to make an informed decision about your findings.（徹底分析；做出明智的決定；發現）
you'll receive and assess the alert to determine if it's a false positive（評估；確定/決定；誤警報）
which prioritizes incidents according to their level of importance or urgency.（重要等級或緊急程度）
Having previously investigated the file hash, it is confirmed to be a known malicious file.（之前調查過檔案雜湊值，證實這是已知的惡意檔案）
The email body and subject line contained grammatical errors.（語法錯誤）
Tedious, error-prone, or time-consuming tasks can be automated, while analysts can prioritize their time with other tasks.（繁瑣，容易出錯或耗時工作；優先處理...）
It is an example of a non-automated playbook, which requires step-by-step actions performed by an analyst.（一步一步動作）
This depicts the process for detecting a DDoS and begins with determining the indicators of compromise, like unknown incoming traffic.（首先確定入侵指標；）
Documentation must be regularly reviewed and updated to keep up with the evolving threat landscape. (文件必須定期審閱與更新，以跟上不斷演變的威脅形勢)
Incident response plans standardize an organization’s response process by outlining procedures in advance of an incident. (事件發生前)
If a malicious actor compromised a system, evidence must be available to determine their actions so that appropriate legal action can be taken. (採取適當的法律行動)
You observe a known user successfully authenticate a new device using two-factor (觀察到; 注意到)
Security terms
- malicious actors (惡意行為者)
- malicious activity (惡意活動)
- attackers (攻擊者)
- security incidents (資安事件;安全事件)
- security analysts (資安分析師; 安全分析師)
- security professionals (資安專家; 安全專家)
- the suspicious IP address (可疑的)
- unusual processes (不尋常的)
- Virus（病毒）
- Worm（蠕蟲）
- Trojan（木馬）
- Ransomware（勒索軟體）
- Spyware（間諜軟體）
- Software as a service, refers to software suites operated by the CSP that a company can use remotely without hosting the software.
- it is referred to as a hybrid cloud environment.
- As a security analyst
- Splunk is a data analysis platform
- Splunk Enterprise is a self-hosted tool used to retain, analyze and search the log data to provide security information and alert in real-time