Analyzes events through cybersecurity lens using threat modeling, attack surface analysis, defense-in-depth, zero-trust architecture, and risk-based frameworks (CIA triad, STRIDE, MITRE ATT&CK). Provides insights on vulnerabilities, attack vectors, defense strategies, incident response, and security

Cybersecurity Analyst Skill Purpose Analyze events through the disciplinary lens of cybersecurity, applying rigorous security frameworks (CIA triad, defense in depth, zero trust), threat modeling methodologies (STRIDE, PASTA, VAST), attack surface analysis, and industry standards (NIST, ISO 27001, MITRE ATT&CK) to understand security risks, identify vulnerabilities, assess threat actors and attack vectors, evaluate defensive controls, and recommend risk mitigation strategies. When to Use This Skill Security Incident Analysis : Investigate breaches, data leaks, ransomware attacks, insider threats Vulnerability Assessment : Identify weaknesses in systems, applications, networks, processes Threat Modeling : Analyze potential attack vectors and threat actors for new systems or changes Security Architecture Review : Evaluate design decisions for security implications and gaps Risk Assessment : Quantify and prioritize security risks using frameworks like CVSS, FAIR Compliance Analysis : Assess adherence to security standards (SOC 2, PCI DSS, HIPAA, GDPR) Incident Response Planning : Design detection, containment, eradication, and recovery strategies Security Posture Evaluation : Assess overall defensive capabilities and maturity Code Security Review : Identify security vulnerabilities in software implementations Core Philosophy: Security Thinking Cybersecurity analysis rests on fundamental principles: Defense in Depth : No single security control is perfect. Layer multiple independent controls so compromise of one doesn't compromise the whole system. Assume Breach : Modern security assumes attackers will penetrate perimeter defenses. Design systems to minimize damage and enable detection when (not if) breach occurs. Least Privilege : Grant minimum access necessary for legitimate function. Every excess permission is an opportunity for exploitation. Zero Trust : Never trust, always verify. Verify explicitly, use least privilege access, and assume breach regardless of network location. Security by Design : Security cannot be bolted on afterward. It must be fundamental to architecture and implementation from the beginning. CIA Triad : Security protects three properties—Confidentiality (only authorized access), Integrity (only authorized modification), Availability (accessible when needed). Threat Informed Defense : Base defensive priorities on understanding of actual threat actors, their capabilities, motivations, and tactics (threat intelligence). Risk Based Approach : Perfect security is impossible. Prioritize security investments based on risk (likelihood × impact) to maximize security per dollar spent. Theoretical Foundations (Expandable) Foundation 1: CIA Triad (Classic Security Model) Components : Confidentiality : Information accessible only to authorized entities Protection mechanisms: Encryption, access controls, authentication Threats: Eavesdropping, data theft, unauthorized disclosure Example violations: Data breach, password theft, insider leak Integrity : Information modifiable only by authorized entities in authorized ways Protection mechanisms: Hashing, digital signatures, access controls, version control Threats: Tampering, unauthorized modification, malware Example violations: Database manipulation, man in the middle attacks, ransomware encryption Availability : Information and systems accessible when needed by authorized entities Protection mechanisms: Redundancy, backups, DDoS mitigation, incident response Threats: Denial of service, ransomware, system destruction Example violations: DDoS attacks, ransomware, infrastructure failures Extensions : Authenticity : Verified identity of entities and origin of information Non repudiation : Cannot deny taking action Accountability : Actions traceable to entities Application : Every security analysis should identify which aspects of CIA triad are at risk and how controls protect each. Sources : [CIA Triad Wikipedia](https://en.wikipedia.org/wiki/Information security Key concepts) [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework) Foundation 2: Defense in Depth (Layered Security) Principle : Deploy multiple layers of security controls so compromise of one layer doesn't compromise entire system. Historical Origin : Military defensive strategy—multiple concentric perimeter defenses Security Layers : 1. Physical : Facility access controls, locked server rooms 2. Network : Firewalls, network segmentation, IDS/IPS 3. Host : Endpoint protection, host firewalls, patch management 4. Application : Input validation, secure coding, authentication 5. Data : Encryption at rest and in transit, DLP, tokenization 6. Human : Security awareness training, phishing simulation Key Insight : Redundancy is not waste—it's resilience. Even if attacker bypasses firewall, they still face authentication, authorization, monitoring, encryption, and detection controls. Application : Security architecture should have multiple independent defensive layers protecting critical assets. Limitation : Can create complexity and false sense of security if layers are not maintained or are interdependent. Sources : [Defense in Depth NSA](https://www.nsa.gov/Press Room/Cybersecurity Advisories Guidance/) [Layered Security CISA](https://www.cisa.gov/topics/cybersecurity best practices) Foundation 3: Zero Trust Architecture Core Principle : "Never trust, always verify" regardless of network location Contrast with Perimeter Model : Traditional security assumed internal network is trusted ("castle and moat"). Zero trust assumes no network location is trusted. Key Tenets (NIST SP 800 207): 1. Verify explicitly : Always authenticate and authorize based on all available data points 2. Least privilege access : Limit user access with Just In Time and Just Enough Access 3. Assume breach : Minimize blast radius and segment access; verify end to end encryption Components : Identity centric security : Identity becomes new perimeter Micro segmentation : Network divided into small zones with separate controls Continuous verification : Authentication and authorization are continuous, not one time Data centric : Protect data itself, not just perimeter around it Drivers : Cloud adoption (no clear perimeter) Remote work (users outside traditional perimeter) Sophisticated attacks (perimeter breaches common) Application : Modern security architectures should be designed with zero trust principles, especially for cloud and hybrid environments. Sources : [NIST SP 800 207: Zero Trust Architecture](https://csrc.nist.gov/publications/detail/sp/800 207/final) [Zero Trust Microsoft Security](https://www.microsoft.com/en us/security/business/zero trust) Foundation 4: Threat Modeling Definition : Structured approach to identify and prioritize potential threats to a system Purpose : Proactively identify security issues during design phase when fixes are cheapest Benefits : Find vulnerabilities before implementation Prioritize security work Communicate risks to stakeholders Guide security testing Common Methodologies : STRIDE (Microsoft): S poofing identity T ampering with data R epudiation I nformation disclosure D enial of service E levation of privilege PASTA (Process for Attack Simulation and Threat Analysis): Seven stage risk centric methodology Aligns business objectives with technical requirements VAST (Visual, Agile, and Simple Threat modeling): Scalable for agile development Two types: application threat models and operational threat models Application : Use threat modeling for new features, architecture changes, or security reviews. Sources : [Threat Modeling OWASP](https://owasp.org/www community/Threat Modeling) [STRIDE Threat Model Microsoft](https://learn.microsoft.com/en us/azure/security/develop/threat modeling tool threats) Foundation 5: MITRE ATT&CK Framework Description : Knowledge base of adversary tactics and techniques based on real world observations Purpose : Understand how attackers operate to inform defense, detection, and threat hunting Structure : Tactics : High level goals (e.g., Initial Access, Execution, Persistence, Privilege Escalation) Techniques : Ways to achieve tactics (e.g., Phishing, Exploiting Public Applications) Sub techniques : Specific implementations Procedures : Specific attacker behaviors 14 Tactics (Enterprise Matrix): 1. Reconnaissance 2. Resource Development 3. Initial Access 4. Execution 5. Persistence 6. Privilege Escalation 7. Defense Evasion 8. Credential Access 9. Discovery 10. Lateral Movement 11. Collection 12. Command and Control 13. Exfiltration 14. Impact Application : Map defensive controls to ATT&CK techniques Identify detection gaps Threat intelligence sharing Red team/purple team exercises Value : Common language for describing attacker behavior; basis for threat informed defense Sources : [MITRE ATT&CK](https://attack.mitre.org/) [ATT&CK Navigator](https://mitre attack.github.io/attack navigator/) Core Analytical Frameworks (Expandable) Framework 1: Attack Surface Analysis Definition : Identification and assessment of all points where unauthorized user could enter or extract data from system Components : Attack Surface Elements : Network attack surface : Exposed ports, services, protocols Software attack surface : Applications, APIs, web interfaces Human attack surface : Users, administrators, social engineering targets Physical attack surface : Facility access, hardware access Attack Vectors : Methods attackers use to exploit attack surface Network based: Port scanning, protocol exploits, man in the middle Web based: SQL injection, XSS, CSRF, authentication bypass Email based: Phishing, malicious attachments, credential harvesting Physical: Theft, unauthorized access, evil maid attacks Social engineering: Pretexting, baiting, tailgating Analysis Process : 1. Enumerate : List all entry points and assets 2. Classify : Categorize by type and criticality 3. Assess : Evaluate exploitability and impact 4. Prioritize : Rank by risk 5. Reduce : Minimize unnecessary exposure Metrics : Number of exposed services Number of internet facing applications Number of privileged accounts Lines of code exposed to untrusted input Application : Reducing attack surface is fundamental defensive strategy. Eliminate unnecessary exposure. Sources : [Attack Surface Analysis OWASP](https://owasp.org/www community/Attack Surface Analysis Cheat Sheet) [Reducing Attack Surface Microsoft](https://learn.microsoft.com/en us/windows/security/threat protection/windows defender application control/microsoft recommended block rules) Framework 2: Risk Assessment Frameworks Purpose : Quantify and prioritize security risks to guide resource allocation Common Frameworks : CVSS (Common Vulnerability Scoring System): Standard for assessing vulnerability severity Score 0 10 based on exploitability, impact, scope Base score (intrinsic characteristics) + temporal + environmental scores Widely used but criticized for not capturing actual risk in specific contexts FAIR (Factor Analysis of Information Risk): Quantitative risk framework Risk = Loss Event Frequency × Loss Magnitude Enables cost benefit analysis of security investments More complex but provides dollar denominated risk figures NIST Risk Management Framework (RMF): Seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor Links security controls to risk management Used by U.S. federal agencies Qualitative vs. Quantitative : Qualitative : High/Medium/Low risk ratings (simpler, faster, subjective) Quantitative : Numerical risk values (complex, objec

cybersecurity-analyst