Module 1: Introduction to Ethical Hacking

Section 1: Information Security

The CIA Triad

Information security's primary focus is the balanced protection of the confidentiality, integrity, and availability of data (also known as the CIA triad).

• Confidentiality: Only authorized users can access data
• Integrity: Data is protected from unauthorized modification
• Availability: Data and systems are accessible when needed

Non-repudiation

In law, non-repudiation implies one's intention to fulfill their obligations to a contract.

Section 2: Hacking Methodology

CEH Hacking Methodology Phases

1. Gaining Access - Cracking passwords, vulnerability exploitation
2. Escalating Privileges - Moving from user to admin/root access
3. Maintaining Access - Executing applications, hiding files
4. Covering Tracks - Clearing logs

Cyber Kill Chain (Lockheed Martin)

1. Reconnaissance
2. Weaponization
3. Delivery
4. Exploitation
5. Installation
6. Command and Control (C2)
7. Action on Objectives

MITRE ATT&CK Framework

A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Section 3: Hacker Types & Concepts

Hacker Classifications

• White Hat: Ethical hackers who work to keep data safe
• Black Hat: Hackers with malicious intentions who steal and exploit data
• Grey Hat: May violate laws but without malicious intent

Script Kiddie

An unskilled individual who uses scripts or programs developed by others.

Hacktivist

Uses hacking techniques to promote a political agenda or social change.

Section 4: Security Controls & Risk

Risk Management

Identification, evaluation, and prioritization of risks followed by coordinated application of resources.

Risk Matrix

A matrix used during risk assessment to define risk level by considering probability against consequence severity.

Defense-in-Depth

A layered security approach where multiple controls protect information assets.

Threat Modelling

A process to identify potential threats and prioritize countermeasures.

Section 5: Security Laws & Regulations

• PCI DSS: Payment Card Industry Data Security Standard
• ISO 27001: Information security management systems
• HIPAA: Healthcare data protection
• Sarbanes-Oxley Act: Financial record keeping
• DMCA: Digital Millennium Copyright Act
• FISMA 2014: Federal Government cybersecurity practices
• GDPR: EU privacy law with penalties up to €20M or 4% of global revenue
• Data Protection Act 2018: UK's implementation of GDPR