1
00:00:00,020 --> 00:00:01,290
In this section of the course,

2
00:00:01,290 --> 00:00:03,630
we're going to be covering malicious activity.

3
00:00:03,630 --> 00:00:04,860
Now in the digital age,

4
00:00:04,860 --> 00:00:07,289
the threat landscape is constantly evolving with new forms

5
00:00:07,289 --> 00:00:10,440
of malicious activity emerging at an alarming rate.

6
00:00:10,440 --> 00:00:12,990
Cyber attacks are a subset of these activities

7
00:00:12,990 --> 00:00:15,180
and they become a huge concern for individuals,

8
00:00:15,180 --> 00:00:17,130
businesses, and governments alike.

9
00:00:17,130 --> 00:00:19,590
These attacks are not only increasing in frequency,

10
00:00:19,590 --> 00:00:21,690
but they're also increasing in sophistication

11
00:00:21,690 --> 00:00:23,490
and this makes them quite a challenge to us

12
00:00:23,490 --> 00:00:25,230
as cybersecurity professionals.

13
00:00:25,230 --> 00:00:27,240
Now, in this section of the course, we're going to be diving

14
00:00:27,240 --> 00:00:29,190
into the diverse world of cyber attacks

15
00:00:29,190 --> 00:00:31,800
and shedding some light on the various types, mechanisms

16
00:00:31,800 --> 00:00:33,360
and impacts that they have.

17
00:00:33,360 --> 00:00:34,890
We're going to be exploring the breadth and depth

18
00:00:34,890 --> 00:00:37,584
of malicious activities that lurk in the cyber realm.

19
00:00:37,584 --> 00:00:39,180
Now, it's important for you to understand

20
00:00:39,180 --> 00:00:41,460
these cyber threats, because it really is the first step

21
00:00:41,460 --> 00:00:43,650
towards effective prevention and mitigation

22
00:00:43,650 --> 00:00:45,690
for you as a cybersecurity professional.

23
00:00:45,690 --> 00:00:47,880
Now, by gaining insights into the tactics, techniques

24
00:00:47,880 --> 00:00:50,040
and procedures employed by these cyber criminals,

25
00:00:50,040 --> 00:00:52,620
we as cyber defenders can better equip ourself

26
00:00:52,620 --> 00:00:53,760
to protect our networks

27
00:00:53,760 --> 00:00:56,250
against these invisible yet potent threats.

28
00:00:56,250 --> 00:00:58,526
So in this section of the course, we're going to be focused

29
00:00:58,526 --> 00:01:02,640
on Domain 2 and specifically on objective 2.4.

30
00:01:02,640 --> 00:01:05,129
The objective 2.4 states that given a scenario

31
00:01:05,129 --> 00:01:06,810
you must be able to analyze indicators

32
00:01:06,810 --> 00:01:08,280
of malicious activity.

33
00:01:08,280 --> 00:01:10,680
First, we'll be discussing Distributed Denial of Service

34
00:01:10,680 --> 00:01:12,870
attacks known as DDoS attacks.

35
00:01:12,870 --> 00:01:14,130
As we go through this lesson,

36
00:01:14,130 --> 00:01:15,570
we'll be covering all the different variants

37
00:01:15,570 --> 00:01:18,450
of a Denial of Service attack, including Denial of Service,

38
00:01:18,450 --> 00:01:20,550
Amplified Distributed Denial of Service attacks

39
00:01:20,550 --> 00:01:22,890
Reflected Distributed Denial of service attacks

40
00:01:22,890 --> 00:01:24,300
and the ways that we can avoid

41
00:01:24,300 --> 00:01:26,670
or stop these types of attacks from occurring.

42
00:01:26,670 --> 00:01:28,590
Then we'll be jumping into a discussion

43
00:01:28,590 --> 00:01:31,950
on Domain Name Server attacks, known as DNS attacks,

44
00:01:31,950 --> 00:01:34,080
and this includes DNS cache poisoning,

45
00:01:34,080 --> 00:01:36,870
DNS amplification attacks, DNS tunneling,

46
00:01:36,870 --> 00:01:40,350
domain hijacking, and DNS zone transfer attacks.

47
00:01:40,350 --> 00:01:41,700
After that, we'll be talking

48
00:01:41,700 --> 00:01:43,500
about Directory Traversal attacks.

49
00:01:43,500 --> 00:01:45,030
Now a directory traversal attack

50
00:01:45,030 --> 00:01:46,800
also known as a path traversal

51
00:01:46,800 --> 00:01:49,410
involves explaining insufficient security validation

52
00:01:49,410 --> 00:01:52,620
or sanitization of user supplied input file names.

53
00:01:52,620 --> 00:01:55,650
Next, we'll be discussing privilege escalation attacks.

54
00:01:55,650 --> 00:01:57,690
Now, a privilege escalation attack is the type

55
00:01:57,690 --> 00:01:59,640
of network intrusion that involves exploiting

56
00:01:59,640 --> 00:02:01,980
a system vulnerability to gain elevated access

57
00:02:01,980 --> 00:02:03,810
to resources that are normally protected

58
00:02:03,810 --> 00:02:05,790
from an application or user.

59
00:02:05,790 --> 00:02:08,190
Then we'll be discussing replay attacks.

60
00:02:08,190 --> 00:02:10,020
Now, replay attacks involve the malicious

61
00:02:10,020 --> 00:02:13,620
or fraudulent repeat or delay of a valid data transmission.

62
00:02:13,620 --> 00:02:14,850
In this type of an attack,

63
00:02:14,850 --> 00:02:16,740
an attacker intercepts a data transmission

64
00:02:16,740 --> 00:02:18,300
and then retransmits it.

65
00:02:18,300 --> 00:02:21,240
After that, we're going to be looking at session hijacking.

66
00:02:21,240 --> 00:02:24,630
Now session hijacking, also known as session sidejacking,

67
00:02:24,630 --> 00:02:27,720
cookie hijacking, or session key hijacking is a type

68
00:02:27,720 --> 00:02:30,000
of security attack where a user session is taken

69
00:02:30,000 --> 00:02:31,530
over by the attacker.

70
00:02:31,530 --> 00:02:32,790
In this type of attack,

71
00:02:32,790 --> 00:02:35,040
the attacker can exploit a valid computer session

72
00:02:35,040 --> 00:02:36,960
to gain unauthorized access to information

73
00:02:36,960 --> 00:02:39,162
or services inside of a computer system.

74
00:02:39,162 --> 00:02:40,830
Then we're going to be diving

75
00:02:40,830 --> 00:02:42,870
into malicious code injection attacks.

76
00:02:42,870 --> 00:02:45,090
Now, malicious code injection is a broad class

77
00:02:45,090 --> 00:02:47,378
of attacks where an attacker can introduce harmful code

78
00:02:47,378 --> 00:02:49,980
into a programmer system to cause it to behave

79
00:02:49,980 --> 00:02:51,630
in an unintended way.

80
00:02:51,630 --> 00:02:54,420
After that, we'll be covering Indicators of Compromise,

81
00:02:54,420 --> 00:02:56,640
known as IoCs, and this includes things

82
00:02:56,640 --> 00:02:59,550
like account lockouts, concurrent session utilization,

83
00:02:59,550 --> 00:03:02,910
block content, impossible travel, resource consumption,

84
00:03:02,910 --> 00:03:05,700
resource inaccessibility, out of cycle logging,

85
00:03:05,700 --> 00:03:07,410
publish documents that you've been hacked

86
00:03:07,410 --> 00:03:09,030
and missing log files.

87
00:03:09,030 --> 00:03:11,310
Finally, we'll take a short quiz to see what you learned

88
00:03:11,310 --> 00:03:12,570
during this section of the course

89
00:03:12,570 --> 00:03:14,400
and review each of those quiz questions fully

90
00:03:14,400 --> 00:03:16,616
to ensure you can explain why the right answer was right.

91
00:03:16,616 --> 00:03:19,440
So if you're ready, let's hop on into our coverage

92
00:03:19,440 --> 00:03:22,040
of malicious activity in this section of the course.