Skip to content
BoKSA

CYBOK II chapters 6 9 Attacks & Defences

CYBOK II chapters 6 - 9 Attacks & Defences

1. Introduction: Navigating the Landscape of Attacks and Defences

Within the comprehensive Cyber Security Body of Knowledge (CyBOK), the Attacks & Defences cluster represents the technical and operational frontline of the discipline. For a second-year Higher Vocational Education (HBO) student, mastering this cluster is a strategic milestone. It marks the transition from learning how systems should work to understanding how they actually fail under pressure. Building resilient infrastructure is impossible without a granular understanding of the adversary’s toolkit; to defend a network, one must first deconstruct the mechanics of the attack.This guide provides a structured walkthrough of the four core Knowledge Areas (KAs) that define this space:

  1. KA 06: Malware & Attack Technologies – Explores the malicious software ecosystem and the methodologies used to analyze and detect digital threats.
  2. KA 07: Adversarial Behaviours – Shifts the focus to the "who" and "why," characterizing human actors and their operational models.
  3. KA 08: Security Operations & Incident Management (SOIM) – Focuses on the "engine room" of defense: the day-to-day monitoring, analysis, and response workflows.
  4. KA 09: Forensics – Details the scientific rigor required to investigate incidents and derive digital evidence that is legally and technically sound.Together, these chapters move logically from identifying the technical artifacts (malware) and the actors behind them (adversaries) to the professional operations and investigative practices (SOIM and Forensics) required to manage the lifecycle of a cyber attack.

2. CYBOK 06: Malware & Attack Technologies

Context & Strategy

Malware is far more than a collection of "viruses." It is a sophisticated, evolving ecosystem of software engineered for diverse malicious goals, from financial theft to industrial sabotage. As a security specialist, you must move beyond generic definitions. Understanding malware taxonomy is a prerequisite for selecting the appropriate detection and response strategies; if you cannot classify the threat, you cannot effectively neutralize it.

Explanation of Concepts
  • Malware Taxonomy & PUPs: Malware is classified by its propagation behavior and payload. This includes Potentially Unwanted Programs (PUPs) —software that may not be overtly malicious but compromises privacy or system performance, often entering via bundled "freeware."
  • Static vs. Dynamic Analysis:
  • Static Analysis: The process of examining a file’s code or structure without executing it (e.g., disassembly, string analysis, or signature matching).
  • Dynamic Analysis: Observing the software's behavior in real-time while it executes within a controlled, monitored environment.
  • Detection & Evasion: Specialists utilize Virtualised Network Environments to safely execute threats. However, this is a constant "cat-and-mouse" game; adversaries employ Evasion Techniques (anti-analysis) designed to detect if the malware is running in a sandbox, causing it to remain dormant or change its behavior to avoid detection.
Starting Points
  • Consult CyBOK Section 6.3 on "Malware Analysis" for detailed technical methodologies.
  • Explore the MITRE ATT\&CK framework to see how specific malware families map to real-world adversary tactics.
  • Use cloud-based sandboxes like Any.Run to practice interactive malware hunting and observe process execution in real-time.
Points of Attention (Quality Check)
  • Safety/Isolation: Is the analysis host completely isolated from the production network (e.g., using host-only networking or air-gapping)?
  • Anti-Analysis Triggers: Have you checked for "dormant" behavior? Malware may wait for specific user interactions or system dates to bypass sandboxes.
  • Attribution Limits: Remember that code reuse is common. Does your analysis distinguish between the malware's capabilities and the identity of the actor?Connective Tissue: While malware represents the "weapon," it does not operate in a vacuum. Behind every malicious binary is a human actor with specific motivations and operational constraints.

3. CYBOK 07: Adversarial Behaviours

Context & Strategy

Cyber security is ultimately a "human versus human" game played through a technical medium. By understanding the behavioral side of attacks, you shift from a reactive posture (patching vulnerabilities) to a proactive one (modeling threats). Knowing your adversary allows you to anticipate their moves based on their resources, risk tolerance, and ultimate objectives.

Explanation of Concepts
  • Characterisation of Adversaries: Actors range from "script kiddies" (opportunistic, low-skill) to state-sponsored Advanced Persistent Threats (APTs) (highly resourced, focused, and patient).
  • Elements of a Malicious Operation: Attacks are rarely isolated events. They are campaigns involving multiple phases, from infrastructure setup to the eventual achievement of the objective (e.g., data exfiltration).
  • Models of Malicious Operations: Specialized frameworks help us visualize these behaviors. The Cyber Kill Chain focuses on the linear stages of an intrusion, while the Diamond Model maps the relationship between four core features: adversary, infrastructure, capability, and victim. This socio-technical context helps explain why certain actors choose specific targets.
Starting Points
  • Review the Diamond Model of Intrusion Analysis to understand how to link infrastructure to actor capabilities.
  • Analyze high-profile breach reports from firms like Mandiant or CrowdStrike to identify the behavioral signatures of different threat groups.
Points of Attention (Quality Check)
  • Motivation: Is the goal clearly identified? (e.g., Is this financial theft, political espionage, or a "hacktivist" protest?)
  • Capability Alignment: Are the tools used consistent with the suspected actor's resources?
  • Environmental Factors: Does the profile account for how the adversary’s environment (e.g., lack of extradition, state support) influences their behavior?Connective Tissue: Once we understand the adversary’s intent and behavior, we must build the "Security Operations" required to monitor their presence and disrupt their activities.

4. CYBOK 08: Security Operations & Incident Management (SOIM)

Context & Strategy

SOIM is the "engine room" of cyber security. It is the operational hub where data, technology, and human expertise meet to maintain the organization's secure state. In the HBO context, this is where theory becomes practice: managing the "Monitor-Analyse-Plan-Execute-Knowledge" (MAPE-K) workflow.

Explanation of Concepts
  • The MAPE-K Workflow: Effective operations follow the structured cycle defined in CyBOK Sections 8.2 through 8.6:
  • Monitor (8.2): Collecting data from diverse sources (Netflow, logs, IDS).
  • Analyse (8.3): Processing data to identify threats.
  • Plan (8.4): Using SIEM tools to correlate alerts and prioritize response.
  • Execute (8.5): Implementing mitigations and countermeasures.
  • Knowledge (8.6): Managing threat intelligence to improve future cycles.
  • SIEM vs. SOAR: SIEM (Security Information and Event Management) aggregates and correlates logs to find patterns. SOAR (Security Orchestration, Automation and Response) automates the response actions, reducing the time between detection and mitigation.
  • Detection Logic: Misuse Detection looks for specific known-bad patterns (signatures), whereas Anomaly Detection identifies deviations from a baseline of "normal" behavior.
Starting Points
  • Investigate the CyBOK section on "Alert Correlation" to understand how to reduce noise in a Security Operations Center (SOC).
  • Experiment with open-source tools like the ELK Stack (Elasticsearch, Logstash, Kibana) for log monitoring or TheHive for incident case management.
Points of Attention (Quality Check)

SOIM Quality Indicator,Effective Operations,Weak Operations
Alert Tuning,Low false-positive rate; focus on high-fidelity alerts.,High alert fatigue; analysts ignore repetitive warnings.
Response Process,Documented playbooks and clear escalation paths.,"Ad-hoc, unrecorded responses (""firefighting"")."
Analytical Context,"Accounts for the Base-rate Fallacy (The tendency to ignore the low probability of an attack when interpreting alerts, leading to frequent false positives).",Analyzes events in total isolation without environmental context.
Connective Tissue: Even the best operations can be bypassed. When an incident occurs, "Forensics" is the discipline used to look back in time and reconstruct the truth.

5. CYBOK 09: Forensics

Context & Strategy

Digital forensics is the scientific application of cyber security to legal and investigative problems. It is the meticulous process of turning digital "artifacts"—volatile memory, disk fragments, or cloud logs—into admissible evidence. It requires a mindset shift from stopping an attack to proving exactly what happened.

Explanation of Concepts
  • The Cognitive Task Model: Investigation is not a linear checklist but a series of loops:
  • The Foraging Loop (9.1.3.4): Searching for and extracting raw data and artifacts.
  • The Sense-making Loop (9.1.3.5): Interpreting those artifacts to build a coherent narrative of the incident.
  • Forensic Domains:
  • Storage Forensics: Recovery of data from physical disks, including file carving.
  • Memory Forensics: Capturing volatile data from RAM (e.g., active encryption keys or running processes).
  • Cloud Forensics: Investigating data across distributed, virtualized environments where physical access is impossible.
  • Legal Standards: Investigators must adhere to the Daubert Standard to ensure their scientific methods are valid. Maintaining a rigorous Chain of Custody is mandatory to prove the evidence has not been tampered with.
Starting Points
  • Explore the NIST Computer Forensics Tool Testing (CFTT) project to understand how forensic tools are validated for reliability.
  • Practice "file carving" on sample disk images using tools like Autopsy to recover deleted files based on headers and footers.
Points of Attention (Quality Check)
  • Repeatability: Could another investigator follow your documentation and achieve the exact same result?
  • Integrity of Evidence: Was a physical or software-based write-blocker used during data acquisition to prevent any modification of the original media? (CyBOK 9.2.2).
  • Documentation: Is there a clear distinction in your report between the raw data (fact) and your interpretation of that data (opinion)?Connective Tissue: These four areas—Malware, Adversaries, Operations, and Forensics—provide the 360-degree view required to navigate the modern "Attacks & Defences" landscape.

6. Advanced Notes (For 3rd & 4th Year Students)

  • Concolic Execution: A hybrid approach used in malware analysis that combines concrete execution (testing with real values) and symbolic execution (treating inputs as mathematical variables) to explore all possible execution paths within a program.
  • Hyperproperties: While most security properties are "trace properties" (what happens in one run), hyperproperties define security across sets of execution traces, allowing for the formal definition of complex concepts like non-interference.
  • Machine Learning Evasion: As SOIM moves toward ML-based analytics, be aware of "adversarial examples"—malicious inputs specifically crafted to trick machine learning models into misclassifying a threat as benign traffic.

7. Conclusion: The Socio-Technical Imperative

For a 2nd-year HBO student, the "Attacks & Defences" cluster is more than a technical requirement; it is the foundation of your professional identity. This guide illustrates that security is inherently socio-technical. Malware is a human creation (KA 06), utilized by actors with human motives (KA 07), managed by human-led operations (KA 08), and scrutinized within human legal systems (KA 09).Your role in the cyber security world is to act as the bridge between technical defense and organizational resilience. By mastering these four knowledge areas, you move beyond being a "user of tools" to becoming a specialist capable of navigating the complex reality of modern digital conflict.