cybersecurity-analyst

What this skill does

# Cybersecurity Analyst Skill

## Purpose

Analyze events through the disciplinary lens of cybersecurity, applying rigorous security frameworks (CIA triad, defense-in-depth, zero-trust), threat modeling methodologies (STRIDE, PASTA, VAST), attack surface analysis, and industry standards (NIST, ISO 27001, MITRE ATT&CK) to understand security risks, identify vulnerabilities, assess threat actors and attack vectors, evaluate defensive controls, and recommend risk mitigation strategies.

## When to Use This Skill

- **Security Incident Analysis**: Investigate breaches, data leaks, ransomware attacks, insider threats
- **Vulnerability Assessment**: Identify weaknesses in systems, applications, networks, processes
- **Threat Modeling**: Analyze potential attack vectors and threat actors for new systems or changes
- **Security Architecture Review**: Evaluate design decisions for security implications and gaps
- **Risk Assessment**: Quantify and prioritize security risks using frameworks like CVSS, FAIR
- **Compliance Analysis**: Assess adherence to security standards (SOC 2, PCI-DSS, HIPAA, GDPR)
- **Incident Response Planning**: Design detection, containment, eradication, and recovery strategies
- **Security Posture Evaluation**: Assess overall defensive capabilities and maturity
- **Code Security Review**: Identify security vulnerabilities in software implementations

## Core Philosophy: Security Thinking

Cybersecurity analysis rests on fundamental principles:

**Defense in Depth**: No single security control is perfect. Layer multiple independent controls so compromise of one doesn't compromise the whole system.

**Assume Breach**: Modern security assumes attackers will penetrate perimeter defenses. Design systems to minimize damage and enable detection when (not if) breach occurs.

**Least Privilege**: Grant minimum access necessary for legitimate function. Every excess permission is an opportunity for exploitation.

**Zero Trust**: Never trust, always verify. Verify explicitly, use least privilege access, and assume breach regardless of network location.

**Security by Design**: Security cannot be bolted on afterward. It must be fundamental to architecture and implementation from the beginning.

**CIA Triad**: Security protects three properties—Confidentiality (only authorized access), Integrity (only authorized modification), Availability (accessible when needed).

**Threat-Informed Defense**: Base defensive priorities on understanding of actual threat actors, their capabilities, motivations, and tactics (threat intelligence).

**Risk-Based Approach**: Perfect security is impossible. Prioritize security investments based on risk (likelihood × impact) to maximize security per dollar spent.

---

## Theoretical Foundations (Expandable)

### Foundation 1: CIA Triad (Classic Security Model)

**Components**:

**Confidentiality**: Information accessible only to authorized entities

- Protection mechanisms: Encryption, access controls, authentication
- Threats: Eavesdropping, data theft, unauthorized disclosure
- Example violations: Data breach, password theft, insider leak

**Integrity**: Information modifiable only by authorized entities in authorized ways

- Protection mechanisms: Hashing, digital signatures, access controls, version control
- Threats: Tampering, unauthorized modification, malware
- Example violations: Database manipulation, man-in-the-middle attacks, ransomware encryption

**Availability**: Information and systems accessible when needed by authorized entities

- Protection mechanisms: Redundancy, backups, DDoS mitigation, incident response
- Threats: Denial of service, ransomware, system destruction
- Example violations: DDoS attacks, ransomware, infrastructure failures

**Extensions**:

- **Authenticity**: Verified identity of entities and origin of information
- **Non-repudiation**: Cannot deny taking action
- **Accountability**: Actions traceable to entities

**Application**: Every security analysis should identify which aspects of CIA triad are at risk and how controls protect each.

**Sources**:

- [CIA Triad - Wikipedia](https://en.wikipedia.org/wiki/Information_security#Key_concepts)
- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)

### Foundation 2: Defense in Depth (Layered Security)

**Principle**: Deploy multiple layers of security controls so compromise of one layer doesn't compromise entire system.

**Historical Origin**: Military defensive strategy—multiple concentric perimeter defenses

**Security Layers**:

1. **Physical**: Facility access controls, locked server rooms
2. **Network**: Firewalls, network segmentation, IDS/IPS
3. **Host**: Endpoint protection, host firewalls, patch management
4. **Application**: Input validation, secure coding, authentication
5. **Data**: Encryption at rest and in transit, DLP, tokenization
6. **Human**: Security awareness training, phishing simulation

**Key Insight**: Redundancy is not waste—it's resilience. Even if attacker bypasses firewall, they still face authentication, authorization, monitoring, encryption, and detection controls.

**Application**: Security architecture should have multiple independent defensive layers protecting critical assets.

**Limitation**: Can create complexity and false sense of security if layers are not maintained or are interdependent.

**Sources**:

- [Defense in Depth - NSA](https://www.nsa.gov/Press-Room/Cybersecurity-Advisories-Guidance/)
- [Layered Security - CISA](https://www.cisa.gov/topics/cybersecurity-best-practices)

### Foundation 3: Zero Trust Architecture

**Core Principle**: "Never trust, always verify" regardless of network location

**Contrast with Perimeter Model**: Traditional security assumed internal network is trusted ("castle and moat"). Zero trust assumes no network location is trusted.

**Key Tenets** (NIST SP 800-207):

1. **Verify explicitly**: Always authenticate and authorize based on all available data points
2. **Least privilege access**: Limit user access with Just-In-Time and Just-Enough-Access
3. **Assume breach**: Minimize blast radius and segment access; verify end-to-end encryption

**Components**:

- **Identity-centric security**: Identity becomes new perimeter
- **Micro-segmentation**: Network divided into small zones with separate controls
- **Continuous verification**: Authentication and authorization are continuous, not one-time
- **Data-centric**: Protect data itself, not just perimeter around it

**Drivers**:

- Cloud adoption (no clear perimeter)
- Remote work (users outside traditional perimeter)
- Sophisticated attacks (perimeter breaches common)

**Application**: Modern security architectures should be designed with zero trust principles, especially for cloud and hybrid environments.

**Sources**:

- [NIST SP 800-207: Zero Trust Architecture](https://csrc.nist.gov/publications/detail/sp/800-207/final)
- [Zero Trust - Microsoft Security](https://www.microsoft.com/en-us/security/business/zero-trust)

### Foundation 4: Threat Modeling

**Definition**: Structured approach to identify and prioritize potential threats to a system

**Purpose**: Proactively identify security issues during design phase when fixes are cheapest

**Benefits**:

- Find vulnerabilities before implementation
- Prioritize security work
- Communicate risks to stakeholders
- Guide security testing

**Common Methodologies**:

**STRIDE** (Microsoft):

- **S**poofing identity
- **T**ampering with data
- **R**epudiation
- **I**nformation disclosure
- **D**enial of service
- **E**levation of privilege

**PASTA** (Process for Attack Simulation and Threat Analysis):

- Seven-stage risk-centric methodology
- Aligns business objectives with technical requirements

**VAST** (Visual, Agile, and Simple Threat modeling):

- Scalable for agile development
- Two types: application threat models and operational threat models

**Application**: Use threat modeling for new features, architecture changes, or security reviews.

**Sources*