Course 46 - CompTIA Cybersecurity Analyst | Episode 1: Fundamentals, Risk & the CIA Triad

Cybersecurity Threat Management: Reconnaissance, the CIA Triad, and Risk FundamentalsEpisode OverviewThis episode introduces the foundational concepts of cybersecurity threat management associated with CySA+ Domain 1.The lesson begins with threat identification and reconnaissance, examining how security professionals collect information about systems, organizations, and potential attack surfaces through active and passive open-source intelligence (OSINT) techniques.From there, the episode moves into the CIA Triad, one of the fundamental models used to understand information security: Confidentiality, Integrity, and Availability.Finally, we establish the foundation for cybersecurity risk analysis by examining the relationship between assets, vulnerabilities, and threats. Understanding these three elements provides the basis for identifying risk, prioritizing security controls, and determining where defensive resources should be applied.1. Understanding Cybersecurity Threat ManagementEffective security begins with understanding what must be protected and what could potentially threaten it.Threat management involves identifying and analyzing:- Potential threats.- Vulnerabilities.- Valuable organizational assets.- Existing security controls.- Attack surfaces.- Potential consequences of security incidents.Rather than treating cybersecurity as a collection of isolated tools, this approach establishes a structured process for understanding the environment before determining how it should be protected.2. Threat Identification and ReconnaissanceA security team needs visibility into the environment before it can effectively assess threats.Reconnaissance is the process of gathering information that can help establish an understanding of a target environment.This can include information about:- Network infrastructure.- Internet-facing systems.- Domain names.- Public services.- Technologies in use.- Employees and organizational structures.- Potential attack surfaces.Reconnaissance can be divided broadly into two categories: passive and active.3. Passive Open-Source IntelligencePassive reconnaissance gathers information without directly interacting with the target systems in a way that would normally generate direct network activity against them.Security professionals may examine publicly available information such as:- Public websites.- DNS information.- Search engine results.- Public documentation.- Certificate information.- Job postings.- Publicly exposed technical information.- Other legitimate OSINT sources.The objective is to build an understanding of the organization's external footprint while minimizing direct interaction with the target environment.4. Active ReconnaissanceActive reconnaissance involves directly interacting with systems or network infrastructure to gather additional information.Examples can include authorized:- Network scanning.- Service discovery.- Port identification.- Host enumeration.- Banner collection.- Connectivity testing.Because active reconnaissance generates traffic, it can be detected by firewalls, intrusion detection systems, security monitoring platforms, and other defensive technologies.For professional security assessments, active reconnaissance should therefore be conducted only within an authorized scope and according to defined testing rules.5. Evaluating Network Security ControlsThreat management also requires understanding how defensive controls protect different parts of the infrastructure.Network infrastructure can include:- Routers.- Switches.- Firewalls.- Wireless infrastructure.- Network security appliances.Endpoints can include:- Servers.- Desktop computers.- Laptops.- Smartphones.- Other connected devices.Security professionals evaluate whether appropriate controls exist across these different layers and whether those controls adequately address the organization's identified risks.6. The CIA TriadThe CIA Triad provides one of the most fundamental frameworks for understanding information security.It consists of:Confidentiality → Integrity → AvailabilityEach component addresses a different security objective.7. ConfidentialityConfidentiality ensures that sensitive information is accessible only to authorized individuals, systems, or processes.Common confidentiality controls include:- Encryption.- Password-based authentication.- Access contr