Cyber Wiki Learning Path
Cybersecurity Foundations
Build the vocabulary and mental models needed to understand systems, risk, controls, attacks, and resilience.
Recommended Sequence
80 connected entries
802.1X Network Access Control
802.1X Network Access Control is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
AI audit · AdvancedAI Audit Hallucination Controls
AI audit hallucination controls prevent unsupported generated statements from being treated as evidence, criteria, citations, calculations, or conclusions.
AI assurance · AdvancedAI Control Design Effectiveness
AI control design effectiveness asks whether a control, as documented and configured, is capable of preventing, detecting, or correcting the risk it was selected to address.
AI controls · AdvancedAI Control Monitoring
AI control monitoring observes whether preventive, detective, and corrective controls remain active, correctly configured, sufficiently covered, and effective as systems change.
AI assurance · AdvancedAI Control Operating Effectiveness
AI control operating effectiveness evaluates whether an appropriately designed control performed consistently, by the right people or automation, throughout the period under review.
AI resilience · AdvancedAI Deactivation and Contingency Controls
AI deactivation and contingency controls let an organization pause, limit, localize, roll back, or replace an AI capability when risk exceeds tolerance.
Third-party AI risk · IntermediateAI Procurement and Contract Controls
AI procurement and contract controls convert governance, security, privacy, performance, audit, incident, and exit requirements into enforceable supplier obligations.
AI legal governance · AdvancedAI Regulatory Role Mapping
AI regulatory role mapping identifies whether an organization acts as a provider, deployer, importer, distributor, user, controller, processor, or another regulated actor for each system.
AI application security · IntermediateAI Secrets Management
AI secrets management protects API keys, tokens, certificates, and credentials used by models, agents, pipelines, and tools.
AI architecture · AdvancedAI Shared-Responsibility Mapping
AI shared-responsibility mapping assigns control duties across model providers, cloud platforms, application teams, data owners, users, and oversight functions.
AI risk management · IntermediateAI Use-Case Intake Governance
AI use-case intake governance creates a controlled entry point where proposed AI uses are identified, classified, owned, and screened before procurement or development proceeds.
AI third-party risk · AdvancedAI Vendor Change Notification
AI vendor change notification requires providers to disclose material changes that could alter risk, performance, data handling, compliance, or system behavior.
AI third-party risk · AdvancedAI Vendor Control Monitoring
AI vendor control monitoring evaluates whether a provider continues to meet security, privacy, resilience, transparency, and notification commitments after onboarding.
Authorization · IntermediateAccess Control Lists on Hosts
Host access control lists extend basic owner-group-other permissions with named user and group entries, default inheritance, and more precise authorization for shared files and directories.
Defensive operations concept · AdvancedActive Defense
Active defense uses authorized, bounded techniques that increase visibility, constrain adversary freedom, and create response opportunities without abandoning legal, safety, or governance controls.
Systems security concept · IntermediateActive Directory Fundamentals
Active Directory Fundamentals concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Network security concept · BeginnerAddress Resolution Protocol (ARP)
Address Resolution Protocol (ARP) describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Validation practice · AdvancedAdversary Emulation for SOC Validation
Adversary emulation for SOC validation reproduces selected threat behaviors under controlled conditions to test people, telemetry, analytics, workflows, and decision authority end to end.
Execution control · IntermediateApplication Allowlisting
Application allowlisting permits only approved executables, scripts, libraries, installers, or other code to run under defined rules.
Threat terminology · FoundationalAttack Vectors
An attack vector is the route, method, or mechanism an adversary uses to reach a target and attempt an unauthorized action.
Access control model · IntermediateAttribute-Based Access Control
Attribute-based access control evaluates characteristics of the subject, resource, action, and environment to make a contextual access decision.
Secure automation · AdvancedAutomation Blast-Radius Control
Automation blast-radius control limits the systems, accounts, data, regions, and actions a script, pipeline, agent, or remediation job can affect.
Routing security · AdvancedBGP Route Security
BGP route security applies policy, filtering, validation, monitoring, and operational discipline to reduce accidental or malicious route announcements.
Framework mapping practice · IntermediateCIS Controls Crosswalks
CIS Controls crosswalks map safeguards to requirements or outcomes in other frameworks so organizations can reuse evidence and understand overlapping intent.
Control prioritization model · IntermediateCIS Controls Implementation Groups
CIS Controls Implementation Groups organize safeguards into prioritized sets that reflect organizational resources, complexity, data sensitivity, and threat exposure.
Control framework · IntermediateCIS Critical Security Controls
The CIS Controls provide a prioritized set of safeguards that organizations can use to improve defensive capability and reduce common attack paths.
Security control guidance · IntermediateCIS Safeguards
CIS Safeguards are specific, actionable practices organized under the CIS Critical Security Controls and prioritized through Implementation Groups.
Change management · AdvancedChange Automation Evidence
Change automation evidence records what an automated change intended, who authorized it, what code and inputs ran, which targets changed, and whether outcomes matched the plan.
Governance practice · AdvancedCloud AI Services Governance
Cloud AI services governance controls how managed machine-learning, generative AI, language, vision, and decision services are selected, configured, and used.
Application architecture · AdvancedCloud API Management
Cloud API management publishes, secures, observes, versions, and governs interfaces used by applications, partners, and services.
Assurance practice · AdvancedCloud Audit Evidence
Cloud audit evidence demonstrates how cloud controls are designed and operating through configuration, logs, assessments, access reviews, provider reports, tickets, approvals, and automated test results.
Assurance practice · AdvancedCloud Compliance and Assurance
Cloud compliance and assurance map obligations to provider, customer, and shared controls and collect evidence that those controls are designed and operating effectively.
Technology model · BeginnerCloud Computing
Cloud computing delivers configurable computing resources as on-demand services over a network, with rapid provisioning, measured use, and shared provider infrastructure.
Security architecture · AdvancedCloud Control Plane Security
The cloud control plane contains the APIs, consoles, identities, and orchestration functions used to create and change cloud resources.
Audit control · IntermediateCloud Control-Plane Logging
Cloud control-plane logging records administrative and API actions that create, change, or delete cloud resources and policies.
Availability control · IntermediateCloud DDoS Protection
Cloud distributed-denial-of-service protection combines provider-scale network defenses, traffic filtering, rate controls, resilient architecture, and response procedures.
Architecture and data-protection practice · AdvancedCloud Data-Plane Security
Cloud data-plane security protects the operations that read, write, process, transmit, and delete workload and business data after cloud resources have been configured.
Cloud service concept · IntermediateCloud Database Services
Cloud database services provide relational, key-value, document, graph, cache, and other data models with varying levels of provider management.
Cloud service concept · IntermediateCloud Edge Services and Content Delivery
Cloud edge services place content, acceleration, routing, filtering, or application functions closer to users and devices.
Network security control · AdvancedCloud Egress Control
Cloud egress control limits and monitors outbound communication from workloads, users, and services to reduce exfiltration, command-and-control, and unauthorized dependency risk.
Resilience and supplier-management practice · AdvancedCloud Exit Planning
Cloud exit planning defines how an organization can move, replace, or retire cloud services while preserving data, evidence, continuity, security, and legal obligations.
Preventive and detective control · IntermediateCloud Guardrails
Cloud guardrails are centrally defined controls that prevent, constrain, detect, or remediate unsafe configurations while allowing teams to work within approved boundaries.
Architecture practice · IntermediateCloud High Availability
Cloud high availability uses redundant components, failure isolation, health detection, and automated recovery to keep a service accessible despite expected faults.
Network architecture · AdvancedCloud Hybrid Connectivity
Hybrid connectivity joins cloud environments with data centers, offices, edge locations, or other providers through VPNs, dedicated links, and routing services.
Cloud security practice · IntermediateCloud Identity and Access Management
Cloud identity and access management governs human and workload access to provider consoles, APIs, resources, data, secrets, and administrative functions.
Cloud workload security practice · AdvancedCloud Instance Metadata Security
Cloud instance metadata security protects workload identity and configuration services that can expose temporary credentials or sensitive context to code running on a compute resource.
Hybrid connectivity · AdvancedCloud Interconnect Security
Cloud interconnect security protects dedicated and virtual connectivity between enterprise networks, cloud providers, exchanges, and software-defined interconnection services.
Cryptographic control · IntermediateCloud Key Management
Cloud key management governs the creation, storage, protection, use, rotation, recovery, and destruction of cryptographic keys used by cloud services and workloads.
Platform architecture · IntermediateCloud Landing Zones
A cloud landing zone is a governed foundation for accounts or subscriptions, identity, networking, logging, policy, security services, and workload onboarding.
Network architecture · IntermediateCloud Networking with VPCs and VNets
Virtual private clouds and virtual networks create logically isolated address spaces, subnets, routes, interfaces, and gateways inside cloud environments.
Operating model · AdvancedCloud Operating Model
A cloud operating model defines how teams make decisions, provide platforms, govern risk, manage cost, operate services, and improve capabilities in a cloud environment.
Reliability practice · AdvancedCloud Reliability and Fault Domains
Cloud reliability engineering identifies failure modes and distributes components across independent fault domains so services can continue or recover within defined objectives.
Operational capability · IntermediateCloud Resilience
Cloud resilience is the ability to prepare for, withstand, recover from, and adapt to disruption while preserving important services and acceptable outcomes.
Network control · IntermediateCloud Security Groups and Network ACLs
Security groups, firewall rules, and network access-control lists restrict traffic at resource, subnet, or network boundaries.
Operational concept · IntermediateCloud Service Quotas and Capacity
Cloud service quotas limit the number, rate, size, or regional availability of resources and API operations.
Cloud concept · BeginnerCloud Service and Deployment Models
Cloud service models describe which layers a provider manages, while deployment models describe how cloud resources are owned, shared, and connected.
Contract and service concept · IntermediateCloud Service-Level Agreements
A cloud service-level agreement defines provider commitments and remedies for specified aspects of service availability or performance.
Reliability practice · IntermediateCloud Service-Level Objectives
Service-level objectives define measurable reliability targets for a service, such as availability, latency, durability, or successful request rate.
Network concept · IntermediateCloud Subnets, Routes, and Gateways
Cloud subnets divide address space, route tables determine forwarding, and gateways connect workloads to other networks or provider services.
Identity control · IntermediateCloud Workload Identities
Cloud workload identities let applications, services, virtual machines, containers, and automation authenticate without sharing human accounts or embedding permanent secrets.
Threat and attack concept · IntermediateCommand and Control Channels
Command and Control Channels is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Detection practice · IntermediateCommand and Control Detection
Command and control detection identifies the channels, timing patterns, protocol misuse, infrastructure, and host behavior used to direct compromised systems.
Control allocation concept · AdvancedCommon, Inherited, and System-Specific Controls
Common controls support multiple systems, inherited controls are received from another provider or environment, and system-specific controls are implemented for one system.
Control selection practice · AdvancedControl Baselines and Tailoring
A control baseline is a starting set of safeguards selected for a defined impact or risk context; tailoring adjusts that set to the system, organization, threats, and applicable requirements.
Network security concept · BeginnerDNS Resolution Process
DNS Resolution Process describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Third-party privacy · AdvancedData Processing Agreement Controls
Data processing agreement controls translate privacy obligations into enforceable purpose, instruction, security, rights, retention, transfer, incident, audit, and exit requirements.
Service management · IntermediateFour Dimensions of Service Management
The four dimensions provide a balanced view of organizations and people, information and technology, partners and suppliers, and value streams and processes.
Network security concept · BeginnerInternet Control Message Protocol (ICMP)
Internet Control Message Protocol (ICMP) describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Secure design principle · FoundationalLeast Functionality
Least functionality limits systems to the services, features, protocols, software, accounts, and permissions required for their intended purpose.
Networking foundation · FoundationalMAC Addresses
A media access control address is a link-layer identifier used by network interfaces and local network technologies to deliver frames within a broadcast domain.
Access control · IntermediateNetwork Access Control
Network access control evaluates who or what is connecting and applies an access decision based on identity, device posture, location, role, and policy.
Operational technology monitoring · AdvancedOT Network Monitoring Baselines
OT network monitoring baselines describe expected devices, peers, protocols, commands, direction, timing, volume, and maintenance behavior so meaningful deviations can be investigated.
Operational technology resilience · AdvancedOT Recovery and Process Safety
OT recovery restores trustworthy control, visibility, configuration, data, and operations in a sequence that protects people, environment, equipment, and process stability.
Systems security concept · IntermediateOperating System Fundamentals
Operating System Fundamentals concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Network reference · BeginnerPorts and Protocols
Ports help identify application services at transport endpoints, while protocols define the rules systems use to exchange information.
Systems security concept · IntermediateProcesses, Services, and Daemons
Processes, Services, and Daemons is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Project governance · IntermediateProject Change Control
Project change control evaluates, authorizes, communicates, implements, verifies, and records proposed changes to scope, schedule, cost, quality, security, or operational configuration.
Project management · IntermediateProject Change Control and Approval
Project change control evaluates proposed changes, their combined effects, available options, authority, and implementation conditions before baselines are modified.
Project management · IntermediateSchedule Baseline Control
Schedule baseline control establishes an approved timing model and uses progress, dependencies, forecasts, and authorized changes to keep delivery expectations credible.
Third-party privacy · IntermediateVendor Privacy Due Diligence
Vendor privacy due diligence evaluates whether a provider’s processing, controls, governance, history, and supply chain are appropriate for the intended data and service risk.