Cyber Wiki Topic 03
Systems, Endpoints & Infrastructure
Operating systems, endpoints, servers, platforms, hardening, administration, and infrastructure resilience.
Topic Directory
115 entries
Active Directory Fundamentals
Active Directory Fundamentals concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
ATT&CK mitigation profile · IntermediateAntivirus/Antimalware (M1049)
Use maintained antimalware capabilities to prevent, detect, quarantine, and investigate malicious code and known harmful artifacts. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Mandatory access control · IntermediateAppArmor Profile Enforcement
AppArmor profile enforcement confines programs with path-oriented rules that describe the files, capabilities, networking, and execution behavior each application is permitted to use.
Execution control · IntermediateApplication Allowlisting
Application allowlisting permits only approved executables, scripts, libraries, installers, or other code to run under defined rules.
Asset management practice · BeginnerAsset Inventory
An asset inventory is an authoritative record of the hardware, software, services, cloud resources, data stores, operational technology, and other components the organization must manage and protect.
Asset assurance practice · IntermediateAsset Inventory Quality
Asset inventory quality evaluates completeness, accuracy, freshness, ownership, classification, and reconciliation across the systems that produce inventory data.
NIST CSF Subcategory profile · IntermediateAsset Life-Cycle Management (ID.AM-08) — NIST CSF 2.0 Subcategory
Apply ID.AM-08 to achieve this CSF 2.0 outcome: Systems, hardware, software, services, and data are managed throughout their life cycles.
NIST CSF Category profile · IntermediateAsset Management (ID.AM) — NIST CSF 2.0 Category
Use ID.AM to manage inventory, ownership, dependency, prioritization, data awareness, and life-cycle management within the Identify Function.
NIST CSF Subcategory profile · IntermediateAsset Prioritization (ID.AM-05) — NIST CSF 2.0 Subcategory
Apply ID.AM-05 to achieve this CSF 2.0 outcome: Assets are prioritized based on classification, criticality, resources, and impact on the mission.
Systems security concept · IntermediateBIOS and UEFI Security
BIOS and UEFI Security concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Recovery protection practice · AdvancedBackup Isolation and Immutability
Backup isolation and immutability reduce the chance that compromised production identities, systems, or administrators can alter or destroy recovery data.
Resilience practice · BeginnerBackup and Recovery Strategies
Backup and recovery strategies preserve usable copies of data and system state so services can be restored after failure, error, corruption, or attack.
Provisioning security · IntermediateBare-Metal Provisioning Security
Bare-metal provisioning security protects installation media, firmware settings, deployment networks, bootstrap credentials, hardware identity, and the first configuration applied to a physical server.
ATT&CK mitigation profile · IntermediateBehavior Prevention on Endpoint (M1040)
Prevent high-risk endpoint behavior by evaluating process, script, memory, file, and system activity rather than relying only on known signatures. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
ATT&CK mitigation profile · IntermediateBoot Integrity (M1046)
Protect the chain of trust from firmware through operating-system startup so unauthorized boot components are blocked or exposed. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Configuration management · AdvancedConfiguration Baseline Enforcement
Configuration baseline enforcement ensures systems remain within approved security and operational settings or have documented, time-bounded exceptions.
Configuration assurance practice · IntermediateConfiguration Compliance Validation
Configuration compliance validation compares live settings against approved baselines and verifies that findings are corrected or explicitly accepted.
Configuration management · AdvancedConfiguration Drift Remediation
Configuration drift remediation detects differences from approved baselines, determines cause and risk, and restores or formally accepts the intended state.
Asset-management practice · IntermediateContinuous Asset Discovery
Continuous asset discovery uses multiple authoritative and observed sources to identify devices, cloud resources, virtual systems, and other enterprise assets as they appear and change.
ATT&CK mitigation profile · IntermediateData Backup (M1053)
Maintain recoverable copies of critical data and configurations that remain available after deletion, corruption, ransomware, or operational failure. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
NIST CSF Subcategory profile · IntermediateData and Metadata Inventories (ID.AM-07) — NIST CSF 2.0 Subcategory
Apply ID.AM-07 to achieve this CSF 2.0 outcome: Inventories of data and corresponding metadata for designated data types are maintained.
Physical security · IntermediateData-Center Physical Security
Data-center physical security layers site boundaries, controlled entry, surveillance, visitor handling, equipment protection, media controls, and emergency procedures around critical infrastructure.
Database resilience · IntermediateDatabase Backup Verification
Database backup verification confirms that backup files are complete, readable, protected, and capable of restoring the intended database state.
Database security · IntermediateDatabase Configuration Hardening
Database configuration hardening reduces unnecessary functions, insecure defaults, exposed interfaces, weak authentication, and excessive privileges in a database platform.
Database resilience · AdvancedDatabase Point-in-Time Recovery
Point-in-time recovery combines a consistent base backup with ordered transaction logs so a database can be restored to a selected moment before an error or attack.
ATT&CK mitigation profile · IntermediateDisable or Remove Feature or Program (M1042)
Reduce attack surface by removing or disabling software, services, interpreters, protocols, and features that are not required. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Messaging security practice · IntermediateEmail Security Controls
Email security controls combine authentication, filtering, attachment and link analysis, impersonation protection, account security, user reporting, and response workflows.
Systems security concept · IntermediateEndpoint Application Control
Endpoint Application Control concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Detection platform · IntermediateEndpoint Detection and Response
Endpoint detection and response collects endpoint activity, identifies suspicious behavior, supports investigation, and provides response actions such as isolation or process termination.
Security practice · BeginnerEndpoint Hardening
Endpoint hardening reduces unnecessary exposure on workstations, laptops, servers, and mobile devices through secure configuration and controlled functionality.
Operational technology security · AdvancedEngineering Workstation Hardening
Engineering workstation hardening protects systems that configure controllers, logic, firmware, safety parameters, and other high-impact OT assets.
ATT&CK mitigation profile · IntermediateEnvironment Variable Permissions (M1039)
Prevent unauthorized users and processes from changing environment variables that influence execution, search paths, libraries, credentials, or application behavior. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
ATT&CK mitigation profile · IntermediateExecution Prevention (M1038)
Block unapproved code, scripts, macros, binaries, and interpreters from executing in contexts where they are not required. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
ATT&CK mitigation profile · IntermediateExploit Protection (M1050)
Use platform and application protections that make vulnerability exploitation less reliable or prevent common exploit behaviors. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
System security concept · BeginnerFile Systems and Permissions
File systems organize stored data and enforce permissions that determine who can read, write, execute, modify, or delete files and directories.
Filesystem security · IntermediateFilesystem Mount Hardening
Filesystem mount hardening uses mount boundaries and options to reduce executable content, device access, privilege transitions, and unsafe write behavior on selected filesystems.
Platform security practice · AdvancedFirmware Security
Firmware security protects the low-level code and configuration that initialize and control hardware through trusted update, integrity verification, access control, inventory, monitoring, and recovery.
Image security · IntermediateGolden Image Security
Golden image security establishes a versioned, patched, scanned, minimally configured, and reproducible template for deploying servers or virtual machines without carrying hidden state forward.
Systems security concept · IntermediateGroup Policy Security
Group Policy Security concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Infrastructure risk · IntermediateHardware Failure Risk Management
Hardware failure risk management identifies component, power, cooling, media, controller, cable, and environmental failure modes and connects them to monitoring, spares, redundancy, maintenance, and recovery.
NIST CSF Subcategory profile · IntermediateHardware Inventories (ID.AM-01) — NIST CSF 2.0 Subcategory
Apply ID.AM-01 to achieve this CSF 2.0 outcome: Inventories of hardware managed by the organization are maintained.
Hardware security concept · AdvancedHardware Root of Trust
A hardware root of trust provides protected functions and measurements used to establish device identity, key custody, boot integrity, attestation, or isolated execution.
Systems security concept · IntermediateHost-Based Firewalls
Host-Based Firewalls is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Operational technology security · IntermediateHuman-Machine Interface Security
Human-machine interface security protects operator visibility and control while preserving rapid, reliable access to accurate process information and safe actions.
Virtualization security · IntermediateHypervisor Management-Plane Security
Hypervisor management-plane security protects the privileged interfaces, APIs, accounts, consoles, networks, and automation that can create, inspect, move, or control virtual workloads.
Systems security concept · IntermediateInternet of Things Security
Internet of Things Security is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Connected-device lifecycle control · AdvancedIoT Secure Update Mechanisms
IoT secure update mechanisms let a device authenticate update metadata and payloads, verify integrity and authorization, install changes safely, resist rollback, recover from failure, and report update state throughout a long product lifecycle.
Hardware interface security concept · AdvancedJTAG and UART Security
JTAG and UART security controls debug, test, programming, and serial interfaces that can expose firmware, memory, boot state, credentials, consoles, and privileged device control when physically accessible.
Operating-system security · IntermediateKernel Module Security
Kernel module security governs which code may extend the operating-system kernel, when modules may load, and how unsupported or unnecessary drivers are prevented from expanding privilege.
Windows credential-protection concept · AdvancedLSASS and Credential Protection
The Local Security Authority Subsystem Service enforces local security policy, validates certain logons, creates access tokens, and handles credential material; protecting LSASS is central to limiting credential theft from Windows endpoints.
Risk treatment practice · AdvancedLegacy System Security
Legacy system security applies isolation, compensating controls, strict access, monitoring, change discipline, recovery planning, and retirement governance where modern controls cannot be installed.
ATT&CK mitigation profile · IntermediateLimit Hardware Installation (M1034)
Control attachment and installation of hardware that could introduce code, storage, network access, or unauthorized interfaces. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
ATT&CK mitigation profile · IntermediateLimit Software Installation (M1033)
Restrict who and what may install software so unapproved tools, packages, drivers, and persistence mechanisms are harder to introduce. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Operating-system security · IntermediateLinux Security Modules
Linux Security Modules provide a common kernel framework for mandatory access-control and other security mechanisms that enforce policy beyond traditional user and group permissions.
Framework scope · IntermediateMITRE ATT&CK® Platforms and Technology Scope
How ATT&CK platform metadata helps analysts distinguish Windows, Linux, macOS, cloud, identity, SaaS, containers, network devices, ESXi, and pre-compromise activity.
Endpoint security concept · BeginnerMobile Device Security
Mobile device security protects phones, tablets, and portable endpoints through device management, secure configuration, identity controls, application governance, and data protection.
Network storage security · IntermediateNFS Security
NFS security protects shared Unix-style filesystems through controlled exports, identity mapping, network restrictions, transport protection, least privilege, and careful handling of root access.
NIST CSF Subcategory profile · IntermediateNetwork Communication and Data Flow Representations (ID.AM-03) — NIST CSF 2.0 Subcategory
Apply ID.AM-03 to achieve this CSF 2.0 outcome: Representations of the organization’s authorized network communication and internal and external network data flows are maintained.
Network storage security · IntermediateNetwork-Attached Storage Security
Network-attached storage security protects shared file appliances through hardened management, segmented data access, strong identity, protocol controls, snapshots, monitoring, and recoverable configuration.
Operational technology risk · IntermediateOT Asset Inventory Confidence
OT asset inventory confidence measures how complete, accurate, current, attributable, and operationally useful an inventory is for devices, software, communications, ownership, and dependencies.
Operational technology architecture · AdvancedOT Jump Server Security
An OT jump server is a controlled intermediary for administrative or support access into restricted environments and must be treated as a high-consequence security boundary.
Operational technology risk · AdvancedOT Legacy System Compensating Controls
OT legacy system compensating controls reduce exposure when obsolete hardware, operating systems, software, or protocols cannot support preferred security safeguards.
Operational technology security · IntermediateOT Safety and Cybersecurity
OT safety and cybersecurity integrate protection of people, environment, equipment, process quality, continuity, and information across systems that affect the physical world.
ATT&CK mitigation profile · IntermediateOperating System Configuration (M1028)
Harden operating systems through secure defaults, least functionality, protected administration, and continuously enforced configuration baselines. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Systems security concept · IntermediateOperating System Fundamentals
Operating System Fundamentals concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Infrastructure security practice · AdvancedOperational Technology Security
Operational technology security protects systems that monitor or control physical processes, including industrial control systems, building systems, manufacturing equipment, and safety-related environments.
Software supply-chain security · IntermediatePackage Repository Trust
Package repository trust verifies the origin, integrity, authorization, and lifecycle of software packages before they are introduced into managed systems.
Operational technology security · AdvancedPassive OT Asset Discovery
Passive OT asset discovery infers devices, roles, communications, protocols, and changes from observed traffic without actively interrogating sensitive control equipment.
Operational control · BeginnerPatch Management
Patch management identifies, evaluates, tests, deploys, and verifies updates that correct vulnerabilities, defects, and unsupported components.
Patch management · AdvancedPatch Workflow Rollback Readiness
Patch workflow rollback readiness prepares tested recovery paths when an update causes instability, incompatibility, or security regression.
Service management · IntermediatePayment Terminal Security
Payment terminal security protects point-of-interaction devices through approved design, inventory, deployment, physical inspection, tamper awareness, access control, maintenance, and replacement procedures.
Resilience concept · IntermediatePhysical Security Dependencies
Physical security dependencies are facilities, power, environmental systems, devices, access controls, and supply conditions whose failure can undermine digital security and service continuity.
ATT&CK mitigation profile · IntermediatePrivileged Process Integrity (M1025)
Protect privileged processes and security boundaries from injection, modification, debugging, credential extraction, and untrusted code. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Systems security concept · IntermediateProcesses, Services, and Daemons
Processes, Services, and Daemons is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Recovery architecture · IntermediateRAID and Backup Boundaries
RAID and backup boundaries distinguish device-failure tolerance from independent recovery copies that protect against deletion, corruption, ransomware, application error, and site loss.
ATT&CK mitigation profile · IntermediateRemote Data Storage (M1029)
Keep recoverable or authoritative data copies in storage that is separated from the primary system and governed through independent access controls. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Remote administration security concept · AdvancedRemote Desktop Security
Remote Desktop security protects Windows interactive administrative sessions by controlling who can connect, how endpoints authenticate, where credentials are exposed, which channels are redirected, and how activity is monitored and contained.
Operational technology security · IntermediateRemovable Media Controls for OT
Removable media controls for OT govern authorization, sourcing, scanning, transfer, use, custody, sanitization, and evidence for portable storage that crosses trust boundaries.
Systems security concept · IntermediateRemovable Media Security
Removable Media Security is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
ATT&CK mitigation profile · IntermediateRestrict File and Directory Permissions (M1022)
Apply least-privilege permissions to files and directories so unauthorized users and processes cannot read, alter, replace, or execute protected content. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
ATT&CK mitigation profile · IntermediateRestrict Library Loading (M1044)
Constrain which dynamic libraries, modules, drivers, and extensions privileged or sensitive processes may load. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
ATT&CK mitigation profile · IntermediateRestrict Registry Permissions (M1024)
Limit who and what can modify security-sensitive registry locations used for startup, services, policies, credentials, and application behavior. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Storage access control · IntermediateSAN Zoning and LUN Masking
SAN zoning and LUN masking restrict which initiators can communicate with storage targets and which logical units each host may discover or use.
Mandatory access control · IntermediateSELinux Policy Enforcement
SELinux policy enforcement uses labels, types, roles, and policy rules to confine processes and data even when conventional ownership and mode bits would permit access.
Network storage security · IntermediateSMB and Samba Security
SMB and Samba security combines share permissions, filesystem permissions, identity integration, protocol hardening, network restrictions, and auditing to protect cross-platform file services.
Remote-access security · IntermediateSSH Server Hardening
SSH server hardening limits remote administrative exposure through strong cryptography, controlled authentication, restricted forwarding, explicit access rules, logging, and timely maintenance.
Operational technology security · AdvancedSafety Instrumented System Cybersecurity
Safety instrumented system cybersecurity protects independent sensing, logic, and final elements designed to move a process to a safe condition when hazardous limits are exceeded.
Systems security concept · IntermediateSecure Boot
Secure Boot concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Platform security · IntermediateSecure Boot and Trusted Start
Secure boot and trusted start protect the earliest stages of system startup by checking firmware, boot components, and configuration before the operating system assumes control.
Embedded platform-security control · AdvancedSecure Boot for Embedded Devices
Secure boot for embedded devices creates a chain of verified software from an initial trusted component through bootloader, operating system, firmware, and application so unauthorized code is not executed during startup.
Systems security concept · IntermediateSecure Configuration Management
Secure Configuration Management concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Endpoint and network control · IntermediateSecure Web Browsing Controls
Secure web browsing controls reduce exposure from malicious sites, downloads, scripts, browser extensions, sessions, and unsafe content execution.
Systems security concept · IntermediateSecurity Baselines and Benchmarks
Security Baselines and Benchmarks is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Operational control · IntermediateSecurity Configuration Management
Security configuration management defines, applies, monitors, and changes configuration baselines so that systems remain understandable and defensible.
Infrastructure resilience · IntermediateServer Power Resilience
Server power resilience combines redundant supplies, independent circuits, UPS capacity, generators, distribution, monitoring, maintenance, and graceful shutdown to manage electrical failure.
Server hardening · IntermediateServer Role Minimization
Server role minimization installs and enables only the operating-system features, applications, ports, and administrative interfaces required for a defined workload.
Service reliability · IntermediateService Dependency Management
Service dependency management maps and controls the services, mounts, networks, identities, secrets, timers, and startup conditions a workload requires to operate safely.
Administrative security · IntermediateShell Environment Secret Protection
Shell environment secret protection keeps credentials, tokens, paths, history, startup files, and inherited variables from exposing authority or changing command behavior unexpectedly.
NIST CSF Subcategory profile · IntermediateSoftware, Service, and System Inventories (ID.AM-02) — NIST CSF 2.0 Subcategory
Apply ID.AM-02 to achieve this CSF 2.0 outcome: Inventories of software, services, and systems managed by the organization are maintained.
Storage resilience · IntermediateStorage Resilience and RAID
Storage resilience and RAID use redundancy, striping, parity, mirroring, monitoring, and rebuild procedures to maintain service through selected device failures.
NIST CSF Subcategory profile · IntermediateSupplier-Provided Service Inventories (ID.AM-04) — NIST CSF 2.0 Subcategory
Apply ID.AM-04 to achieve this CSF 2.0 outcome: Inventories of services provided by suppliers are maintained.
Systems security concept · IntermediateSystem Hardening
System Hardening concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Lifecycle risk concept · IntermediateTechnology Obsolescence and End-of-Life Risk
Technology obsolescence and end-of-life risk arise when unsupported hardware, software, protocols, skills, components, or suppliers can no longer meet security and operational needs.
Systems security concept · IntermediateType 1 and Type 2 Hypervisors
Type 1 and Type 2 Hypervisors concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Provisioning security · IntermediateUnattended Installation Security
Unattended installation security protects answer files, embedded credentials, scripts, drivers, repositories, and post-install actions used to automate operating-system deployment.
Software asset control · IntermediateUnauthorized Software Management
Unauthorized software management identifies, evaluates, removes, blocks, or formally approves software that is not permitted for the device or environment.
Windows privilege-boundary control · IntermediateUser Account Control
User Account Control limits routine use of administrative privileges by giving administrators a filtered standard token and requiring an elevation decision before a process receives the full administrative token.
ATT&CK mitigation profile · IntermediateUser Account Control (M1052)
Use operating-system elevation boundaries and prompts to separate ordinary user activity from administrative actions and reduce silent privilege use. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Systems security concept · IntermediateVirtual Machine Security
Virtual Machine Security concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Virtualization security · IntermediateVirtual Machine Snapshot Security
Virtual machine snapshot security governs point-in-time state copies that may contain memory, credentials, sensitive data, vulnerable software, and configuration that later returns during rollback.
Platform concept · IntermediateVirtualization and Containers
Virtualization and containers isolate workloads and share underlying resources through hypervisors, operating-system controls, images, and orchestration platforms.
Windows platform-security control · AdvancedWindows Credential Guard
Windows Credential Guard uses virtualization-based security to isolate selected domain credentials from the normal operating system so that compromise of the host is less likely to expose reusable NTLM hashes and Kerberos ticket-granting tickets.
Host firewall control · IntermediateWindows Defender Firewall
Windows Defender Firewall is a stateful host firewall that applies profile-aware inbound and outbound rules to programs, services, ports, protocols, interfaces, users, and network conditions.
Windows configuration-security concept · IntermediateWindows Registry Security
The Windows Registry is a hierarchical configuration database whose keys and values influence operating-system, service, application, security, persistence, and user behavior; protecting it requires permission control, change monitoring, and recovery discipline.
Service hardening · Intermediatesystemd Service Hardening
systemd service hardening uses unit-level sandboxing, identity, filesystem, capability, namespace, and resource controls to reduce what a Linux service can do if it fails or is compromised.