Cybersecurity Analyst

Cybersecurity Analyst Skill

Purpose

Analyze events through the disciplinary lens of cybersecurity, applying rigorous security frameworks (CIA triad, defense-in-depth, zero-trust), threat modeling methodologies (STRIDE, PASTA, VAST), attack surface analysis, and industry standards (NIST, ISO 27001, MITRE ATT&CK) to understand security risks, identify vulnerabilities, assess threat actors and attack vectors, evaluate defensive controls, and recommend risk mitigation strategies.

When to Use This Skill

• Security Incident Analysis: Investigate breaches, data leaks, ransomware attacks, insider threats
• Vulnerability Assessment: Identify weaknesses in systems, applications, networks, processes
• Threat Modeling: Analyze potential attack vectors and threat actors for new systems or changes
• Security Architecture Review: Evaluate design decisions for security implications and gaps
• Risk Assessment: Quantify and prioritize security risks using frameworks like CVSS, FAIR
• Compliance Analysis: Assess adherence to security standards (SOC 2, PCI-DSS, HIPAA, GDPR)
• Incident Response Planning: Design detection, containment, eradication, and recovery strategies
• Security Posture Evaluation: Assess overall defensive capabilities and maturity
• Code Security Review: Identify security vulnerabilities in software implementations

Core Philosophy: Security Thinking

Cybersecurity analysis rests on fundamental principles:

Defense in Depth: No single security control is perfect. Layer multiple independent controls so compromise of one doesn't compromise the whole system.

Assume Breach: Modern security assumes attackers will penetrate perimeter defenses. Design systems to minimize damage and enable detection when (not if) breach occurs.

Least Privilege: Grant minimum access necessary for legitimate function. Every excess permission is an opportunity for exploitation.

Zero Trust: Never trust, always verify. Verify explicitly, use least privilege access, and assume breach regardless of network location.

Security by Design: Security cannot be bolted on afterward. It must be fundamental to architecture and implementation from the beginning.

CIA Triad: Security protects three properties—Confidentiality (only authorized access), Integrity (only authorized modification), Availability (accessible when needed).

Threat-Informed Defense: Base defensive priorities on understanding of actual threat actors, their capabilities, motivations, and tactics (threat intelligence).

Risk-Based Approach: Perfect security is impossible. Prioritize security investments based on risk (likelihood × impact) to maximize security per dollar spent.

Theoretical Foundations (Expandable)

Foundation 1: CIA Triad (Classic Security Model)

Components:

Confidentiality: Information accessible only to authorized entities

• Protection mechanisms: Encryption, access controls, authentication
• Threats: Eavesdropping, data theft, unauthorized disclosure
• Example violations: Data breach, password theft, insider leak

Integrity: Information modifiable only by authorized entities in authorized ways

• Protection mechanisms: Hashing, digital signatures, access controls, version control
• Threats: Tampering, unauthorized modification, malware
• Example violations: Database manipulation, man-in-the-middle attacks, ransomware encryption

Availability: Information and systems accessible when needed by authorized entities

• Protection mechanisms: Redundancy, backups, DDoS mitigation, incident response
• Threats: Denial of service, ransomware, system destruction
• Example violations: DDoS attacks, ransomware, infrastructure failures

Extensions:

• Authenticity: Verified identity of entities and origin of information
• Non-repudiation: Cannot deny taking action
• Accountability: Actions traceable to entities

Application: Every security analysis should identify which aspects of CIA triad are at risk and how controls protect each.

Sources:

• CIA Triad - Wikipedia
• NIST Cybersecurity Framework

Foundation 2: Defense in Depth (Layered Security)

Principle: Deploy multiple layers of security controls so compromise of one layer doesn't compromise entire system.

Historical Origin: Military defensive strategy—multiple concentric perimeter defenses

Security Layers:

1. Physical: Facility access controls, locked server rooms
2. Network: Firewalls, network segmentation, IDS/IPS
3. Host: Endpoint protection, host firewalls, patch management
4. Application: Input validation, secure coding, authentication
5. Data: Encryption at rest and in transit, DLP, tokenization
6. Human: Security awareness training, phishing simulation

Key Insight: Redundancy is not waste—it's resilience. Even if attacker bypasses firewall, they still face authentication, authorization, monitoring, encryption, and detection controls.

Application: Security architecture should have multiple independent defensive layers protecting critical assets.

Limitation: Can create complexity and false sense of security if layers are not maintained or are interdependent.

Sources:

• Defense in Depth - NSA
• Layered Security - CISA

Foundation 3: Zero Trust Architecture

Core Principle: "Never trust, always verify" regardless of network location

Contrast with Perimeter Model: Traditional security assumed internal network is trusted ("castle and moat"). Zero trust assumes no network location is trusted.

Key Tenets (NIST SP 800-207):

1. Verify explicitly: Always authenticate and authorize based on all available data points
2. Least privilege access: Limit user access with Just-In-Time and Just-Enough-Access
3. Assume breach: Minimize blast radius and segment access; verify end-to-end encryption

Components:

• Identity-centric security: Identity becomes new perimeter
• Micro-segmentation: Network divided into small zones with separate controls
• Continuous verification: Authentication and authorization are continuous, not one-time
• Data-centric: Protect data itself, not just perimeter around it

Drivers:

• Cloud adoption (no clear perimeter)
• Remote work (users outside traditional perimeter)
• Sophisticated attacks (perimeter breaches common)

Application: Modern security architectures should be designed with zero trust principles, especially for cloud and hybrid environments.

Sources:

• NIST SP 800-207: Zero Trust Architecture
• Zero Trust - Microsoft Security

Foundation 4: Threat Modeling

Definition: Structured approach to identify and prioritize potential threats to a system

Purpose: Proactively identify security issues during design phase when fixes are cheapest

Benefits:

• Find vulnerabilities before implementation
• Prioritize security work
• Communicate risks to stakeholders
• Guide security testing

Common Methodologies:

STRIDE (Microsoft):

• Spoofing identity
• Tampering with data
• Repudiation
• Information disclosure
• Denial of service
• Elevation of privilege

PASTA (Process for Attack Simulation and Threat Analysis):

• Seven-stage risk-centric methodology
• Aligns business objectives with technical requirements

VAST (Visual, Agile, and Simple Threat modeling):

• Scalable for agile development
• Two types: application threat models and operational threat models

Application: Use threat modeling for new features, architecture changes, or security reviews.