GIAC GSEC Course Notes

Understand how traffic actually moves, how architecture constrains it, how cloud/virtualization changes the trust boundary, and how wireless expands the physical edge.

• Defensible Network Architecture: Allowing management protocols from all internal subnets.

• Identify what the scenario is actually testing before reaching for a familiar control.

Build independent layers around identity, data, endpoints, networks, and recovery; prioritize controls from risk rather than from product categories.

• Defense in Depth: Adding a third MFA factor when the problem is post-authentication access.

• Identify what the scenario is actually testing before reaching for a familiar control.

Find weaknesses, validate them safely, recognize attack behavior, correlate evidence, contain active harm, eradicate causes, and verify recovery.

• Vulnerability Scanning and Penetration Testing: Treating scanner output as confirmed exploit.

• Identify what the scenario is actually testing before reaching for a familiar control.

Know what cryptographic, network, and endpoint controls actually provide—and the failure modes they do not cover.

• Cryptography: Saying encryption automatically provides integrity.

• Identify what the scenario is actually testing before reaching for a familiar control.

Be comfortable with Windows identity, permissions, GPOs, updates, PowerShell/auditing, service exposure, and Azure/host policy interactions.

• Windows Security Infrastructure: Sharing domain Administrator credentials.

• Identify what the scenario is actually testing before reaching for a familiar control.

Understand permissions, privilege, hardening, SELinux, service exposure, container isolation, and native macOS data protection.

• Linux Fundamentals: Saying group permissions 'override' ownership.

• Identify what the scenario is actually testing before reaching for a familiar control.