Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.
6.2. Quick Reference Tables
Attack Framework Comparison
| Framework | Granularity | Primary Use | Structure |
|---|---|---|---|
| Cyber Kill Chain | 7 stages, high-level | Gap analysis, stage-based defense | Linear sequence |
| MITRE ATT&CK | Hundreds of techniques | TTP detection coverage, hunt hypotheses | 14 tactics × N techniques matrix |
| Diamond Model | 4 vertices per event | Attribution, intel pivoting | Relationship model |
| OSSTMM | Test cases | Security testing methodology | Assessment framework |
| OWASP Testing Guide | Web test cases | Web application assessment | Checklist by category |
Scanning Type Decision Matrix
| Need to… | Use… |
|---|---|
| Find what external attackers see | External, non-credentialed scan |
| Find patch status and installed software | Internal, credentialed scan |
| Assess without impacting OT/ICS systems | Passive scan only |
| Continuously monitor without agents | Agentless, passive scanning |
| Validate that a vuln is actually exploitable | Penetration test / Metasploit |
| Assess cloud IAM and configuration | Scout Suite / Prowler |
| Test web application logic | Burp Suite / OWASP ZAP |
Control Type Quick Reference
| Function | Implementation | Example |
|---|---|---|
| Preventative + Technical | Firewall, MFA, encryption | Block attack before it occurs |
| Detective + Technical | SIEM, IDS, audit logs | Identify attack in progress |
| Corrective + Technical | Patch, re-image, restore backup | Fix after attack |
| Preventative + Administrative | Security policy, training, background checks | Reduce human risk factors |
| Detective + Administrative | Log review policy, audit schedule | Systematic review for anomalies |
| Compensating | Network isolation for EOL system | Alternative when primary control infeasible |
Vulnerability Priority Factors
| Factor | Lower Priority | Higher Priority |
|---|---|---|
| Exposure | Internal only, isolated | Internet-facing, directly accessible |
| Exploit availability | No public exploit | Metasploit module exists; CISA KEV listed |
| CVSS Attack Vector | Local or Physical | Network (remotely exploitable) |
| Asset criticality | Test/dev system | Production; payment processing; domain controller |
| Patch availability | No patch available | Vendor patch available |
| User interaction required | Requires victim action | No user interaction needed |
Email Authentication Summary
| Check | What It Validates | Bypass Method |
|---|---|---|
| SPF | Sending IP authorized for the domain | Register a lookalike domain with valid SPF |
| DKIM | Email not tampered with; signing domain authorized it | Register lookalike domain; sign with your own key |
| DMARC | SPF and/or DKIM aligned with From: domain | Register lookalike domain that passes both |
| All three pass | Email came from where it claims | Doesn't prove the claimed identity is trustworthy |
SOC Metrics Reference
| Metric | Formula | What High Value Means | Improvement Lever |
|---|---|---|---|
| MTTD | Avg(detection_time - incident_start_time) | Detection gaps, alert fatigue, missing log sources | Better correlation rules, more log sources, FP reduction |
| MTTR | Avg(containment_time - detection_time) | Slow response, unclear playbooks, manual steps | SOAR automation, playbook improvement, training |
| MTTRemediate | Avg(remediation_time - detection_time) | Patch approval delays, complex eradication | Emergency change process, faster eradication playbooks |
| Alert Volume | Total alerts / time period | Rising: new coverage or degrading tuning | Tune noisy rules; increase analyst capacity |
Written byAlvin Varughese
Founder•18 professional certifications