aner/roam
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

backup: 2026-10-06 10:50

Browse Source
This commit is contained in:
Aner Zakobar
2026-10-06 10:50:02 +03:00
parent 32009710da
commit 12328a02fc
17 changed files with 349 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
just-talkingcyber-terminology-ramp.org
+1 -22
View File
@@ -4,26 +4,5 @@
#+title: just-talking/cyber-terminology-ramp
#+filetags: :project: :knowledge: :cybersecurity:
Tracking Aner's month-long cybersecurity terminology/domain ramp-up before starting the Index-backed OT/ICS security startup (~2026-10-28). See [[just-talking/user-profile]] for the job context, [[just-talking/conversations]] for full session logs, [[just-talking/cyber-glossary]] for the running quiz-ready term glossary, and [[just-talking/cyber-reading-list]] for standout resources worth keeping/sharing.
MIGRATED 2026-10-06 to [[ot-ics-security-ramp]] (new project at ~/projects/tutorials/ot-ics-security-ramp) — the cyber ramp-up outgrew just-talking's general-chat scope into a standalone educational project. See there for current content; this node is kept only so old links/backlinks aren't dead ends.
** Key Context
- Startup secures networks of utility companies — this is OT/ICS/critical-infrastructure security, not general enterprise security.
- Trigger: interview process surfaced that Aner didn't know "RAT" or "C2" despite solid underlying concept knowledge (8200 SDR, Gita WiFi/Bluetooth security research) — a terminology/lingo gap, not a concept gap.
- Daily RSS reading habit already established (Krebs, SANS ISC, CISA Advisories, etc. — see 2026-09-28 conversation entry for full list).
** Self-Assessment Results (2026-09-29)
Full results and corrected misconceptions (IOC/IOA swap, Kerberoasting) logged in [[just-talking/cyber-glossary]]. Biggest blanks going in: APT, TTP, living-off-the-land, exfiltration, most of the defensive stack (EDR/XDR/SIEM/SOAR/NDR/etc.), cloud security beyond self-taught k8s, IR/forensics entirely, frameworks/compliance entirely, vendor landscape partial only.
** Methodology (decided 2026-09-29)
Hybrid approach, not one-size-fits-all:
- Conceptually rich + currently blank domains (OT/ICS fundamentals, IR/forensics, frameworks/compliance, defensive stack) → conversational deep-dive, one section at a time, discuss before moving on.
- Pure vocabulary/naming gaps (vendor landscape, acronym expansion, APT/TTP-style terms) → quick reference pass, no deep discussion needed.
- Priority reorder given the utility-company detail: OT/ICS fundamentals first, ahead of generic defensive-stack coverage.
- **Standing workflow preference: auto-update [[just-talking/cyber-glossary]] and [[just-talking/cyber-reading-list]] with every new term/resource covered, without asking first or narrating "I'll add this" — just do it.**
** OT/ICS Deep-Dive Progress (started 2026-09-29)
Covered so far (full definitions in [[just-talking/cyber-glossary]]): IT-vs-OT / AIC triad; Purdue Model levels 0-5 + Level 3.5 DMZ; ICS protocols (Modbus, DNP3, IEC 61850/GOOSE, IEC 104, OPC-UA); canonical attack case studies (Stuxnet, Ukraine grid/Industroyer, TRITON/SIS, Metcalf sniper attack); OT vendor landscape (Dragos/Claroty/Nozomi "big three" plus Tenable.ot, MS Defender for IoT, Forescout, Armis, vendor-native); 2026 threat landscape from the Dragos Year in Review (KAMACITE/SYLVANITE/BAUXITE, MSP/GIS as supply-chain targets — see [[just-talking/cyber-reading-list]]); NERC CIP compliance (NERC/FERC/BES scope, electric-only vs water/gas, CIP-002/005/007/008/010/013/014).
Not yet covered: IR/forensics (queued next), general frameworks/compliance beyond NERC CIP (NIST CSF, ISO 27001, SOC 2, CIS Controls, STIX/TAXII), remaining defensive-stack acronyms (EDR/XDR/SIEM/SOAR/NDR/NGFW/IDS/IPS/DLP/ZTNA), cloud security beyond k8s (CSPM/CWPP/CIEM).
** Status
OT/ICS deep-dive in progress. Next: IR/forensics.