instruction: Identify the MITRE ATT&CK technique for credential dumping using the LSASS process on Windows systems.

response: Credential dumping from the Local Security Authority Subsystem Service (LSASS) memory is categorized under MITRE ATT&CK technique T1003.001 (OS Credential Dumping: LSASS Memory). Attackers use tools like Mimikatz or procdump to access LSASS memory and extract plaintext or hashed credentials. Defenders should monitor for suspicious access to LSASS, enable Protected Process Light (PPL) for LSASS on supported systems, and implement credential guard and other mitigations to restrict credential theft.


instruction: Explain the principle of least privilege (PoLP) and how it mitigates cybersecurity risk.

response: The principle of least privilege (PoLP) states that users, programs and processes should be granted the minimum level of access — privileges, permissions and rights — needed to perform their duties. Limiting privileges reduces the attack surface because compromised accounts or applications have less ability to move laterally or impact other systems. Implementing PoLP involves using role‑based access control, regularly reviewing and revoking unnecessary permissions, and separating administrative accounts from day‑to‑day user accounts. Least privilege is a core control in frameworks like NIST SP 800‑53 (AC‑2, AC‑6) and helps prevent abuse of privileges by insiders or malware.


instruction: List three access control measures recommended by the NIST SP 800‑53 framework.

response: NIST SP 800‑53 provides a catalog of security controls for federal information systems. Three access control measures include: 1. AC‑2: Account Management – establishing, activating and monitoring user accounts, including enforcing account creation approval and periodic review. 2. AC‑3: Access Enforcement – enforcing approved authorizations by controlling access to resources based on policies and identity attributes. 3. AC‑6: Least Privilege – limiting users to the minimum necessary permissions and restricting the use of privileged functions. Implementing these controls helps organizations manage who can access data and systems and ensures that permissions are aligned with business needs.


instruction: Describe the difference between symmetric and asymmetric encryption with examples.

response: Symmetric encryption uses the same secret key for both encryption and decryption. Examples include AES and 3DES. Because the same key must be shared between sender and receiver, key management is critical and scaling to many users can be challenging. Asymmetric encryption (public‑key cryptography) uses mathematically related key pairs: a public key for encryption or signature verification and a private key for decryption or signature creation. Examples include RSA and Elliptic Curve Cryptography (ECC). Asymmetric cryptography enables secure key exchange and digital signatures; however, it is computationally more expensive than symmetric encryption. Hybrid protocols like TLS combine both, using asymmetric cryptography to establish a shared secret and symmetric algorithms for efficient data transfer.


instruction: Provide three security best practices for securing containerized workloads in a Kubernetes cluster.

response: 1. Implement pod‑level least privilege: define PodSecurityPolicies or Pod Security Admission profiles to enforce restrictions such as running containers as non‑root, disallowing privileged containers and controlling host network and filesystem access. 2. Use image scanning and signing: scan container images for vulnerabilities before deployment and implement image signing (e.g., using Notary or Cosign) to ensure only trusted images run in the cluster. 3. Enable network segmentation and policy: use Kubernetes Network Policies or service meshes to define allowable network flows between pods, reducing lateral movement opportunities. Additional practices include regular patching of Kubernetes components, RBAC for API access, and monitoring for suspicious activity.