CompTIA SecurityX Blog Series
Core Exam Objectives 1: Governance, Risk, and Compliance

A comprehensive threat model must account for the motivation of adversaries, as it shapes the type, scale, and persistence of potential attacks. By examining motivations

In the context of Governance, Risk, and Compliance (GRC), understanding the resources available to threat actors, specifically time and money, is essential for accurate threat

In cybersecurity, understanding actor characteristics is essential to performing comprehensive threat modeling activities. Actor characteristics refer to the traits, capabilities, and resources that adversaries may

Attack patterns are repeatable methods and techniques used by cyber adversaries to exploit vulnerabilities in software, networks, or systems. These patterns provide insight into how

The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is a globally recognized cybersecurity framework that categorizes and documents known tactics, techniques, and procedures

The Common Attack Pattern Enumeration and Classification (CAPEC) framework, developed by the MITRE Corporation, is a comprehensive database of attack patterns used by adversaries. By

The Cyber Kill Chain, developed by Lockheed Martin, is a cybersecurity framework that outlines the stages of a cyberattack from reconnaissance to final objective completion.

The Diamond Model of Intrusion Analysis is a powerful framework designed to enhance cybersecurity threat intelligence. Unlike traditional methods, which may focus solely on known

The STRIDE Framework is a threat modeling methodology developed by Microsoft to help identify and categorize security threats in software and systems. STRIDE stands for

The Open Web Application Security Project (OWASP) is one of the most widely respected security frameworks, providing tools, guidelines, and resources to secure web applications.

Architecture reviews are an essential component of attack surface determination, focusing on assessing the structural design of systems and applications to identify potential security risks.

Data flow analysis is critical in attack surface determination, as it reveals how information travels within and outside an organization’s systems, highlighting potential vulnerabilities at