테스트·보안 스킬

Build a recurring vulnerability scanning process with Nessus, Qualys, or OpenVAS. Prioritize findings using asset importance and known exploitation, then organize remediation deadlines, monitoring dashboards, and automatic tickets for urgent issues.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Establish recurring infrastructure vulnerability scans
• Prioritize fixes using asset importance and exploitation data
• Track remediation deadlines and overdue findings

Build a tracking system for vulnerabilities that cannot be fixed on time. Define exception requests, approval workflows, alternative protective measures, expiration checks, and audit records so teams can track accepted risks and support compliance reviews.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Standardizing exception requests for delayed vulnerability fixes
• Recording alternative protections and risk acceptance
• Checking expired exceptions and producing monthly reports

Plan and run authorized security exercises that simulate an attacker's actions, from reconnaissance to activities after entry. Map techniques to MITRE ATT&CK, a framework of attack behaviors, and report detection gaps and response performance.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning the scope and objectives of a red team exercise
• Designing scenarios based on a specific threat actor
• Measuring detection and response during an exercise

Set up and harden a Sliver server for authorized security exercises that simulate attackers. Cover multiple communication protocols, intermediary servers, certificate-based access for team members, and test programs that use periodic or interactive connections.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building a Sliver server for an authorized red-team exercise
• Configuring multiple communication protocols for an exercise
• Managing certificate-based access for multiple operators

Collect evidence from a compromised computer before shutdown or remediation erases it. Preserve memory, network connections, processes, and system state, then record integrity hashes and handling history to support incident investigation and evidence tracking.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preserving evidence before shutting down a compromised computer
• Collecting memory evidence for suspected fileless malware
• Recording active connections and processes during an intrusion

Collect indicators of compromise, technical clues such as suspicious domains and file hashes, from incident evidence. Add context and confidence scores, then prepare them for detection, blocking, and structured sharing with partners.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Extracting threat indicators from incident evidence
• Adding threat context and confidence scores to indicators
• Preparing indicator lists for detection and blocking

Create a ransomware response playbook aligned with CISA guidance and NIST CSF, a cybersecurity framework. Organize preparation, detection, containment, recovery, and lessons learned into actionable checklists for readiness reviews and simulated incident exercises.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating or updating a ransomware response playbook
• Assessing readiness against CISA guidance
• Validating response steps in a tabletop exercise

Set up an email reporting button and an automated security response workflow. Classify reported messages, extract attack indicators, remove confirmed phishing emails, and send feedback to the people who reported them.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying a phishing reporting button in Outlook
• Automating triage of a dedicated reporting mailbox
• Retracting confirmed phishing emails across inboxes

Build a shared incident timeline in Timesketch from endpoint, server, and cloud logs. Search events, add tags and investigator notes, reconstruct the attack sequence, and organize findings into a story for incident reporting.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reconstructing the sequence of an incident
• Reviewing evidence with multiple analysts
• Combining Plaso output and other logs

Create reusable procedures for responding to security incidents, from detection and containment to recovery. Define decision points, responsibilities, escalation rules, and workflows for security automation platforms so teams can follow a consistent response process.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Establishing an incident response program
• Documenting phishing or ransomware response procedures
• Designing automated security response workflows

Plan and conduct authorized security tests of AWS, Azure, and GCP environments. Check access permissions, credential exposure, cross-account access, and monitoring, then organize findings into a report with severity, business impact, and remediation guidance.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing cloud security before production deployment
• Checking access controls after a cloud migration
• Testing monitoring and incident response readiness

Build a workflow that extracts and deduplicates threat indicators such as URLs and IP addresses, creates readable reports with links disabled, and prepares standardized STIX 2.1 data for sharing through MISP or TAXII.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing threat reports with links disabled
• Consolidating indicators from multiple sources
• Distributing threat indicators through MISP or TAXII

Design employee access management across multiple systems using HR records. This skill covers account changes when people join, move roles, or leave, along with role definitions, approval workflows, periodic access reviews, and cleanup of accounts left behind.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Automating account changes for hires, transfers, and departures
• Finding accounts that remain after employees leave
• Reviewing overlapping roles and unnecessary permissions

Assess authorized web applications for pages and APIs that allow access without authentication. Discover hidden URLs and exposed configuration or backup files, compare signed-in and signed-out responses, and document affected resources, impact, and recommended fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding administrative pages accessible without signing in
• Checking authentication requirements on APIs
• Locating exposed configuration and backup files

Build security detection rules in Splunk using SPL, its search language. Use examples for suspicious logins, network traffic, and PowerShell activity to develop searches, add context and severity, test historical logs, and measure false alerts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating rules to detect suspicious login activity
• Detecting large outbound transfers and access to multiple hosts
• Testing detection rules against historical logs

Set up MISP to collect, store, and correlate threat intelligence from multiple feeds. Use PyMISP to automate searches and imports of indicators of compromise, such as suspicious IP addresses and file hashes, and export data for security monitoring tools.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Collecting threat indicators from multiple feeds
• Automating MISP imports and searches
• Exporting indicators for security monitoring tools

Build a ransomware response playbook for security monitoring teams, covering detection, containment, eradication, and recovery. Include log queries, decision trees, evidence collection, backup restoration, and incident reviews to prepare consistent procedures before an attack occurs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating a standardized ransomware response playbook
• Documenting host isolation and recovery procedures
• Addressing coordination gaps found in tabletop exercises

Create threat detection rules in Sigma, a shared format for security log searches, and convert them for Splunk, Elastic, or Microsoft Sentinel. Validate syntax, test expected matches and false positives, and map coverage to MITRE ATT&CK.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Turning threat reports into detection rules
• Reusing detection logic across SIEM platforms
• Testing rule matches and reducing false positives

Map an organization's internet-facing assets using public information, including domains, indexed services, employee details, and leaked data. Compile findings into a reconnaissance report to support authorized security assessments and identify potential exposure.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Gathering public information before a penetration test
• Finding unknown internet-facing assets
• Checking public sources for leaked credentials and documents

Build incident response dashboards that bring affected systems, containment progress, indicators of compromise, and response timelines into one view. Help security teams coordinate active incidents and prepare operational reports and executive briefings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Coordinating an active security incident
• Tracking affected systems and containment
• Reviewing response timelines after an incident

Assess cybersecurity risks using NIST SP 800-30 Rev 1 by examining threats, weaknesses, likelihood, and business impact. Produce a ranked risk register, a structured record of risks and recommended responses, with a summary for leadership.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing documented risk analysis for compliance frameworks
• Assessing a new system before launch
• Reporting the highest risks to leadership

Set up MISP to collect threat feeds and centrally manage indicators such as suspicious IP addresses and domains. Configure automated synchronization, connect related findings, and export indicators to security monitoring platforms or blocklists.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Centralizing threat indicators from multiple feeds
• Deploying MISP with Docker
• Automating threat feed synchronization

Set up Microsoft Sentinel to collect security logs from AWS, Azure, and GCP. Build detection queries, investigate historical activity, and create automated response workflows for a centralized security operations team.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Centralizing security monitoring across multiple clouds
• Migrating from an existing SIEM platform
• Automating responses to suspicious cloud activity

Build automated pipelines that collect threat indicators, such as malicious IP addresses and file hashes, from multiple feeds. Standardize formats, remove duplicates, assess confidence, and distribute indicators to security monitoring systems for matching and alerts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Automating threat feed ingestion
• Standardizing and deduplicating threat indicators
• Distributing indicators to multiple monitoring systems