Các chủ đề cốt lõi trong bảo mật mạng (Core Topics)
1. Quản trị truy cập & Nhận dạng (Identity & Access Management - IAM)
- Zero Trust Architecture (NIST 800-207), Never Trust Always Verify.
- MFA, Passwordless (FIDO2/WebAuthn, Passkeys), SSO (SAML/OIDC).
- PAM (Privileged Access Management), JIT Access, Session Recording.
- Machine Identity: SPIFFE/SPIRE, mTLS, Certificate Lifecycle Management.
2. Bảo mật Endpoint & XDR
- EDR/XDR: Telemetry, Behavioral Detection, Automated Response.
- Application Control: WDAC, AppLocker, SELinux, AppArmor.
- Hardening: CIS Benchmarks, STIG, Attack Surface Reduction (ASR Rules).
- Mobile/BYOD: MDM/UEM (Intune, Jamf, VMware Workspace ONE).
3. Tường lửa & Bảo mật biên giới (Firewall & Perimeter Security)
- NGFW: App-ID, User-ID, SSL Decryption, IPS, Threat Prevention, WildFire/Sandbox.
- Cloud Firewall: AWS Network Firewall, Azure Firewall, GCP Cloud Armor.
- WAF (Web Application Firewall): OWASP Top 10, API Protection, Bot Management.
- DDoS Protection: L3/4 volumetric, L7 application, DNS amplification.
4. Phát hiện & Phản hồi xâm nhập (Detection & Response)
- SIEM: Log Collection, Parsing, Enrichment, Correlation Rules, Dashboards.
- SOAR: Playbook Automation, Case Management, Threat Intel Integration.
- NDR (Network Detection & Response): Zeek/Suricata + ML, Encrypted Traffic Analysis.
- Threat Hunting: Hypothesis-driven, MITRE ATT&CK Mapping, Sigma Rules.
- Digital Forensics & Incident Response (DFIR): Memory/Disk/Network Forensics.
5. Bảo mật Mạng không dây & IoT/OT
- Wi-Fi 6/6E/7 Security: WPA3, SAE, OWE, MLO, 6GHz.
- NAC: Posture Assessment, Profiling, Guest/IoT Onboarding.
- OT/ICS Security: Purdue Model, IEC 62443, Anomaly Detection (Nozomi, Claroty).
- IoT Security: Device Identity, Firmware Verification, Network Segmentation.
6. Bảo mật Đám mây (Cloud Security)
- CSPM (Cloud Security Posture Management), CNAPP (Cloud-Native Application Protection Platform).
- IAM Conditions, Permission Boundaries, SCPs, Resource Policies.
- Container/K8s Security: Admission Control (OPA/Gatekeeper), Runtime Security (Falco, Tetragon), Image Signing (Cosign/Sigstore).
- Serverless Security, Data Security Posture Management (DSPM).
7. Bảo mật Ứng dụng & DevSecOps (Application Security & DevSecOps)
- SSDLC (Secure SDLC): Threat Modeling (STRIDE, PASTA), SAST/DAST/IAST/SCA/Container/Secrets Scan.
- CI/CD Pipeline Security: SLSA, Provenance, Sigstore, Policy as Code.
- API Security: Schema Validation, Rate Limiting, OAuth2/OIDC, mTLS, GraphQL Security.
- Software Supply Chain: SBOM (SPDX, CycloneDX), SLSA, Dependency Confusion, Typosquatting.
8. Mật mã học ứng dụng (Applied Cryptography)
- TLS 1.3, Certificate Transparency, ACME (Let's Encrypt), mTLS, SPIFFE.
- Key Management: HSM, Cloud KMS, Vault, Key Rotation, Threshold Cryptography.
- Post-Quantum Cryptography (PQC): CRYSTALS-Kyber, Dilithium, SPHINCS+ (NIST PQC Standards).
- Privacy-Enhancing Tech: Homomorphic Encryption, MPC, ZKP, Federated Learning.
9. GRC & Tuân thủ (Governance, Risk & Compliance)
- Frameworks: NIST CSF 2.0, ISO 27001/27002, CIS Controls v8, COBIT, PCI-DSS 4.0.
- Risk Management: FAIR Model, Risk Appetite, Risk Register, Quantification.
- Privacy: GDPR, PDPD (Vietnam), DPIA, DPO, Data Mapping, Consent Management.
- Audit & Assurance: Continuous Controls Monitoring, Automated Evidence Collection.
10. Threat Intelligence & Adversary Emulation
- TIP (Threat Intelligence Platform), STIX/TAXII, MISP, OpenCTI.
- MITRE ATT&CK, D3FEND, ENGAGE.
- Red Teaming, Purple Teaming, Breach & Attack Simulation (BAS), Adversary Emulation Plans.
Chủ đề Hot/Trending 2024-2025 (Research Frontiers)
| Chủ đề | Mô tả | Tại sao quan trọng |
|---|---|---|
| AI/ML Security | Adversarial ML, Model Extraction, Data Poisoning, LLM Security (Prompt Injection, Jailbreak, RAG Poisoning), AI Supply Chain | AI ubiquitous, attack surface mới, quy định mới (EU AI Act, Biden EO) |
| Post-Quantum Cryptography (PQC) | Migration to ML-KEM (Kyber), ML-DSA (Dilithium), SLH-DSA (SPHINCS+). Hybrid KEM. Crypto Agility. | Harvest Now Decrypt Later (HNDL). NIST standards 2024. Migration 5-10 năm. |
| Zero Trust Maturity | ZTA Implementation, ZTNA, Continuous Diagnostics & Mitigation (CDM), Identity-first security. | Mandate liên bang Mỹ (OMB M-22-09), doanh nghiệp chuyển dịch. |
| Software Supply Chain Security | SLSA, SBOM, Sigstore, Reproducible Builds, Malicious Package Detection (typosquatting, dependency confusion). | SolarWinds, Log4j, 3CX, XZ Utils. Executive Order 14028. |
| Cloud-Native Security (CNAPP) | KSPM, DSPM, CIEM, CWPP, CDR (Cloud Detection & Response). Graph-based risk. | Cloud adoption tăng, shared responsibility model phức tạp. |
| Ransomware Resilience | Immutable Backup, Air-gap, Cyber Vault, Rapid Recovery, Ransomware Warranty. | Ransomware-as-a-Service, Double/Triple Extortion, Critical Infrastructure targeting. |
| OT/ICS Security Convergence | IT/OT Convergence, IEC 62443, Purdue Model modernization, Safe Active Querying. | Colonial Pipeline, Water treatment, Tram/rail signaling attacks. |
| Identity as the New Perimeter | Identity Threat Detection & Response (ITDR), Identity Fabric, Decentralized Identity (DID/VC). | 80%+ breaches liên quan identity (Verizon). Okta, Azure AD, Ping Identity attacks. |
Chương trình học/Course gợi ý (Curriculum)
| Giai đoạn | Khóa học/Chứng chỉ | Chủ đề trọng tâm |
|---|---|---|
| Cơ bản | CompTIA Security+, (ISC)² CC, Cisco CCST, Google Cybersecurity Cert | Network+, Security concepts, Crypto basics, Identity, Tools |
| Trung cấp | CySA+, CEH, eJPT, OSCP, AWS/Azure/GCP Security Specialty | Blue Team (SOC), Red Team (Pentest), Cloud Security |
| Nâng cao | CISSP, CCSP, GCFA, GNFA, OSEP, OSEE, GXPN, SANS Courses | Architecture, Forensics, Malware Rev, Cloud, Management |
| Chuyên sâu | PhD/Research, SANS GSE, Custom Research, Conference Speaking | PQC, AI Security, Formal Verification, Side-channels, Novel Protocols |
Nguồn tài nguyên nghiên cứu uy tín
- Tiêu chuẩn/Framework: NIST (CSF, 800-53, 800-171, 800-207), ISO 27001/27002, CIS Controls v8, MITRE ATT&CK/D3FEND.
- Báo cáo Threat Intel: Verizon DBIR, IBM X-Force, Mandiant M-Trends, CrowdStrike GTR, Microsoft Digital Defense Report, ENISA Threat Landscape.
- Hội nghị/Nghiên cứu: Black Hat, DEF CON, RSA Conference, USENIX Security, NDSS, IEEE S&P, ACM CCS, Virus Bulletin.
- Blog/Newsletter: Schneier on Security, The Daily Swig, Dark Reading, Krebs on Security, Project Zero, Google Security Blog, Microsoft Security Blog, Cloudflare Blog.
- Cộng đồng VN: SecVN, VNSEC, OWASP Việt Nam, WhiteHat, VIETTEL Cyber Security, FPT Telecom Security.