A hacktivist is a type of actor who uses hacking techniques to promote a political or social cause or agenda. Hacktivists often target websites or systems of organizations or governments that they oppose or disagree with, and deface them with messages or propaganda related to their cause. In this case, the hacktivist defaced the corporate websites with political propaganda.

The DMARC record's policy tag is incorrectly configured and explains why the company's requirements are not being processed correctly by mailbox providers. The policy tag (p) specifies how mailbox providers should handle messages from the domain that fail DMARC checks. The possible values for the policy tag are none, quarantine, or reject1. None means that no action is taken on failed messages and only reports are sent. Quarantine means that failed messages are treated as suspicious and may be filtered or marked as spam. Reject means that failed messages are rejected and not delivered. In this case, the company's DMARC record has a policy tag value of none, which means that mailbox providers will not ignore any email that fails DMARC as required by the company. Instead, mailbox providers will deliver all messages from the domain regardless of their DMARC status and only send reports to the company. To fix this issue, the company should change its policy tag value to reject, which means that mailbox providers will reject and ignore any email that fails DMARC as required by the company. The DMARC record's DKIM alignment tag (A) is not incorrectly configured and does not explain why the company's requirements are not being processed correctly by mailbox providers. The DKIM alignment tag (adkim) specifies how strictly mailbox providers should match DKIM identifiers with From domain identifiers2. The possible values for DKIM alignment tag are s or r. S means strict alignment, which means that DKIM identifiers must exactly match From domain identifiers. R means relaxed alignment, which means that DKIM identifiers must match From domain identifiers at an organizational level (e.g., subdomain.example.com and example.com are considered aligned). In this case, the company's DMARC record has a DKIM alignment tag value of r, which means that mailbox providers will use relaxed alignment for DKIM verification.

Authentication is a method of verifying a user's identity by requiring some piece of evidence, such as something the user knows (e.g., password), something the user has (e.g., token), or something the user is (e.g., fingerprint). Authentication is the best method to prevent unauthorized use of an API, because it ensures that only legitimate users can access or use the API functions or data. HTTPS, geofencing, or rate limiting are other methods that can enhance the security or performance of an API, but they do not prevent unauthorized use of an API. Reference: https://www.redhat.com/en/topics/api/what-is-api-security

Kitten and Jackal are two APT (Advanced Persistent Threat) adversary archetypes that represent non-nation-state threat actors. APT adversary archetypes are categories of threat actors that share common characteristics, such as motivation, objectives, capabilities, or tactics. APT adversary archetypes can help security analysts understand and prioritize the threats they face2. Kitten is a term used to describe Iranian-based threat actors that are typically not backed by the Iranian government. They are motivated by ideological or religious beliefs and target political or regional adversaries3. Jackal is a term used to describe cybercriminal groups that operate as mercenaries or proxies for other threat actors. They are motivated by financial gain and target various sectors and regions.

The CySA+ exam outline calls out "trusted firmware updates," but trusted firmware itself is more commonly described as part of trusted execution environments (TEEs). Trusted firmware is signed by a chip vendor or other trusted party, and then used to access keys to help control access to hardware. TEEs like those used by ARM processors leverage these technologies to protect the hardware by preventing unsigned code from using privileged features." Trusted firmware updates provide organizations with secure code signing, distribution, installation, and attestation for embedded devices. Embedded devices are devices that have a dedicated function and are part of a larger system or network, such as routers, cameras, sensors, etc. Embedded devices often run on firmware, which is a type of software that controls the device's hardware and functionality. Firmware updates are essential for improving the performance, security, and reliability of embedded devices. However, firmware updates also pose risks of introducing vulnerabilities or malware into the devices if they are not properly secured. Trusted firmware updates are firmware updates that use cryptographic techniques to ensure the integrity, authenticity, and confidentiality of the firmware code and data. Trusted firmware updates typically involve four steps1:
Code signing: The firmware code is digitally signed by the firmware developer or provider using a private key. The digital signature proves that the firmware code is from a trusted source and has not been tampered with.
Distribution: The signed firmware code is securely transmitted to the embedded device or a trusted intermediary (such as a cloud service or a gateway) using encryption or other methods. The transmission ensures that the firmware code is not intercepted or modified by unauthorized parties.
Installation: The embedded device verifies the digital signature of the firmware code using a public key that is stored in a secure location (such as a trusted platform module or TPM). The verification ensures that the firmware code is from a trusted source and has not been tampered with. The embedded device then installs the firmware code and reboots to apply the update.
Attestation: The embedded device reports its firmware status and configuration to a trusted verifier (such as a cloud service or a gateway) using a cryptographic proof. The proof ensures that the embedded device has installed the correct firmware update and has not been compromised.
Trusted firmware updates provide organizations with several benefits for hardware assurance, such as2:
Preventing unauthorized or malicious firmware updates that could compromise the security or functionality of embedded devices Detecting and mitigating firmware attacks or incidents that could affect the availability or performance of embedded devices Complying with regulatory or industry standards or best practices for firmware security Enhancing customer trust and satisfaction with embedded devices Trusted firmware updates do not provide organizations with development, compilation, remote access, or customization for embedded devices (A), as these are software engineering tasks that are not directly related to firmware security. Trusted firmware updates do not provide organizations with security specifications, open-source libraries, or custom tools for embedded devices (B), as these are software resources that are not directly related to firmware security. Trusted firmware updates do not provide organizations with remote code execution, distribution, maintenance, or extended warranties for embedded devices , as these are software features or services that are not directly related to firmware security.