Basic fundamental of cyber security| beginner to expert guide| Type of Cyber Security & Tools 2021
Cyber security is practices of protecting computer network, software program, computing resources and IT related equipment from unauthorized digital access and hacking attempt.
1. Malware Attack :- Malware is a very common cybers attack, Trojan, Adware, Spyware, Suspicious Attachment, Virus Mails, Keylogger, Worms, E-mail attachment are the group of malicious software program use to execute "malware attack".
मालवेयर अटैक- (ट्रोजन, एडवेयर, स्पाईवेयर, सस्पेंस अटैचमेंट, वायरस मेल, कीलॉगर, वर्म्स आदि मुख्य प्रकार है|
2. Advance persistent Threat (APT) :- PSU or govt organization usually face Advance persistent Threat (APT) attack, through APT hacker can get access for prolong period of time. In order to continually gain access of confidential data.
3. Denial of Service (DOS) :- DOS attack flood services request using multiple servers. which stops legitimist service request. Advance version of DOS is, Distributed Denial of services (DDOS), where hacker send multiple requests to the resource, flood the bandwidth result Denial of Service attack to harm the organization.
4. SQL injection:- Hacker can manipulate query in database, hacker can view, edit, delete any data in any vulnerable database server.
5. Man-in-the-middle Attack :- Man-in-the-middle Attack is also through malware, known as the network attack or eavesdropping attack, where hacker can hijacks session between the client and the server, and capture data during transections due to unsecure public network.
6. Type of Password attack:
- Dictionary attack
- Brute force (trail and error method), It takes long time using combination and permutation.
- keylogger attack can capture users typed data.
- Shoulder surfing, by looking over the user's shoulder.
- Rainbow table (Attacker use hash table to find the password of user capture hash value).
7. Social Engineering Attack :- Convince someone to get personal information.
8. Phishing attack:- Practices to send fake mail and get access non targeted attack.
9. Spear Phishing Attack:- Targeted attack individual or group by identify the flaws and gullibility of victims.
10. Whaling Phishing Attack:- when target to wealthy and powerful people such as CEO, CFO are targeted.
Tools and idea to Prevent Cyber Attack and Security method :-
1. Firewall - Software, Hardware.
2. Honeypot (honeypot is a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts from unauthorized access.)
3. Strong Password policy
4. Anti Virus
5. Avoid E-mail from unknown Sources.
6. DMZ : A demilitarized zone, is a subnetwork that sits between the public internet and private networks adds an extra layer of security to protect the sensitive data stored on internal networks DMZ approach makes it more difficult for a hacker to gain direct access to an organization’s data.
1. WanaCry ransomware attack in 2017 due to windows Vulnerability found in (server message block) SMB within a day more than 2,30,000 computers were infected across 150 countries. it encrypted the data of users demanded $300 to $600 to decrypt.
2. In February 2019, Dunkin Donuts users were targeted and users
credentials were stolen.
The of purpose of cyber attack is to temper data for monitory gain or harm any user/organization.
Purpose:
1. Disrupting business Continuity.
2. Manipulating data.
3. Create fear and chaos by disrupting critical infrastructure.
4. Financial loss of the target.
5. Achieve military objectives.
6. Demand ransom.
7. Damage reputation of the target.
8. Propagating religious or political beliefs.
Terminologies of Cyber Security:
1. Network:- Network is a group of devices connected to each other through wired or wireless.
2. Server/Client :- Server is a computer hardware or software that provides functionality for other programs or devices, called "clients". This architecture is called the client–server model.
3. Internet :- Internet is globally connected set of network.
4. Network Protocol :- Network Protocol is the defined set of rules that determine the data connectivity and transmission between devices through internet.
5. TCP/UDP : If TCP/UDP would not have been there our network would have collapse.
6. IP address : IP address helps to identify any device or website on internet, IP address is a 32 bit numerical address like (192.168.1.1) assigned to each equipment on network, without IP any device can not connect to the internet.
7. Media Access Control (MAC):- Mac is also called Physical Address of any network equipment (Physical Address: E0-69-95-DE-07-1D it's a unique identification number that assigned to each hardware in the network. known as physical address and it's can't be changed.
Some of the most important cyber security related terminology.
What is cybersecurity ?
Cybersecurity refers to the protection of hardware, software, and data from attackers/hackers. The primary purpose of cyber security is to protect against cyberattacks like accessing, changing, or destroying sensitive information.
Elements of cybersecurity.
The Major elements of cybersecurity are, Information security, Network security, Operational security, Application security, End-user awareness, Business continuity planning.
Advantages of cyber security awareness
Awareness of cyber security helps you to protects your business, organization against ransomware, malware, social engineering, and phishing. It helps to protects end-users. It gives good protection for both data as well as networks. Increase recovery time after a breach. Cybersecurity prevents unauthorized users.
Cryptography
Cryptography is a technique used to protect information from third parties called adversaries. Cryptography allows only sender and recipient of a message to read details about it.
Differentiate between IDS and IPS.
Intrusion Detection System (IDS) detects intrusions, The administrator has to be careful while preventing the intrusion. In the Intrusion Prevention System, the system finds the intrusion and prevent it from hackers.
What is CIA ?
Confidentiality, Integrity, and Availability (CIA) is a popular model which is designed to develop a security policy, CIA model three concepts:
- Confidentiality: Ensure the sensitive data is accessed only by an authorized user.
- Integrity: Integrity means the information is in the right format.
- Availability: Ensure the data and resources are available for users who need them.
Firewall in cyber security.
Firewall is a security system designed for the network. A firewall is set on the boundaries of any system or network which monitors and controls network traffic. Firewalls are mostly used to protect the system or network from malware, worms, and viruses. Firewalls can also prevent content filtering and remote access.
Type of Firewall:
- Packet-filtering firewalls.
- Circuit-level gateways.
- Stateful inspection firewalls.
- Application-level gateways (proxy firewalls)
- Next-gen firewalls.
- Software firewalls.
- Hardware firewalls.
- Cloud firewalls.
What is Traceroute ?
Traceroute is a tool, that shows the network packet path. It lists all the points that the network packet passes through on LAN/WAN. Traceroute is used mostly when the packet does not reach on the destination. Traceroute is used to check where the connection breaks or stops or to identify the failure.
(9) Differentiate between HIDS and NIDS ?
- HIDS :- Host-based intrusion detection system, use to monitoring and analyze the computing system as well as the network packets on network interfaces,
- NIDS, Network intrusion detection system, works in real-time, which means it tracks live data and flags issues as they happen. It detects malicious traffic on a network, in order to analyze network traffic, including all unicast traffic.
It monitors suspicious system activities and traffic of a specific device, It monitors the traffic of all device on the network.
What is SSL ?
SSL stands for Secure Sockets Layer. It is a technology creating encrypted connections between a web server and a web browser. It is used to protect the information in online transactions and digital payments to maintain data privacy.
Data leakage
Data leakage is an unauthorized transfer of data to the outside world. Data leakage occurs via email, optical media, laptops, and USB keys.
What is Brute force attack, How can we prevent it ?
It is a trial-and-error method to find out the right password or PIN. Hackers repetitively try all the combinations of credentials. In many cases, brute force attacks are automated where the software automatically works to login with credentials. There are ways to prevent Brute Force attacks. using Setting password length. Increase password complexity. Set limit on login failures.
Port scanning service
It is the technique for identifying open ports and service available on a specific host. Hackers use port scanning technique to find information for malicious purposes.
Name the different layers of the OSI model.
Seven different layers of OSI models are as follows:
- Physical Layer
- Data Link Layer
- Network Layer
- Transport Layer
- Session Layer
- Presentation Layer
- Application Layer
What is a VPN and it's usage ?
VPN stands for Virtual Private Network. It is a network connection method for creating an encrypted and safe connection. This method protects data from interference, snooping, censorship.
Black Hat hackers.
Black hat hackers are people who have a good knowledge of breaching network security. These hackers can generate malware for personal financial gain or other malicious reasons. They break into a secure network to modify, steal, or destroy data so that the network can not be used by authorized network users.
White hat hackers.
White hat hackers or security specialist are specialized in penetration testing. They protect the information system of an organization.
Grey hat hackers.
Grey hat hackers are computer hacker who sometimes violate ethical standards, but they do not have malicious intent.
How can we reset a password-protected BIOS configuration ?
There are various ways to reset BIOS password. Some of them are as follows:
- Remove CMOS battery.
- By utilizing the software.
- By utilizing a motherboard jumper.
- By utilizing MS-DOS.
What is MITM attack ?
A MITM or Man-in-the-Middle is a type of attack where an attacker intercepts communication between two persons. The main intention of MITM is to access confidential information.
ARP and its working process.
It is a protocol used for finding MAC address associated with IPv4 address. This protocol work as an interface between the OSI network and OSI link layer.
About botnet.
It's a number of internet-connected devices like servers, mobile devices, IoT devices, and PCs that are infected and controlled by malware.
Main difference between SSL and TLS.
The main difference between these two is that SSL verifies the identity of the sender. SSL helps you to track the person you are communicating to. TLS offers a secure channel between two clients.
Abbreviation of CSRF ?
CSRF stands for Cross-Site Request Forgery.
What is 2FA, how can we implement it for a public website ?
TFA stands for Two Factor Authentication. It is a security process to identify the person who is accessing an online account. The user is granted access only after presenting evidence to the authentication device.
Difference between asymmetric and symmetric encryption.
Symmetric encryption requires the same key for encryption and decryption. On the other hand, asymmetric encryption needs different keys for encryption and decryption.
Full form of XSS ?
XSS stands for cross-site scripting.
Explain WAF:- WAF stands for Web Application Firewall. WAF is used to protect the application by filtering and monitoring incoming and outgoing traffic between web application and the internet.
What is Hacking exactly ? Hacking is a process of finding weakness in computer or private networks to exploit its weaknesses and gain access.
For example, using password cracking technique to gain access to a system.
Who are called hackers ?
A Hacker is a person who finds and exploits the weakness in computer systems, smartphones, tablets, or networks to gain access. Hackers are well experienced computer programmers with knowledge of computer security.
What is network sniffing ?
Network sniffing is a tool used for analyzing data packets sent over a network. This can be done by the specialized software program or hardware equipment. Sniffing can be used to:
Capture sensitive data such as password.
Eavesdrop on chat messages
Monitor data package over a network
Importance of DNS monitoring ?
Yong domains are easily infected with malicious software. You need to use DNS monitoring tools to identify malware.
Process of salting. What is the use of salting ?
Salting is that process to extend the length of passwords by using special characters. To use salting, it is very important to know the entire mechanism of salting. The use of salting is to safeguard passwords. It also prevents attackers testing known words across the system.
For example, Hash("QxLUF1bgIAdeQX") is added to each and every password to protect your password. It is called as salt.
What is SSH ?
SSH stands for Secure Socket Shell or Secure Shell. It is a utility suite that provides system administrators secure way to access the data on a network.
SSL protocol in network security.
SSL verifies the sender's identity, but it does not provide security once the data is transferred to the server. It is good to use server-side encryption and hashing to protect the server against a data breach.
black box testing and white box testing.
Black box testing: It is a software testing method in which the internal structure or program code is hidden.
White box testing: A software testing method in which internal structure or program is known by tester.
Major vulnerabilities in network security.
Vulnerabilities refer to the weak point in software code which can be exploited by a threat actor. They are most commonly found in an application like SaaS (Software as a service) software.
TCP Three-way handshake.
It is a process used in a network to make a connection between a local host and server. This method requires the client and server to negotiate synchronization and acknowledgment packets before starting communication.
The term residual risk, What are three ways to deal with risk ?
It is a threat that balances risk exposure after finding and eliminating threats.
Three ways to deal with risk are:
- Reduce it
- Avoid it
- Accept it.
Define Exfiltration.
Data exfiltration refers to the unauthorized transfer of data from a computer system. This transmission may be manual and carried out by anyone having physical access to a computer.
Exploit in network security?
An exploit is a method utilized by hackers to access data in an unauthorized way. It is incorporated into malware.
Penetrating testing ?
It is the process of checking exploitable vulnerabilities on the target. In web security, it is used to augment the web application firewall.s
Common cyber-attack.
Following are the common cyber-attacks which can be used by hackers to damage network:
- Malware
- Phishing
- Password attacks
- DDoS
- Man in the middle
- Drive-by downloads
Malvertising - (Malvertising is the use of online advertising to spread malware) Rogue software
User authentication process.
In order to authenticate users, they have to provide their identity. The ID and Key can be used to confirm the user's identity. This is an ideal way how the system should authorize the user. concept of cross-site scripting.
Cross-site scripting
Cross-site scripting refers to a network security vulnerability in which malicious scripts are injected into websites. This attack occurs when attackers allow an untrusted source to inject code into a web application.
Name the protocol that broadcast the information across all the devices.
Internet Group Management Protocol or IGMP is a communication protocol that is used in game or video streaming. It facilitates routers and other communication devices to send packets.
Way to protect email messages ?
Use cipher algorithm to protect email, credit card information, and corporate data.
Risks associated with public Wi-Fi network.
Public Wi-Fi has many security issues. Wi-Fi attacks include karma attack, sniffing, war-driving, brute force attack, etc.
Public Wi-Fi may identify data that is passed through a network device like emails, browsing history, passwords, and credit card data.
Data Encryption, Why it is important in network security ?
Data encryption is a technique in which the sender converts the message into a code. It allows only authorized user to gain access.
Main difference between Diffie-Hellman and RSA.
Diffie-Hellman is a protocol used while exchanging key between two parties while RSA is an algorithm that works on the basis two keys called private and public key.
- Tcpdump
- Kismet
- Wireshark
- NetworkMiner
- Dsniff
- Protocol Sniffing
- Web password sniffing
- Application-level sniffing
- TCP Session stealing
- LAN Sniffing
- ARP Sniffing
- What is a distributed denial-of-service attack (DDoS)?
- Using packet Sniffers
- Cross-Site Scripting (XSS Attack)
- IP Spoofing
- Blind Attack
- RSA
- Twofish
- AES
- Triple DES
- Aircrack
- WebDecrypt
- Kismet
- WEPCrack
- Acunetix
- WebInspect
- Probably
- Netsparker
- Angry IP scanner:
- Burp Suite
- Savvius
- SQL Injection
- Cross-site request forgery
- Insecure cryptographic storage
- Broken authentication and session management
- Insufficient transport layer protection
- Unvalidated redirects and forwards
- Failure to restrict URL access
- Trojans
- Adware
- Worms
- Spyware
- Denial of Service Attacks
- Distributed Denial of Service Attacks
- Virus
- Key loggers
- Unauthorized access to computer systems resources
- Phishing
- Virus
- Backdoors
- Bots
- Worm
0 Comments:
Post a Comment