225 - 300 reminders

evil twin

• A type of wireless attack where an attacker sets up a rogue (fake) access point that mimics a legitimate Wi-Fi network, often using the same or a very similar SSID (network name).

• The goal is to trick users into connecting to the attacker's fake AP instead of the real one, believing it's the legitimate network.

• Commonly deployed in public places with open Wi-Fi, like coffee shops, airports, or hotels, where users are used to connecting to unsecured networks without much scrutiny.

• Attackers often pair this with deauthentication attacks: flooding the area with deauth frames to forcibly disconnect users from the real AP, prompting their devices to automatically reconnect, this time to the attacker's rogue AP with the matching name.

• Once a victim connects to the evil twin, all their traffic passes through the attacker's device, allowing the attacker to perform a man-in-the-middle attack: intercepting, monitoring, or even modifying traffic, capturing credentials, session cookies, or other sensitive data.

• Because the fake AP looks identical to the real one (same name, sometimes even cloned MAC address), users have no easy way to visually distinguish it from the legitimate network.

• Mitigations include using a VPN on public Wi-Fi (encrypts traffic even if it passes through a rogue AP), verifying network names/certificates with staff before connecting, and enterprise use of wireless intrusion prevention systems (WIPS) that detect rogue APs and deauth floods.

salting

• A technique used alongside password hashing to strengthen the security of stored passwords.

• Involves adding a random, unique string of data (the "salt") to a password before it's run through a hashing algorithm.

• Each password gets its own distinct salt, so even if two users have the exact same password, their resulting hashes will look completely different once salted and hashed.

• The salt is typically stored alongside the hash in the database (it doesn't need to be secret), so it can be reapplied during future login attempts to verify the password.

• Primary purpose: defeats precomputed attack methods like rainbow tables, since an attacker would need a separate precomputed table for every possible salt value, making that approach computationally impractical.

• Also protects against the weakness of identical passwords producing identical hashes; without salting, an attacker who cracks one hash instantly knows every other account sharing that same password.

• Different from key stretching (like PBKDF2, bcrypt, or scrypt), which intentionally slows down the hashing process itself to make brute-force attempts more time-consuming, salting and key stretching are often used together for stronger password protection.

• Does not encrypt the password (encryption is reversible), salting works in conjunction with one-way hashing, meaning the original password still can't be directly recovered from the stored hash+salt.

cgflags

• Not a standard, widely recognized Linux command-line tool for managing file permissions.

• The closest real concept is cgroups (control groups), a Linux kernel feature used to limit, account for, and isolate resource usage (CPU, memory, disk I/O) of a collection of processes, but this is unrelated to file permission management or the SUID bit.

• Doesn't apply to changing file permissions or removing the setuid bit.

chmod

• Stands for "change mode." A Linux/Unix command used to change the permissions (read, write, execute) of files and directories for the owner, group, and others.

• Uses either symbolic notation (e.g., chmod u+x file, chmod o-w file) or numeric/octal notation (e.g., chmod 755 file) to set permissions.

• Can also modify special permission bits: SUID (set user ID), SGID (set group ID), and the sticky bit.

• The correct tool for both tightening overly permissive file permissions and removing the setuid bit (e.g., chmod u-s filename or chmod 0755 filename).

lsof

• Stands for "list open files." Displays a list of all files currently opened by running processes on a system.

• Since in Unix/Linux almost everything is treated as a file (including network sockets, devices, and directories), lsof is commonly used to see which processes have which files, ports, or network connections open.

• Useful for troubleshooting or investigating suspicious process activity, but it doesn't change permissions or file attributes, it's purely for viewing/inspecting what's open.

setuid

• A special Unix/Linux file permission bit (Set User ID). When set on an executable file, it causes the program to run with the privileges of the file's owner, rather than the privileges of the user who actually executed it.

• Commonly used for programs that need elevated (often root) privileges to perform a specific task, even when run by a regular user (e.g., the passwd command needs to modify a normally root-only file).

• A security risk if misconfigured or applied to the wrong files, since it can allow privilege escalation, a regular user running a SUID-root program could potentially gain root-level access if the program has vulnerabilities.

• It's an attribute/permission bit, not a command-line tool itself, it's viewed with ls -l (shown as an "s" in the permission string) and set or removed using chmod.

SHA-2 (Secure Hash Algorithm 2

• A family of cryptographic hash functions designed by the NSA and published by NIST, used to take an input (like a file, message, or password) and produce a fixed-length output called a hash or digest.

• Includes several variants based on output length, most commonly SHA-224, SHA-256, SHA-384, and SHA-512 (the number refers to the bit-length of the resulting hash).

• SHA-256 is the most widely used variant today and is considered the current standard for law enforcement, forensics, and general security applications.

• One-way function: it's computationally infeasible to reverse a SHA-2 hash back into the original input data, unlike encryption, hashing is not meant to be decrypted.

• Deterministic: the same input will always produce the exact same hash output, but even a tiny change to the input (a single character) produces a completely different, unpredictable hash (this is called the avalanche effect).

• Common uses: verifying file/data integrity (comparing hashes before and after to detect tampering), digital signatures, password storage (usually combined with salting), forensic drive imaging (hashing a disk image to prove it hasn't been altered), and blockchain/cryptocurrency systems.

• Successor to SHA-1, which is now considered cryptographically weak and vulnerable to collision attacks (where two different inputs produce the same hash); SHA-2 was developed to address those weaknesses and remains secure against practical collision attacks as of now.

• Important distinction: SHA-2 by itself is just a hash function, it is not the same as a digital signature. A true digital signature typically involves hashing the data with something like SHA-2, then encrypting that hash with a sender's private key, which is what actually proves who created/signed it (non-repudiation), a plain SHA-2 hash alone only proves integrity (data wasn't altered), not authorship.

Cloud Control Matrix (CCM)

• A cybersecurity control framework developed by the Cloud Security Alliance (CSA) specifically for cloud computing environments.

• Provides a structured set of security controls mapped across multiple domains (e.g., data security, identity management, encryption, incident response) tailored to cloud service providers and cloud consumers.

• Cross-references controls to major compliance standards and frameworks (like ISO 27001, NIST, PCI DSS, GDPR), helping organizations assess a cloud provider's security posture against recognized standards.

• Commonly used by organizations to evaluate and compare the security capabilities of different cloud vendors before adoption.

reference architecture

• A document, typically produced by a manufacturer or vendor, that provides a recommended template or blueprint for how their specific products or systems should be designed, configured, and deployed.

• Shows best-practice arrangements of components (e.g., how firewalls, switches, and security appliances should be laid out together) to achieve an optimal, secure, and functional implementation.

• Serves as a starting point or standard that organizations can adapt to their own environment while staying aligned with the vendor's tested and supported configurations.

• Helps ensure consistency, reduces implementation errors, and reflects the manufacturer's expertise on how their own technology performs best.

CIS Top 20 (CIS Critical Security Controls)

• A prioritized, action-oriented list of cybersecurity best practices developed by the Center for Internet Security (CIS), designed to help organizations defend against the most common and impactful cyberattacks.

• Ranked and grouped into control categories, ranging from basic hygiene (like asset inventory, and secure configurations) to more advanced controls (like penetration testing and incident response).

• Vendor-neutral and broadly applicable, meant to give organizations of any size a practical, prioritized starting point for improving their overall security posture.

• Frequently referenced alongside frameworks like NIST CSF, but is more of a concrete checklist/control set rather than a full risk management methodology.

ping sweep

• A network scanning technique used to determine which IP addresses within a given range are active (i.e., have a live host responding).

• Works by sending ICMP echo request (ping) packets to a range of IP addresses and recording which ones send back an ICMP echo reply.

• Helps network administrators or attackers quickly map out which hosts on a network are currently online, without needing to know exact hostnames in advance.

• Considered a form of reconnaissance, often one of the first steps in network discovery, whether for legitimate administration (asset inventory, troubleshooting) or malicious purposes (identifying live targets before further attacks like port scanning).

• Limitation: it only confirms whether a host is up and responding to ICMP, it doesn't verify the identity, ownership, or legitimacy of the device, and some hosts may be configured to not respond to ICMP requests (making them appear offline even if they're active), which can result in incomplete results.

• Commonly performed using tools like nmap, fping, or angry IP scanner.

• Relevant to the earlier question because a ping sweep would only show that a device at a given IP is alive/responding, it wouldn't help distinguish a legitimate device from one using a spoofed MAC address, since the spoofed device would still respond to pings just like any other active host.

DaaS (Desktop as a Service)

• A cloud computing model that delivers virtual desktop environments to end users over the internet, hosted and managed by a third-party cloud provider.

• Users can access a full desktop operating system, complete with applications, files, and settings, from virtually any device (laptop, tablet, thin client) with an internet connection.

• The cloud provider handles the underlying infrastructure, including the virtual machines, storage, patching, and maintenance of the desktop environment, reducing the burden on the organization's internal IT team.

• Closely related to VDI (Virtual Desktop Infrastructure), the key difference is that VDI is typically self-hosted/managed by the organization on its own infrastructure, while DaaS is outsourced to and hosted by a third-party cloud provider on a subscription basis.

• Useful for scenarios requiring flexible, centrally managed, and consistent desktop environments, such as remote workforces, contractors, BYOD environments, or organizations wanting to avoid managing physical desktop hardware and local software installations.

• Benefits include easier scalability (quickly add/remove desktop instances), centralized security and data control (data stays in the cloud rather than on local devices), and simplified device management.

• Not related to email or general application delivery, it specifically refers to delivering an entire virtualized desktop experience, as opposed to SaaS, which delivers a single specific software application (like email) as a service.

XSS (Cross-Site Scripting)

• A web application vulnerability where an attacker injects malicious scripts (usually JavaScript) into content that is then served to and executed by other users' browsers.

• Exploits the trust a user's browser has in a legitimate website, the malicious script runs in the context of that trusted site, giving it access to things like cookies, session tokens, and other sensitive data the browser holds for that domain.

• Three main types:

  • Stored (persistent) XSS: the malicious script is permanently saved on the target server (e.g., in a database, comment field, or forum post) and served to every user who views that page.

  • Reflected (non-persistent) XSS: the malicious script is embedded in a URL or request and immediately reflected back in the server's response, typically requiring a victim to click a crafted malicious link.

  • DOM-based XSS: the vulnerability exists in client-side JavaScript code itself, where the attack payload is executed as a result of modifying the DOM (Document Object Model) in the victim's browser, without necessarily involving the server at all.

• Common impacts: session hijacking (stealing cookies/session tokens), credential theft, defacement, redirecting users to malicious sites, or performing actions on behalf of the victim without their consent.

• Root cause: applications failing to properly validate, sanitize, or encode user-supplied input before rendering it back to users in a web page.

• Common mitigations: input validation, output encoding/escaping, Content Security Policy (CSP) headers, and using frameworks that automatically escape output by default.

• Different from SQL injection: XSS targets the browser/client-side (executing script in a victim's browser), while SQL injection targets the backend database (executing malicious SQL commands on the server).

dnsenum

• A command-line tool used for DNS enumeration, the process of gathering as much information as possible about a domain's DNS infrastructure.

• Capabilities include finding a domain's nameservers, MX (mail exchange) records, performing zone transfers (if misconfigured and allowed), brute-forcing subdomains, and identifying IP address ranges associated with a domain.

• Works by directly querying the target's DNS servers, which means it involves some direct interaction with the target's infrastructure, making it more active than purely passive OSINT gathering.

• Commonly used during the reconnaissance phase of a penetration test or by attackers to map out a target's network footprint via DNS records.

Nessus

• A widely used commercial vulnerability scanning tool developed by Tenable.

• Actively scans systems, networks, and applications to identify known vulnerabilities, missing patches, misconfigurations, and compliance issues.

• Works by directly probing target systems, sending requests and analyzing responses to determine what vulnerabilities exist, this makes it an active reconnaissance/scanning tool, not a passive one.

• Produces detailed reports ranking vulnerabilities by severity (often using CVSS scoring), helping security teams prioritize remediation efforts.

• Commonly used by security teams for routine vulnerability management and by penetration testers during authorized assessments.

theHarvester

• An open-source OSINT (Open-Source Intelligence) reconnaissance tool used to gather publicly available information about a target organization or domain.

• Collects data such as email addresses, employee names, subdomains, IP addresses, and URLs by querying public sources, search engines (like Google, Bing), PGP key servers, social media, and other open databases, rather than directly interacting with the target's own systems.

• Because it relies on publicly accessible third-party sources instead of probing the target directly, it's considered a passive reconnaissance tool, useful for understanding what information about an organization is already exposed and could be leveraged by an attacker without ever touching the target's network.

• Commonly one of the first tools used in the reconnaissance phase of a penetration test, and it's the correct tool for scenarios (like the previous question) that specifically call for identifying publicly available data without engaging in active reconnaissance.

block cipher

• A symmetric encryption algorithm that encrypts data in fixed-size chunks, called blocks (for example, 128-bit blocks), rather than encrypting data continuously as a stream.

• Each block of plaintext is transformed into a block of ciphertext using the same secret key, and this process is reversible with that same key (symmetric encryption), the same key decrypts what it encrypted.

• Common examples include AES (Advanced Encryption Standard) and DES (Data Encryption Standard, now considered outdated/insecure).

• Often used with a mode of operation (like CBC, GCM, or ECB) that determines how multiple blocks are linked together during encryption, important for security since naive block-by-block encryption (like ECB) can leak patterns in the data.

• Contrasted with a stream cipher, which encrypts data one bit or byte at a time continuously, rather than in fixed-size blocks.

• Not inherently tied to non-repudiation or digital signatures, it's a general-purpose method for achieving confidentiality of data, whether at rest or in transit.

Jamming

• An attack that disrupts or blocks wireless communication by broadcasting interference or noise on the same frequency used by legitimate wireless signals.

• Prevents legitimate devices from establishing or maintaining a connection, essentially a denial-of-service attack targeting the radio frequency layer.

• Does not involve intercepting or impersonating anything, it simply overwhelms the frequency so real signals can't get through clearly.

• Can affect Wi-Fi, Bluetooth, cellular, or other RF-based communications.

Rogue access point

• Any unauthorized wireless access point connected to a network without explicit approval from the network administrator.

• Can be set up maliciously by an attacker seeking unauthorized network access, or unintentionally by an employee plugging in a personal router/AP for convenience.

• Creates a security gap because it may bypass the organization's security controls (firewalls, monitoring, authentication policies) that are otherwise enforced on approved network access points.

• An evil twin is technically a specific, more deceptive type of rogue access point, one that specifically mimics a legitimate AP's identity to trick users, whereas "rogue AP" more broadly just means unauthorized, without necessarily impersonating anything.

Disassociation

• An attack where a malicious actor sends spoofed 802.11 management frames to forcibly disconnect a client device from its currently connected wireless access point.

• Exploits the fact that the disassociation frame in the Wi-Fi protocol is typically unauthenticated, allowing an attacker to send it on behalf of the AP or client without needing to break encryption.

• Often used as a setup step for other attacks, for example, forcing a user to disconnect and then reconnect, so the attacker can capture the handshake (for offline password cracking) or redirect the victim to a rogue/evil twin AP.

• Different from jamming: disassociation targets a specific client connection using legitimate-looking protocol frames, rather than broadly overwhelming the RF spectrum with noise.

BSSID (Basic Service Set Identifier)

BSSID (Basic Service Set Identifier)

• The unique MAC address (hardware address) assigned to a specific wireless access point's radio.

• Functions as the technical, machine-level identifier for a wireless access point, distinguishing one physical AP from another even if they broadcast the same network name.

• When multiple access points share the same network name (ESSID) as part of a larger wireless network (like in an office with several APs for coverage), each individual AP still has its own unique BSSID.

• Relevant to attacks like evil twin: if a rogue AP is spoofing not just the ESSID but also the exact BSSID of a legitimate AP, it's an especially convincing impersonation, since even MAC-based verification would appear to match the real device.

ESSID (Extended Service Set Identifier)

• Commonly just called the SSID, this is the human-readable network name that users see and select when connecting to a Wi-Fi network (e.g., "CorpNet-WiFi").

• Multiple access points can share the same ESSID to form one seamless, extended wireless network, allowing devices to roam between APs without needing to reconnect to a "different" network each time.

• Unlike the BSSID, the ESSID is just a name/label, it doesn't uniquely identify a specific physical device, which is exactly what makes it easy for an attacker to clone in an evil twin attack, simply broadcasting the same name.

Z-Wave

• A wireless communication protocol specifically designed for home automation and IoT devices (smart locks, thermostats, lighting, sensors, etc.).

• Operates on a lower radio frequency (around 800-900 MHz range, varies by region) than Wi-Fi or Bluetooth, which helps reduce interference from common household wireless devices.

• Uses a mesh network topology, meaning devices can relay signals to each other, extending overall range and reliability without needing every device to reach the central hub directly.

• Proprietary technology (managed by the Z-Wave Alliance), meaning devices must be certified to ensure interoperability between different manufacturers.

• Generally considered to have lower power consumption, making it well suited for battery-operated smart home devices.

Zigbee

• A wireless communication protocol built specifically for low-power, low-data-rate IoT and home automation devices, similar in purpose to Z-Wave.

• Operates on the 2.4 GHz frequency band (in most regions), the same general band used by Wi-Fi and Bluetooth, which can sometimes lead to interference.

• Also uses a mesh network topology, allowing devices to relay data to extend coverage across a home or building.

• Open standard (unlike Z-Wave's more proprietary/certified model), maintained by the Zigbee Alliance (now called the Connectivity Standards Alliance), allowing a wider range of manufacturers to build compatible devices.

• Commonly used in smart lighting, sensors, and smart home hubs (e.g., many devices compatible with Amazon Echo or Google Home use Zigbee).

ALE (Annualized Loss Expectancy)

• The total estimated monetary loss an organization expects to incur from a specific risk over the course of one year.

• Calculated using the formula: ALE = SLE x ARO (Single Loss Expectancy multiplied by Annual Rate of Occurrence).

• Used in quantitative risk assessment to help organizations prioritize which risks are worth investing in mitigating, based on the expected annual financial impact.

• Example: if a single incident costs $5,000 (SLE) and is expected to happen twice a year (ARO of 2), the ALE would be $10,000.

ARO (Annual Rate of Occurrence)

• An estimate of how many times a specific risk event is expected to occur within a one-year period.

• A frequency/count value, not a dollar amount, it simply answers "how often does this happen per year?"

• Often derived from historical data or trends (like the steadily increasing device replacement rate in the earlier question) to project future occurrences.

• Used as one of the two inputs (along with SLE) needed to calculate ALE.

RPO (Recovery Point Objective)

• Defines the maximum acceptable amount of data loss, measured in time, that an organization can tolerate after a disruption or disaster.

• Answers the question: "how far back in time can we afford to lose data before it becomes unacceptable?" (e.g., an RPO of 4 hours means backups must occur at least every 4 hours so no more than that much data is ever lost).

• Used in business continuity and disaster recovery planning to determine appropriate backup frequency and data replication strategies.

• Different from RTO (Recovery Time Objective), which measures how quickly a system must be restored after an outage, RPO focuses on acceptable data loss, not downtime.

SLE (Single Loss Expectancy)

• The monetary value of the loss expected from a single occurrence of a specific risk event.

• Calculated using the formula: SLE = Asset Value (AV) x Exposure Factor (EF), where EF is the percentage of the asset's value that would be lost in that event.

• Represents the cost of just one incident, as opposed to ALE, which represents the total expected cost across an entire year (factoring in how often the event is likely to occur).

• Example: if a laptop worth $1,000 (AV) is completely lost or destroyed in an incident (100% EF), the SLE for that event would be $1,000.

TTP (Tactics, Techniques, and Procedures)

• A framework used in cybersecurity and threat intelligence to describe and categorize the behavior patterns of threat actors, essentially the "how" behind an attack.

• Tactics: the high-level, strategic goals an attacker is trying to achieve during an attack (e.g., initial access, privilege escalation, exfiltration). Represents the "what" the attacker wants to accomplish.

• Techniques: the specific methods used to achieve a given tactic (e.g., phishing to gain initial access, or exploiting a specific vulnerability to escalate privileges). Represents the "how" a tactic is carried out.

• Procedures: the detailed, step-by-step implementation of a technique by a specific threat actor or group, essentially their unique playbook or exact sequence of actions (e.g., the specific tools, scripts, or order of operations a particular APT group uses).

• Used to profile and track specific threat actors or groups (like APTs), since TTPs often act like a "fingerprint," different attackers tend to have consistent, identifiable patterns in how they operate, even if they change tools or targets.

• The MITRE ATT&CK framework is one of the most widely used references for cataloging and standardizing known TTPs across the industry, helping defenders map detected activity to known adversary behavior.

• Useful for proactive defense: understanding common TTPs allows security teams to anticipate likely attacker behavior and build detections/defenses around patterns rather than just specific indicators (like IP addresses or file hashes), which attackers can easily change.

• Different from IOCs (Indicators of Compromise), which are specific, static artifacts of an attack (like a malicious file hash or IP address); TTPs describe behavior, which is generally more stable and harder for attackers to change than individual IOCs.

WPA2-Enterprise

• A Wi-Fi security mode that uses 802.1X authentication, requiring each user to authenticate individually with their own unique credentials (username/password, digital certificate, etc.) rather than a shared network password.

• Integrates with a RADIUS (Remote Authentication Dial-In User Service) server, which centrally handles authentication, authorization, and accounting for network access.

• Supports dynamic per-session encryption keys, meaning each user's session gets its own unique encryption key that can be rotated/regenerated without disrupting the connection or requiring reauthentication.

• Because each user authenticates individually, network administrators can track, differentiate, and revoke access for specific users without affecting others, ideal for organizations/enterprises with many users needing granular access control.

• Contrasted with WPA2-Personal (PSK), which uses a single shared password for all users on the network.

WPA3-PSK

• The Personal mode of WPA3 (the newest Wi-Fi security standard), designed for home or small-network use where a single shared password (Pre-Shared Key) is used by all devices connecting to the network.

• Improves upon WPA2-PSK with stronger protection against offline password-guessing/brute-force attacks, using a more secure key exchange method called SAE (Simultaneous Authentication of Equals, also known as Dragonfly).

• Provides forward secrecy, meaning that even if an attacker later obtains the password, they can't decrypt previously captured traffic.

• Since all users share the same key, it cannot differentiate between individual users, and it doesn't natively support RADIUS integration, that functionality is specific to Enterprise mode, not PSK/Personal mode.

802.11n

• An IEEE wireless networking standard (commonly branded as "Wireless N"), part of the broader family of Wi-Fi standards (802.11a/b/g/n/ac/ax, etc.).

• Defines technical specifications related to speed, frequency bands (operates on both 2.4 GHz and 5 GHz), range, and the use of multiple antennas (MIMO, Multiple-Input Multiple-Output) to improve throughput and reliability.

• Purely a performance/connectivity standard, it has no relation to encryption, authentication, or security controls like RADIUS integration or user differentiation.

• Later superseded by faster standards like 802.11ac and 802.11ax (Wi-Fi 6).

forward proxy

• A server that sits between internal clients (users on a network) and the internet, forwarding outbound requests on behalf of those clients.

• When a client wants to access an external website or resource, the request goes to the forward proxy first, which then makes the request to the destination server on the client's behalf, and relays the response back to the client.

• The external server sees the request as coming from the proxy, not directly from the original client, effectively masking the client's identity/IP address from the destination.

• Common uses:

  • Content filtering: blocking access to specific websites or categories of content (e.g., enforcing an organization's acceptable use policy).

  • Caching: storing frequently requested content locally to improve performance and reduce bandwidth usage for repeat requests.

  • Anonymity: hiding internal client IP addresses from external destinations.

  • Monitoring/logging: tracking what internal users are accessing on the internet.

• Contrasted with a reverse proxy, which sits in front of servers (not clients) and manages inbound requests from external users heading to internal backend services, essentially the opposite direction of traffic flow.

• Commonly used in corporate/school networks to control and monitor employee or student internet usage.

Port 135

• RPC Endpoint Mapper

• Used by Microsoft's Remote Procedure Call (RPC) service, specifically the RPC Endpoint Mapper, which helps clients locate the correct port/service for various Windows RPC-based services.

• Often associated with Windows management functions, remote administration, and some legacy Windows services communicating with each other.

• Frequently targeted by attackers and worms in the past (e.g., the Blaster worm exploited RPC vulnerabilities), so it's commonly blocked from external access as a best practice, but it is not itself the SMB file-sharing port.

Port 139

NetBIOS Session Service

• Used for the legacy NetBIOS Session Service, which historically carried SMB (file/printer sharing) traffic over NetBIOS on older Windows networks.

• Part of the original way SMB communicated before Microsoft introduced the ability to run SMB directly over TCP/IP without NetBIOS.

• Still present on many networks for backward compatibility with older systems/applications, but is a common target for attack

Port 143

• Used by IMAP (Internet Message Access Protocol), a protocol for retrieving and managing email messages from a mail server.

• Allows users to view, organize, and sync email across multiple devices while keeping messages stored on the server (as opposed to POP3, which typically downloads and removes messages from the server).

• Unencrypted by default; secure email retrieval typically uses IMAPS (IMAP over SSL/TLS) on port 993 instead.

• Unrelated to file sharing or the SMB protocol.

Port 161

• Used by SNMP (Simple Network Management Protocol), a protocol for monitoring and managing network devices like routers, switches, and servers.

• Allows administrators to query device status, performance metrics, and configuration information remotely.

• Older versions of SNMP (v1 and v2c) are considered insecure due to weak, often default, community strings (essentially plaintext passwords), SNMPv3 added stronger authentication and encryption.

• Unrelated to file sharing/SMB.

Port 443

• Used for HTTPS (HTTP Secure), which is standard HTTP web traffic encrypted using TLS (or historically SSL).

• The standard port for secure websites, protecting data in transit between a browser and a web server, such as login credentials, form submissions, and payment information.

• Essential for modern web security and widely used across virtually all secure websites and web applications.

• Unrelated to SMB or file-sharing traffic.

Port 445

(SMB over TCP / Microsoft-DS)

• Used by modern SMB (Server Message Block), running directly over TCP/IP without requiring NetBIOS.

• Handles file sharing, printer sharing, and other inter-process communication between Windows systems (and Linux/macOS systems using Samba).

• The primary port associated with well-known SMB vulnerabilities and exploits, including EternalBlue (CVE-2017-0144), which was used in the WannaCry ransomware attack.

• Should never be exposed to the internet due to the high risk of exploitation; it's intended for internal network use only.

AH

(Authentication Header)

• A protocol within the IPsec (Internet Protocol Security) suite, used to provide authentication and data integrity for IP packets.

• Verifies that the packet's contents, including the IP header and the payload, haven't been altered or tampered with in transit, and confirms the packet genuinely originated from the claimed sender.

• Uses a hashing/HMAC (Hash-based Message Authentication Code) mechanism to generate an integrity check value based on the packet contents and a shared secret key, allowing the receiver to verify authenticity and integrity.

• Does NOT provide confidentiality/encryption, AH only authenticates and verifies integrity, it does not hide or encrypt the actual data being transmitted, so the payload remains readable to anyone intercepting it.

• Can operate in two modes:

  • Transport mode: only the payload of the original IP packet is protected, the original IP header remains largely intact (used for end-to-end communication between two hosts).

  • Tunnel mode: the entire original IP packet (header and payload) is encapsulated inside a new IP packet, providing protection for the whole original packet (commonly used for VPN gateway-to-gateway communication).

• Contrasted with ESP (Encapsulating Security Payload), which provides confidentiality (encryption) in addition to some authentication, but doesn't authenticate the outer IP header the way AH does. In practice, AH and ESP are sometimes used together to get both full header authentication and payload encryption.

• Because AH doesn't encrypt data and has known compatibility issues with NAT (Network Address Translation, since AH's integrity check includes IP header fields that NAT devices modify), ESP is far more commonly used alone in modern VPN implementations, while AH is used specifically in scenarios that require strict header-level authentication.

NIC teaming (Network Interface Card teaming)

• A technique that combines two or more physical network interface cards (NICs) on a single server or device into one logical network interface.

• Primary goals: redundancy (fault tolerance) and/or increased bandwidth/throughput, depending on the configuration mode used.

• Redundancy/failover: if one NIC or its associated network connection fails, traffic automatically continues flowing through the remaining active NIC(s) in the team, preventing a single point of failure from taking the device offline.

• Load balancing/aggregation: some configurations allow traffic to be spread across multiple NICs simultaneously, increasing overall available bandwidth beyond what a single NIC could provide.

• Commonly used on servers, especially in data centers and virtualization environments, where network uptime and performance are critical.

• A resiliency technique focused specifically on network connectivity redundancy at the hardware/interface level, distinct from broader security strategies like defense in depth, which layers multiple different security controls (firewalls, IPS, etc.) rather than combining physical network hardware

application whitelisting

Application whitelisting

• A security approach that only allows pre-approved, explicitly authorized applications or executables to run on a system, blocking everything else by default.

• Operates on a "default deny" model, unlike blacklisting (which blocks known-bad software while allowing everything else), whitelisting flips the logic: nothing runs unless it's specifically permitted.

• Prevents unauthorized, unknown, or malicious software, including malware, backdoors, and unapproved third-party programs, from executing, even if a user is tricked into downloading it (as in a social engineering attack like the one in the previous question).

• Typically managed through policies that define approved applications by criteria such as file name, file path, digital signature/publisher certificate, or cryptographic hash.

• Particularly effective against zero-day malware and unknown threats, since it doesn't rely on recognizing "known bad" signatures the way traditional antivirus does, if it's not on the approved list, it simply won't run, regardless of whether it's a known threat or a brand-new one.

• Common implementation tools include Microsoft AppLocker and Windows Defender Application Control (WDAC) on Windows systems.

• Trade-off: requires more administrative overhead to maintain and update the approved application list, and can be more restrictive/inconvenient for users compared to blacklisting, since any new legitimate software also needs to be explicitly approved before it can run.

• Different from application management (as discussed in an earlier MDM question), which is more about controlling/restricting what can be installed on mobile devices, whitelisting is a broader endpoint security control applicable to any system (workstations, servers, mobile devices) that enforces strict execution control.

openssl

• A widely used open-source toolkit and command-line tool for implementing and working with SSL/TLS protocols and general cryptographic functions.

• Capabilities include generating and managing digital certificates and keys, encrypting/decrypting files, creating certificate signing requests (CSRs), testing/connecting to a server to check its TLS configuration, and performing hashing operations.

• Commonly used by administrators to verify certificate validity, test whether a server supports specific TLS versions/ciphers, or troubleshoot HTTPS/TLS connection issues.

• More focused on certificate/cryptographic management and testing a connection's TLS handshake, rather than capturing and inspecting ongoing live traffic for arbitrary applications.

hping

• A command-line packet crafting and network testing tool that allows users to manually build and send custom TCP/IP packets.

• Can be used to perform tasks like custom ping-like probes (hence the name), firewall rule testing, port scanning, and simulating certain types of attacks (like SYN floods) for testing purposes.

• Useful for testing how a network or firewall responds to specific, custom-crafted traffic, rather than for capturing and analyzing existing traffic already flowing between two systems.

• Often used in penetration testing or network troubleshooting scenarios where standard ping/traceroute tools aren't flexible enough.

Adversary behavior profiles

• Documented patterns of behavior, tactics, techniques, and procedures (TTPs) associated with specific known threat actors or groups (such as APTs).

• Built from threat intelligence research, tracking how particular attackers typically operate (their preferred tools, attack sequences, and objectives).

• Used to help defenders recognize and attribute attacks to specific known adversaries, and to anticipate likely next steps during an active intrusion, based on historical attacker behavior patterns rather than a baseline of the organization's own normal traffic.

• Closely related to the MITRE ATT&CK framework, which catalogs known adversary TTPs.

IPS signatures

• Predefined patterns or rules used by an Intrusion Prevention System (IPS) to identify known malicious traffic or attack patterns.

• Works similarly to antivirus signatures, matching incoming/outgoing traffic against a database of known threats (like a particular exploit's network pattern) to detect and block them.

• The foundation of signature-based detection, which is fundamentally different from anomaly-based detection: signature-based systems catch known threats they've been specifically programmed to recognize, while anomaly-based systems catch anything that deviates from an established baseline, including previously unknown (zero-day) threats.

• Requires regular updates to stay effective against new and evolving threats, since it can only detect what it already has a signature for.

SPF (Sender Policy Framework)

• An email authentication method that allows domain owners to specify which mail servers are authorized to send email on behalf of their domain.

• Published as a DNS TXT record listing the approved IP addresses/servers permitted to send mail for that domain.

• When an email is received, the recipient's mail server checks the sending server's IP against the domain's published SPF record, if it doesn't match, the email may be flagged, rejected, or marked as suspicious.

• Primarily helps prevent email spoofing (attackers forging the "From" address to impersonate a legitimate domain), but does not encrypt email content or protect against interception in transit.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

• An email authentication policy framework that builds on top of both SPF and DKIM.

• Allows domain owners to specify how receiving mail servers should handle emails that fail SPF or DKIM checks (e.g., reject, quarantine, or allow with monitoring).

• Also provides reporting capabilities, giving domain owners visibility into who is sending email using their domain, including legitimate senders and potential spoofing attempts.

• Strengthens overall email authentication and anti-spoofing/phishing defenses, but like SPF and DKIM, does not encrypt the actual content of emails or protect against interception during transmission.

DKIM (DomainKeys Identified Mail)

• An email authentication method that uses public-key cryptography to add a digital signature to outgoing emails.

• The sending mail server signs the email with a private key, and the receiving server verifies that signature using a public key published in the sender's DNS records.

• Confirms that the email genuinely originated from the claimed domain and that its content (specific header fields and body) hasn't been altered or tampered with in transit.

• Focused on message integrity and sender authenticity verification, not on encrypting the email content to prevent interception, an attacker could still potentially intercept and read the message, they just couldn't alter it undetected or successfully forge the signature