300 - 375 reminders

hypervisor firewall

• A firewall specifically designed to operate at the virtualization layer, filtering and controlling traffic between virtual machines (VMs) running on the same physical hypervisor host.

• Provides visibility and control over east-west traffic (VM-to-VM communication within the same host), which can otherwise bypass traditional network firewalls entirely since it may never leave the virtual environment to touch the physical network.

• Enables microsegmentation, allowing administrators to define granular rules about which VMs can communicate with each other, even if they're on the same host, limiting an attacker's ability to move laterally if one VM is compromised.

• Often implemented as part of virtualization platforms themselves (e.g., VMware NSX, Hyper-V's built-in extensible switch with firewall extensions) rather than as separate physical hardware.

• Directly addresses risks unique to virtualized environments, where multiple VMs (potentially with different trust levels or owned by different tenants) share the same underlying physical hardware.

Hypervisor network switches (virtual switches)

• Software-based switches built into a hypervisor that manage and route network traffic between VMs running on the same physical host, as well as traffic going out to the physical network.

• Function similarly to a physical network switch, but exist entirely within the virtualization layer, connecting virtual network interface cards (vNICs) of different VMs to each other and to physical network adapters.

• Can be configured with VLANs to logically separate traffic groups, but since intra-host VM-to-VM traffic can be switched entirely within this virtual switch, it may never reach a physical switch, meaning security controls applied only at the physical network level (like physical VLANs or firewalls) might not see or filter this internal traffic.

• Common examples include VMware's vSwitch/Distributed Switch and Microsoft Hyper-V's Virtual Switch.

• Understanding this distinction (virtual switch vs. physical switch) is why simply adding more VLANs at the physical hypervisor network switch level may not fully address east-west traffic risks between VMs on the same host, a dedicated hypervisor/VM-aware firewall provides more direct, granular control over that specific traffic path.

Hypervisor

Hypervisor

A hypervisor is the software (or sometimes firmware/hardware) layer that creates and runs virtual machines (VMs) on a single physical computer. It sits between the physical hardware and the VMs, allowing one physical server to be divided up and shared among multiple separate, isolated "virtual" computers, each running its own operating system as if it had its own dedicated hardware.

In the context of the question: imagine one physical server in a data center. Instead of running just one operating system directly on that hardware, the hypervisor lets you run several independent VMs on that same single physical machine at the same time, each VM thinking it has its own CPU, memory, and network connection, even though they're all actually sharing the same underlying physical resources.

Two main types:

• Type 1 (bare-metal): runs directly on the physical hardware, with no underlying OS (examples: VMware ESXi, Microsoft Hyper-V, Xen). Common in enterprise data centers.

• Type 2 (hosted): runs as an application on top of an existing operating system (examples: VMware Workstation, VirtualBox). Common for personal/desktop use.

Why it matters for the question: since multiple VMs can live on the very same physical hypervisor host, if one VM gets compromised, there's a risk the attacker could try to attack or move laterally to another VM sitting right next to it on that same physical machine, this is the "VM being compromised by another VM on the same hypervisor" scenario. Because that VM-to-VM traffic can happen entirely inside the hypervisor's own virtual network (never touching your normal physical network equipment), a regular network firewall sitting outside the hypervisor wouldn't necessarily see or filter it, which is exactly why a hypervisor-level firewall is the right tool: it's positioned inside that virtual environment where the traffic actually happens.

RADIUS (Remote Authentication Dial-In User Service)

• A centralized authentication, authorization, and accounting (AAA) protocol used to manage remote and network access.

• Allows a network to verify user credentials against a central server rather than storing credentials locally on each access point or device.

• Commonly used in enterprise Wi-Fi (WPA2/WPA3-Enterprise) and VPN setups, where each user authenticates with their own unique username/password or certificate rather than a single shared network key.

• Enables centralized control, logging, and the ability to individually revoke access for specific users without affecting others.

EAP-PEAP (Protected Extensible Authentication Protocol)

• A version of EAP (Extensible Authentication Protocol) that wraps the authentication exchange inside an encrypted TLS tunnel before credentials are transmitted.

• Provides mutual authentication: the client can verify the legitimacy of the server (helping prevent connection to rogue/fake access points), while the server authenticates the client's credentials.

• Commonly used alongside RADIUS in 802.1X-based enterprise wireless authentication (WPA2/WPA3-Enterprise).

• More secure than sending authentication credentials in the clear, since the TLS tunnel protects the exchange from eavesdropping.

WPA-TKIP (Wi-Fi Protected Access - Temporal Key Integrity Protocol)

• TKIP was the encryption protocol introduced with the original WPA standard, designed as an improvement over WEP's broken encryption.

• Has since been found to have significant cryptographic weaknesses and is now considered outdated and insecure by modern standards.

• Superseded by WPA2/WPA3 using AES-based encryption (CCMP), which is much stronger; TKIP should be disabled/avoided in favor of AES wherever possible.

bluesnarfing

• An attack in which an unauthorized attacker gains access to information on a device via a Bluetooth connection, without the victim's knowledge or consent.

• Allows the attacker to steal data such as contacts, emails, text messages, photos, calendar entries, and other information stored on the victim's Bluetooth-enabled device (phones, laptops, tablets).

• Exploits vulnerabilities in the Bluetooth protocol implementation, often on older or unpatched devices, to establish an unauthorized connection and pull data without pairing or explicit permission from the user.

• Different from bluejacking, which is a much less harmful prank-style attack involving sending unsolicited messages or contact cards to nearby Bluetooth devices, bluesnarfing actually steals/accesses private data, while bluejacking is more of a nuisance without data theft.

• Requires the attacker to be within Bluetooth range (typically a relatively short distance, though this can be extended with specialized antennas) of the target device.

• Mitigations include keeping Bluetooth turned off when not in use, setting devices to "non-discoverable" mode, keeping device firmware/software updated to patch known Bluetooth vulnerabilities, and being cautious about pairing requests from unknown devices.

GPO (Group Policy Object)

• A feature of Microsoft Windows Active Directory used to centrally manage and enforce configuration settings and security policies across Windows-joined computers and user accounts within a domain.

• Allows administrators to define rules for things like password requirements, account lockout policies, software installation restrictions, desktop configurations, firewall settings, and much more, all applied automatically to targeted computers/users when they connect to the domain.

• Applied through Active Directory, GPOs can be linked to specific organizational units (OUs), domains, or sites, allowing different policies to be applied to different groups of computers or users within the same organization.

• Changes made through a GPO are automatically pushed out and enforced the next time affected devices check in with the domain controller (or on a regular refresh interval), providing centralized, consistent policy enforcement without needing to manually configure each machine individually.

• Major limitation: GPOs only work within a Windows/Active Directory environment. They cannot be applied to non-Windows devices like smartphones, tablets, macOS, or Linux systems, which is why GPOs alone are insufficient for managing security across heterogeneous platforms (as in the previous question), a solution like MDM is needed to cover devices outside the Windows/AD ecosystem.

The Diamond Model of Intrusion Analysis

• An analytical framework used to track and understand cyberattacks by examining four core, interconnected elements arranged like the points of a diamond: Adversary (who is conducting the attack), Capability (the tools, malware, or techniques they use), Infrastructure (the systems, IPs, domains, or servers used to launch/support the attack), and Victim (the target of the attack).

• Each event/intrusion is analyzed by mapping these four features and how they relate to one another, helping analysts understand the relationships and connections between different attacks or campaigns.

• Useful for attributing attacks to specific threat actors, identifying patterns across multiple incidents, and understanding an adversary's broader operational approach over time

The Cyber Kill Chain

• A framework developed by Lockheed Martin that breaks down a cyberattack into a sequential series of stages: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control (C2), and Actions on Objectives.

• Describes the typical progression an attacker follows from initial research on a target through to achieving their final goal (e.g., data exfiltration).

• Used by defenders to identify at which stage an attack is currently occurring, allowing them to disrupt or block the attack before it progresses further along the chain.

• Focuses on the sequence/phases of an attack, rather than the specific adversary/capability/infrastructure/victim relationship mapping used in the Diamond Model.

The MITRE CVE database (Common Vulnerabilities and Exposures)

• A publicly available, standardized catalog of known cybersecurity vulnerabilities and exposures, each assigned a unique identifier (e.g., CVE-2017-0144).

• Maintained by MITRE Corporation, providing a common reference so security professionals and vendors can consistently identify and discuss the same specific vulnerability.

• Used for vulnerability identification and research, not for analyzing or tracking adversary behavior, infrastructure, or intrusion campaigns.

• Different from the MITRE ATT&CK framework, which does catalog adversary tactics, techniques, and procedures (TTPs), CVE is specifically about vulnerabilities, not attacker behavior patterns.

The incident response process

• A structured methodology for handling and managing a security incident from detection through resolution, typically involving phases like: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned.

• Focuses on the operational and procedural steps an organization takes to detect, respond to, and recover from a security incident.

• A broader, process-oriented framework for incident management, rather than a specific analytical model for understanding and attributing the characteristics of an adversary's attack campaign the way the Diamond Model does.

NAT (Network Address Translation)

• A technique that translates IP addresses as traffic passes through a router or gateway, commonly used to allow multiple internal devices (with private IP addresses) to share a smaller number of public IP addresses when accessing the internet.

• Can also be configured in reverse (static/destination NAT) to map a specific public IP address to a specific internal device, allowing that device to be reached externally while preserving its association with a designated public IP.

• Helps conserve public IP address space and adds a layer of obscurity, since internal addressing structure isn't directly exposed to external networks.

• In the context of the previous question, NAT is the mechanism that manages and maintains how existing public IP addresses assigned to equipment are used and mapped, without requiring wholesale changes to the addressing scheme.

BGP (Border Gateway Protocol)

• 
  

• The routing protocol used to exchange routing information between different autonomous systems (large networks, like those belonging to ISPs or major organizations) across the internet.

• Responsible for determining the best paths for data to travel across the global internet, essentially how large-scale internet routing decisions are made between networks.

• Operates at a much broader, internet-wide routing level rather than managing IP address translation or usage for equipment on a single organization's core router.

AES (Advanced Encryption Standard)

• A symmetric encryption algorithm (the same key is used for both encryption and decryption), widely regarded as the current global standard for strong encryption.

• Available in different key lengths, commonly AES-128, AES-192, and AES-256, with AES-256 offering the highest level of security among these.

• Used extensively across many security contexts, including securing data in transit (as the actual cipher used within protocols like TLS), encrypting data at rest (like full disk encryption), and Wi-Fi security (WPA2/WPA3).

• Has withstood extensive cryptographic scrutiny over many years without practical, known weaknesses, making it the go-to choice when "strongest cipher" is required.

3DES (Triple Data Encryption Standard)

• An older symmetric encryption algorithm that applies the original DES (Data Encryption Standard) cipher three times in succession to each data block, intended to strengthen the relatively weak original DES.

• Despite the improvement over single DES, 3DES is now considered outdated and relatively weak by modern standards, it's slower and less secure compared to AES.

• Deprecated in most modern security standards and being phased out of use in favor of AES, since it's vulnerable to certain attacks (like meet-in-the-middle attacks) and offers significantly weaker performance and security margins.

Homomorphic encryption

• A specialized form of encryption that allows mathematical operations and computations to be performed directly on encrypted data (ciphertext), without ever needing to decrypt it first.

• The result of these operations, once decrypted, matches what would have been produced by performing the same operations on the original plaintext data.

• Enables scenarios where a third party (like a cloud provider) can process, analyze, or manipulate sensitive data on behalf of the data owner, without ever actually seeing the underlying unencrypted content.

• Extremely computationally intensive and slow compared to standard encryption methods, historically limiting its practical, widespread use, though it's increasingly used in privacy-sensitive cloud computing scenarios where confidentiality during processing is critical, even at the cost of performance.

Ephemeral (keys/encryption)

• Refers to temporary, short-lived cryptographic keys that are generated fresh for a single session or transaction and then discarded, rather than being reused across multiple sessions.

• Commonly associated with key exchange protocols like Ephemeral Diffie-Hellman (DHE) or Elliptic Curve Diffie-Hellman Ephemeral (ECDHE).

• Provides Perfect Forward Secrecy (PFS): since a new key is generated for each session, even if a long-term private key is later compromised, past communications encrypted with previous ephemeral session keys remain secure and cannot be decrypted retroactively.

• Not itself a method for computing on encrypted data or a general encryption algorithm, it specifically describes the temporary nature of keys used during a key exchange process.

STIX (Structured Threat Information Expression)

• A standardized language and format used to describe and represent cyber threat intelligence in a structured, machine-readable way.

• Allows organizations to consistently document details about threats, including indicators of compromise (IOCs), attack patterns, threat actors, malware, campaigns, and the relationships between them.

• Uses a common vocabulary and structure so that threat intelligence shared between different organizations, tools, and platforms can be automatically parsed, understood, and correlated, rather than relying on unstructured text reports that are harder to process at scale.

• Often described as the "what" of threat intelligence, defining the content and structure of the data, in contrast to TAXII, which handles the "how", the transport/exchange mechanism used to actually share that STIX-formatted data between parties.

• Commonly used together with TAXII to enable automated, standardized threat intelligence sharing: STIX defines the data format, while TAXII provides the client-server protocol to distribute and retrieve it.

• Maintained and developed under OASIS (a standards organization), with STIX 2.x being the current widely adopted version, replacing the more complex XML-based STIX 1.x.

• Enables better collaboration and faster response across organizations, since threat data described in STIX can be ingested directly into security tools (like SIEMs or threat intelligence platforms) for automated correlation and alerting, rather than requiring manual interpretation.

Tor (The Onion Router)

• A free, open-source network and browser designed to anonymize internet traffic by routing it through multiple volunteer-operated relay nodes, encrypting the data at each layer (hence "onion" routing).

• Each relay node only knows the previous and next hop in the chain, not the full path, making it very difficult to trace the origin or destination of the traffic.

• Provides access to both anonymized browsing of the regular internet and specifically to .onion sites, commonly associated with the dark web, a portion of the internet not indexed by standard search engines and often used for anonymity-focused (and sometimes illicit) activity.

• Monitoring for Tor traffic/connections on a corporate network is a common way to detect attempts to access the dark web or anonymize outbound traffic.

AIS (Automated Indicator Sharing)

• A free threat intelligence sharing service run by CISA (Cybersecurity and Infrastructure Security Agency) in the United States.

• Allows organizations (government and private sector) to share and receive cyber threat indicators, such as malicious IP addresses, domains, and file hashes, in near real-time.

• Uses standardized formats like STIX and the TAXII protocol to enable automated, machine-readable exchange of threat data between participants.

• Helps organizations stay updated on emerging threats collaboratively, but it is not a network itself, it's a threat intelligence sharing program/service.

IoC (Indicator of Compromise)

• A piece of forensic evidence or artifact that suggests a system, network, or environment has been compromised or is under attack.

• Examples include unusual outbound network traffic, known-malicious IP addresses or domains, unexpected file hashes, unusual login patterns, or the presence of specific malware signatures.

• Used by security teams and tools (like SIEMs and threat intelligence platforms) to detect, investigate, and respond to potential security incidents.

• Not a network or protocol itself, it's a category of evidence/data used to identify that malicious activity has occurred or is occurring.

Honeynets

• A network of multiple honeypots (decoy systems designed to look like legitimate, vulnerable systems) set up specifically to attract, detect, and study attackers.

• Allows security researchers and organizations to observe attacker behavior, tools, and techniques in a controlled, isolated environment without risking real production systems.

• Since honeynets are decoys with no legitimate business purpose, any interaction with them is inherently suspicious, making them useful for early detection of reconnaissance or intrusion attempts.

• Not used for monitoring legitimate network traffic or protecting real data, their purpose is deception and threat intelligence gathering.

Tcpreplay

• A suite of command-line tools used to replay previously captured network traffic (from a pcap file) back onto a network or through a device.

• Commonly used for testing purposes, such as evaluating how network security tools (like IDS/IPS or firewalls) respond to specific, previously recorded traffic patterns, including known attack traffic.

• Useful for reproducing network conditions or attack scenarios in a controlled test environment, rather than for live, real-time monitoring of an actual production network.

• Does not perform active detection or monitoring itself, it's a traffic generation/testing tool.