may 1

DES

is an old symmetric encryption algorithm that is no longer secure due to its weak key size.

3DES

is an older encryption algorithm that applies DES encryption three times to improve security, but it is now outdated.

AES

3DES is replaced by ______

802.1X

a network security system that requires login before you can access a network

AES

is a strong encryption standard/method used to secure data by converting it into unreadable form.

EFS

A Windows feature/tool that encrypts files

Attack Vector

is the path or method a hacker uses to get into a system

backdoor

is a hidden way or method that allows unauthorized access to a system without normal authentication.

Cisco Talos

is a cybersecurity research and threat intelligence team run by Cisco

Reconnaissance,

Weaponization,

Delivery,

Exploitation

what are the Cyber Kill Chains? (In-order)

Reconnaissance

A Cyber Kill Chain where the attacker gathers information about the target to find weaknesses

Weaponization

A Cyber Kill Chain where the attacker creates or prepares malware/exploit to use against the target

Delivery

A Cyber Kill Chain where the attacker sends the malware to the target system

Exploitation

A Cyber Kill Chain where the attacker uses a vulnerability to execute the attack on the system

CybOX

A standardized language for describing cyber observables—basically, things you can detect or measure in a system or network.

CybOX

lets security tools and analysts describe what was seen during an attack in a structured, machine-readable way.

DAT Files

virus definition files used by antivirus software

DFS

a system that lets you access files from multiple servers as if they are in one place

DHCP spoofing

Threat actors configure a fake DHCP server on the network to issue DHCP addresses to clients.

RAM → Fixed Disk(Hard Drive) → Archived Backup

In what order should you collect digital evidence?

Archived Backup

Which amongst them is the least Volatile?

• Fixed Disk(Hard Drive)

• Archived Backup

• RAM

DMZ

Places public servers in a separate middle zone. Acts as a buffer between internet and private network

VLAN

Splits one network into multiple smaller networks

Example:

• HR, Sales, IT separated

VPN

Encrypts your data, hides your real IP address and lets you connect to the internet safely

VPN

It creates a secure tunnel to connect to the internet safely

DNS

You type:

👉 You type:

```
google.com
```

👉 ______ converts it to:

```
142.250.xxx.xxx
```

👉 So your computer knows where to go

DNS Amplification

A type of DDoS attack where attackers use open DNS servers to flood a target with large amounts of traffic

EFS

a Windows feature that encrypts (locks) specific files

FireEye Helix

is a security tool/platform that detects, monitors, and helps respond to cyber threats.

HTTP Flooding

is a type of DDoS attack where attackers send a huge number of HTTP requests to a website

HTTP Flooding

1⃣ Attacker sends tons of requests like:

• “Load homepage”

• “Open page”

2⃣ Server tries to respond to all of them

3⃣ Server gets overwhelmed

👉 Real users can’t access the site

IP Spoofing

Faking the IP address in a packet to pretend to be another device

ARP Spoofing

💡 What it does

• Tells devices:

  • “I am the router”

• Victim sends data to attacker

💡 Example

👉 Attacker sits between:

• Victim 💻

• Router 🌐

👉 Intercepts traffic

IP,

ARP

_____ spoofing fakes identity on the internet, while _____ spoofing redirects traffic on a local network.

Keylogger

is a tool or malware that records everything you type on your keyboard

LDAP

its a system that’s like a login Directory Address Book

Sandboxing,

Integrity Checking,

Signature-Based,

Heuristics-based

list down the malware mitigation techniques

Sandboxing

malware mitigation technique: running a program in a safe, isolated environment. It’s like “safe testing box”

Integrity checking

malware mitigation technique: making sure data has not been altered by comparing it to its original state.

Signature-Based

malware mitigation technique: detecting malware by matching known patterns

Heuristic-based

malware mitigation technique: identifies malware by analyzing suspicious behavior/patterns rather than matching known signatures/patterns.

MD5

hashing algorithm used to create a fixed-length hash from data.

Metasploit

is a penetration testing tool used by security professionals to test if systems are vulnerable by trying to exploit them

NAC

is a security system that controls and verifies devices before allowing them to access a network. It’s like a security guard at the network door

Firewall

It controls what traffic is allowed through the network.