PT.2 Net Security D.4

[4.1] IoT

Internet of Things: connected devices such as sensors or cameras. isolate them when their security is limited.

[4.1] OT / ICS / SCADA

Operational Technology / Industrial Control Systems / and Supervisory Control and Data Acquisition support physical or industrial operations.

[4.1] BYOD

Bring Your Own Device: employee-owned devices access organizational resources under defined policies.

[4.2] DoS vs. DDoS

Denial of Service overwhelms or disrupts a service. Distributed DoS uses multiple sources.

[4.2] MAC flooding

Overloads a switch's MAC table / potentially causing more unknown-unicast flooding and exposing traffic.

[4.2] VLAN hopping

Attempts to cross VLAN boundaries / such as by abusing trunk negotiation or double tagging.

[4.2] ARP poisoning

Sends false IPv4-to-MAC mappings to redirect or interrupt local traffic.

[4.2] DNS poisoning

Introduces false DNS information so users resolve names to the wrong destinations.

[4.2] On-path attack

An attacker positions themselves in a communication path to intercept or alter traffic.

[4.2] Rogue DHCP server

An unauthorized server supplies address / gateway / or DNS settings that can redirect or disrupt clients.

[4.2] Rogue AP vs. evil twin

A rogue AP is unauthorized. an evil twin impersonates a legitimate wireless network to attract clients.

[4.2] Wireless deauthentication attack

Uses or spoofs management messages to disconnect clients. protected management frames can mitigate some attacks.

[4.2] Social engineering

Manipulates people into revealing information or taking unsafe actions.

[4.2] Phishing vs. spear phishing

Phishing broadly uses deceptive messages. spear phishing targets a particular person or group.

[4.2] Tailgating

An unauthorized person follows someone into a restricted physical area.

[4.2] Shoulder surfing

Observes a person's screen or typing to obtain sensitive information.

[4.2] Malware

Malicious software designed to harm systems / steal information / or gain unauthorized access.

[4.2] Virus vs. worm

A virus attaches to a host file or program. a worm can spread independently across systems.

[4.2] Trojan

Malicious software disguised as something legitimate or useful.

[4.2] Ransomware

Malware that denies access / often by encrypting files / and demands payment.

[4.3] Device hardening

Reduces attack opportunities through secure settings / updates / minimal services / and restricted access.

[4.3] Default credential risk

Known factory credentials let attackers log in if administrators do not replace or disable them.

[4.3] Disable unused services and ports

Reduces unnecessary entry points and unauthorized connections.

[4.3] ACL

Access Control List: ordered permit/deny rules controlling traffic or access.

[4.3] ACL processing

Rules are generally evaluated in order. many systems apply an implicit deny when no rule matches.

[4.3] Stateful vs. stateless firewall

Stateful filtering tracks connections. stateless filtering evaluates packets against rules without connection context.

[4.3] Screened subnet / DMZ

A controlled zone for public-facing services / separated from the trusted internal network.

[4.3] Trusted vs. untrusted zone

Trusted zones contain managed resources. untrusted zones require stricter access controls. Trust should still be verified.

[4.3] Port security

Restricts allowed source MAC addresses or counts on a switch port.

[4.3] DHCP snooping

Filters DHCP server messages on untrusted ports and maintains bindings used by other protections.

[4.3] Dynamic ARP inspection (DAI)

Validates ARP messages against trusted bindings to reduce ARP spoofing.

[4.3] Content filtering

Blocks or allows traffic according to content / categories / URLs / or organizational policy.

[4.3] Security-rule troubleshooting

Check rule order / addresses / direction / protocol / ports / and logging before changing a rule.

[4.3] Guest isolation

Allow required visitor services while blocking access to internal sensitive systems.

[4.3] Management-network isolation

Restricts administration to dedicated networks and authorized systems or jump hosts.

[4.2] DNS amplification

A DDoS technique using small queries and larger responses from DNS servers to flood a victim / often with a spoofed source address.

[4.2] DNS tunneling

Encodes other traffic in DNS messages. Attackers may use it for command-and-control or data exfiltration.

[4.2] DNS hijacking

Changes DNS settings or compromises resolution infrastructure to redirect users through an attacker-controlled resolver or answer.

[4.3] DNS service protection

Patch DNS systems / limit unnecessary exposure / restrict zone transfers / monitor suspicious query patterns.

[4.3] Why isolate industrial systems?

Their availability needs and specialized devices can make ordinary enterprise changes risky. Restrict access and carefully plan updates