Technical Questions
What is on your home network?

What is the difference between a threat, a vulnerability, and a risk?
	A threat is from someone targeting a vulnerability (or weakness) in the organization that was not mitigated or taken care of since it was not properly identified as a risk. A threat is referred to like the event, which has the potential to harm the data of any individual or the organization. It can be natural, unintentional and intentional threats. Threat: Someone with the potential to harm a system or an organization. Threat refers to something that has all the potential to deliver serious damage to the computer systems, networks, and, etc. some of the threats include spyware, keylogger, backdoor, and, etc.

	Vulnerability: Weakness in a system that can be exploited by a potential hacker. Vulnerability (weakness) is a gap in the protection efforts of a system, a threat is an attacker who exploits that weakness. Vulnerability means weakness. It refers to the gap between the protection efforts of a system and the attacker who can exploit the weak points. Vulnerability means that weakness in the system, which can be exploited by the attacker or the hackers.
Risk: Potential for loss or damage when threat exploits a vulnerability. Risk is the measure of potential loss when that vulnerability is exploited by the threat. Risk mainly refers to check the loss or damage happen when any type of threat exploited the vulnerability. A risk is nothing but a measure that determines the potential loss that would occur if the vulnerability gets exploited.

What is SSL?
SSL is a standard security technology for creating an encrypted link between a server and a client (usually a web server and a web browser).
SSL is the industry-standard security technology creating encrypted connections between Web Server and a Browser. This is used to maintain data privacy and to protect the information in online transactions.
SSL is identity verification, not hard data encryption. It is designed to be able to prove that the person you are talking to on the other end is who they say they are.
SSL referred as secure socket layer, which helps in providing the secured conversation and helps in verifying the person.

What are the differences between HTTPS, SSL, and TLS?
HTTPS is hypertext transfer protocol and secures communications over a network. TLS is transport layer security and is a successor protocol to SSL.
HTTPS secure communications over a network
TLS is transport layed security
SSL is a successor for TLS

What is the difference between symmetric and asymmetric encryption?
Symmetric encryption uses the same key to encrypt and decrypt, while asymmetric encryption uses different keys for encryption and decryption. Asymmetric encryption is commonly used to secure an initial key-sharing conversation, but then the actual conversation is secured using symmetric crypto. Communication using symmetric crypto is usually faster due to the slightly simpler math involved in the encryption/decryption process and because the session setup doesn’t involve PKI certificate checking.
Symmetric encryption uses the same key for both encryption and decryption, while Asymmetric encryption uses different keys for encryption and decryption.
Symmetric is usually much faster but the key needs to be transferred over an unencrypted channel.
Asymmetric on the other hand is more secure but slow. Hence, a hybrid approach should be preferred. Setting up a channel using asymmetric encryption and then sending the data using symmetric process.
Symmetric encryption uses the same key to encrypt and decrypt, while Asymmetric uses different keys for encryption and decryption. Symmetric is usually much faster, but is difficult to implement most times due to the fact that you would have to transfer the key over an unencrypted channel. Therefore many times an Asymmetric connection will be established first, then send creates the Symmetric connection.

What is the difference between UDP and TCP?
Both are protocols for sending packets of information over the internet and are built on top of the internet protocol. TCP stands for transmission control protocol and is more commonly used. It numbers the packets it sends to guarantee that the recipient receives them. UDP stands for user datagram protocol. While it operates similarly to TCP, it does not use TCP’s error-checking abilities, which speeds up the process, but makes it less reliable.


What is a traceroute?
A traceroute, or tracert, can help you see where a breakdown of communications occurred. It shows what routers you touch as you move along to your final destination. If there is somewhere you cannot connect, you can see where it happened.
Traceroute is a tool that shows the path of a packet. It lists all the points (mainly routers) that the packet passes through. This is used mostly when the packet is not reaching its destination. Traceroute is used to check where the connection stops or breaks to identify the point of failure.
In case you can’t ping the final destination, tracert will help to identify where the connection stops or gets broken, whether it is firewall, ISP, router etc.
Tracert or traceroute, depending on the operating system, allows you to see exactly what routers you touch as you move along the chain of connections to your final destination. However, if you end up with a problem where you can’t connect or can’t ping your final destination, a tracert can help in that regard as you can tell exactly where the chain of connections stop. With this information, you can contact the correct people – whether it be your own firewall, your ISP, your destination’s ISP or somewhere in the middle.

What tech blogs do you follow?
RSS feed
Cyber, Dark Reading, Krebs on Security, Schneier on Security, The CyberWire, Help Net Security

What is Cryptography?
Cryptography is the practice and study of techniques for securing information and communication mainly to protect the data from third parties that the data is not intended for.

What is the difference between IDS and IPS?
IDS is Intrusion Detection System and it only detects intrusions and the administrator has to take care of preventing the intrusion. Whereas, in IPS i.e., Intrusion Prevention System, the system detects the intrusion and also takes actions to prevent the intrusion.
IDS is an intrusion detection system whereas an IPS is an intrusion prevention system. IDS will just detect the intrusion and will leave the rest to the administrator for further action whereas an IPS will detect the intrusion and will take further action to prevent the intrusion. Another difference is the positioning of the devices in the network. Although they work on the same basic concept but the placement is different.
IPS stands for Intrusion Prevention System. IPS helps in detecting the intrusion and it will take further action to prevent it from the intrusion. IDS stand for an Intrusion detection system that helps in detection of an intrusion and after that administrator of the system will take decision for assessment and evaluation.


Explain CIA triad.
CIA stands for Confidentiality, Integrity, and Availability. CIA is a model that is designed to guide policies for Information Security. It is one of the most popular models used by organizations.
Confidentiality
The information should be accessible and readable only to authorized personnel. It should not be accessible by unauthorized personnel. The information should be strongly encrypted just in case someone uses hacking to access the data so that even if the data is accessed, it is not readable or understandable.
Integrity
Making sure the data has not been modified by an unauthorized entity. Integrity ensures that data is not corrupted or modified by unauthorized personnel. If an authorized individual/system is trying to modify the data and the modification wasn’t successful, then the data should be reversed back and should not be corrupted.
Availability
The data should be available to the user whenever the user requires it. Maintaining of Hardware, upgrading regularly, Data Backups and Recovery, Network Bottlenecks should be taken care of.

How is Encryption different from Hashing?
Both Encryption and Hashing are used to convert readable data into an unreadable format. The difference is that the encrypted data can be converted back to the original data by the process of decryption but the hashed data cannot be converted back to original data.
Point 1: Encryption is reversible whereas hashing is irreversible. Hashing can be cracked using rainbow tables and collision attacks but is not reversible.
Point 2: Encryption ensures confidentiality whereas hashing ensures Integrity.

What is a Firewall and why is it used?
A Firewall is a network security system set on the boundaries of the system/network that monitors and controls network traffic. Firewalls are mainly used to protect the system/network from viruses, worms, malware, etc. Firewalls can also be to prevent remote access and content filtering.
A firewall is a device that allows/blocks traffic as per defined set of rules. These are placed on the boundary of trusted and untrusted networks.



What is the difference between VA(Vulnerability Assessment) and PT(Penetration Testing)?
Vulnerability Assessment is the process of finding flaws on the target. Here, the organization knows that their system/network has flaws or weaknesses and want to find these flaws and prioritize the flaws for fixing.
Penetration Testing is the process of finding vulnerabilities on the target. In this case, the organization would have set up all the security measures they could think of and would want to test if there is any other way that their system/network can be hacked.
Vulnerability Assessment is an approach used to find flaws in an application/network whereas Penetration testing is the practice of finding exploitable vulnerabilities like a real attacker will do. VA is like travelling on the surface whereas PT is digging it for gold.

What is a three-way handshake?
A three-way handshake is a method used in a TCP/IP network to create a connection between a host and a client. It’s called a three-way handshake because it is a three-step method in which the client and server exchanges packets. The three steps are as follows:
The client sends a SYN(Synchronize) packet to the server check if the server is up or has open ports
The server sends SYN-ACK packet to the client if it has open ports
The client acknowledges this and sends an ACK(Acknowledgment) packet back to the server

What are some of the common Cyberattacks?
Malware, Phishing, Password Attacks, DDOS, Man in the Middle, Drive-by Downloads, Malvertising, Rogue Software

What is a Brute Force Attack? How can you prevent it?
Brute Force is a way of finding out the right credentials by repetitively trying all the permutations and combinations of possible credentials. In most cases, brute force attacks are automated where the tool/software automatically tries to login with a list of credentials. There are various ways to prevent Brute Force attacks.
Password Length, Complexity, and Limiting Login Attempts



What is Port Scanning?
Port scanning is process of sending messages in order to gather information about network, system etc. by analysing the response received.
Port Scanning is the technique used to identify open ports and service available on a host. Hackers use port scanning to find information that can be helpful to exploit vulnerabilities. Administrators use Port Scanning to verify the security policies of the network.


What is a VPN?
It is used to create a safe and encrypted connection. When you use a VPN, the data from the client is sent to a point in the VPN where it is encrypted and then sent through the internet to another point. At this point, the data is decrypted and sent to the server. When the server sends a response, the response is sent to a point in the VPN where it is encrypted and this encrypted data is sent to another point in the VPN where it is decrypted. And finally, the decrypted data is sent to the client. The whole point of using a VPN is to ensure encrypted data transfer.


What are black hat, white hat and grey hat hackers?
Black hat hackers are those who hack without authority.
White hat hackers are authorised to perform a hacking attempt under signed NDA.
Grey hat hackers are white hat hackers which sometimes perform unauthorised activities.

What is an ARP and how does it work?
Address Resolution Protocol (ARP)is a protocol for mapping an Internet Protocol address (IP address) to a physical machine address that is recognized in the local network.
When an incoming packet destined for a host machine on a particular local area network arrives at a gateway, the gateway asks the ARP program to find a physical host or MAC address that matches the IP address.

HIDS vs NIDS and which one is better and why?
HIDS is host intrusion detection system and NIDS is network intrusion detection system. Both the systems work on the similar lines. It’s just that the placement in different. HIDS is placed on each host whereas NIDS is placed in the network. For an enterprise, NIDS is preferred as HIDS is difficult to manage, plus it consumes processing power of the host as well.
Both acronyms are Intrusion Detection Systems, however the first is a Host Intrusion Detection System whereas the second is a Network Intrusion Detection System. An HIDS runs as a background utility in the same as an anti-virus program for instance, while a Network Intrusion Detection System sniffs packets as they go across the network looking for things that aren’t quite ordinary. Both systems have two basic variants: signature based and anomaly based. Signature based is very much like an anti-virus system, looking for known values of known ‘bad things’, while anomaly looks more for network traffic that doesn’t fit the usual pattern of the network. This requires a bit more time to get a good baseline, but in the long term can be better on the uptake for custom attacks.
HIDS(Host IDS) and NIDS(Network IDS) are both Intrusion Detection System and work for the same purpose i.e., to detect the intrusions. The only difference is that the HIDS is set up on a particular host/device. It monitors the traffic of a particular device and suspicious system activities. On the other hand, NIDS is set up on a network. It monitors traffic of all device of the network.

What is compliance?
Abiding by a set of standards set by a government/Independent party/organisation. E.g. An industry which stores, processes or transmits Payment related information needs to be complied with PCI DSS (Payment card Industry Data Security Standard). Other compliance examples can be an organisation complying with its own policies.

Why would you want to use SSH from a Windows pc?
Because it may be the only machine you have access to at the moment, and you need to reach the other machine via SSH.

Explain CSRF?
Cross Site Request Forgery is a web application vulnerability in which the server does not check whether the request came from a trusted client or not. The request is just processed directly. It can be further followed by the ways to detect this, examples and countermeasures.

Explain DDoS attacks?
DDoS is abbreviated as distributed denial of service. It is used to make the server unavailable for the legal request as sometimes network or servers are occupied with a request in many numbers, which are not able to handle and recognized. The request can come to form the different source that is called distributed denial of service attack. These attacks can be mitigated with help of identifying the network conditions in normal. It can be done in scrubbing centers, where the traffic has been analyzed in such a manner that irrelevant traffic can be identified and removed.

What is the protocol that broadcast the messages across all the devices?
Internet Group Management Protocol [IGMP] is the communication protocol which is used in video or game streaming. This communication protocol facilitates the communication devices and the adjacent routers to send packets across the network.

What is used to hide the message in cryptography?
The cipher, an algorithm is used to perform the encryption or the decryption. It is used to protect e-mail messages, corporate data, and credit card information.

Cyber Kill Chain
Reconnaissance:
Intruder selects target, researches it, and attempts to identify vulnerabilities in the target network.
Weaponization:
Intruder creates remote access malware weapon, such as a virus or worm, tailored to one or more vulnerabilities.
Delivery:
Intruder transmits weapon to target (e.g., via e-mail attachments, websites or USB drives)
Exploitation:
Malware weapon's program code triggers, which takes action on target network to exploit vulnerability.
Installation:
Malware weapon installs access point (e.g., "backdoor") usable by intruder.
Command and Control:
Malware enables intruder to have "hands on the keyboard" persistent access to target network.
Actions on Objective:
Intruder takes action to achieve their goals, such as data exfiltration, data destruction, or encryption for ransom.
OSI Model
Application
To allow access to network resources
Presentation
To translate encrypt, and compress data
Session
To establish manage, and terminate sessions
Transport
To provide reliable process-to process message delivery and error recovery
Network
To move packets from source to destination; to provide internetworking
Data Link
To organize bits into frames; to provide hop-to-hop delivery
 Physical
To transmit bits over a medium, to provide mechanical and electrical specifications

TCP/IP
Application
Controls the exchange of requests and responses between the client process and the server process.
Transport
Implements flow control and error control
Internet
Controls the routing of the packet across the internet
Data
Controls the sending of a packet across a single subnet

How to find IP address?
Windows
Setting, Networking & Internet, and Ethernet
Linux
curl ifconfig.me
Mac
Wifi, Network Preferences


Man in the middle attack
A MITM(Man-in-the-Middle) attack is a type of attack where the hacker places himself in between the communication of two parties and steal the information. Suppose there are two parties A and B having a communication. Then the hacker joins this communication. He impersonates as party B to A and impersonates as party A in front of B. The data from both the parties are sent to the hacker and the hacker redirects the data to the destination party after stealing the data required. While the two parties think that they are communicating with each other, in reality, they are communicating with the hacker.
You can prevent MITM attack by using the following practices:
Use VPN
Use strong WEP/WPA encryption
Use Intrusion Detection Systems
Force HTTPS
Public Key Pair Based Authentication

RIP (Routing Information Protocol)
	Is a distance vector protocol that uses hop count as its primary metric. RIP defines how routers should share information when moving traffic among an interconnected group of local area network.

HTTP/HTTPs
	HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands.

UDP
	UDP sends messages, called datagrams, and is considered a best-effort mode of communications.

TCP
	TCP supports host-to-host communication. TCP sends individual packets and is considered a reliable transport medium;

DNS
	Is the phonebook of the Internet. Humans access information online through domain names, like nytimes.com or espn.com. Web browsers interact through Internet Protocol (IP) addresses. DNS translates domain names to IP addresses so browsers can load Internet resources.

DHCP (Dynamic Host Configuration Protocol)
	When a PC doesn’t an IP address the DHCP server will assign it an IP address