Cybersecurity Technical Questions

What is a DDOS attack and how to stop and prevent them?

A DDOS (distributed denial-of-service ) is a malicious attempt of disrupting regular traffic of a network by flooding with a large number of requests and making the server unavailable to the appropriate requests. The requests come from several unauthorized sources and hence called distributed denial of service attacks. The following methods will help you to stop and prevent DDOS attacks: Build a denial of service response plan Protect your network infrastructure Employ basic network security Maintain strong network architecture Understand the Warning Signs Consider DDoS as a service

What is a Firewall? What is the usage of it?

A Firewall can be defined as a network security system set on the boundaries of the system/network and is used to monitor and control the network traffic. The main usage of Firewalls is to protect the system/network from viruses, worms, malware, threats etc. Firewalls can also be used to prevent remote access and content filtering.

What is the use of Traceroute?

A Traceroute is a network diagnostic tool, used for tracking the pathway of an IP network from source to destination. It records the period of each hop the packet makes while its route to its destination.

What is the difference between black hat, white hat, and grey hat hackers?

A black-hat hacker is a person who tries to obtain unauthorized access into a system or a network to steal information for malicious purposes. White-hat hackers are also known as ethical hackers; they are well-versed with ethical hacking tools, methodologies, and tactics for securing organization data. They try to detect and fix vulnerabilities and security holes in the systems. Many top companies recruit white hat hackers. A grey hat hacker is a computer security expert who may violate ethical standards or rules sometimes but does not have the malicious intent of a black hat hacker.

What is a cybersecurity risk assessment?

A cybersecurity risk assessment refers to detecting the information assets that are prone to cyber-attacks(including customer data, hardware, laptop, etc.) and also evaluates various risks that could affect those assets. It is mostly performed to identify, evaluate, and prioritize risks across organizations. The best way to perform cybersecurity risk assessment is to detect: Relevant threats in your organization Internal and external vulnerabilities Evaluate vulnerabilities impact if they are exploited

What is the difference between a false positive and a false negative in IDS?

A false positive is considered to be a false alarm and a false negative is considered to be the most complicated state. A false positive occurs when an IDS fires an alarm for legitimate network activity. A false negative occurs when IDS fails to identify malicious network traffic. Compared to both, a false positive is more acceptable than a false negative as they lead to intrusions without getting noticed.

What is the use of a firewall and how it can be implemented?

A firewall is a security system used to control and monitor network traffic. It is used for protecting the system/network from malware, viruses, worms, etc., and secures unauthorized access from a private network. The steps required to set up and configure the firewall are listed below: Change the default password for a firewall device. Disable the remote administration feature. Configure port forwarding for specific applications to function correctly, such as an FTP server or a web server. Firewall installation on a network with an existing DHCP server can cause errors unless its firewall's DHCP is disabled. Make sure the firewall is configured to robust security policies.

What is port scanning?

A port scanning is an application designed for identifying open ports and services accessible on a host network. Security administrators mostly utilize it for exploiting vulnerabilities, and also by hackers for targeting victims. Some of the most popular port scanning techniques are listed below: Ping scan TCP connect TCP half-open Stealth scanning - NULL, FIN, X-MAS UDP

What is a three-way handshake process?

A three-way handshake process is used in TCP (Transmission Control Protocol) network for the transmission of data in a reliable way between the host and the client. It's called a three-way handshake because three segments are exchanged between the server and the client. SYN: The client wants to establish a connection with the server, and sends a segment with SYN(Synchronize Sequence Number) to the server if the server is up and has open ports. SYN + ACK: The server responds to the client request with SYN-ACK signal bits set if it has open ports. ACK: The client acknowledges the response of a server and sends an ACK(Acknowledgment) packet back to the server.

Define Cybersecurity?

Cybersecurity refers to the protection of internet-connected systems such as software, hardware, electronic data, etc., from cyber attacks. In a computing text, it is referred to as protection against unauthorized access.

What do you understand by VA (Vulnerability Assessment) and PT (Penetration Testing)?

As the name specifies, VA or Vulnerability Assessment is the process of finding vulnerabilities or flaws on the target. In this process, the organization already knows that their system/network has flaws or weaknesses and wants to find these flaws and prioritize fixing them. PT or Penetration Testing is the process of deep searching and finding vulnerabilities on the target. In this process, the organizations set up all the possible security measures they could think of and test if there is any other way their system/network can be ha

What are the common methods of authentication for network security?

Biometrics - It is a known and registered physical attribute of a user specifically used for verifying their identity. Token - A token is used for accessing systems. It makes it more difficult for hackers to access accounts as they have long credentials. Transaction Authentication - A one-time pin or password is used in processing online transactions through which they verify their identity. Multi-Factor Authentication - It's a security system that needs more than one method of authentication. Out-of-Band Authentication - This authentication needs two different signals from two different channels or networks. It prevents most of the attacks from hacking and identity thefts in online banking.

What do you understand by Black Hat Hackers, White Hat Hackers and Grey Hat Hackers?

Black Hat Hackers: Black Hat Hackers are the most critical types of hackers. They attempt to obtain unauthorized access to a system to disrupt its operations or steal sensitive and important data. Black Hat Hackers are also known as crackers. Black Hat Hacking is always illegal due to its malicious aim. The main purpose of Black Hat Hacking is to steal company data, violate privacy, cause system damage, block network connections, etc. White Hat Hackers: White Hat Hackers are used to accessing the system for penetration testing and vulnerability assessments. They never intend to harm the system; rather, than strive to uncover holes in a computer or network system. White Hat Hackers are also referred to as Ethical Hackers. Hacking done by White Hat Hackers is called Ethical hacking. It is not a crime, and it is considered one of the most difficult professions in the IT business. Many businesses hire ethical hackers to do penetration tests and vulnerability assessments. Grey Hat Hackers: Grey Hat Hackers are a combination of Black Hat Hackers and White Hat Hackers. They use elements of both black and white hat hacking techniques. They are supposed to act without malice, but for the sake of amusement, they can exploit the security flaw in a computer system or network without the permission or knowledge of the owner. The main goal of Grey Hat Hackers is to draw the owners' attention to the security flaw or hole in the network in the hope of receiving gratitude or a reward.

What is the difference between hashing and encryption?

Both hashing and encryption are used to convert readable data into an unreadable format. The significant difference is that encrypted data can be transformed into original data by decryption, whereas hashed data cannot be processed back to the original data.

What do you understand by Brute Force Attack? How can you prevent it?

Brute Force Attack is a method of finding the right credentials by repetitively trying all the permutations and combinations of possible credentials. Brute Force Attacks are automated in most cases where the tool/software automatically tries to log in with a list of possible credentials. Following is a list of some ways to prevent Brute Force Attacks: Password Length: The length of a password is an important aspect to make it hard to crack. You can specify to set at least a minimum length for the password. The lengthier the password, the harder it is to find. Password Complexity: You can include different characters formats in the password to make brute force attacks harder. Using the combination of alpha-numeric keywords along with special characters and upper and lower case characters can increase the password complexity making it difficult to be cracked. Limiting Login Attempts: You can make the password hard for brute force attacks by setting a limit on login failures. For example, you can set the limit on login failures as 5. So, when there are five consecutive login failures, the system will restrict the user from logging in for some time or send an Email or OTP to log in the next time. Because brute force is an automated process, limiting login attempts will break the brute force process.

What are the techniques used in preventing a Brute Force Attack?

Brute Force Attack is a trial and error method that is employed for application programs to decode encrypted data such as data encryption keys or passwords using brute force rather than using intellectual strategies. It's a way to identify the right credentials by repetitively attempting all the possible methods. Brute Force attacks can be avoided by the following practices: Adding password complexity: Include different formats of characters to make passwords stronger. Limit login attempts: set a limit on login failures. Two-factor authentication: Add this layer of security to avoid brute force attacks.

What is a CIA triad?

CIA (confidentiality, integrity, and availability) triad is a model designed to handle policies for information security within an organization. Confidentiality - A collection of rules that limits access to information. Integrity - It assures the information is trustworthy and reliable. Availability - It provides reliable access to data for authorized people.

What do you understand by CIA triad?

CIA is an acronym that stands for Confidentiality, Integrity, and Availability. It is commonly known as the CIA triad. CIA is a model that specifies the guide policies for Information Security. It is one of the most popular models used by organizations. Confidentiality: It specifies that the information should be accessible and readable only to authorized personnel and ensures that unauthorized personnel cannot access it. The information should be strongly encrypted so that if someone uses hacking to access the data, they cannot read or understand it. Integrity: Integrity is used to ensure that an unauthorized entity has not modified the data. It also ensures that data should not be corrupted. If an authorized individual/system tries to modify the data and the modification should not be successful, the data reversed back and should not be corrupted. Availability: It ensures that the data is available to the user whenever the user requires it. To achieve this, maintaining hardware, upgrading them regularly, data backups and recovery are necessary.

How to prevent CSRF attacks?

CSRF is referred to as Cross-site Request Forgery, where an attacker tricks a victim into performing actions on their behalf. CSRF attacks can be prevented by using the following ways: Employing the latest antivirus software which helps in blocking malicious scripts. While authenticating to your banking site or performing any financial transactions on any other website do not browse other sites or open any emails, which helps in executing malicious scripts while being authenticated to a financial site. Never save your login/password within your browser for financial transactions. Disable scripting in your browser.

What is cognitive security

Cognitive security is one of the applications of AI technologies that is used explicitly for identifying threats and protecting physical and digital systems based on human understanding processes. Self-learning security systems use pattern recognition, natural language processing, and data mining to mimic the human brain.

What do you understand by compliance in Cybersecurity?

Compliance means living by a set of standards set by an organization/government/independent party. It helps in defining and achieving IT targets and also in mitigating threats through processes like vulnerability management.

What is Cross-Site Scripting and how it can be prevented?

Cross-Site Scripting is also known as a client-side injection attack, which aims at executing malicious scripts on a victim's web browser by injecting malicious code. The following practices can prevent Cross-Site Scripting: Encoding special characters Using XSS HTML Filter Validating user inputs Using Anti-XSS services/tools

What is Cryptography?

Cryptography is a method to transform and transmit confidential data in an encoded way to protect the information from third parties for whom data is not authorized.

Why is Cyber Crime increasing day by day every year?

Cyber Crime is increasing day by day every year because of the following reasons: Cyber Crime is easy to accomplish. A person having good knowledge of computer hacking can do Cybercrime. There is a lower risk of getting caught in Cybercrime. A cyber attackers can get huge money for their little work. Cyber attackers can target thousands of victims. With the introduction of cryptocurrencies, money laundering is getting easier.

What is Cyber Crime? Give some examples of Cyber Crime.

Cyber Crime is just like regular crime but happens on the Internet. Following are some examples of Cyber Crime: Identity Theft Online Predators Hacking of sensitive information from the Internet BEC ("Business Email Compromise") Ransomware Stealing intellectual property

What is Cyber Security? / What do you know about Cyber Security?

Cyber Security is a practice of protecting internet-connected systems such as hardware, software, programs, computers, servers, mobile devices, electronic systems, networks, and data from malicious digital attacks. The main purpose of cyber security is to protect against cyberattacks like accessing, changing, or destroying sensitive information from your computer system. The cyber attackers are mainly aimed at accessing, changing, or destroying sensitive information, extorting money from users, or interrupting normal business processes. Cyber Security is also known as computer security, information technology (IT) security, cybersecurity etc. It is used to measure the combat threats against networked systems and applications, whether those threats originate from inside or outside of an organization. We can divide the term cyber security into two parts: cyber and security. Cyber refers to the technology that includes systems, networks, programs, and data of an internet-connected system. The word security specifies the protection of the systems, networks, applications, and information.

What are the main advantages of cyber security?

Cyber security protects online businesses and transactions against ransomware, malware, online frauds, and phishing. It protects the end-users. It provides great protection for both data as well as networks. It can increase the recovery time after a breach. It prevents unauthorized users from accessing sensitive information.

What is the need for DNS monitoring?

DNS (Domain Name System) is a service that is used for converting user-friendly domain names into a computer-friendly IP address. It allows websites under a particular domain name that is easy to remember. DNS monitoring is nothing but monitoring DNS records to ensure does it route traffic properly to your website, electronic communication, services, and more.

Define data leakage and its types?

Data Leakage refers to the illegal transmission of data to an external destination or unauthorized entity within an organization. It can transfer data either physically or electronically. It usually occurs via the web, emails, and mobile data storage devices. Types of data leakage: The Accidental Breach - The majority of data leakage incidents are accidental. Ex: An entity may choose the wrong recipient while sending confidential data. The Disgruntled or ill-intentioned Employee - The authorized entity sends confidential data to an unauthorized body. Electronic Communications with Malicious Intent - The problem is all the electronic mediums are capable of file transferring and external access sources over the internet.

What are the different types of Cyber Security?

Every organization has some assets that are made up of a variety of different systems. These systems must have a strong Cyber Security aspect to make the organization work well. According to the devices used in Cyber Security, it can be divided into the following types: Network security: Network security is one of the most important types of Cyber security. In this process, we have to secure a computer network against unauthorized access, intruders, attacks, disruption, and misuse using hardware and software. This security also adds an extra layer in protecting an organization's assets from both external and internal threats. An example of Network security is using a Firewall. Application security: Application security is used to safeguard software and devices against malicious attacks. This can be achieved by regularly updating the apps to ensure that they are secure against threats. Identity management & security: Identity management & security identifies each individual's level of access inside an organization. For example, you can restrict and allow access to data according to an individual's job role in the company. Data security: Data security is used to ensure that you put your data in a strong data storage system to ensure data integrity and privacy while in storage and transport. Operational security: Operational security is used to analyze and make decisions about handling and securing the data assets. For example: Storing data in an encrypted form in the database is an example of Operational security. Mobile security: Mobile security is used to specify the protection of organizational and personal data held on mobile devices such as cell phones, PCs, tablets, and other similar devices against various hostile attacks. Examples of mobile security threats are unauthorized access, device loss or theft, malware, and other threats that can harm mobile devices. Cloud security: The main aim of cloud security is to safeguard the data held in a digital environment or cloud infrastructures for an organization. It uses various cloud service providers, including AWS, Azure, Google, and others, to assure protection against a variety of threats.

What are the key elements of Cyber Security?

Following is the list of key elements of Cyber Security: Information security Network security Operational security Application security End-user security Business continuity planning

What is the difference between a threat, vulnerability and risk?

Generally, people think that threat, vulnerability and risk are the same, but there are some crucial differences between them: Threat: A threat can be any form of hazard capable of destroying or stealing data, disrupting operations, or cause harm in general. Some examples of threats are Malware, phishing, data breaches, and even unethical employees etc. Any type of threat may be harmful for the organization, so; it is essential to understand threats for developing effective mitigation and making informed cyber security decisions. Vulnerability: Vulnerability is a possible problem or a flaw in hardware, software, personnel, or procedures that can harm the organization. Threat actors can use these vulnerabilities to achieve their objectives. Some examples of vulnerabilities are given below: Physical vulnerabilities: Publicly exposed networking equipment is an example of Physical vulnerability. Software vulnerabilities:e. buffer overflow vulnerability in a browser. Human vulnerabilities:e. an employee vulnerable to phishing assaults. Zero-day vulnerability: It is a type of vulnerability for which a remedy is not yet available. To cope up with vulnerabilities, we have a method called Vulnerability management. It is the process of identifying, reporting and repairing vulnerabilities. Risk: Risk is a combination of threat and vulnerability. When we combine the probability of a threat and the consequence of vulnerability, it is called a risk. Risk is the likelihood of a threat agent successfully exploiting vulnerability. A formula to calculate risk: Risk = likelihood of a threat * Vulnerability Impact To control and manage the risk, we use a method called Risk management. It is a process of identifying all potential hazards, analyzing their impact, and determining the best course of action. This is an always running procedure used to examine the new threats and vulnerabilities regularly. By using this method, we can avoid or minimize risks. We can also accept or passed them to a third party according to the response chosen.

Explain System hardening?

Generally, system hardening refers to a combination of tools and techniques for controlling vulnerabilities in systems, applications, firmware, and more in an organization. The purpose of system hardening is to decrease the security risks by reducing the potential attacks and condensing the system's attack surface. The following are the various types of system hardening: Database hardening Operating system hardening Application hardening Server hardening Network hardening

What are HTTP response codes?

HTTP response codes display whether a particular HTTP request has been completed. 1xx (Informational) - The request has been received, and the process is continuing. 2xx (Success) - The request was successfully received and accepted. 3xx (Redirection) - Further action must be taken to complete it. 4xx (Client Error) - Request cannot be fulfilled or has incorrect syntax. 5xx (Server Error) - The server fails to fulfill the request.

What is the difference between hashing and salting?

Hashing is majorly used for authentication and is a one-way function where data is planned to a fixed-length value. Salting is an extra step for hashing, where it adds additional value to passwords that change the hash value created.

What is the main purpose of Hashing?

Hashing is required when we have to compare a huge amount of data. We can create different hash values for different data, and we can compare hashes too. Following is a list of some most important usage of Hashing: Hashing facilitates us to keep and find records of hashed data. Hashing can be used in cryptographic applications such as a digital signature. With the use of hashing, we can create random strings to avoid data duplication. Geometric hashing is a type of hashing used in computer graphics to help find proximity issues in planes.

What is the difference between IDS and IPS?

IDS stands for Intrusion Detection Systems.IPS stands for Intrusion Prevention Systems.IDS can only detect intrusions, but it is unable to prevent intrusions.IPS can detect as well as prevent intrusions.IDS is a monitoring system.IPS is a control system.IDS requires a human or another system to look at the results.IPS only requires a regularly updated database with the latest threat data.

What is data leakage in the context of Cyber security?

In the context of Cyber security, data leakage is an unauthorized transfer of data to the outside of the secure network. Data leakage can occur via email, optical media, laptops, and USB keys etc.

What are some common Hashing functions/algorithms?

Message-Digest Algorithm (MD5) Message-Digest Algorithm or MD5 is the latest and advanced form of MD4. It was introduced after finding severe security issues in MD4. MD5 is used to generate 128-bit outputs for a variable length of inputs. MD5 is the advanced version and the successor to MD4. It covers a lot of security threats but fails to provide full data security services. It is one of the most widely used algorithms, but the main issue with using MD5 is its vulnerability and collisions. Secure Hashing Algorithm (SHA) Secure Hashing Algorithm, or SHA, was developed by the National Security Agency. Later it was updated repeatedly to improve the security flaws in the old genre. Its latest and advanced version is SHA-2 that many firms are using for cryptographic purposes. Tiger Cipher Algorithm Tiger cypher algorithm is a faster and more efficient algorithm compared to Message Digest (MD5) and Secure Hashing Algorithm. It is mostly used in new generation computers and has a 192-bit hashing system. Its latest and advanced version is the Tiger2 algorithm which is more powerful than the Tiger algorithm. RIPMEND Algorithm Hans Dobbertin designed RIPMEND cryptographic hashing algorithm. It is created using the EU project RIPE framework and has a 164-bit digest. WHIRLPOOL Algorithm Vincent Rijmenand Paul Barreto designed the WHIRLPOOL algorithm. It accepts any messages of a length less than 2256 bits and returns a 512-bit message digest. Its first version was whirlpool-0, the second version was named Whirlpool-T, and the latest and most advanced version is Whirlpool.

Which are the best Patch management tools or software? Why are they used?

Patch management tools or software are used to ensure that the components of a company's software and IT infrastructure are up to date. The patch management tools work by tracking updates of various software and middleware solutions, and then they alert users to make necessary updates or execute updates automatically. Following is a list of the top 10 best patch management software or tools: Atera NinjaRMM Acronis Cyber Protect Cloud Acronis Cyber Protect PDQ Deploy ManageEngine Patch Manager Plus Microsoft System Center Automox SmartDeploy SolarWinds Patch Manage

What is phishing and how it can be prevented?

Phishing is a malicious attempt of pretending oneself as an authorized entity in electronic communication for obtaining sensitive information such as usernames, passwords, etc. through fraudulent messages and emails. The following practices can prevent phishing: Use firewalls on your networks and systems. Enable robust antivirus protection that has internet security. Use two-factor authentication wherever possible Maintain adequate security. Don't enter sensitive information such as financial or digital transaction details on web pages that you don't trust. Keep yourself updated with the latest phishing attempts.

What do you understand by Port Scanning?

Port scanning is the technique administrators, and hackers use to identify the open ports and services available on a host. Hackers use this technique to find information that can be helpful to find flaws and exploit vulnerabilities, and administrators use this technique to verify the security policies of the network. Following is a list of some most common Port Scanning Techniques: Ping Scan TCP Half-Open TCP Connect UDP Stealth Scanning

What is SQL injection and how it can be prevented?

SQL Injection (SQLi) is a type of code injection attack where it manages to execute malicious SQL statements to control a database server behind a web application. Attackers mostly use this to avoid application security measures and thereby access, modify, and delete unauthorized data. The following ways will help you to mitigate or prevent SQL injection attacks: Include Prepared Statements (with Parameterized Queries) Use Stored Procedures Validate user input Hide data from the error message Update your system Store database credentials separate and encrypted Disable shell and any other functionalities you don't need

Which is more secure SSL or HTTPS?

SSL (Secure Sockets Layer) is a secure protocol that provides safer conversations between two or more parties across the internet. It works on top of the HTTP to provide security. HTTPS (Hypertext Transfer Protocol Secure) is a combination of HTTP and SSL to provide a safer browsing experience with encryption. In terms of security, SSL is more secure than HTTPS.

What is a Botnet?

See iA Botnet is a group of internet-connected devices such as servers, PCs, mobile devices, etc., that are affected and controlled by malware. It is used for stealing data, sending spam, performing distributed denial-of-service attack (DDoS attack), and more, and also to enable the user to access the device and its connection.mage

What is the difference between stored and reflected XSS?

Stored XSS Attacks - The attacks where the injected scripts are stored on the target servers permanently. In this, the victim retrieves the malicious script from the server when requests the stored information. Reflected XSS Attacks - In this, the user has to send the request first, then it will start running on the victim's browser and reflects results from the browser to the user who sent the request.

List the common types of cybersecurity attacks.

The following are the most common types of cybersecurity attacks: Malware SQL Injection Attack Cross-Site Scripting (XSS) Denial-of-Service (DoS) Man-in-the-Middle Attacks Credential Reuse Phishing Session Hijacking

How to prevent 'Man-in-the-Middle Attack'?

The following practices prevent the 'Man-in-the-Middle Attacks': Have stronger WAP/WEP Encryption on wireless access points avoids unauthorized users. Use a VPN for a secure environment to protect sensitive information. It uses key-based encryption. Public key pair-based authentication must be used in various layers of a stack for ensuring whether you are communicating the right things are not. HTTPS must be employed for securely communicating over HTTP through the public-private key exchange.

How will you keep yourself updated with the latest cybersecurity news?

The following ways will help you to keep up with the latest cybersecurity updates: Follow news websites and blogs from security experts. Browse security-related social media topics. Check vulnerability alert feeds and advisory sites. Attend cybersecurity live events.

What is the main goal of Cyber Security?

The main objective of cyber security is to protect data from cyber-attacks. It follows a principle called CIA trio. It is a security sector that provides a triangle of three connected principles. The CIA model is used to help organizations to develop policies for their information security architecture. There are three main components Confidentiality, Integrity, and Availability of this CIA model. One or more of these principles is broken when it finds a security breach. This model provides a security paradigm to guide individuals through many aspects of IT security. Let's see these three security aspects in detail: Confidentiality: Confidentiality is used to provide privacy to prevent unauthorized access to data. It ensures that the data is only accessible to those who are authorized to use it and restricts access to others. It restricts vital information to be exposed to the wrong hands. A good example of Confidentiality is Data encryption which is used to keep information private. Integrity: The Integrity principle is used to assure that the data is genuine, correct, and safe from unwanted threat actors or unintentional user alteration. It also specifies that the source of information must be genuine. If any changes are made, precautions should be taken to protect sensitive data from corruption or loss and recover from such an incident quickly. Availability: The Availability principle ensures that the information is constantly available and accessible to those who have access to it. It also ensures that any types of system failures or cyber-attacks do not obstruct these accesses.

What is the use of Patch Management?

The purpose of patch management is to keep updating various systems in a network and protect them against malware and hacking attacks. Many enterprise patch management tools manage the patching process by installing or deploying agents on a target computer, and they provide a link between centralized patch servers and computers to be patched.

What is the difference between vulnerability assessment and penetration testing?

The terms Vulnerability assessment and penetration testing are both different, but serve an essential function of protecting the network environment. Vulnerability Assessment: It's a process to define, detect, and prioritize the vulnerabilities in computer systems, network infrastructure, applications, etc., and gives the organization the required information to fix the flaws. Penetration Testing: It is also called pen testing or ethical hacking. It's a process of testing a network, system, application, etc. to identify vulnerabilities that attackers could exploit. In the context of web application security, it is most widely used to augment a web application firewall (WAF).

What is the difference between Threat, Vulnerability, and Risk?

Threat: Someone with the potential to cause harm by damaging or destroying the official data of a system or organization. Ex: Phishing attack Vulnerability: It refers to weaknesses in a system that makes threat outcomes more possible and even more dangerous. Ex: SQL injections, cross-site scripting Risk: It refers to a combination of threat probability and impact/loss. In simple terms, it is related to potential damage or loss when a threat exploits the vulnerability.

What is two-factor authentication and how it can be implemented for public websites?

Two-factor authentication is also referred to as dual-factor authentication or two-step verification where the user provides two authentication factors for protecting both user credentials and resources while accessing. The two-factor authentication can be implemented on public websites such as Twitter, Microsoft, LinkedIn, and more for enabling another protection on your already protected account with a password. For enabling this double factor authentication, you can easily go to settings and then manage security settings.

What is a VPN? What is its use in Cyber Security?

VPN is an acronym that stands for Virtual Private Network. It creates a safe encrypted tunnel across the internet by connecting a VPN server to a VPN client. Suppose a user has a VPN client installed on their machine. The VPN client then creates an encrypted tunnel to the VPN server, and the user can securely send or receive information over the internet.