| Threat | Description |
|---|---|
| DoS/DDoS | Denial of Service / Distributed DoS - overwhelms a server with traffic to make it unavailable |
| MITM | Man-in-the-Middle - attacker intercepts communication between two parties |
| Phishing | Fraudulent emails/websites that trick users into revealing credentials |
| ARP Spoofing | Attacker sends fake ARP replies to associate their MAC with a legitimate IP |
| DNS Spoofing | Corrupting DNS cache to redirect users to malicious sites |
| SQL Injection | Injecting malicious SQL into web forms to access/manipulate databases |
| Port Scanning | Probing a host for open ports to find vulnerabilities |
| Packet Sniffing | Capturing network traffic to read unencrypted data |
| Ransomware | Malware that encrypts files and demands payment for decryption |
A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predefined security rules.
| Firewall Type | Description | OSI Layer |
|---|---|---|
| Packet Filtering | Inspects packets based on IP, port, protocol. Simple and fast but limited. | Layer 3-4 |
| Stateful Inspection | Tracks connection state. Allows return traffic for established connections. | Layer 3-4 |
| Application Layer (WAF) | Inspects application-level traffic (HTTP, FTP). Can detect SQL injection, XSS. | Layer 7 |
| Next-Generation (NGFW) | Combines stateful inspection with deep packet inspection, IPS, and application awareness. | All layers |
A VPN creates an encrypted tunnel over a public network (Internet), allowing secure communication as if devices were on a private network.
| Type | Description | Examples | Use Case |
|---|---|---|---|
| Symmetric | Same key for encryption and decryption. Fast. | AES, DES, 3DES, RC4 | Bulk data encryption |
| Asymmetric | Public key encrypts, private key decrypts. Slower. | RSA, ECC, Diffie-Hellman | Key exchange, digital signatures |
| Hashing | One-way function. Cannot be reversed. | MD5, SHA-1, SHA-256, bcrypt | Password storage, integrity verification |
SSL/TLS secures HTTPS connections. The handshake establishes a secure session:
Source: application subnet 10.12.4.0/24
Destination: database 10.40.8.15
Protocol and port: TCP 5432
Decision: allow this flow; deny other database sources
Verification: permitted application connects, unrelated subnet is blocked, both results are logged.A useful rule identifies direction, endpoints, protocol, port, purpose, and test evidence.
Expected host: api.example
Certificate checks: trusted issuer, valid time window, hostname match, allowed key usage
Failure policy: stop the connection and report the validation error
Unsafe workaround: disabling certificate verificationEncryption without peer authentication still permits interception by an untrusted endpoint.
A firewall controls network paths, not application authorization, input validation, patching, secrets, or encryption correctness. Opening port 443 permits HTTPS traffic, including malicious requests, to reach the service. Use least-privilege network rules together with TLS, authentication, application controls, monitoring, and timely updates.
The hostname may not match, the certificate chain may be incomplete, the client may not trust the issuer, the clock may be wrong, or protocol and cipher settings may be incompatible. TLS also depends on reaching the correct server through DNS and routing. Inspect the presented chain and handshake error instead of checking only the expiration date.
An IDS observes traffic and raises alerts, while an IPS sits in the traffic path and can block or modify suspicious flows.
Explore 500+ free tutorials across 20+ languages and frameworks.