[Day 7] 2. Security Threats and Defense Mechanisms

Attacks Against Encryption

1. Brute Force:
   Attempting all possible combinations to decrypt the data.
2. Finding Vulnerabilities in the Algorithm:
   Exploiting weaknesses in the cryptographic algorithm.

---

Security Attacks and Threats

1. Security Events:
   Incidents impacting confidentiality, integrity, or availability.
2. Types of Attacks:
   • Internal: Attacks initiated from within the organization.
   • External: Attacks originating from outside the organization.
3. Denial of Service (DoS, DDoS):
   Overwhelming a system or network to render it unavailable.

---

Symptoms of Attacks

1. Network performance slows down.
2. Unexpected pop-ups.
3. CPU utilization spikes.
4. System performance deteriorates (computer slows down).
5. Unfamiliar processes start without user action.
6. Unauthorized software gets installed automatically.

---

Types of Intruders

1. State-Sponsored:
   Attackers working for a country to harm the image or operations of another country.
2. Organized Crime:
   Professionals targeting financial gain.
3. Script Kiddies:
   Amateur hackers experimenting with minimal knowledge.

---

IT Act

• Covered earlier in the Security-Concepts Module.
• For further clarification, refer to Wikipedia.

---

Screened Host Firewall (Single-Homed Bastion Host)

• A basic firewall mechanism with a specialized name.
• Protects internal networks by acting as a single entry point.

!2. Screened Host Firewall (single-homed bastion host).png

---

Unified Threat Management (UTM)

• A hardware-based security solution integrating multiple protection measures.
• Requires specialized hardware; configurations were not covered in the lab.

---

Developed by C-DAC

• Distributed Honeynet System: Tracks attackers using distributed honeypots.
• Dynamically Configured Honeypots: Adjusts traps for evolving threats.
• UAC (URL Analyzer and Classifier): Categorizes and analyzes URLs.
  (Recommended to explore further online for details.)

---

Honeypot

• A decoy system designed to attract attackers.
• Used to study attack methods and gather details about the attacker.

---

SIEM (Security Information and Event Management)

• A category of software for monitoring, analyzing, and managing security data.
• Components of SIEM:
  • Nagios: Monitoring tool.
  • SNORT: Open-source intrusion detection system.
• OSSIM (Open Source SIEM):
  Open-source solution combining various SIEM components.

---