A network is a group of interconnected devices that communicate to share resources and information. It can be wired or wireless.
An IP (Internet Protocol) address is a unique numerical identifier assigned to each device on a network to facilitate communication.
- IPv4: 32-bit addressing, supports 4.3 billion addresses.
- IPv6: 128-bit addressing, supports an enormous number of addresses, improving scalability and security.
- Private IPs: Used within local networks (e.g., 192.168.x.x).
- Public IPs: Used on the internet and assigned by ISPs.
A subnet mask divides an IP address into network and host portions, determining which part identifies the network and which part identifies the device.
The Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses to devices in a network, reducing manual configuration.
The Domain Name System (DNS) translates domain names (e.g., google.com) into IP addresses, making it easier to access websites.
NAT allows multiple devices on a local network to share a single public IP address for internet access.
A firewall is a security system that monitors and controls incoming and outgoing network traffic based on security rules.
- Packet Filtering Firewall
- Stateful Inspection Firewall
- Proxy Firewall
- Next-Generation Firewall (NGFW)
A Virtual Private Network (VPN) encrypts internet connections, providing secure remote access and anonymity.
SSH (Secure Shell) is a protocol used for secure remote access to servers using encrypted communication.
- HTTP (Hypertext Transfer Protocol): Unencrypted web communication.
- HTTPS (HTTP Secure): Secure, encrypted communication using SSL/TLS.
An SSL/TLS certificate encrypts website traffic, ensuring secure communication and trustworthiness.
A load balancer distributes incoming network traffic across multiple servers to optimize performance and availability.
- Layer 4 Load Balancer (Transport Layer)
- Layer 7 Load Balancer (Application Layer)
A Demilitarized Zone (DMZ) is a security buffer between an internal network and the internet, hosting public-facing services securely.
Port forwarding redirects network traffic from one port to another, often used to expose internal services externally.
ARP translates IP addresses into MAC addresses to enable communication within a local network.
- IDS (Intrusion Detection System): Monitors network traffic for threats.
- IPS (Intrusion Prevention System): Blocks malicious traffic automatically.
Zero Trust is a security model that assumes no entity (inside or outside the network) is trusted by default.
- Symmetric Encryption: Uses one key for encryption and decryption.
- Asymmetric Encryption: Uses a public-private key pair (e.g., RSA).
A CDN improves website speed and security by distributing content across multiple servers worldwide.
- TCP: Reliable, connection-oriented, ensures data delivery.
- UDP: Faster, connectionless, best for real-time applications.
A reverse proxy sits between users and backend servers, protecting them from direct exposure and filtering malicious traffic.
- Encryption
- Data integrity
- Authentication
MFA adds an extra security layer by requiring multiple verification methods (e.g., password + OTP).
A bastion host is a highly secured jump server used to access internal networks securely.
The OSI model has 7 layers: Physical, Data Link, Network, Transport, Session, Presentation, Application.
A WAF protects web applications by filtering and blocking malicious HTTP traffic.
A honeypot is a security system designed to detect and study cyberattacks by mimicking real systems.
BGP is a routing protocol used for exchanging routing information between networks on the internet.
A Distributed Denial-of-Service (DDoS) attack overwhelms a system. It can be mitigated using rate limiting, firewalls, and cloud-based protection.
The CIA Triad stands for Confidentiality, Integrity, and Availability, which are fundamental security principles.
SSO allows users to log in to multiple applications using a single authentication process.
A security token is a physical or digital device used for authentication.
An ACL defines rules that allow or deny traffic based on IP, ports, or protocols.
Containers share OS kernels, so misconfigurations can expose services to security threats.
It is dividing a network into smaller parts to improve security and performance.
- Active reconnaissance: Direct interaction with the target.
- Passive reconnaissance: Collecting data without direct interaction.
Mutual TLS (mTLS) ensures both client and server authenticate each other before communication, enhancing security in microservices and API interactions.
- L3 Firewall (Network Layer): Filters traffic based on IP addresses.
- L4 Firewall (Transport Layer): Filters based on ports and TCP/UDP protocols.
- L7 Firewall (Application Layer): Filters based on application-specific data (e.g., HTTP, FTP).
- Security Groups: Act as virtual firewalls at the instance level, stateful.
- Network ACLs: Act at the subnet level, stateless.
SIEM aggregates security data from multiple sources to detect, analyze, and respond to threats.
Threat modeling identifies potential threats and vulnerabilities in a system to proactively mitigate risks.
Ephemeral ports (e.g., 49152-65535) are temporary ports used by client applications for outbound connections.
DNSSEC (DNS Security Extensions) prevents DNS spoofing by adding cryptographic signatures to DNS records.
- Remote Access VPN (for individuals connecting to a network remotely).
- Site-to-Site VPN (connects entire networks).
A service mesh (e.g., Istio, Linkerd) provides mTLS, authentication, and observability for secure communication between microservices.
- Injection (e.g., SQL injection)
- Broken Authentication
- Sensitive Data Exposure
- XML External Entities (XXE)
- Broken Access Control
- Security Misconfiguration
- Cross-Site Scripting (XSS)
- Insecure Deserialization
- Using Components with Known Vulnerabilities
- Insufficient Logging & Monitoring
WebSockets require authentication, encryption (WSS), and proper origin checks to prevent attacks.
An SSRF attack tricks a server into making requests to internal services, leading to data leaks or system compromise.
AWS WAF filters web traffic based on rules, rate limiting, and bot mitigation to prevent common attacks like SQL injection and XSS.
Kubernetes RBAC grants permissions based on Roles, RoleBindings, ClusterRoles, and ClusterRoleBindings, restricting access to resources.
A MAC address is a unique identifier for network interfaces. MAC filtering allows or denies network access based on these addresses.
DNS poisoning tricks users into visiting malicious sites by altering DNS records. Prevention includes DNSSEC, monitoring, and secure DNS resolvers.
Federated identity allows users to authenticate across multiple applications using a single set of credentials (e.g., Google or Microsoft sign-in).
Kubernetes Network Policies define rules for pod communication, restricting traffic based on namespaces, labels, and IP ranges.
PoLP ensures users and applications only have the minimum access needed to perform their tasks, reducing security risks.
60. How do HSTS (HTTP Strict Transport Security) and CSP (Content Security Policy) improve web security?
- HSTS: Forces HTTPS connections to prevent downgrade attacks.
- CSP: Restricts allowed content sources to prevent XSS attacks.
💡 Want to contribute?
We welcome contributions! If you have insights, new tools, or improvements, feel free to submit a pull request.
📌 How to Contribute?
- Read the CONTRIBUTING.md guide.
- Fix errors, add missing topics, or suggest improvements.
- Submit a pull request with your updates.
📢 Stay Updated:
⭐ Star the repository to get notified about new updates and additions.
💬 Join discussions in GitHub Issues to suggest improvements.
🔗 GitHub: @NotHarshhaa
📝 Blog: ProDevOpsGuy
💬 Telegram Community: Join Here
