Ut1

1. Explain the three D’s of security ?

Ans=

Three D’s of Security

 The Three D’s of Security are Deter, Detect, and Defend.

 These principles help protect systems, data, and networks from threats.

[Link]:

 Prevent threats before they happen.

 Use strong passwords, firewalls, CCTV cameras, and security policies.
 Example: Installing a security alarm system to scare away intruders.

[Link]:

 Identify security breaches as soon as they occur.

 Use surveillance cameras, intrusion detection systems, and monitoring software.
 Example: A firewall detecting an unauthorized attempt to access a network.

[Link]:

 Take action to stop or recover from security threats.

 Use antivirus software, backup systems, and security response plans.
 Example: An antivirus removing malware from a computer to protect data.
[Link] the CIA triad model .

Ans=

 The CIA Triad is a basic model used in information security.

 It helps protect data and keep it safe from harm. The three main parts of the CIA
Triad are:

1. Confidentiality (Keeping Data Private)

 Only authorized users can access sensitive information.

 Strong passwords and security codes help protect data.
 Encryption (locking data with a special code) makes sure hackers can’t read it.
 Example: When you enter a password to access your bank account, it ensures
only you can see your account details.

2. Integrity (Keeping Data Correct and Untouched)

 Data should not be changed or damaged by mistake or on purpose.

 Security checks (like digital signatures) help confirm that data is correct.
 Backups keep copies of data in case something goes wrong.
 Example: When sending an online message, encryption ensures the message stays
the same and is not changed by hackers.

3. Availability (Making Sure Data is Always Reachable)

 Data should be available whenever needed.

 Regular system maintenance and backups prevent data loss.
 Protection against cyber-attacks ensures systems don’t crash.
 Example: Online shopping websites use strong security to make sure they don’t
shut down, allowing customers to buy items anytime.
[Link] the two most common approach of Security models (onion defence model,
lollipop model) ?

Ans=

1. Onion Defense Model (Layered Security)

 This model is like an onion, with multiple layers of security.

 Even if one layer is broken, the attacker must go through other layers.
 Each layer has different security measures to protect data.

Layers of Security in Onion Model:

1. Perimeter Security – Firewalls and network protection.

2. Access Control – User authentication (passwords, biometrics).
3. Application Security – Protecting software from attacks.
4. Data Encryption – Locking data so only authorized people can read it.
5. Monitoring & Response – Detecting and stopping threats.

Example: A bank has security guards at the entrance, locked doors, fingerprint
access, and cameras inside to protect money and customers.
2. Lollipop Model (Single Point of Entry)

 This model is like a lollipop, where security is strong at the entry point but open
inside.
 It allows trusted users to access the system after strict verification.
 Once inside, the security is less strict because only authorized users are allowed.

Lollipop Model Works:

1. Strong Authentication – Users must verify their identity (passwords, OTP,

biometrics).
2. Strict Firewall – Controls who can enter the network.
3. Open Internal Network – Once inside, access to data is easier.

Example: A company requires employees to scan their ID card at the entrance, but
once inside, they can move freely between departments.

[Link] and explain the steps to create a security defense plan.

Ans=
A Security Defense Plan helps protect systems and data from cyber threats. Below
are the key steps:

Steps to Create a Security Defense Plan

1. Identify Assets – List important data, devices, and systems that need protection.
2. Assess Risks – Find potential threats like hacking, malware, or weak security
points.
3. Define Security Policies – Set rules for passwords, data access, and network
safety.
4. Implement Security Measures – Use firewalls, antivirus, encryption, and strong
authentication.
5. Monitor & Detect Threats – Track unusual activities and set up security alerts.
6. Create an Incident Response Plan – Plan steps to handle security breaches
quickly.
7. Train Employees – Educate staff on cybersecurity and phishing attacks.
8. Update & Test Regularly – Perform security audits and keep software up to date.

[Link] - Short note

Ans=

Man-in-the-Middle (MITM) Attack

 A Man-in-the-Middle (MITM) attack happens when a hacker secretly listens to

or changes messages between two people without them knowing.
 The attacker acts as a middleman and can steal or modify important data like
passwords, credit card details, or personal messages.

How MITM Attacks Happen

 Hacker intercepts communication between two people.

 Reads, steals, or changes the data before passing it on.
 Neither person realizes that their conversation has been tampered with.

Examples of MITM Attacks

1. Fake Wi-Fi Hotspots – A hacker sets up a free Wi-Fi network, and when people
connect, their data gets stolen.
2. Session Hijacking – A hacker steals login details and takes over someone’s online
account.
3. Fake Websites (DNS Spoofing) – A hacker tricks users into visiting a fake
website to steal their passwords.

Prevention Methods

 Always use secure (HTTPS) websites when browsing.

 Avoid public Wi-Fi or use a VPN for security.
 Enable two-factor authentication (2FA) for extra protection.
 Never enter sensitive details on suspicious links or websites.

Ut2
[Link] different types of Authentication in detail.? Write a short note on
certificate-based authentication?

Ans=

Authentication

 Authentication is the process of verifying a user's identity before granting access

to a system or network.
 There are several types of authentication:

[Link]-Factor Authentication (SFA)

 Uses only one method to verify identity, like a password, PIN

 Example: Logging into an email account with a password.

2 Multi-Factor Authentication (MFA)

 Requires two or more verification steps for added security.

 Example: Banking apps require a password and an OTP sent to a mobile phone.

3 Biometric Authentication

 Uses unique biological traits like fingerprints, retina scans, or facial recognition.
 Example: Unlocking a phone using a fingerprint scanner.

4. Certificate-Based Authentication

 Uses digital certificates issued by a trusted Certificate Authority (CA).

 Example: Logging into a corporate network using an electronic ID card.

certificate-Based Authentication
Certificate-Based Authentication is a secure authentication method that uses digital
certificates to verify a user's identity.

How It Works?

1. A user receives a digital certificate from a trusted Certificate Authority (CA)

2. When logging in, the system checks the certificate’s validity.
3. If the certificate is valid, the user is granted access to the system.

Benefits of Certificate-Based Authentication

 More secure than passwords, as certificates cannot be easily guessed.

 Reduces phishing attacks since users do not enter passwords.
 Used in secure environments, like corporate networks and online banking.

Example of Certificate-Based Authentication

 A company provides employees with smart cards containing digital certificates.

 Employees insert the card and enter a PIN to log into work computers.

[Link] asymmetric and symmetric key cryptography/encryption

?
Ans=
[Link] Public key Cryptography and its significance in secure communication ?
Ans=
Public Key Cryptography

 Public Key Cryptography (PKC) is a way to secure communication using two

keys:

1. Public Key – Shared with everyone; used to lock (encrypt) the message.
2. Private Key – Kept secret by the receiver; used to unlock (decrypt) the message.

 This system is called asymmetric encryption because the keys are different for
locking and unlocking the message.

How Does It Work

 The sender uses the public key of the receiver to encrypt the message.
 The receiver uses their private key to decrypt the message.
 Only the receiver can read the message because only they have the private key.

Significance in Secure Communication

1. Confidentiality –Only authorized users can access sensitive information

2. Authentication – Verifies the sender's identity using digital signatures.
3. Integrity –Data should not be changed or damaged by mistake or on purpose.

9. Explain different types of database backups?

Ans=

Database Backups
 Database backups are essential to protect data from loss due to system failures,
cyberattacks, or accidental deletions.
 There are several types of backups used in database management:

1. Full Backup

 Creates a complete copy of the entire database for easy restoration.

 Example: A company takes a full backup every Sunday.

2. Incremental Backup

 saves only new or changed data since the last backup to save storage.
 Example: A bank takes a full backup on Sunday and incremental backups daily.

3. Differential Backup

 Stores all changes made since the last full backup for faster recovery.
 Example: A company takes a full backup on Sunday and a differential backup
every evening.

4. Mirror Backup

 Maintains a real-time, exact copy of the database for quick access.

 Example: Used for critical financial transactions in banks.

5. Cloud Backup

 Saves a backup on a cloud server instead of local storage.

 Example: Google Drive, AWS, and Microsoft Azure provide cloud backups.

[Link] the concept of Encryption and Decryption for shared symmetric key with
diagram?
Ans=
Encryption and Decryption Using a Shared Symmetric Key

 Encryption is the process of converting plain text into coded text (ciphertext) to
protect data.
 Decryption is the process of converting the ciphertext back into readable text
(plain text).
 In symmetric key cryptography, the same key is used for both encryption and
decryption.\
 The sender and receiver must share the secret key securely before
communication.

· Steps of Encryption & Decryption:

1. Encryption: Converts the original message into unreadable text using a secret key.
2. Transmission: The encrypted message is sent securely.
3. Decryption: The receiver uses the same key to turn the message back into readable
text.
4. Security: The key must be kept safe to prevent unauthorized access.

Ut 3
[Link] a short note on Hubs and Switches
Ans=
[Link] the Cisco Hierarchical Internetworking model?
Ans=
Cisco Hierarchical Internetworking Model

 The Cisco Hierarchical Internetworking Model is a structured approach to

designing networks.
 It divides a network into three layers to improve scalability, performance, and
security.

1. Core Layer

 The core layer is the backbone of high-speed data transport between different
network parts.
 It is designed to provide the fastest possible data transfer, focusing on efficient
data forwarding.

[Link] Layer

 This layer acts as a middleman between the core layer and the access layer.
 It collects data from the access layer and sends it to the core layer.\
 This layer also helps manage things like security and traffic control.

3. Access Layer

 This is where users and devices connect to the network, like computers,
printers, and phones.
 The access layer is responsible for allowing or blocking access to the network
and keeping it secure.

[Link] Network Address Translation (NAT) and Port Address

Translation (PAT) ?
Ans=

[Link] the concepts of network hardening?

Ans=

Network Hardening
 Network hardening means making a network stronger and more secure to protect
it from hackers and cyber threats.
 The goal is to reduce weaknesses and prevent unauthorized access.

Key Concepts of Network Hardening:

[Link] Off Unused Services

 Disable unnecessary programs and services to reduce security risks.

 Keep only the essential applications running.

[Link] Strong Passwords and Authentication

 Enable Multi-Factor Authentication (MFA) for extra security.

 Set strong passwords and change them regularly.

[Link] Up Firewalls

 Firewalls control and filter network traffic to block harmful connections.

 They help prevent unauthorized access to important systems.

[Link] Software Updated

 Regularly update operating systems, apps, and security software.

 Updates fix security holes that hackers could use.

[Link] Data and Network Traffic

 Use VPNs (Virtual Private Networks) for safe internet use.

1.

[Link] are the different form of wireless attacks? Explain ?

Ans=
 Wireless attacks target networks that use Wi-Fi, Bluetooth, or other wireless
communication methods.
 Hackers exploit weak security settings, unencrypted data, and open access points
to gain unauthorized access.

Different Forms of Wireless Attacks

1. Evil Twin Attack – A fake Wi-Fi network is created to trick users and steal their
data.
2. Man-in-the-Middle (MITM) Attack – Hackers secretly intercept communication
between devices.
3. War Driving – Attackers search for weak or unprotected Wi-Fi networks to hack.
4. Rogue Access Point – A hacker sets up a fake Wi-Fi inside a network to gain
control.
5. Denial-of-Service (DoS) Attack – Hackers overload a Wi-Fi network, making it
slow or unusable.
6. Bluejacking – Attackers send unwanted messages to Bluetooth devices.
7. Bluesnarfing – Hackers steal personal data (contacts, messages, files) from
Bluetooth devices.
8. WEP/WPA Cracking – Hackers break weak Wi-Fi security passwords to access
the network.

Ut 4

[Link] Intrusion Detection System (IDS) types and detection models ?

Ans=

1. Types of IDS

 Network-based IDS (NIDS) – Monitors network traffic for suspicious activities.

Example: Snort.
 Host-based IDS (HIDS) – Runs on individual computers to detect unauthorized
changes. Example: OSSEC.
 Hybrid IDS – Combines NIDS and HIDS for better protection.
 Perimeter IDS – Secures the boundary of a network from external threats.
 Virtual IDS (VIDS) – Monitors cloud or virtual environments for threats.

2. IDS Detection Models

 Signature-based Detection – Matches network activity with known attack

patterns. Works for known threats but not for new ones.
 Anomaly-based Detection – Detects unusual activity by learning normal
network behavior. Useful for new or unknown threats.
 Hybrid Detection – Uses both signature-based and anomaly-based methods for
better security.
 Behavior-based Detection – Focuses on user and system behavior to find
suspicious actions.

[Link] is Private Branch Exchange (PBX). How it can be secured .

Ans=
PBX

 PBX (Private Branch Exchange) is a telephone system used inside a company.

 It helps employees talk to each other and manage calls from outside.
 PBX can work with landlines or over the internet (VoIP).
 It saves money by handling calls efficiently.

How to Secure PBX

1. Use Strong Passwords – Change default passwords for PBX systems.

2. Enable Firewalls – Protect PBX from unauthorized access.
3. Monitor Call Logs – Check for unusual call patterns or fraud.
4. Limit Call Access – Restrict international or expensive calls.
5. Regular Software Updates – Fix security vulnerabilities by updating PBX
software.
6. Use Encryption – Secure voice data to prevent eavesdropping.
7. Disable Unused Features – Turn off unnecessary services to reduce risks.

[Link] a shortnote on Security Information and Event Management ?

Ans=
Security Information and Event Management (SIEM)

 Security Information and Event Management (SIEM) is a system that helps

organizations monitor, detect, and respond to security threats in real-time.
 It collects and analyzes data from different sources like firewalls, servers, and
antivirus software to identify suspicious activities.
 SIEM combines Security Information Management (SIM) (long-term storage
and analysis) and Security Event Management (SEM) (real-time monitoring).

Features of SIEM:

1. Real-time Monitoring – Tracks network activity to detect threats quickly.

2. Log Collection & Analysis – Gathers data from multiple systems to find security
issues.
3. Threat Detection – Identifies cyberattacks like hacking or malware.
4. Incident Response – Helps IT teams respond to security breaches.

[Link] a short on Access Control List?

Ans=
Access Control List (ACL)

 Access Control List (ACL) is a security feature that controls who can access
resources in a network.
 It is used in firewalls, routers, and operating systems to allow or deny traffic
based on rules.
 It works like a list of rules that tells the system which users or devices can access
specific files, folders, or network areas.
 ACLs help protect sensitive data by allowing only authorized users to access it.
 They control network traffic by specifying which IP addresses or user accounts
are allowed or denied access.

· Types of ACLs:

1. Standard ACL – Filters traffic based on the source IP address only.

2. Extended ACL – Filters traffic based on source and destination IP addresses,
ports, and protocols.

[Link] different classic security models. ?

Ans=
Classic Security Models in Information Security

 Security models help define how information is accessed and protected in a

system.
 Below are some classic security models used in information security:

1. Bell-LaPadula Model (BLP)

 Focuses on confidentiality (protects data from unauthorized access).

 Uses "No Read Up, No Write Down" rule:
 A lower-level user cannot read higher-level data (No Read Up).
 A higher-level user cannot write lower-level data (No Write Down).
 Used in military and government systems.

2. Biba Model

 Focuses on data integrity (prevents unauthorized modification).

 Uses "No Read Down, No Write Up" rule:
 A higher-level user cannot read lower-level data (No Read Down).
 A lower-level user cannot write higher-level data (No Write Up).
 Used in financial and medical systems.

3. Clark-Wilson Model

 Ensures data integrity by defining well-structured transactions.

 Uses a set of rules and controlled access to prevent unauthorized changes.
 Used in business and banking applications.

Ut5

[Link] is Cloud computing security services? Benefit,types

Ans=Cloud Computing Security Services

 Cloud security services help protect data, applications, and cloud systems from
cyber threats.
 They ensure that only authorized users can access data and that information
remains safe from hackers.

Benefits of Cloud Security Services:

✔ Keeps Data Safe: Uses encryption to protect information.

✔ Saves Money: No need to buy expensive security hardware.
✔ Easy to Expand: Security grows as cloud services grow.
✔ Follows Rules: Helps businesses follow security laws like GDPR.
✔ Data Backup: Restores lost data in case of cyberattacks or failures.

Types of Cloud Security Services:

[Link] and Access Management (IAM):

Ensures only the right people access data using passwords or multi-factor
authentication.

[Link] Encryption:

Locks data using codes so only authorized users can read it.

[Link] and Intrusion Detection Systems (IDS):

Blocks hackers and monitors network activity for suspicious behavior.

[Link] Information and Event Management (SIEM):

Alerts security teams about threats in real-time.

[Link] and Recovery:

Stores copies of data to recover in case of loss.

[Link] Protection:

Secures computers and phones that access cloud services.

[Link] and Governance:

Ensures cloud security follows legal rules and industry standards.

[Link] and explain Secure Development Litecycle (SSDL) and explain it detail ?

Ans=
Secure Software Development Lifecycle (SSDL)

 The Secure Software Development Lifecycle (SSDL) is a process that ensures

security is integrated at every stage of software development.
 It helps identify and fix security issues early, reducing risks.

Phases of SSDL:

1. Planning:Define security requirements for the software.

2. Design:Create a secure architecture for the software.
3. Implementation:Write secure code by following coding guidelines.
4. Testing:Perform security testing to find weaknesses.
5. Deployment:Secure the software before launching.
6. Maintenance:Regularly update and patch security flaws.

[Link] Virlual Machine? Explain how to protect the Guest Os, virtual storage and
Virtual Networkes in Virtual machine ?
Ans=

Virtual Machine (VM)

 A Virtual Machine (VM) is a software-based simulation of a physical computer

 It runs an operating system (Guest OS) on another system (Host OS) using
special software like VMware or VirtualBox.

how to protect=