Module - 4
Cyber Security Tools & Technologies
Antivirus / Anti-malware
Definition / Purpose
Software that detects, prevents, and removes malicious software (malware) such as
viruses, worms, trojans, ransomware, spyware, adware.
It scans files, monitors system behaviour, blocks threats, quarantines suspicious
items.
Detection methods
o Signature-based detection: compares files against known malware signatures.
o Heuristic / behaviour-based detection: looks for suspicious behaviour
(e.g. unexpected file modifications, process spawning)
o Real-time (on-access) scanning: scans as files are accessed or modified
o Periodic (on-demand) scanning: scheduled full or quick scans
o Sandbox / virtualization: run unknown files in isolated environment
Limitations & challenges
o Signature-based methods fail for new, unknown, or zero-day malware
o Performance overhead
o False positives / false negatives
o Malware can use obfuscation, packing, polymorphism to evade detection
Examples / products
Bitdefender, Kaspersky, Norton, Windows Defender, etc. (also next-gen AV solutions)
Firewalls
Definition / Purpose
A firewall is a security device (software, hardware, or both) that monitors and
controls incoming and outgoing network traffic based on predetermined security
rules. It acts as a barrier between a trusted internal network and untrusted external
networks (like the Internet).
Types / classifications
Type Function / Layer Notes
Packet-filter Operates at network /
firewall transport layers, inspects IP Simple, fast, stateless
packets (source/dest IP, ports,
protocol)
More aware, can block
Stateful firewall Keeps track of connection
unexpected packets in
state (e.g. TCP sessions)
an established session
Application-layer / Inspects data at application-level More granular filtering (e.g.
Proxy (HTTP, FTP, DNS, etc.) block certain HTTP requests)
firewall
Next-Generation Combines firewall features +
Firewall (NGFW) More intelligent
intrusion prevention, application
control over modern
awareness, etc.
traffic
Rule base / Access Control Lists (ACLs)
Defining which traffic is allowed or denied (by IP, port, protocol, interface). Principle
of least privilege: only allow what’s needed.
Placement
Could be at network perimeter, between network segments (internal), host-based
firewalls on endpoints.
Limitations / Bypass techniques
Firewalls may not inspect encrypted traffic unless they have SSL/TLS inspection,
certain protocols may tunnel through (VPN, SSH), misconfigurations are a major risk.
Intrusion Detection Systems / Intrusion Prevention Systems (IDS / IPS)
IDS (Intrusion Detection System)
Monitors network or system traffic, looking for suspicious patterns or anomalies,
generates alerts when potential malicious activity is detected. It is passive (doesn’t
block by itself).
IPS (Intrusion Prevention System)
Extends IDS capabilities by actively blocking or rejecting detected malicious traffic
(prevention).
Types / architectures
o Network-based IDS/IPS (NIDS / NIPS): monitors network traffic
o Host-based IDS/IPS (HIDS / HIPS): monitors activities on a specific host
(file changes, processes, logs)
o Signature-based detection: matches known attack patterns
o Anomaly-based detection: identifies deviations from baseline behaviour
o Hybrid / behaviour + signature mixing
Challenges
o False positives and alert fatigue
o Encrypted traffic
o Performance (latency)
o Maintenance (keeping signatures up to date)
Examples / Tools
Snort (open-source, can operate as IDS/IPS)
Security Onion, Suricata, Zeek, etc.
Encryption Tools
Purpose
To protect confidentiality, integrity, and sometimes authenticity of data by
transforming it into unreadable form for unauthorized parties.
Types of cryptography
o Symmetric-key (same key for encryption and decryption) — e.g. AES, DES
o Asymmetric-key / Public-key (public and private keys) — e.g. RSA, ECC
o Hash functions (one-way, fixed-length output) — e.g. SHA-256, MD5
(though MD5 is obsolete)
o Digital signatures / certificate-based authentication
Encryption in transit vs encryption at rest
o In transit: SSL/TLS, HTTPS, VPN tunnels
o At rest: disk encryption, file-level encryption
Tools / implementations
OpenSSL, GnuPG, VeraCrypt, BitLocker, SSL/TLS libraries, etc.
Key management
One of the biggest challenges. Secure generation, storage, rotation, distribution,
revocation.
Virtual Private Networks (VPNs)
Definition / Purpose
A VPN provides a secure, encrypted tunnel between endpoints over an
insecure network (often the internet). Users can access internal resources as if
they were directly connected to the private network.
Types / modes
o Remote-access VPN: for individual clients to connect
o Site-to-site VPN: connecting two networks over the Internet
o Protocols: IPsec (ESP, AH, IKE), SSL/TLS-based VPNs
o Tunnelling protocols: PPTP (older, insecure), L2TP, OpenVPN, Wire Guard
Security features / considerations
o Encryption of data in transit
o Authentication of endpoints
o Re-keying (refreshing session keys)
o Split tunnelling (some traffic goes direct, some via VPN) — trade-offs
o Performance overhead and latency
Use cases
Remote workers, secure access to internal resources, bypassing censorship, secure
path over public Wi-Fi, etc.
Authentication Mechanisms & Access Control
Authentication (verifying identity)
Something you know: password, PIN
Something you have: token, smart card, security key
Something you are: biometric (fingerprint, iris, face)
Multi-factor authentication (MFA): combining two or more
Single Sign-On (SSO), federated identity
Allowing users to login once and gain access to multiple systems (using protocols like
SAML, OAuth, OpenID Connect)
Access Control / Authorization
Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Role-Based Access Control (RBAC)
Attribute-Based Access Control (ABAC)
Principles
Least privilege: users/processes should have only the minimum access needed
Separation of duties
Just-in-time access, temporal constraints
Password management / policies
Strong password requirements, periodic expiry, no reuse, storage (hashed + salted),
account lockout, etc.
Cyber Hygiene
This is about maintaining consistent, basic security practices (analogous to
personal hygiene) to reduce risk exposure.
Importance & Concept
Cyber hygiene refers to routine practices and precautions that users, IT teams,
and organizations follow to maintain system health and defend against cyber
threats.
Good cyber hygiene helps reduce risk, detect issues early, limit damage, and
support resilient systems.
It is everyone’s responsibility—not just IT.
Key Practices
Below are fundamental practices often recommended:
Strong passwords & identity hygiene
Use long, complex, unique passwords per account
Use passphrases or combinations
Use password managers
Avoid sharing or reusing passwords
Use multi-factor authentication (MFA) wherever possible
Regular updates and patch management
Keep operating systems, firmware, software, apps up to date
Apply vendor patches regularly
Automate updates when possible
Monitor for security advisories
Backups & recovery planning
Regular backups of important data (ofline or offsite)
Test restorations periodically
Maintain versioned backups
Have a disaster recovery / incident response plan
Browser / Email hygiene / Secure browsing habits
Only visit trusted websites, check HTTPS
Don’t click suspicious links or attachments (phishing)
Use ad blockers, script blockers
Clear cache, cookies when needed
Use secure DNS, avoid malicious sites
Least privilege, account hygiene
Use standard (non-admin) accounts for daily tasks
Revoke access of accounts no longer needed
Limit software installations
Asset inventory & monitoring
Know what hardware and software you have
Monitor for changes, anomalies, new devices
Awareness, training & social engineering defenses
Educate users on phishing, social engineering tactics
Regular security awareness programs
Network hygiene & segmentation
Segment networks (separate critical systems)
Monitor traffic, limit open ports
Logging, auditing & continuous monitoring
Enable logging on systems, network devices
Audit logs regularly
Use intrusion detection, SIEM, alerts
Secure configuration / hardening
Disable unnecessary services, ports, default accounts
Use secure settings (e.g. disable SMBv1, enforce strong TLS)
Incident readiness & periodic reviews
Practice incident response drills
Regularly review security posture, threat landscape
These practices correspond to frameworks like CERT’s cyber hygiene or NIST controls.
Challenges & Common Failures
User behaviour (weak passwords, careless clicking)
Incomplete patching
Backup failures or insecure backups
Shadow IT (unauthorized software/hardware)
Over-reliance on technology (ignoring processes, policies)
Complacency over time
Network Security Fundamentals
Securing the network is foundational, since network is the pathway for threats and
attacks.
Wired Network Security
Use secure switching (disable unused ports, implement port security, MAC filtering)
VLANs to separate traffic / network segmentation
Use Access Control Lists (ACLs) on routers and switches
Secure management interfaces (SSH, disable Telnet, use strong credentials)
Use 802.1X / port-based network access control
Monitor ARP spoofing, MAC flooding, etc.
Wireless Network Security
Use strong encryption (WPA3 preferably, or WPA2 with AES)
Disable WEP / WPA (insecure)
Use strong passphrases / pre-shared keys or enterprise authentication (802.1X)
Hide SSID (though not a strong security measure)
Use separation (guest Wi-Fi, network segmentation)
Use MAC filtering, but don’t rely solely on it (MAC spoofing)
Disable WPS
Use a captive portal with authentication if needed
Monitor rogue APs, wireless intrusion detection systems
Secure Configurations & Hardening
Disable unused services and ports
Change default credentials
Use secure protocols (SSH, TLS) not insecure ones
Enforce secure cipher suites, disable old protocols (SSL, TLS1.0/1.1)
Use firewall / IPS / IDS inline
Use network-based security appliances (next-gen firewall, UTM)
Keep firmware / network OS up to date
Secure device management (ACLs, out-of-band management)
Network Monitoring & Traffic Analysis
Packet sniffing / analysis (Wireshark, tcpdump)
Flow-based monitoring (NetFlow, sFlow)
Use network intrusion detection / prevention systems
Use Security Information and Event Management (SIEM) to collect and correlate logs
Baseline normal traffic and detect anomalies
Use IDS/IPS to generate alerts
Use endpoint and network monitoring tools
Defence in Depth & Layered Security
Don’t rely on a single security mechanism
Use overlapping controls (firewall + IDS + encryption + access control + monitoring)
Segment high-value assets behind multiple barriers
Use redundancy and fallback controls
Implement network zones (DMZ, internal, restricted)
Threats & Attack Types to Consider
Man-in-the-Middle (MITM) attacks
ARP poisoning, DNS spoofing
Packet sniffing / eavesdropping
Replay attacks
Denial-of-Service (DoS / DDoS)
VLAN hopping, guest network attacks
Rogue devices (unauthorized wireless AP)