Security on The VikiD Truth

Types of Malware

Thu, 01 Dec 2016 02:33:47 +0400

Types of Malware

Here is the truth about malware types: the labels (virus, worm, trojan, ransomware…) describe how a program spreads or what it demands – not how sophisticated it is. A boring script with a clever delivery path beats a clever payload nobody installs.

Firewalls

Mon, 28 Nov 2016 10:07:35 +0400

Firewalls

Here is the truth about firewalls: they are not a magic shield – they are deliberate rules about who may speak to whom. A misconfigured firewall is either a locked door with the window open, or a doorstop.

What it is, in plain words

A firewall filters network traffic according to rules. It can run:

Metasploit & Armitage

Mon, 28 Nov 2016 05:59:34 +0400

Metasploit & Armitage

Here is the truth about Metasploit: it is a library of known doors and the tools to push them – useful in a lab and a liability anywhere you lack permission. The Framework is not magic; it packages other people’s vulnerability research into a consistent interface.

What it is, in plain words

The Metasploit Framework (open source, Rapid7) is a platform for developing, organising and running exploits. Core ideas:

Ettercap

Mon, 28 Nov 2016 02:47:13 +0400

Ettercap

Here is an uncomfortable truth about local networks: most of them still trust whoever is plugged in. Ettercap is the classic tool that demonstrates what a machine sitting on the same LAN can do to that trust – mostly by quietly inserting itself into other people’s conversations.

What it is, in plain words

Ettercap is a free and open-source suite for man-in-the-middle (MITM) attacks on a local network. It can:

Penetration Testing

Sun, 27 Nov 2016 11:05:30 +0400

Penetration Testing

Here is the truth about penetration testing: it is authorised breaking, done carefully, so the real breakers have a harder time. Without a clear scope and written permission it is just hacking; with them it is engineering.

What it is, in plain words

A penetration test (pentest) is a structured engagement where an operator attempts to find and exploit vulnerabilities in a system, within agreed rules, and then reports what they found and how to fix it. It answers a sharper question than a vulnerability scan: not “what might be wrong?” but “what can an attacker actually do?”

Linux Security

Sun, 27 Nov 2016 11:05:12 +0400

Linux Security

Here is the truth about Linux security: there is no antivirus product that will save a misconfigured server, and no amount of hardening will save a system you never update. Security is a set of habits – least privilege, small attack surface, quick patches, deep defence – not a package you install.

What it is, in plain words

Linux security covers everything that keeps a Linux system doing only what you intend: authentication, permissions, updates, network exposure, service hygiene, kernel hardening, logging and response. The same kernel runs phones, TVs, supercomputers and the web; the threats differ, but the principles don’t.

Computer Security

Sun, 27 Nov 2016 11:01:30 +0400

Computer Security

Here is the truth about computer security: it is not a product you buy or a department you hire – it is the practice of making systems fail safely when people, software and physics all misbehave. Everything else is technique.

What it is, in plain words

Computer security is the set of ideas and practices that protect the confidentiality, integrity and availability of information and systems (the classic CIA triad). Around those three sit authentication (“who are you?”), authorisation (“what are you allowed to do?”), accountability (logging and audit), and non-repudiation.