Cyber Security Essentials - The Fundamentals

Learn how phishing, a social engineering attack, steals credentials and credit card numbers through spoofed emails and bogus login pages; use vigilance, two-factor authentication, and strong passwords to prevent it.

Smishing is a text-message form of phishing using social engineering to steal data; avoid unknown numbers, don't click links, verify the link's authenticity and use antivirus protection.

Explore spam and spit, spam over instant messaging and internet telephony, and why they bypass antiviruses and firewalls; protect yourself by avoiding suspicious links and using a virus scanner.

Vishing is a phone-based phishing attack using social engineering to steal personal and financial details. Do not share information, verify callers, and avoid gift cards or wire transfers.

Trace how spam, named after Hormel Foods' spiced ham, evolved into unsolicited bulk email and teaches you to mark spam and avoid links or attachments from botnets.

Explore how spear phishing leverages targeted email attacks to steal credentials and access networks. Learn practical defenses, including employee training to spot suspicious emails.

Explore dumpster diving in cyber security, where attackers seek discarded information and storage media from desks and trash, and learn prevention strategies like shredding, destroying storage media, and securing waste.

Identify how shoulder surfing allows criminals to steal passwords and other login data in public places. Learn to protect yourself from onlookers at ATMs, checkout terminals, and shared devices.

Explore how phishing extends to farming, where compromised dns name resolution redirects you from a genuine site to a malicious one, via host file changes or dns vulnerabilities.

Prevent tailgating by recognizing physical breaches where an unauthorized person follows an authorized individual into a secure area; stay alert, don’t hold doors, escort suspicious individuals, and report issues.

Explore elicitation techniques used in social engineering to discreetly gather information through casual conversation, including flattery, false statements, and playing dumb to trigger responses.

Whaling attacks target senior executives with personalized phishing to steal data or funds. Defense starts with educating staff about security policy and maintaining healthy skepticism toward unsolicited requests.

Protect your identity by understanding social engineering and common theft tactics like card skimming, dumpster diving, phishing, smishing, and ghosting, and learn practical steps to reduce risk.

Learn how invoice scams deceive organizations by posing as suppliers to alter bank details via phishing emails, highlighting real-world risks and the need for verification.

Understand credential harvesting through phishing emails, fake websites, password theft, and the risk of selling credentials on the dark web.

Explore the reconnaissance phase of cyber security, showing how attackers gather public information using search engines, social networks, and tools like Maltego and Shodan to map targets.

Explore how hoaxes ignite alarm and confusion through fake warnings and scareware, often spreading via chain messages, risking productivity, credibility, and even system damage, unlike harmless pranks.

Watering hole attacks compromise legitimate websites to infect visitors with malware, aiming to steal credentials or access sensitive information, targeting high security organizations via employees, partners, vendors, and unsecured networks.

Examine typosquatting as a social engineering tactic that uses misspelled domains to lure users to fake login pages, steal credentials, and threaten identity, credit, and reputation.

Study pretexting, a social engineering method using a fabricated scenario to steal personal information by impersonating authorities or co-workers. See how credibility and authoritative voice build trust to bypass skepticism.

Examine how social engineering exploits human psychology, from phishing and impersonation to urgency and scarcity, and why training mitigates these attacks.

Explore how social media shapes perceptions and societies, fueling population-centric hybrid warfare with fake news, trolls, diplomacy, lawfare, and foreign electoral intervention.

Explore how ransomware operates through a three-phase attack—phishing to malware delivery, hybrid encryption with a key pair, and ransom demands, with historical examples.

Worms propagate across networks and move rapidly between computers, exploiting vulnerabilities via file sharing, email attachments, or links, with phishing components; unlike viruses, they operate independently.

Identify potentially unwanted programs (PUPs) that are bundled with legitimate software, spot dark patterns, read EULAs, use custom installs, and download from official sources.

Explore fileless malware that loads into memory and runs as an active process, mainly on Windows. Identify three attack types: registry manipulation, memory code injection, and script-based techniques.

Explore how command and control (C2) attacks compromise networks through malware, botnets, and DDoS, enabling data theft and full attacker control over infected computers.

Investigate how bots and botnets automate malware-infected devices to generate traffic, enable bot-driven attacks, and how to detect and block them with robots.txt and captchas.

Explore how crypto malware and ransomware encrypt data, demand bitcoins, threaten backups, and deploy logic bombs; learn offline backups, updates, antivirus signatures, and cautious web and email practices.

Identify how logic bombs hide as malicious code, lie dormant until a trigger, and unleash data corruption, deletion, or theft; learn prevention via disaster recovery, file scanning, and updated antivirus.

Spyware secretly observes device activity, collecting websites visited and passwords, stealing payment data and emails, risking identity theft; defend with basic cyber security: avoid unknown emails and untrusted downloads.

Keyloggers log keystrokes to monitor and steal passwords, software or hardware, raising ethical concerns; protect devices by removing unwanted software, using a virtual keyboard, a password manager, and antivirus.

Explores the history and mechanics of backdoors, from war games to hardware and software access, with examples like the NSA encryption chip, routers, Quadriga, and NotPetya.

Uncover how rootkits grant remote control and spy on users by corrupting system components, and review hardware/firmware, bootloader, memory, application, and kernel mode variants with basic prevention.

Learn how stolen, weak, and reused passwords drive data breaches, and explore password attack types—spraying, dictionary, brute force, rainbow tables, and unencrypted methods—and best practices to strengthen security.

Explore dictionary attacks, where attackers use dictionary words to crack passwords or decrypt data, and learn defenses like account locking and delayed responses with complex passwords.

Understand how brute force attacks use trial and error to guess passwords or keys. Protect with encryption, salted hashes, two-factor authentication, login limits, CAPTCHAs, and intrusion detection.

Discover how trojans masquerade as legitimate software to trick users via social engineering, and explore backdoor, banker, rootkits, and remote access trojans with practical protections.

Learn how physical attacks like malicious USB cables, malicious flash drives, cloning, and skimming threaten data security.

Explore how rainbow tables crack password hashes by using pre-computed values to gain authentication, and learn defenses like salt and key stretching.

Explore how USB devices enable juice jacking, malware delivery, and data leakage when connected, and learn data loss prevention, USB access control, and endpoint security for protection.

Understand how card cloning and card skimming steal data from magnetic stripes and PINs via skimmers and fake keypads at POS terminals and ATMs, despite EMV encryption.

Explore how malicious flash drives infect systems through USB malware, spoofing, and cases like Stuxnet, and learn practical defenses such as write protectors, USB antivirus, encryption, and host device protection.

Explore how card cloning and skimming steal data from magnetic stripes at point-of-sale terminals and ATMs, using fake keypads and covert scanners, and how EMV strengthens protection.

Explore skimming in cybersecurity, including physical and digital skimming techniques used to steal card data from point-of-sale devices and online retailers.

Explore the Asilomar AI Principles emphasizing safety, security, and verifiability in AI systems, and learn how AI and machine learning bolster cybersecurity through threat hunting and vulnerability management.

Explore how machine learning introduces security risks, including data injection and backdoors, and learn how to protect ML algorithms and training data against manipulation.

Compare cloud-based and on-premises security, weighing cost, control, uptime, and trade-offs, while emphasizing cybersecurity awareness training and phishing prevention to protect data in any deployment.

Understand what a supply chain is and how a supply chain attack targets weak links in third-party vendors by exploiting vulnerabilities and inserting malware to steal data.

Explore birthday attacks as a cryptographic attack that targets hash collisions. Learn how attackers force identical hash values, revealing vulnerabilities in md5.

Explore how cryptography protects information and communication with encryption algorithms, and how attackers aim to break these schemes through brute force, man-in-the-middle, replay, side-channel, power analysis, and timing attacks.

Explore hashing and hashing algorithms, learn how hash values secure data transmission, and understand hash collisions, with examples like MD5 and SHA-2/SHA-3 and security considerations for selecting algorithms.

Learn how downgrade attacks use weaker cryptography, including poodle, freak, and logjam, to crack encrypted data, and how to defend by upgrading to TLS 1.2 and disabling legacy protocols.