Information Security

A dictionary attack systematically tries a list of common words or phrases to guess a password. Brute force involves trying all possible character combinations, while the other options refer to network-level attacks.

Phishing attacks often succeed by targeting users who lack technical knowledge about cybersecurity threats and safe computing practices. These users may not recognize warning signs like suspicious URLs, unexpected requests for sensitive information, or generic greetings. While anyone can fall victim to sophisticated phishing, less technical users are disproportionately targeted.

An attack vector is the specific path or method used by an attacker to gain unauthorized access to a system. Examples include phishing emails, malicious links, or software vulnerabilities.

Encryption is the best countermeasure against session hijacking because it prevents attackers from reading the session tokens or data being transmitted. Without encryption, session tokens can be easily intercepted in transit.

The first phase of a DDoS attack is the intrusion or preparation phase, where the attacker compromises multiple systems (creating a botnet) to use them for the attack. Finding a target is a prerequisite, but the actual attack process begins with building the botnet.

Sniffing is the process of monitoring and capturing all data packets passing through a network. It is often used by attackers to steal sensitive information like passwords or session tokens.

A backdoor is a method of bypassing normal authentication to secure remote access to a computer. It allows attackers to maintain access even if the original entry point is closed.

Authentication is the process of verifying that a user is who they claim to be. This is typically done using passwords, biometrics, or tokens.

Confidentiality ensures that sensitive information is accessed only by authorized individuals. It prevents unauthorized disclosure of data.

A masquerade attack occurs when an entity pretends to be another entity to gain unauthorized access or privileges. This is a common form of identity spoofing.

An active attack involves modifying data or gaining unauthorized access to resources, which can cause significant damage. Passive attacks, by contrast, only involve monitoring or eavesdropping on data.

Steganography is the practice of concealing a file, message, image, or video within another file, message, image, or video. It differs from encryption, which makes data unreadable.

Enumeration is the process of extracting information from a target system, such as usernames, machine names, network resources, and services. It is a key step in the reconnaissance phase of an attack.

Clickjacking is a malicious technique where an attacker tricks a user into clicking on a hidden or transparent element on a webpage. This action is performed on behalf of the user on a different site.

A Man-in-the-Middle (MitM) attack occurs when an attacker secretly intercepts and relays messages between two parties who believe they are communicating directly. This allows the attacker to read, send, or modify data.