Can you explain the difference between symmetric and asymmetric encryption? When would you use one over the other?
Answer: Symmetric encryption uses a single key to both encrypt and decrypt data, while asymmetric encryption uses a public key to encrypt data and a private key to decrypt it. Asymmetric encryption is more secure, but it is slower and more resource-intensive than symmetric encryption. As a result, symmetric encryption is often used for encrypting large amounts of data, while asymmetric encryption is used for secure communication and data exchange.
Can you explain the concept of "defense in depth" and how it applies to cyber security?
Answer: Defense in depth is a security strategy that involves using multiple layers of security controls to protect an organization's assets. This can include firewalls, intrusion detection systems, access controls, and encryption. The goal is to create a layered defense that can withstand attacks from multiple vectors, rather than relying on a single security control.
How do you ensure that user accounts are secure?
Answer: I ensure that user accounts are secure by implementing strong password policies, enabling multi-factor authentication, and conducting regular user access reviews.
Can you explain the concept of zero trust and how it applies to cybersecurity?
Answer: Zero trust is a security model that assumes all network traffic and user activity is potentially malicious, and requires strict authentication and access controls for all users and devices.
What is a penetration test?
Answer: A penetration test is an authorized simulated attack on a system or network to identify vulnerabilities and test the effectiveness of security measures.
What is a security audit?
Answer: A security audit is a systematic evaluation of the security of a company's information system by measuring how well it conforms to a set of established criteria.
What is a honeypot?
Answer: A honeypot is a decoy system designed to attract and trap cyber attackers, giving security teams an opportunity to study their methods and protect against future attacks.
What is a zero-day vulnerability?
Answer: A zero-day vulnerability is a previously unknown software vulnerability that is discovered and exploited by cyber attackers before a fix or patch is available.
What is the CIA triad?
Answer: The CIA triad is a framework for information security that includes confidentiality, integrity, and availability.
What is access control?
Answer: Access control is the process of limiting access to a system or network to authorized users, devices, or applications.
What is the difference between HIDS and NIDS?
Answer: HIDS(Host IDS) and NIDS(Network IDS) are both Intrusion Detection Systems and work for the same purpose i.e., to detect intrusions. The only difference is that the HIDS is set up on a particular host/device. It monitors the traffic of a particular device and suspicious system activities. On the other hand, NIDS is set up on a network. It monitors the traffic of all devices on the network.
What do you understand by Risk, Vulnerability & Threat in a network?
Threat: Someone with the potential to harm a system or an organization
Vulnerability: Weakness in a system that can be exploited by a potential hacker
Risk: Potential for loss or damage when threat exploits a vulnerability
How often should you perform Patch management?
Answer: Patch management should be done as soon as it is released. For Windows, once the patch is released it should be applied to all machines, not later than one month. The same goes for network devices, patch them as soon as it is released. Proper patch management should be followed.
How would you reset a password-protected BIOS configuration?
Answer: Since BIOS is a pre-boot system it has its own storage mechanism for settings and preferences. A simple way to reset is by popping out the CMOS battery so that the memory storing the settings loses its power supply and as a result, it will lose its setting.
What are salted hashes?
Answer: Salt is random data. When a properly protected password system receives a new password, it creates a hash value of that password, a random salt value, and then the combined value is stored in its database. This helps to defend against dictionary attacks and known hash attacks.
What is Cognitive Cybersecurity?
Answer: Cognitive Cybersecurity is an application of AI technologies patterned on human thought processes to detect threats and protect physical and digital systems.
What are some of the common Cyberattacks?
1. Malware
2. Phishing
3. Password Attacks
4. DDoS
5. Man in the Middle
6. Drive-By Downloads
7. Malvertising
8. Rogue Software
What is the difference between VA(Vulnerability Assessment) and PT(Penetration Testing)?
Answer: Vulnerability Assessment is the process of finding flaws in the target. Here, the organization knows that its system/network has flaws or weaknesses and wants to find these flaws and prioritize the flaws for fixing.
Penetration Testing is the process of finding vulnerabilities in the target. In this case, the organization would have set up all the security measures they could think of and would want to test if there is any other way that their system/network can be hacked.
How is Encryption different from Hashing?
Answer: Both Encryption and Hashing are used to convert readable data into an unreadable format. The difference is that the encrypted data can be converted back to the original data by the process of decryption but the hashed data cannot be converted back to the original data.
What is a Firewall and why is it used?
Answer: A Firewall is a network security system set on the boundaries of the system/network that monitors and controls network traffic. Firewalls are mainly used to protect the system/network from viruses, worms, malware, etc. Firewalls can also be to prevent remote access and content filtering.
What is Cryptography?
Answer: Cryptography is the practice and study of techniques for securing information and communication mainly to protect the data from third parties that the data is not intended
What are the top cyber security threats today?
Answer: The top cyber security threats today include phishing attacks, ransomware, social engineering, insider threats, and advanced persistent threats (APTs).
How do you ensure compliance with relevant laws and regulations?
Answer: Discuss your knowledge of relevant laws and regulations in the industry, such as the GDPR or HIPAA, and how you ensure compliance through policies and procedures.
How do you collaborate with other departments, such as IT or legal, to implement effective cybersecurity measures?
Answer: Be prepared to discuss your communication and collaboration skills and how you work with other departments to ensure a comprehensive and cohesive approach to cyber security.
How do you handle a cyber security breach?
Answer: Discuss your experience with incident response plans and your methodology for containing and mitigating the impact of a breach, including notifying stakeholders and implementing remediation measures.