Layer 7 – Application

Layer 3 – Network

Layer 4 – Transport

  Layer 2 – Data Link

Layer 1 – Physical

   Very high speed with no resource usage

    Works only at the Application Layer

Tracks active connections and prevents spoofed packets

Does not keep any connection records

Only filters traffic by IP address

Mandatory Access Control (MAC)

Discretionary Access Control (DAC)

Role-Based Access Control (RBAC)

Time-Based Access Control

Location-Based Access Control

It deletes data permanently

It converts ciphertext into plain text

It converts plain text into unreadable form

It makes data public for everyone

It compresses the size of data

Symmetric encryption

Substitution cipher

Hashing

Asymmetric encryption

Caesar Cipher

Encrypting and decrypting data

Compressing files

Storing and verifying passwords or file integrity

Hiding encryption keys

Translating data into another language

To make data transmission faster

To preserve the confidentiality, integrity, and availability of data

To block all internet access

To collect user information for analysis

To increase Wi-Fi range

Connection

Confidentiality

Control

Configuration

Cryptography

Using HTTPS to encrypt traffic

Making regular data backups

Applying digital signatures and checksums

Limiting Wi-Fi access with a password

Blocking unknown IP addresses

Firewall

Antivirus software

Malware operator or insider

Security update

Network cable

Asset

Threat

Vulnerability

Control

Risk

Availability

Integrity

Confidentiality

Authentication

Risk

Strong passwords

WPA3 encryption

Rate limiting and redundancy

Using HTTPS

File hashing

To detect suspicious activity and generate alerts

To automatically block all incoming traffic

To encrypt network traffic

To replace the firewall

  To manage user authentication

Signature-based

Anomaly-based

Heuristic-based

Behavior-based

  Policy-based detection

It is placed inline and may slightly slow down traffic

It has no impact on traffic speed

It encrypts all traffic, causing significant delay

It only monitors traffic out-of-band

It analyzes traffic after it reaches the destination

It is a powerful, open-source IDS/IPS

It is a proprietary, expensive system

It does not require any configuration.

It can only function as a packet sniffer

It is available only for Windows systems

A higher rate of false positives

Inability to detect new attacks

It requires no training period

It only works with encrypted traffic

It consumes almost no system resources

Software that helps users organize their files efficiently

Software that causes random pop-ups but does not damage data

Software intentionally created to damage systems, steal data, or disrupt networks in various harmful ways

A temporary tool used for testing system vulnerabilities

An application that protects devices from online threats

It hides within image files and activates only when opened

It copies documents and sends them to hackers over email

It replicates itself and spreads across computer networks automatically, consuming bandwidth and slowing systems.

It monitors user behavior to collect login information

It updates operating systems without user permission

It can infect files only after being connected to the internet.

It spreads automatically through local networks

It disguises itself as legitimate software but secretly performs malicious actions once installed on the victim’s system.

It replaces operating system files with fake ones.

It is only found on mobile devices and tablets

   It shows ads and pop-ups to generate income for the attacker.

It modifies hardware settings to cause overheating

It encrypts important files on a victim’s device and demands payment, often in cryptocurrency, to restore access

It records everything typed on the keyboard

It changes system settings to hide unwanted programs

A cyberattack that lasts less than twenty-four hours

A type of attack that targets antivirus databases before they update

An exploitation of an undiscovered vulnerability that developers and security vendors have not yet patched or identified

A planned attack that occurs on the day software is released

A network test performed by ethical hackers

Scans the system for viruses

Filters incoming and outgoing network traffic according to defined rules

Encrypts data during transmission over the network

Stores data backups

Controls antivirus signature updates

Used for data compression before transmission

Provides routing of IP packets

Provides encryption and authentication of data during transmission.

Analyzes network traffic for malicious activity

Manages the distribution of IP addresses among network devices

Encrypts files and demands ransom

Spreads automatically through the network

Attaches itself to legitimate programs and infects other files

Monitors user activity and sends data to hackers

Displays advertisements on the screen

Conficker

Pegasus

ILOVEYOU

WannaCry

Stuxnet

Encrypting files

Verifying user identity

Creating user accounts

Blocking websites

Managing passwords

Password-based

Token-based

Biometric

Smart card

Email code

Monitors traffic

Grants or denies access

Repairs system errors

Updates software

Encrypts files

RBAC

DAC

MAC

UAC

PAC

Cheaper

Easier

More secure

Uses one password

Works offline only

3

4

5

6

7

FTP

HTTP

SMTP

SSH

SNMP

HTTP

FTP

HTTPS

ARP

POP3

IP

ICMP

TCP

DNS

HTTP

Data compression

Routing optimization

Encrypting and protecting transmitted data

File transfer

Network discovery

Layer 2

Layer 3(Network)

Layer 4

Layer 7

Layer 1

Packet Filtering Firewall

Stateful Inspection Firewall

Application Firewall

Hardware Firewall

Software Firewall

Windows Firewall

Linux iptables

FortiGate

Proxy firewall

SSH

Cannot filter packets

Low CPU usage

Needs frequent updates and maintenance

Cannot inspect content

Only works on Layer 3

Play videos

Block unauthorized access

Install software

Delete files

Print documents

A program to speed up the internet

A system that controls network traffic based on security rules

An antivirus for a computer

A backup program

A system for storing logs

Packet Filtering Firewall

Stateful Inspection Firewall

Application Firewall

Hardware Firewall

Software Firewall

Low CPU usage

Instant filtering without checking connection states

Tracks connection state and prevents spoofed packets

Ignores IPs and ports

Works only at the application level

Only filters packets by IP

Provides packet filtering, application control, IDS/IPS, and deep packet inspection

Is only a software firewall

Ignores all HTTPS connections

Allows all users full network access

Application Layer

Transport Layer

Internet Layer

Network Access Layer

Session Layer

HTTP

FTP

SSH

Telnet

DNS

Uses UDP instead of TCP

Adds encryption through TLS

Transfers data faster

Works without ports

Sends data in plain text

TLS

SSH

TCP

HTTP

ICMP

Confidentiality, Integrity, Availability

Casualty, Integrity, Eventuality

Confidentiality, Identification, Authentication

Compliance, Integrity, Accessibility

Communication, Information, Analysis

Practices and technologies that preserve the confidentiality, integrity, and availability (CIA) of data in transit and networked systems

Methods used only to speed up data transmission across networks

Methods used only to speed up data transmission across networks

   Physical measures to protect network cables and hardware from theft

Techniques for improving website design and user experience

  A valuable data or service that must be protected

A weakness an attacker can exploit to cause harm

  Any unauthorized entity that attempts to access the network

  The impact caused by an incident on system availability

   A technology that prevents eavesdropping on open Wi-Fi

    Confidentiality

  Integrity

Availability

Authentication

Accountability

To delete confidential information

To protect and ensure the integrity of information

To slow down data transmission

To compress files efficiently

To detect computer viruses

The process of verifying user identity

The process of converting ciphertext into plain text

The process of converting plain text into unreadable ciphertext

The process of compressing large files

The process of deleting sensitive data

It uses complex algorithms

It requires too much memory

It is too slow for large data

The key distribution problem

It cannot encrypt numbers

Secret key

Public key

Random key

Private key

Shared session key

RSA

AES

SHA-256

MD5

Diffie–Hellman

It can be easily reversed

It uses a private and public key

It produces a fixed-size output and cannot be reversed

It slows down encryption

It requires symmetric algorithms

Confidentiality only

Data compression

File deletion protection

Authenticity and integrity of a message

Fast encryption speed

Uses a pair of public and private keys

Uses one key for both encryption and decryption

Does not require any key

Is slower but more secure

Is only used for digital signatures

AES

DES

Blowfish

RSA

SHA-1

Password storage

File integrity verification

Digital signatures

Data encryption

Blockchain verification

Everyone can decrypt it

Only Alice can decrypt it

Only Bob can decrypt it

The message becomes a hash

It automatically verifies the sender

Detects attacks by comparing network traffic to known patterns of malicious activity

Uses machine learning to detect previously unknown attacks

Blocks all incoming traffic by default

Relies on system administrators to manually identify every intrusion

Detects only internal network misconfigurations

It uses fewer system resources

It detects zero-day attacks by recognizing abnormal behavior

It requires no initial configuration

It never produces false positives

It only analyzes encrypted traffic

Router

Switch

Firewall

Modem

Hub

To increase internet speed

To provide secure communication over public networks

To host web applications

To detect malware

To store encrypted passwords

It requires frequent signature updates to be effective

It can detect zero-day attacks

It has a very low false positive rate

It learns a baseline of normal network behavior

It is ineffective against any new threats

Spyware

   Trojan

   Worm

Rootkit

  Ransomware

IDS can block suspicious traffic

IPS can not only detect but also prevent an attack

IDS/IPS analyze network packets and system logs.

IDS operates only at the application layer.

IPS is used exclusively for data encryption

Permissions are linked to roles

Users get random access

It simplifies administration

Used only by hackers

Roles are based on hardware

HTTPS

SSH

FTP

Telnet

DES

Track connection state

Block all HTTP traffic

Prevent spoofed packets

Filter local files

Develop web pages

Snort is primarily a firewall application

Snort can function as both IDS and IPS

Snort uses rule-based signatures to detect threats

Snort is a commercial-only tool with no open-source version

Snort cannot perform packet logging

HTTP

FTP

HTTPS

TLS

SMTP

Password

Username

Fingerprint

Email address

IP address

Using strong passwords

Disabling all firewalls

Applying access control lists (ACLs)

Allowing open Wi-Fi networks

Sharing admin credentials

It is used for secure remote login and management.

It operates on port 22

It uses TLS for encryption

It transfers data in plain text.

It supports key-based authentication without a password

Regularly updating antivirus software

Using firewalls

Downloading files from any source.

Implementing IDS/IPS systems

Ignoring security updates

Viruses

Worms

Trojans

Browsers

Ransomware

Traffic filtering by IP and port

Web development

Access control for trusted users

Sending emails automatically

Protection against attacks and malware

Encryption

Data compression

Authentication

Zero-latency transmission

Data integrity

Eavesdropping/sniffing

Spoofing

DDoS (Denial of Service)

    Data compression

VPN tunneling

Symmetric encryption is faster than asymmetric

Asymmetric encryption solves the key distribution problem

Hash functions can be reversed easily

Digital signatures prove message authenticity

Hash functions use two keys

It supports multi-threading for high performance

It cannot read Snort rule sets

It performs protocol identification and file extraction

It is developed and maintained by Cisco Systems

It includes native support for JSON output and EVE logging

Phishing

DDoS

SQL Injection

DHCP configuration

Subnetting

Regular software updates

Disabling unnecessary network services

Using intrusion detection and prevention systems (IDS/IPS)

Allowing default passwords

Ignoring access logs