Cyber security basics: 50 cards on attacks, cryptography and defenses

All 50 cards

1. 1
   The CIA triad
   Confidentiality (only authorized people can read data), Integrity (data isn’t altered undetected) and Availability (systems and data are usable when needed)
2. 2
   Which CIA property does each attack hit: DDoS, a leaked database, a tampered invoice?
   DDoS: availability. Leaked database: confidentiality. Tampered invoice: integrity

   Ransomware hits availability, and confidentiality too when attackers also steal and threaten to publish data.
3. 3
   Authentication vs authorization
   Authentication verifies who you are; authorization decides what you are allowed to do

   In HTTP, 401 Unauthorized actually means “not authenticated”, while 403 Forbidden means authenticated but not allowed.
4. 4
   Vulnerability vs threat vs risk
   A vulnerability is a weakness; a threat is something that could exploit it; risk is the likelihood of that happening combined with its impact
5. 5
   Principle of least privilege
   Give every user, service and process only the permissions it needs, for only as long as it needs them, which limits the damage when an account is compromised
6. 6
   Defense in depth
   Layering independent controls (network filtering, MFA, patching, encryption, monitoring, backups) so that when one fails, others still protect you
7. 7
   Zero trust
   “Never trust, always verify”: no user or device is trusted because of its network location; every request is authenticated, authorized and encrypted, with least privilege and an assumption that a breach has already happened

   NIST SP 800-207 is the standard reference.
8. 8
   Phishing
   Fraudulent messages that impersonate a trusted sender to trick people into revealing credentials, paying money or running malware

   Spear phishing targets specific people, whaling targets executives, smishing uses SMS and vishing uses voice calls.
9. 9
   Red flags of a phishing email
   Urgency or threats, a sender or link domain that is slightly off, links whose real target differs from the text, unexpected attachments, and requests for credentials, payment or changed bank details
10. 10
    Brute force vs credential stuffing vs password spraying
    Brute force tries many passwords against one account; credential stuffing replays username–password pairs leaked from other sites; password spraying tries a few common passwords against many accounts to avoid lockouts

    MFA and blocking known-breached passwords defeat most of these.
11. 11
    Cross-site scripting (XSS)
    An attacker gets their script to run in other users’ browsers on a trusted site, where it can steal data or act as the user

    Stored XSS is saved on the server (e.g. in a comment), reflected XSS bounces off a request parameter, and DOM-based XSS happens entirely in client-side JavaScript.
12. 12
    Prevent XSS when displaying user input with plain JavaScript
    javascript

    // Vulnerable: the input is parsed as HTML
    el.innerHTML = comment
    
    // Safe: the input is shown as text
    el.textContent = comment

    Frameworks like React escape output by default; when you must render user HTML, sanitize it with a library such as DOMPurify.
13. 13
    Content Security Policy (CSP)
    A response header that tells the browser which sources of scripts, styles and other resources are allowed, so injected scripts are blocked even if an XSS bug slips through

    Example: Content-Security-Policy: default-src 'self'. Inline scripts are blocked unless allowed with a nonce or hash.
14. 14
    Cross-site request forgery (CSRF)
    A malicious site makes a logged-in user’s browser send an unwanted request, such as a transfer or password change, to a site that trusts the user’s cookies
15. 15
    How do you prevent CSRF?
    Require an anti-CSRF token on state-changing requests, set session cookies to SameSite=Lax or Strict, check the Origin header, and never change state with GET requests
16. 16
    Session cookie flags HttpOnly, Secure and SameSite
    HttpOnly hides the cookie from JavaScript (limiting theft via XSS), Secure sends it only over HTTPS, and SameSite limits sending it on cross-site requests (limiting CSRF)
17. 17
    SQL injection, and the fix
    python

    # Vulnerable: input becomes part of the SQL
    cur.execute(f"SELECT * FROM users WHERE email = '{email}'")
    
    # Safe: a parameterized query
    cur.execute("SELECT * FROM users WHERE email = %s", (email,))

    With the vulnerable version, an input like ' OR '1'='1 changes the query’s logic. Parameterized queries send data separately from the SQL.
18. 18
    Man-in-the-middle (MITM) attack
    An attacker secretly sits between two parties, reading or altering their traffic, for example through a rogue Wi-Fi hotspot, ARP spoofing or DNS spoofing

    TLS with proper certificate validation is the main defense.
19. 19
    HSTS
    HTTP Strict Transport Security: a header (Strict-Transport-Security: max-age=31536000; includeSubDomains) telling browsers to use only HTTPS for the site, which defeats SSL-stripping attacks

    Sites can join browsers’ HSTS preload list so even the first visit uses HTTPS.
20. 20
    Server-side request forgery (SSRF)
    Tricking a server into making requests to places the attacker can’t reach directly, such as internal services or the cloud metadata endpoint at 169.254.169.254

    Defenses: allowlist destinations, block internal address ranges, and require IMDSv2 on AWS.
21. 21
    Changing /invoices/1001 to /invoices/1002 shows someone else’s invoice. What is the flaw?
    Broken access control, specifically an insecure direct object reference (IDOR): the server doesn’t check that the user owns the object

    Fix it by checking authorization on the server for every request; hard-to-guess IDs alone aren’t enough.
22. 22
    DoS vs DDoS
    A denial-of-service attack overwhelms a system from one source; a distributed attack uses many sources, often a botnet, which makes it much harder to block

    Mitigations include CDNs and scrubbing services, rate limiting and autoscaling.
23. 23
    Ransomware, and the best defense
    Malware that encrypts (and often steals) data and demands payment. The key defense is offline or immutable backups with tested restores, plus patching, MFA and least privilege
24. 24
    Virus vs worm vs trojan
    A virus attaches to files and spreads when they run; a worm spreads across networks on its own; a trojan poses as legitimate software to get installed
25. 25
    Zero-day vulnerability
    A flaw the vendor doesn’t know about or hasn’t patched yet, so there is no fix available when attackers start exploiting it
26. 26
    Software supply chain attack
    Compromising software you depend on, such as a library, build tool or update server, to reach every user of it

    Examples: SolarWinds (2020) and the xz Utils backdoor (2024). Defenses: lockfiles, dependency scanning, verified signatures and an SBOM.
27. 27
    Hashing vs encryption
    Hashing is one-way: it turns data into a fixed-size digest that can’t be reversed (integrity checks, password storage). Encryption is two-way: data can be decrypted with the right key (confidentiality)
28. 28
    Is Base64 encryption?
    No. Base64 is an encoding: anyone can decode it without a key. It only makes binary data safe to transport as text
29. 29
    Properties of a cryptographic hash function
    Deterministic, fast to compute, infeasible to reverse (preimage resistance), infeasible to find two inputs with the same hash (collision resistance), and a tiny input change completely changes the output

    MD5 and SHA-1 are broken for collision resistance; use SHA-256 or SHA-3 instead.
30. 30
    Why not store passwords as SHA-256 hashes?
    General-purpose hashes are fast, so attackers can test billions of guesses per second on GPUs. Use a slow, salted password hashing algorithm: Argon2id, scrypt, bcrypt or PBKDF2

    OWASP recommends Argon2id first.
31. 31
    Salt
    A unique random value stored next to each password hash, so identical passwords produce different hashes and precomputed rainbow tables are useless

    A salt isn’t secret. A pepper is an extra secret value kept outside the database, such as in a secrets manager.
32. 32
    Symmetric encryption
    The same secret key encrypts and decrypts. It is fast, but both sides must somehow share the key securely

    Examples: AES (e.g. AES-256-GCM) and ChaCha20-Poly1305.
33. 33
    Asymmetric (public-key) encryption
    A key pair: the public key can be shared and is used to encrypt or verify, while the private key stays secret and is used to decrypt or sign. It is much slower than symmetric encryption

    Examples: RSA and elliptic-curve algorithms such as X25519 and Ed25519. Post-quantum algorithms such as ML-KEM are being rolled out alongside them.
34. 34
    Bob wants to send Alice a secret message and prove it is from him. Which keys does he use?
    He encrypts with Alice’s public key, so only her private key can decrypt it, and signs with his own private key, so anyone can verify it with his public key
35. 35
    Digital signature
    A value computed over a message’s hash with the signer’s private key; anyone can verify it with the public key, proving integrity and authenticity

    It also gives non-repudiation: the signer can’t plausibly deny signing.
36. 36
    How does TLS use both symmetric and asymmetric cryptography?
    Asymmetric cryptography authenticates the server (its certificate and signature) and runs a key exchange such as ECDHE to agree on shared keys; fast symmetric encryption such as AES-GCM then protects the actual data
37. 37
    TLS certificate
    A document binding a public key to a domain name, signed by a certificate authority (CA); browsers accept it if it chains up to a root CA in their trust store and is valid for the domain

    The maximum lifetime of public TLS certificates is being cut in steps, to 200 days in 2026 and 47 days by 2029, so automated renewal (such as ACME with Let’s Encrypt) is essential.
38. 38
    What did TLS 1.3 change?
    A faster handshake (one round trip), mandatory forward secrecy, and removal of legacy options such as RSA key exchange, CBC-mode ciphers, RC4 and SHA-1

    TLS 1.0 and 1.1 are formally deprecated; use TLS 1.2 or 1.3.
39. 39
    Forward secrecy
    Using fresh (ephemeral) keys for each session, so stealing the server’s long-term private key later can’t decrypt previously recorded traffic
40. 40
    Is a JWT’s payload secret?
    No. A standard signed JWT is only Base64URL-encoded, so anyone can read it; the signature prevents tampering, not reading. Don’t put secrets in it

    Always verify the signature, expected algorithm, expiry, issuer and audience on the server.
41. 41
    Multi-factor authentication (MFA)
    Requiring factors of at least two different types: something you know (a password), something you have (a phone or security key) and something you are (a fingerprint)

    A password plus a security question is still a single factor type.
42. 42
    Rank these MFA methods from weakest to strongest: SMS codes, authenticator app codes, FIDO2 security keys
    SMS (vulnerable to SIM swapping and interception), then authenticator app TOTP codes (still phishable), then FIDO2/WebAuthn security keys or passkeys, which are phishing-resistant

    Push approvals can be abused through MFA fatigue: attackers spam prompts until someone taps Approve.
43. 43
    Passkeys
    FIDO2/WebAuthn credentials that replace passwords with a key pair: the private key stays on your device or password manager, the site stores only the public key, and the credential works only on the real site’s domain, so phishing pages can’t use it
44. 44
    What is the OWASP Top 10, and what is its number one risk?
    An awareness list of the most critical web application security risks, published by the OWASP Foundation. Broken access control is ranked first in both the 2021 and 2025 editions

    Other long-standing categories include injection, cryptographic failures and security misconfiguration. The 2025 edition broadened vulnerable components into software supply chain failures.
45. 45
    Examples of security misconfiguration
    Default credentials left in place, verbose error pages with stack traces, publicly readable storage buckets, unnecessary open ports or services, and missing security headers
46. 46
    Network firewall vs web application firewall (WAF)
    A network firewall filters traffic by IP address, port and protocol; a WAF inspects HTTP requests at layer 7 to block attacks such as SQL injection and XSS patterns
47. 47
    Vulnerability scan vs penetration test
    A vulnerability scan is an automated search for known weaknesses; a penetration test is an authorized, human-led attempt to exploit weaknesses and show their real impact
48. 48
    CVE vs CVSS
    A CVE is a unique ID for a publicly disclosed vulnerability, such as CVE-2021-44228 (Log4Shell); CVSS is a 0–10 score of its severity

    Log4Shell scored the maximum 10.0.
49. 49
    The 3-2-1 backup rule
    Keep three copies of your data on two different types of storage, with one copy offsite

    Against ransomware, make at least one copy offline or immutable and test restores regularly.
50. 50
    You committed an API key to a Git repository. What now?
    Revoke and rotate the key immediately; deleting it in a new commit isn’t enough because it remains in the history and any clones

    Then check the provider’s logs for misuse. Secret scanning (such as GitHub push protection or gitleaks) helps prevent repeats.