Networking essentials for defenders
- Ports & protocols: 20/21 FTP, 22 SSH, 53 DNS, 80/443 HTTP(S), 3389 RDP, 445 SMB. Know which should NEVER face the internet unguarded (hint: RDP, SMB).
- TCP/IP layers: attacks live at every layer — ARP spoofing (L2), IP spoofing/DDoS (L3), TLS stripping (L4-7), phishing (L8: the human).
- DNS is the attacker's favorite channel — tunneling/exfil via TXT records. Defenders: log DNS, alert on abnormal volume.
- Firewalls/segmentation: default-deny, least-open. VLANs contain lateral movement.
Operating systems
- Windows: AD domains, Group Policy, Event IDs (4624/4625 logon, 4688 process creation, 7045 service installs), Sysmon for deep telemetry.
- Linux: file permissions (chmod/umask), sudo logs (/var/log/auth.log or secure), systemd units, cron persistence locations.
Cryptography in practice
- Symmetric (AES): fast bulk encryption; the key IS the secret.
- Asymmetric (RSA/ECC): keypairs — public encrypts/verifies, private decrypts/signs. TLS handshake uses both.
- Hashing (SHA-256): integrity & password storage (with salt + slow functions: bcrypt/argon2).
- PKI & certificates: chains of trust; let's not confuse expired/self-signed alerts away.
You don't need to implement crypto — you need to NEVER roll your own and to spot its misuse in reviews.