NETSEC! ni edson

The practice and study of techniques for securing communication and data in the presence of possible threats.

It guarantees that the message was not altered.

It guarantees that the message is not a forgery and comes from the stated sender.

It guarantees that only authorized users can read the message.

It guarantees that the sender cannot deny sending a message.

It ensures a message has not changed during transmission.

By using hash functions.

A one-way function that produces a fixed-size hashed message.

A legacy hash function that produces a 128-bit digest and should only be used when no better alternatives are available.

Because it is a legacy algorithm with security weaknesses.

A hash function that produces a 160-bit hash and is similar to MD5.

Because it has known flaws and is a legacy algorithm.

A family of next-generation hash algorithms including SHA-224, SHA-256, SHA-384, and SHA-512.

SHA-256, SHA-384, and SHA-512.

Hash-based Message Authentication Code.

A hash function combined with a secret key.

Authentication and integrity.

Man-in-the-middle attacks.

Only authorized parties with the secret key.

Ensuring only authorized parties can access sensitive information.

An encryption method that uses the same secret key for encryption and decryption.

Both parties must share the secret key beforehand.

It is fast and uses less CPU than asymmetric encryption.

128 bits.

An encryption method that uses two different keys.

Encrypting data.

Decrypting data.

1,024 bits or higher.

It is considered unreliable.

Computational problems like factoring large numbers or discrete logarithms.

Confidentiality, authentication, and integrity.

Securing HTTPS websites such as online banking and shopping.

Remote server access.

Establishing secure connections in IPsec VPNs.

Email encryption.

A method that allows two parties to create the same secret key without sending it directly.

It allows secure key exchange even if someone is listening.

An email virus with the subject line “ILOVEYOU” that spread rapidly worldwide in 2000.

A Filipino student.

About 45 million computers.

Within just 10 days.

It caused billions of dollars in damage.

Vance Joshua Tamayo.

Defrauding investors through cryptocurrency scams.

At least ₱100 million.

4.5% monthly returns.

Around ₱500–600 million.

Media personalities, police officers, and government employees.

Individuals or groups that exploit systems to cause harm, steal data, or expose vulnerabilities.

Threat actors who exploit system weaknesses, often acting quickly.

Individuals who commit unauthorized or unethical acts without personal gain or intent to cause damage.

They may disclose the vulnerability to the affected organization.

A well-known gray-hat hacker active in the early 2000s.

Yahoo!, Microsoft, and The New York Times.

By exploiting weak security configurations and unprotected networks.

To expose vulnerabilities rather than steal data or demand payment.

Organizations improved security, but he still faced legal consequences.

The debate on responsible disclosure and hacking ethics.

A breach of Bulacan State University’s student portal by Pinoy Grayhats.

By exploiting outdated program code and system vulnerabilities.

No, no student data was leaked or compromised.

They informed administrators and suggested security improvements.

They took the system offline, updated it, and migrated to AWS.

Gray-hat hackers who use hacking as a form of protest.

Posting articles, leaking data, and launching network attacks.

A breach that exposed data of about 55 million registered voters.

A hacktivist group.

To protest and expose weak cybersecurity, not to demand ransom.

The National Privacy Commission investigated and enforced the Data Privacy Act.

A ransomware attack that compromised personal and medical data.

The Medusa ransomware group.

Cybercrime.

Encrypting files, demanding ransom, and leaking data.

They shut down systems and worked with experts and government agencies.

Hackers backed by governments to steal secrets and gather intelligence.

Foreign governments, terrorist groups, and corporations.

A Chinese hacking campaign targeting Philippine government systems.

Military documents related to the South China Sea.

By targeting system administrators through a compromised cloud service provider.

DICT shut down access in February 2024.

A destructive attack using Shamoon malware.

Iranian-linked hackers.

Through a phishing email infecting one IT employee.

Destruction of 35,000 computers.

About five months.

Their motivation, legality, and impact.

Social or political causes.

Government-directed intelligence gathering and sabotage.

To assess risks, intentions, and consequences in cybersecurity.

The practice of protecting computers, networks, data, and systems from attacks, damage, or unauthorized access.

Tools, technologies, policies, and strategies to defend information from cyber threats.

Hackers, viruses, malware, and data breaches.

Cyberattacks are becoming more advanced and more common.

Advanced skills, powerful tools, and automated attacks.

Companies, hospitals, and government networks.

Attacks can come from both inside and outside the network.

Anything of value to an organization, including people, equipment, resources, and data.

A weakness in a system or its design that can be exploited.

A potential danger to a company’s assets, data, or network functionality.

A mechanism that takes advantage of a vulnerability.

A counter-measure that reduces the likelihood or severity of a threat.

The likelihood that a threat will exploit a vulnerability and cause harm.

By the probability of an event and its consequences.

A politically motivated attack involving website defacement and DDoS attempts.

September 21, 2025.

Oplan Cyberdome, repelling 1.4 million attempts.

No data exfiltration occurred.

An exfiltration of sensitive patient data.

October 23, 2025.

SimonMed Imaging, a healthcare provider.

A multi-layered defense using backup, segmentation, and education.

Paths or methods attackers use to enter a system or network.

It helps identify how attacks begin and where security should be strengthened.

External and internal.

Hackers, phishing emails, and malware.

Threats from people or devices inside the organization.

They already have access to systems and networks.

When important information is stolen, leaked, or destroyed.

Through cyberattacks or accidental mishandling of data.

Financial damage, loss of customers, legal penalties, and long recovery times.

Data Loss Prevention (DLP) tools and strong security policies.

Intercepted messages can reveal confidential information.

Stolen devices can expose confidential data.

Weak security settings can allow unauthorized access.

Unauthorized data transfer or loss of USB drives.

It should be shredded when no longer required.

Using weak or compromised passwords that allow easy access to data.

It prevents unauthorized access to corporate data.

Harmful software designed to damage devices, steal information, or gain unauthorized access to systems.

Viruses, worms, spyware, adware, trojans, ransomware, and rootkits.

Users unknowingly install malware, security gaps are exploited, devices lack enterprise protection, and human error is common.

Human error.

Through emails, downloads, infected websites, and malicious links.

Confidentiality, integrity, and availability.

The oldest and most common type of malware that requires human action to spread.

They attach to files or programs and execute when opened by the user.

Human action such as opening infected files.

Corrupt files, erase drives, cause boot issues, steal data, and spread via email.

A worm from 2000 that spread via email and overwrote files.

Onel de Guzman, a Filipino programmer.

By shutting down email systems, updating antivirus software, and restoring backups.

A virus that attacks the boot sector or file system of storage devices.

A virus that targets BIOS or UEFI firmware.

A virus that exploits Microsoft Office macro features.

A virus that inserts itself into executable programs.

A virus that attacks operating system script interpreters.

Malware that disguises itself as legitimate software.

To trick users into installing malicious software.

A Trojan that allows remote access to a system.

A Trojan designed to steal financial information.

A Trojan that encrypts files and demands payment.

A Remote Access Trojan that gives full control of a device.

Steal data, control systems, disable security, and launch attacks.

Malware that steals banking and e-wallet credentials.

Blankbot, Godfather, and ToxicPanda.

An estimated ₱86 billion in losses.

It overlays fake login screens and intercepts OTPs.

Software that displays unwanted advertisements.

Bundled with free software, fake updates, and shady websites.

Pop-ups, redirects, system slowdown, and privacy risks.

It can track users and act as an entry point for spyware.

Malware that blocks access to systems or files until ransom is paid.

Phishing emails, malicious downloads, vulnerabilities, USB drives, and drive-by downloads.

Encrypts them and makes them unusable.

A 2023 attack by the Medusa group demanding ransom.

Encrypting data and threatening to leak it.

Malware that hides itself while gaining administrator-level access.

They operate deep within the operating system.

Disable security tools, install malware, and monitor activity.

A stealth attack on a Philippine military company lasting over 14 months.

Malware that secretly monitors and collects user information.

Passwords, financial data, browsing habits, and communications.

Spyware that extracts saved credentials and session data.

Over 315,000 compromised accounts in the Philippines.

Malware that self-replicates without user interaction.

By exploiting vulnerabilities and scanning networks.

Network congestion and delivery of other malware.

It led to the enactment of the E-Commerce Law (RA 8792).

Rootkit.

Ransomware.

Information theft.

Data encryption and extortion.

Backups, user training, strong passwords, and MFA.

They protect against ransomware.

A layered security approach.

No, multiple defenses are required.

Tools used for penetration testing and cyberattacks to identify, exploit, or defend against vulnerabilities.

Authorized testing of systems to identify security weaknesses before attackers do.

To crack or recover passwords through repeated guessing.

John the Ripper, Ophcrack, Hashcat, and THC Hydra.

Detecting security vulnerabilities in wireless networks.

Aircrack-ng, Kismet, InSSIDer, and KisMAC.

Tools that probe networks for open TCP or UDP ports.

Nmap, SuperScan, and Angry IP Scanner.

Testing firewall robustness using specially crafted packets.

Hping, Scapy, Socat, and Yersinia.

Tools that capture and analyze network packets.

Wireshark, Tcpdump, Ettercap, and Dsniff.

Directory and file integrity checking to detect hidden malware.

AIDE, Netfilter, and PF.

Tools used to discover software security vulnerabilities.

Skipfish, Wapiti, and W3af.

Investigating digital evidence in computers.

Sleuth Kit, Helix, Maltego, and EnCase.

Reverse engineering binaries and analyzing malware.

GDB, WinDbg, and IDA Pro.

Operating systems pre-loaded with security testing tools.

Kali Linux and BackBox Linux.

Encoding data to prevent unauthorized access.

VeraCrypt, OpenSSH, OpenSSL, and Tor.

Identifying and exploiting weaknesses in systems.

Metasploit, Core Impact, and Sqlmap.

Tools that scan networks for known vulnerabilities.

Nessus, SAINT, and OpenVAS.

Passive monitoring of data in transit.

Altering packet data without the user’s knowledge.

Forging source IP addresses to bypass access controls.

Using valid user credentials to gain access.

Flooding systems to prevent normal use.

Positioning between sender and receiver to control communication.

Using stolen secret keys without the owner’s awareness.

Reading and monitoring unencrypted network data.

Attackers breached Target through an HVAC vendor using network scanning.

Nmap.

BlackPOS RAM scraper malware.

\$202 million in losses.

Attackers stole funds by intercepting SWIFT transactions.

Packet sniffers similar to Wireshark.

Eavesdropping and man-in-the-middle.

\$81 million.

Apache Struts vulnerability CVE-2017-5638.

Metasploit.

\$425 million in damages.

Weak SHA-1 hashing without salt.

John the Ripper.

165 million passwords.

Password-based and compromised-key attacks.

Aircrack-ng.

Eavesdropping.

\$256 million in losses.

Nessus.

IP spoofing and denial of service.

\$171 million.

They can be used for both attack and defense.

Written permission is legally required before testing.

Using tools to prevent, detect, and respond to attacks early.

They identify weaknesses before attackers exploit them.

They monitor network anomalies.

It secures sensitive data.

\$4.45 million.

Exploits can be developed within hours of a CVE release.

Tools are becoming easier to use while attacker expertise requirements decrease.

Proactive vulnerability management, network segmentation, strong cryptography, and patch management.

To ensure responsible and lawful use of powerful tools.

The fundamental set of rules for addressing and routing data over the internet.

To learn about ARP, DNS, and DHCP attacks, their prevention, and key security questions.

A cyberattack where fake ARP messages link a malicious MAC address to a trusted IP address.

ARP cache poisoning.

To spy on traffic, perform man-in-the-middle attacks, or launch denial-of-service attacks.

An attack where the intruder intercepts and possibly alters communication between two parties.

Hackers, developers for debugging, and ethical hackers for security testing.

Data spying, malware infection, ransomware, or total network disruption.

Because attackers may only spy or modify data without disrupting services.

A cyberattack simulation involving North Korean hackers targeting a nuclear power plant.

It allowed them to disguise themselves as trusted devices and bypass security controls.

Device scanning, password probing, lateral movement, and reprogramming devices.

A single deception can compromise entire operational systems.

ARP spoofing can act as an entry point to deeper system compromise.

A security feature that validates ARP packets and blocks malicious replies.

To prevent attackers from replacing legitimate MAC addresses.

By limiting the number of MAC addresses per switch port.

It isolates sensitive systems even if ARP spoofing occurs elsewhere.

It detects abnormal ARP changes or ARP storms early.

They reduce reliance on unauthenticated ARP communication.

A DDoS attack that abuses publicly accessible DNS servers to amplify traffic.

Low-level malicious DNS activity designed to look legitimate.

Creating hidden subdomains on a legitimate domain for malicious use.

Hiding data inside DNS queries and responses to bypass security controls.

Data exfiltration or remote system control.

A DNS infrastructure failure due to firewall changes and DNS upgrades.

Global service disruption and financial losses for merchants.

Failures can disrupt services and cause major financial damage.

DNS should not be a single point of failure.

Using redundant DNS servers across regions.

They reduce risk during network or DNS changes.

An attack that exploits DHCP to provide false network configurations.

A rogue DHCP server giving incorrect IP configuration to clients.

Traffic is redirected through an attacker for MITM attacks.

Users may be redirected to malicious websites.

They can lead to denial-of-service attacks on clients.

Default settings allowed DNS spoofing via rogue DHCP servers.

DNS records can be modified without authentication.

Around 40%.

Default configurations can create major hidden vulnerabilities.

It ensures only trusted servers issue leases.

Authenticated DNS updates that prevent unauthorized changes.

To stop anonymous or rogue DNS modifications.

A switch feature that blocks DHCP responses from untrusted ports.

It prevents unauthorized devices from injecting DHCP traffic.

It has no authentication and blindly trusts ARP replies.