Cyber Security

WHAT IS FILE STRUCTURE
"File structure" refers to the format of the label and data blocks and of any logical record
control information.
• The organization of a given file may be sequential, relative, or indexed.
• Sequential Files: A sequential file is organized in such a way that each record in the file
except the first has no previous record and each record except the last has no after record.
The sequential file relationship is established by the order in which the records are written
when the file is created.
• Relative file: A Relative file is a file in which each record is identified by its ordinal position
in the file (record 1, record 2 and so on). This means that records can be accessed
randomly as well as sequentially.
 (Ordinal Number- a number defining the position of something in a series, such as ‘first’, ‘second’, or
‘third)
• Indexed file: An indexed file is a file in which each record includes a primary key. To
distinguish one record from another, the value of the primary key must be unique for each
record.
 Records can then be accessed randomly by specifying the value of the record's primary key. Indexed file
records can also be accessed sequentially.
Ref: https://supportline.microfocus.com/documentation/books/nx50/fhorgs.htm
Registry
• Whenever a user installs a software program/application, a hardware or a device
driver for a newly connected hardware in a Windows based computer system, the
initial configuration settings of these are stored as keys and values in a system defined,
central hierarchical database repository called Windows Registry.
• During the usage of the software or the hardware, the changes made to these
configurations are updated in the registry.
• Also, the changes made to Control Panel settings, file associations, Windows
components and so on, during the use of the computer, are updated in the registry.
• Registry is a critical factor for stability, reliability and performance of a computer. Most
of the computer problems are caused by system registry errors.
• the Registry files are stored in the WindowsSystem32Config folder.
Ref: https://help.comodo.com/topic-159-1-290-3248-.html
Hash Value
• A hash value can be used to uniquely identify secret information.
• A hash value is a numeric value of a fixed length that uniquely
identifies data. Hash values represent large amounts of data as much
smaller numeric values, so they are used with digital signatures. You
can sign a hash value more efficiently than signing the larger value.
Mode of working in IDS and IPS?
• IDS and IPS work together to provide a network security solution.
• IDS: An IDS captures packets in real time, processes them, and can respond to threats.
An intrusion detection system (IDS) is a device or software application that monitors a network or
systems for malicious activity.
 It works on copies of data traffic to detect suspicious activity by using signatures.
 Less secure
Allows malicious traffic before its identified
• IPS: An IPS provides protection from malicious attacks in real time.

IPS (Intrusion Prevention System) is a device that controls access to IT networks in order to protect
systems from attack and abuse.
This is called inline mode.
More secure
Don’t allow malicious traffic
• Difference: IPS responds immediately and does not allow any malicious traffic to pass, whereas an
IDS allows malicious traffic to pass before it can respond.
Difference between Packet and flow ?
• Packets Are the Past, Flows Are the Future
• Packets are units of data in the Network Layer (IP in case of the
Internet)
• A flow is a sequence of packets from a sending application to a
receiving application.
NODE
• Any system or device connected to a network is also called a node.
For example, if a network connects a file server, five computers, and two
printers, there are eight nodes on the network.
• Each device on the network has a network address, such as a MAC
address, which uniquely identifies each device. This helps keep track
of where data is being transferred to and from on the network.
Ref: https://techterms.com/definition/node
Gateway
• A gateway is a hardware device that acts as a "gate" between two networks.
It may be a router, firewall, server, or other device that enables traffic to flow in and out of the network.
While a gateway protects the nodes within network, it also a node itself.
The gateway node is considered to be on the "edge" of the network as all data must flow through it
before coming in or going out of the network.
It may also translate data received from outside networks into a format or protocol recognized by devices
within the internal network.
A router is a common type of gateway used in home networks. It allows computers within the local
network to send and receive data over the Internet.
A firewall is a more advanced type of gateway, which filters inbound and outbound traffic, disallowing
incoming data from suspicious or unauthorized sources.
A proxy server is another type of gateway that uses a combination of hardware and software to filter
traffic between two networks. For example, a proxy server may only allow local computers to access a list
of authorized websites.
What are the major conditions to block traffic on firewall?
• If anyone want to block a category, but allow a few specific sites in
that category.
• If anyone want to allow some categories, but block individual sites in

the category.
Ref:
https://help.deepsecurity.trendmicro.com/Protection-Modules/Firewall
/firewall-rule-action-priority.html
Difference between firewall and IPS?
• A firewall permits and blocks traffic by port/protocol rules.
• Firewall mainly inspects L7 applications & protocols, however there are many
protocols those are not being inspected by firewall.
• A Firewalls can Accept/Drop the packets on the basis of pre defined policies
using IP Address , Port Number and Protocols. Firewall cannot inspect traffic
Content.
For example, Windows Firewall.
• An Intrusion Prevention System (IPS) detects unauthorized access and then

prevents it. Therefore, you would not need to manually block the attack
yourself.
For example, Cisco IPS.
• It works mainly on L2.
Diffrence between Sflow and Netflow?
• A flow is a sequence of packets from a sending application to a
receiving application.
• Both NetFlow and sFlow are network traffic monitoring tools
• One of the most notable differences between Netflow vs sFlow is that
Netflow is restricted to IP traffic only – this is where sFlow has the
greater advantage in terms of analyzation, as it can collect, monitor
and analzye traffic from OSI Layers 2, 3, 4, 5, 6 and 7.
• Netflow is only available for Cisco hardware and other select
manufacturers but sFlow was developed to be compatible on many
different platforms of switches and routers.

Cyber Security

Uploaded by

Copyright:

Available Formats

Cyber Security

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Cyber Security

Uploaded by

Copyright:

Available Formats

WHAT IS FILE STRUCTURE

• IPS: An IPS provides protection from malicious attacks in real time.

• If anyone want to allow some categories, but block individual sites in

• An Intrusion Prevention System (IPS) detects unauthorized access and then

You might also like