Cybersecurity FAQ

A vulnerability is a weakness in a system (e.g. a buffer overflow in a library). An exploit is the technique or code that takes advantage of that weakness. A payload is what executes after the exploit succeeds — a reverse shell, ransomware dropper, etc. All three are required for a complete attack chain.

Yes, through several vectors: TLS interception proxies that install rogue CA certificates on corporate devices, SSL stripping attacks that downgrade HTTPS to HTTP before it reaches the browser, and certificate spoofing when a CA is compromised. HTTPS guarantees encryption in transit — not protection from compromised endpoints or CA chains.

Zero trust means never assuming any user, device, or network segment is trusted by default — even internal ones. Every access request is authenticated, authorized, and continuously validated. In practice it means strong identity verification, micro-segmentation, least-privilege access, device posture checks, and logging every request.

Hiding implementation details can slow attackers down but not stop them. Kerckhoffs's principle states a cryptosystem should be secure even if everything about the system, except the key, is public knowledge. If secrecy of design is your only protection, a single leak — a disgruntled employee, a leaked binary, a patent filing — collapses the entire security model.

Privilege escalation is gaining access rights beyond those you were granted. Vertical escalation moves from a regular user to admin/root. Horizontal escalation lets you access another user's data at the same permission level. Most malware, ransomware, and APT campaigns rely on escalation — initial access is rarely with high privileges.

It is better than nothing, but it has well-documented weaknesses. SIM swapping lets attackers redirect your phone number to their SIM. SS7 protocol flaws allow interception of SMS at the network level. Real-time phishing proxies can capture OTP codes in transit. FIDO2 hardware keys or authenticator apps are significantly stronger alternatives.

Every user, process, and system should be granted only the minimum permissions required to perform its function — no more. A developer does not need production database write access to write code. A microservice does not need admin rights to read a config file. Violations of this principle are consistently among the top factors in breach impact.

Instead of attacking your target directly, attackers compromise a dependency, vendor, or tool that the target trusts. SolarWinds (malicious update pushed to 18,000+ orgs), XZ Utils backdoor (malicious maintainer introduced a remote-code-execution backdoor in a widely-used compression library), and npm package hijacking are canonical examples. Trust of third-party code is an often-overlooked attack surface.

Layering multiple, independent security controls so that the failure of a single layer does not result in compromise. A firewall, IDS, endpoint protection, network segmentation, application-layer WAF, and strong authentication each address different threat vectors. An attacker who bypasses the perimeter firewall still faces authentication, endpoint controls, and logging.

A side-channel attack that infers secret information from the time it takes a system to respond. A password comparison that exits early on the first wrong character takes slightly different time for different guesses — leaking character-by-character. Constant-time comparison functions always evaluate every character regardless of correctness, eliminating the signal attackers rely on.