Spaces:
Running on Zero
Running on Zero
File size: 6,333 Bytes
3644651 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 | [
{
"id": "kb001",
"title": "DDoS Attack",
"category": "Denial of Service",
"content": "A Distributed Denial of Service (DDoS) attack floods a server or network with massive traffic from multiple compromised systems, making services unavailable to legitimate users. Common defenses include rate limiting, traffic filtering, load balancing, cloud DDoS protection, and continuous network monitoring."
},
{
"id": "kb002",
"title": "Port Scanning",
"category": "Reconnaissance",
"content": "Port scanning is a reconnaissance technique used by attackers to identify open ports and running services on a target system. It is often the first step before exploitation. Defensive measures include firewall rules, intrusion detection systems, port knocking, and monitoring unusual connection attempts."
},
{
"id": "kb003",
"title": "Brute Force Attack",
"category": "Authentication Attack",
"content": "A brute force attack repeatedly attempts different username and password combinations until the correct credentials are found. Mitigation techniques include multi-factor authentication, account lockout policies, CAPTCHA, strong passwords, and login monitoring."
},
{
"id": "kb004",
"title": "Botnet Activity",
"category": "Malware",
"content": "A botnet is a network of compromised devices remotely controlled by attackers. Botnets are commonly used for DDoS attacks, spam campaigns, cryptocurrency mining, and malware distribution. Defenses include endpoint protection, network monitoring, device patching, and blocking command-and-control communications."
},
{
"id": "kb005",
"title": "SQL Injection",
"category": "Web Application Attack",
"content": "SQL Injection is a web attack where malicious SQL queries are inserted into application inputs to access, modify, or delete database information. Prevention includes parameterized queries, prepared statements, input validation, least-privilege database accounts, and web application firewalls."
},
{
"id": "kb006",
"title": "Cross Site Scripting (XSS)",
"category": "Web Security",
"content": "Cross Site Scripting (XSS) allows attackers to inject malicious JavaScript into trusted websites. It can steal cookies, session tokens, or redirect users. Prevention includes input sanitization, output encoding, Content Security Policy (CSP), and secure coding practices."
},
{
"id": "kb007",
"title": "Phishing Email",
"category": "Social Engineering",
"content": "Phishing emails impersonate trusted organizations to trick users into revealing passwords, banking information, or downloading malware. Users should verify sender identities, avoid suspicious links, inspect attachments carefully, and report suspicious emails."
},
{
"id": "kb008",
"title": "Ransomware",
"category": "Malware",
"content": "Ransomware encrypts files and demands payment for decryption. It commonly spreads through phishing emails, software vulnerabilities, or malicious downloads. Mitigation includes offline backups, endpoint protection, timely patching, network segmentation, and user awareness training."
},
{
"id": "kb009",
"title": "Man-in-the-Middle Attack",
"category": "Network Attack",
"content": "A Man-in-the-Middle (MITM) attack intercepts communication between two parties without their knowledge. Attackers may steal credentials or modify transmitted data. Prevention includes HTTPS, TLS encryption, VPNs, certificate validation, and secure Wi-Fi practices."
},
{
"id": "kb010",
"title": "DNS Spoofing",
"category": "Network Attack",
"content": "DNS Spoofing redirects users to malicious websites by manipulating DNS responses. Attackers can steal credentials or distribute malware. Protection includes DNSSEC, encrypted DNS, secure DNS servers, and monitoring suspicious DNS traffic."
},
{
"id": "kb011",
"title": "Insider Threat",
"category": "Internal Security",
"content": "An insider threat originates from employees, contractors, or trusted individuals who intentionally or unintentionally compromise organizational security. Mitigation includes least privilege access, user activity monitoring, security awareness training, and role-based access control."
},
{
"id": "kb012",
"title": "Zero-Day Vulnerability",
"category": "Vulnerability",
"content": "A zero-day vulnerability is a software flaw that is unknown to the vendor and has no available patch. Attackers exploit it before it is publicly disclosed. Organizations should deploy intrusion detection systems, endpoint detection, threat intelligence, and rapid patch management."
},
{
"id": "kb013",
"title": "Network Intrusion Detection System",
"category": "Cyber Defense",
"content": "A Network Intrusion Detection System (NIDS) continuously monitors network traffic to identify malicious activities, attacks, and policy violations. It uses machine learning, signature detection, anomaly detection, and threat intelligence to detect cyber threats in real time."
},
{
"id": "kb014",
"title": "Machine Learning Intrusion Detection",
"category": "Artificial Intelligence",
"content": "Machine learning intrusion detection systems analyze network traffic patterns to classify normal and malicious behavior. Algorithms such as Random Forest, XGBoost, LightGBM, and Deep Learning models improve detection accuracy while reducing false positives."
},
{
"id": "kb015",
"title": "Cyber Threat Intelligence",
"category": "Threat Intelligence",
"content": "Cyber Threat Intelligence (CTI) is the collection, analysis, and sharing of information about cyber threats, attacker techniques, vulnerabilities, malware, and indicators of compromise. CTI enables organizations to proactively defend against emerging attacks and supports incident response."
}
] |