Skip to main content

Security

How to keep a conversation private and trustworthy on a path you do not control. The module starts with the attacker's position and the goals you defend, builds up the cryptography (ciphers, hashes, key exchange, signatures), then shows how certificates, TLS and real authentication schemes use it. It ends with the network-level pieces: VPNs, common attacks, DDoS, and the firewalls that enforce policy at the boundary.

What you will be able to answer​

  • What are confidentiality, integrity and availability, and what can an attacker do from each position on the path?
  • Why is AEAD the default for symmetric encryption, and how do HMAC and salted, slow password hashes differ from a plain hash?
  • How does Diffie-Hellman agree on a secret in the open, why does it need signatures to stop a man in the middle, and what does forward secrecy buy?
  • How does a browser validate a certificate chain, and how do revocation, ACME and Certificate Transparency fit in?
  • What happens in a TLS 1.3 handshake, how does it save a round trip over 1.2, and what do SNI, ALPN and resumption do?
  • How do sessions, JWTs, OAuth/OIDC, mTLS and passkeys differ, and which one fits which problem?
  • How do IPsec, WireGuard and SSH tunnels carry traffic, and what do split and full tunnels change?
  • Which attacks (ARP, DNS, DHCP, BGP, VLAN, MITM) need which attacker position, and what defeats each?
  • How do amplification and SYN floods work, and how do scrubbing and anycast absorb them?
  • How do stateless and stateful firewalls, WAFs, DMZs and zero trust differ, and why does a full conntrack table drop packets?
On this page