← Back to Security Menu | 🏠 Hub
OSI Model (7 layers): 7. Application — HTTP, FTP, DNS, SMTP 6. Presentation — SSL/TLS, Encryption 5. Session — Session management 4. Transport — TCP (reliable) / UDP (fast) 3. Network — IP, Routing 2. Data Link — MAC address, Ethernet 1. Physical — Cables, WiFi signals
| Port | Protocol | Risk if open |
|---|---|---|
| 22 | SSH | Brute force — restrict to My IP |
| 23 | Telnet | ❌ Unencrypted — never use! |
| 80 | HTTP | Unencrypted web — use 443 |
| 443 | HTTPS | ✅ Encrypted — OK |
| 3306 | MySQL | Never expose to public internet |
| 3389 | RDP | Brute force — VPN ကနေပဲ ဝင် |
| 21 | FTP | ❌ Unencrypted — use SFTP |
Firewall = Network traffic ကို filter လုပ်တဲ့ security gate Types: 🔹 Packet Filter — IP/Port rules (basic) 🔹 Stateful — Connection state track 🔹 Application — Layer 7, deep inspection (WAF) 🔹 Next-Gen (NGFW)— IPS + App control Linux UFW (Uncomplicated Firewall): sudo ufw enable sudo ufw allow 22 # SSH sudo ufw allow 80 # HTTP sudo ufw allow 443 # HTTPS sudo ufw deny 3306 # Block MySQL from outside sudo ufw status verbose Windows: netsh advfirewall firewall add rule name="Block Port 23" protocol=TCP dir=in localport=23 action=block
VPN = Encrypted tunnel ကနေ internet သုံး How it works: Your Device → [Encrypted Tunnel] → VPN Server → Internet Use cases: ✅ Public WiFi လုံခြုံစွာ သုံး ✅ Remote work — office network ဝင် ✅ Geo-restricted content access ✅ ISP tracking ကနေ ကာကွယ် Types: 📱 Consumer VPN: NordVPN, ExpressVPN, ProtonVPN 🏢 Corporate VPN: OpenVPN, WireGuard, Cisco AnyConnect ☁️ Site-to-Site: AWS VPN, office ↔ cloud connect WireGuard (modern, fast VPN): - Open source - Simple config - 4x faster than OpenVPN
| IDS | IPS | |
|---|---|---|
| Full name | Intrusion Detection System | Intrusion Prevention System |
| Action | Detect → Alert (passive) | Detect → Block (active) |
| Placement | Out of band (mirror) | Inline (traffic passes through) |
| Example | Snort (detect mode) | Snort (prevent mode), Suricata |
Wireshark = Network traffic capture & analyze tool # Install: wireshark.org Key features: - Real-time packet capture - Protocol decode (HTTP, DNS, TCP, etc.) - Filter by protocol/IP/port Useful filters: http # HTTP traffic only ip.addr == 192.168.1.1 # Specific IP tcp.port == 443 # HTTPS http.request.method == "POST" # POST requests dns # DNS queries What you can see on HTTP: - Usernames, passwords (plaintext!) - Form data - Cookies HTTPS: all encrypted → only see metadata (IP, timing)
← Security 03 | Next: Security 05 → Cryptography →