A firewall inspects traffic crossing a network boundary and allows or blocks it against a set of rules. It is the checkpoint between a trusted network and an untrusted one.
Fig. 01 — Firewall
Swipe sideways to see the whole diagram →
Step by step
Traffic reaches the boundary
Every packet entering or leaving the protected network passes through the firewall first.
Match against rules
Rules are read in order and compared on source IP, destination IP, protocol and port.
Check the state table
A stateful firewall remembers connections your side started, so return traffic for those is allowed automatically.
Apply the action
The first matching rule decides: allow, deny or reject. Most firewalls end with an implicit deny-all.
Inspect deeper if configured
A next-generation firewall also examines the application layer, so it can block a specific app or a known malicious payload rather than just a port.
Log everything
Denied attempts are recorded. Those logs are usually the first place an investigation starts.
Real-world example
Your office firewall permits outbound HTTPS on port 443 but blocks inbound connections on port 3389. Staff can browse freely, while an attacker scanning for exposed Remote Desktop finds nothing to connect to.
Where people get this wrong
A firewall is imagined as a wall that stops attacks. It is a rule list that stops traffic. Anything arriving on a port you allowed walks straight through, which is why almost every modern breach uses a port the firewall was configured to permit.
Common interview questions
What is the difference between a stateless and a stateful firewall?
A stateless firewall judges each packet in isolation. A stateful firewall tracks connections, so it knows whether a packet belongs to a session you initiated.
What is a DMZ?
A separate network segment for public-facing servers. If a web server there is compromised, the attacker still faces a firewall before reaching the internal network.
What is the difference between deny and reject?
Deny drops the packet silently. Reject sends back an error. Silent drops give a scanner less information about your network.
Does a firewall stop all attacks?
No. It cannot help with traffic on an allowed port, phishing, or a compromised insider. It is one layer, not the whole defence.
Inside the Druvexaa simulation
The simulation lets you write rules and then fire different kinds of traffic at them, so you can see the first matching rule win and watch what an implicit deny at the bottom of the list actually does.
A VPN builds an encrypted tunnel across a public network. Traffic inside the tunnel is unreadable to anyone in between, so a private network can safely extend over the internet.
Fig. 02 — VPN
Swipe sideways to see the whole diagram →
Step by step
Authenticate
The client proves its identity with a certificate, key or credentials before any tunnel is built.
Negotiate keys
Both ends agree on encryption algorithms and derive session keys, typically using a Diffie-Hellman exchange.
Encapsulate
Each original packet is encrypted and wrapped inside a new outer packet addressed to the VPN server.
Traverse the internet
Anyone observing sees only traffic between you and the VPN server. The real destination and contents are hidden.
Decrypt and forward
The VPN server unwraps the packet and sends the original on to its destination on the private network or the internet.
Return the same way
Replies come back to the VPN server, are re-encrypted, and travel home through the same tunnel.
Real-world example
Connecting to your company VPN from a café means the café's network sees only encrypted traffic to one server. Your internal file share behaves as if you were sitting at your desk.
Where people get this wrong
A VPN is sold as anonymity. It moves the point where your traffic becomes visible from your ISP to the VPN provider. That is a meaningful change of trust, but it is not invisibility, and it does nothing once you sign into an account.
Common interview questions
What is the difference between site-to-site and remote-access VPN?
Site-to-site links two whole networks through gateway devices. Remote-access connects one user's device into a network.
What does a VPN not protect you from?
Malware, phishing, browser fingerprinting, or being tracked once you log into an account. It protects the transport, not your behaviour.
What is split tunnelling?
Sending only corporate traffic through the tunnel while everything else goes out directly. It saves bandwidth but widens the attack surface.
Which protocols are commonly used?
IPsec and OpenVPN are the traditional choices; WireGuard is now popular for being far simpler and faster.
Inside the Druvexaa simulation
The simulation shows the packet before and after encapsulation, so you can read the original headers, watch them disappear inside the outer packet, and see exactly what an observer in the middle can and cannot see.
Most account breaches do not involve breaking encryption. They involve guessing weak passwords, reusing leaked ones, or tricking a person into typing their password into a fake page.
Fig. 03 — Attackers steal passwords
Swipe sideways to see the whole diagram →
Step by step
Brute force
Software tries every combination. Length matters far more than symbols here — each extra character multiplies the work enormously.
Dictionary attacks
Lists of common passwords and predictable substitutions like P@ssw0rd are tried first, because they succeed so often.
Credential stuffing
Usernames and passwords leaked from one breached site are replayed against banks and email. Reuse is what makes this work.
Phishing
A convincing fake login page collects the password directly. No cracking is needed at all.
Why hashing matters
Good sites store a salted hash, not the password. A leak then reveals hashes that are slow and expensive to reverse.
Why MFA helps
A second factor means a stolen password alone is not enough to log in.
Real-world example
A single leaked password from a shopping site becomes a bank account breach only when the same password was reused there. Unique passwords contain the damage to one account.
Where people get this wrong
Complexity rules are treated as the answer. A short password with symbols is weaker than a long ordinary phrase, and reuse defeats both. The failure is almost never the password's character set.
Common interview questions
Why is hashing preferred over encrypting passwords?
Encryption is reversible with the key. A hash is one-way, so a stolen database does not directly hand over the passwords.
What is a salt?
Random data added to each password before hashing, so identical passwords produce different hashes and precomputed rainbow tables become useless.
Is a long passphrase better than a short complex password?
Usually yes. Length increases the search space far more than adding a couple of symbols to a short word.
What is credential stuffing?
Automatically replaying username and password pairs leaked from one service against many others, exploiting password reuse.
Inside the Druvexaa simulation
Type a password into the simulation and watch an estimated cracking time recalculate live as you change length and reuse, alongside a demonstration of how a leaked database becomes a login attempt elsewhere.
Encryption converts readable data into ciphertext that only a holder of the right key can reverse. Symmetric encryption such as AES uses one shared key; asymmetric encryption such as RSA uses a public key to encrypt and a private key to decrypt.
Fig. 04 — Encryption (AES and RSA)
Swipe sideways to see the whole diagram →
Step by step
Symmetric is fast
AES transforms data in blocks using one key. It is efficient enough to encrypt a video stream in real time.
But the key must travel
Both sides need the same key, and sending it over the network is exactly the problem encryption was meant to solve.
Asymmetric solves the exchange
A public key can be published freely. Anything encrypted with it can only be decrypted by the matching private key, which never leaves its owner.
Asymmetric is slow
RSA is orders of magnitude slower than AES, so it is impractical for large amounts of data.
Real systems use both
Asymmetric encryption is used briefly to agree a shared secret; that secret becomes an AES key and handles everything afterwards. This is what TLS does.
Signatures reverse the roles
Encrypting a hash with a private key produces a signature that anyone can verify with the public key, proving origin and integrity.
Real-world example
Every HTTPS page you load does both. RSA or an elliptic-curve equivalent verifies the server and helps agree a session key in the first few milliseconds; AES then encrypts every byte of the page after that.
Where people get this wrong
Encryption is treated as a single quality a system either has or lacks. What actually determines safety is key management — where the key is stored, who can reach it, and whether it is ever reused. Strong AES with a key sitting in a configuration file next to the data is not protection, and the algorithm is almost never the part that fails.
Common interview questions
Why not use RSA for everything?
It is far too slow for bulk data. It is used to establish a shared key, after which a symmetric cipher takes over.
What is the difference between encryption and hashing?
Encryption is reversible with a key. Hashing is one-way and is used for verification, not for recovering the original data.
What does a digital signature prove?
That the message came from the holder of the private key and has not been altered since it was signed.
What is a key exchange?
A method such as Diffie-Hellman that lets two parties agree a shared secret over a public channel without transmitting the secret itself.
Inside the Druvexaa simulation
The tunnel simulation shows plaintext being transformed block by block into ciphertext, then lets you attempt decryption with the wrong key so you can see that the output is not partially readable — it is noise.
A hash function turns input of any size into a fixed-length fingerprint. The same input always produces the same output, and there is no practical way to work backwards from the output to the input.
Fig. 05 — Hashing
Swipe sideways to see the whole diagram →
Step by step
Deterministic
The same input always produces the same hash. This is what makes comparison possible.
Fixed length
A single character and a huge file both produce a digest of the same size.
One-way
Given a hash, there is no efficient method to recover the input. You can only guess inputs and compare.
Avalanche effect
Changing one bit of input changes roughly half the output bits, so similar inputs produce completely unrelated hashes.
Collision resistance
It should be infeasible to find two inputs with the same hash. MD5 and SHA-1 have failed this test and should not be used for security.
Salting for passwords
A unique random salt is added per password before hashing, so identical passwords produce different hashes and precomputed tables become useless.
Real-world example
A site verifying your login never decrypts a stored password. It hashes what you typed with your stored salt and compares the two digests. If a database leaks, attackers get salted hashes rather than passwords.
Where people get this wrong
Fast hashes are assumed to be good hashes. For passwords, speed is the vulnerability — SHA-256 is designed to be fast, which means an attacker can test billions of guesses per second against a leaked database. Password storage deliberately uses slow algorithms like bcrypt or Argon2, where being inefficient is the entire security feature.
Common interview questions
Why is hashing preferred to encryption for passwords?
Encryption can be reversed by anyone who obtains the key. A hash cannot be reversed at all, so a leak does not directly expose passwords.
What is a hash collision?
Two different inputs producing the same digest. A usable collision breaks the algorithm for security purposes, which is what happened to MD5.
What does a salt protect against?
Rainbow tables and the ability to spot users who chose the same password, since identical inputs no longer produce identical hashes.
Why use bcrypt or Argon2 rather than SHA-256 for passwords?
They are deliberately slow and memory-hard, which limits how many guesses an attacker can make per second.
Inside the Druvexaa simulation
The security simulation hashes whatever you type and updates the digest live, so you can change a single character and watch the entire output change, then add a salt and see two identical passwords produce completely different stored values.
Phishing tricks a person into handing over credentials or money by impersonating something they trust. It targets human judgement rather than software, which is why technical defences alone do not stop it.
Fig. 06 — Phishing and Social Engineering
Swipe sideways to see the whole diagram →
Step by step
Build a pretext
A message appears to come from a bank, employer, delivery service or colleague. Public information makes it specific and convincing.
Create urgency
A deadline, a suspended account, a payment about to fail. Urgency exists to stop you from verifying.
Provide a route
A link to a lookalike domain, an attachment, a QR code, or a phone number that reaches the attacker.
Harvest the credential
You type a password or read out an OTP. No system was compromised — the information was volunteered.
Variants by channel
Spear phishing targets one named person, smishing arrives by SMS, vishing by phone call. The structure is identical.
The defence is procedural
Navigate to sites yourself rather than through links, verify unusual requests through a channel you already trust, and treat urgency itself as the warning sign.
Real-world example
A message says your electricity connection will be disconnected tonight unless a small payment is made, with a number to call. The urgency is the attack. A genuine utility does not disconnect by SMS within hours, and the number belongs to the attacker.
Where people get this wrong
Phishing is imagined as obvious — bad grammar and strange addresses. Modern attempts are cleanly written, use valid HTTPS certificates, and often reference real details taken from public profiles. Judging by appearance fails. The reliable signal is structural: an unexpected request, combined with time pressure, arriving through a channel you did not initiate.
Common interview questions
Why does multi-factor authentication not fully stop phishing?
An attacker running a live proxy can relay the one-time code in real time. Phishing-resistant methods such as passkeys or hardware keys bind the credential to the real domain.
What is spear phishing?
A targeted attack researched around one specific person or role, which makes it far more convincing than mass phishing.
Why is urgency such a common element?
It suppresses verification. If the target pauses to check through another channel, the attack usually fails.
What is the strongest single habit against phishing?
Never following the link provided. Reaching the service the way you normally would defeats the lookalike domain entirely.
Inside the Druvexaa simulation
The security awareness simulation presents a series of realistic messages and lets you decide which are genuine, then reveals the structural signal in each one rather than the surface details most people look at.
An IDS watches traffic and raises an alert when it sees something suspicious. An IPS sits directly in the traffic path and blocks it. The difference is one of position and authority, not of detection ability.
Fig. 07 — IDS and IPS
Swipe sideways to see the whole diagram →
Step by step
Signature detection
Traffic is matched against patterns of known attacks. Accurate for known threats, blind to anything new.
Anomaly detection
A baseline of normal behaviour is learned, and deviations are flagged. Catches novel attacks but generates more false positives.
Network-based versus host-based
A NIDS watches traffic on a segment. A HIDS runs on a single machine and watches its files, logs and processes.
An IDS observes
It receives a copy of the traffic. It cannot stop anything, so a false positive costs an analyst's time and nothing more.
An IPS intervenes
It sits inline and can drop packets or reset connections. A false positive here blocks legitimate traffic and becomes an outage.
Tuning is the real work
An untuned system produces so many alerts that genuine ones are missed. Most of the value comes from reducing noise, not from adding rules.
Real-world example
An IPS blocking a database exploit protects the server automatically. The same IPS mis-classifying a bulk report export as data exfiltration stops a business process at month end — which is why many organisations run detection first and enable blocking only for rules they trust completely.
Where people get this wrong
An IPS is assumed to be strictly better because it can block. Inline placement means it is also a single point of failure and a source of latency, and a bad signature update can take a network down more effectively than an attacker. The choice between them is about tolerance for false positives, not about capability.
Common interview questions
What is the core difference between IDS and IPS?
An IDS monitors a copy of traffic and alerts. An IPS is inline and can block. Detection logic is often identical.
What is the difference between signature-based and anomaly-based detection?
Signature matching compares against known attack patterns. Anomaly detection flags deviations from a learned baseline, catching new attacks at the cost of more false positives.
Why is a false positive more serious on an IPS?
It drops legitimate traffic, creating an outage, whereas on an IDS it only generates an unnecessary alert.
How does an IDS differ from a firewall?
A firewall enforces policy on whether traffic is allowed. An IDS inspects traffic that has already been allowed, looking for malicious behaviour within it.
Inside the Druvexaa simulation
The firewall simulation lets you place inspection either inline or on a monitoring tap and then send both malicious and legitimate traffic through, so you can see the same false positive produce an alert in one configuration and an outage in the other.
These topics are written to the same depth. A dedicated Druvexaa simulation is planned for each — until then, every one links to the closest existing simulation and quiz.
Confidentiality, Integrity and Availability are the three properties every security decision trades against. Almost any control strengthens one and costs something in another.
Fig. 08 — CIA Triad
Swipe sideways to see the whole diagram →
Step by step
Confidentiality
Information reaches only those authorised to see it. Encryption and access control are the main tools.
Integrity
Information is not altered without detection. Hashing, checksums and digital signatures provide this.
Availability
Systems and data are reachable when needed. Redundancy, backups and DDoS protection serve this property.
The trade-offs are real
Strong encryption with a lost key destroys availability. Aggressive availability through wide replication increases the confidentiality surface.
Use it as a checklist
For any proposed control, ask which of the three it improves and which it weakens. That question exposes most bad security decisions quickly.
Real-world example
Ransomware is an availability attack, not a confidentiality one — the data was never stolen in the classic case, just made unreachable. Which is why backups, not encryption, are the defence that actually works against it.
Where people get this wrong
Security is treated as one dimension where more is always better. Locking a system down so tightly that staff cannot work has not improved security; it has traded away availability and usually pushed people into insecure workarounds. Good security is a deliberate balance, not a maximum.
Common interview questions
Which property does a backup protect?
Availability, and to a degree integrity, since a clean backup lets you restore data that was tampered with.
Give an example of confidentiality and availability conflicting.
Encrypting everything with keys held by one person protects confidentiality, but if that person is unavailable, so is the data.
Which property does a digital signature protect?
Integrity, plus authenticity — it proves the content is unchanged and identifies who signed it.
Inside the Druvexaa simulation
No dedicated simulation yet. The security awareness and firewall simulations demonstrate confidentiality and availability controls respectively, and the hashing demonstration covers integrity.
Malware is any software written to harm, exploit or take control of a system. The categories are distinguished by how the code spreads and what it does once it is in place.
Fig. 09 — Types of Malware
Swipe sideways to see the whole diagram →
Step by step
Virus
Needs a host file and a user to run it. Spread is limited by human action.
Worm
Self-propagating across networks by exploiting vulnerabilities. This is why worms spread far faster than viruses.
Trojan
Disguised as something useful. It does not self-replicate — it relies entirely on the user installing it.
Ransomware
Encrypts files and demands payment. Modern variants also steal the data first, so paying does not remove the leak.
Spyware and keyloggers
Designed to stay hidden and quietly send information out, which is why they are often found long after infection.
Rootkits and botnets
A rootkit hides other malware from the operating system. A botnet turns many infected machines into a controllable network.
Real-world example
A worm reaching an unpatched server needs no one to click anything — it exploits the vulnerability directly. This is why patching matters more than user training against this particular class, while the reverse is true for trojans.
Where people get this wrong
Antivirus is treated as the complete defence. Signature-based detection only recognises what it has seen before, and modern malware is regularly repacked specifically to defeat it. Patching, least-privilege accounts and tested backups prevent far more damage than any scanner catches.
Common interview questions
What is the difference between a virus and a worm?
A virus needs a host file and user action to spread. A worm propagates itself across a network without either.
Why does paying a ransomware demand not solve the problem?
There is no guarantee of a working key, the intrusion path usually remains open, and modern attacks exfiltrate data before encrypting it.
What makes a rootkit particularly dangerous?
It compromises the system at a level that lets it hide from the operating system's own tools, so infection can persist undetected.
Inside the Druvexaa simulation
No dedicated simulation yet. The security awareness simulation covers the delivery stage — how malware typically reaches a machine in the first place, which is where it is cheapest to stop.
A denial of service attack overwhelms a system so legitimate users cannot reach it. A distributed attack sends that traffic from many machines at once, which makes simple blocking ineffective.
Fig. 10 — DDoS Attack
Swipe sideways to see the whole diagram →
Step by step
Volumetric attacks
Raw traffic floods the link until legitimate packets cannot get through. Measured in gigabits per second.
Protocol attacks
Exhaust connection state rather than bandwidth — a SYN flood fills the connection table with half-open connections.
Application layer attacks
Small numbers of expensive requests, such as a costly search query repeated endlessly. Hard to distinguish from real users.
Amplification
The attacker sends small spoofed requests to services that reply with much larger responses, multiplying their traffic many times over.
Mitigation
Traffic is routed through scrubbing centres or a CDN that absorbs and filters it, so only clean traffic reaches the origin.
Rate limiting and caching
At the application layer, limiting requests per client and caching expensive responses removes most of the leverage.
Real-world example
A CDN absorbs a volumetric attack because the traffic hits dozens of edge locations with enormous combined capacity, rather than one origin server on a single link.
Where people get this wrong
DDoS is assumed to be about bandwidth, so people plan for a bigger pipe. Application-layer attacks use very little bandwidth and still take a site down by exhausting database connections or CPU. Capacity planning alone does not defend against them; rate limiting and caching do.
Common interview questions
What is the difference between DoS and DDoS?
DoS comes from one source and can often be blocked. DDoS comes from many distributed sources, so blocking individual addresses does not work.
What is an amplification attack?
The attacker sends small spoofed requests to a service that replies with far larger responses directed at the victim, multiplying the traffic.
How does a CDN help against DDoS?
It distributes traffic across many high-capacity edge locations that absorb and filter it before it reaches the origin.
Inside the Druvexaa simulation
No dedicated simulation yet. The load balancing and server switching simulation shows health checks removing an overwhelmed server from the pool, which is the same mechanism that keeps a service partially alive under attack.
SQL injection happens when user input is pasted directly into a database query, letting an attacker change what the query does rather than just what it searches for.
Fig. 11 — SQL Injection
Swipe sideways to see the whole diagram →
Step by step
The root cause
Code builds a query by joining strings together, so the database cannot tell instruction from data.
The attack
Input containing SQL syntax closes the intended clause and appends new logic — bypassing a login, reading other tables, or deleting data.
Why filtering fails
Blocking quotes and keywords is a losing game. Encodings, comments and alternative syntax defeat every blacklist eventually.
Parameterised queries fix it
The query structure is sent to the database first, then values are bound separately. Input is data by definition and cannot become instruction.
Defence in depth
Least-privilege database accounts, so a successful injection cannot drop tables, and error messages that do not leak schema details.
Real-world example
A login form that builds its query by concatenation can be bypassed with input that always evaluates true. The same form using a prepared statement treats that identical input as a username to look up, finds nothing, and denies access.
Where people get this wrong
Escaping user input is believed to be the fix. Escaping is a patch over the real problem, which is that data and instructions are travelling in the same string. Parameterised queries remove the ambiguity entirely — and once you use them, escaping stops being something you have to remember to do correctly every single time.
Common interview questions
How do you prevent SQL injection?
Use parameterised queries or prepared statements everywhere, combined with least-privilege database accounts. Do not rely on input filtering.
Why is input sanitisation not a complete defence?
Blacklists miss encodings and alternative syntax. Separating query structure from data removes the vulnerability rather than filtering it.
What is blind SQL injection?
Exploitation where the application returns no error or data, so the attacker infers results from response timing or behaviour differences.
Inside the Druvexaa simulation
No dedicated simulation yet. The security awareness simulation covers the broader pattern behind this class of bug, where untrusted input is trusted at a point where it should not be.