Cyber Sécurité

# Aim for >= 12 chars, mixing classes (lower, upper, digits, symbols)
# Entropy estimate: length * log2(pool)
#   62 chars  (a-z A-Z 0-9) -> ~5.95 bits/char
#   95 chars  (printable)   -> ~6.57 bits/char
# < 40 bits  = weak   |  >= 80 bits = strong
# Use a passphrase: 4+ random words are easier to remember and strong

# Never store plaintext passwords. Use adaptive hashing:
# Argon2id (preferred) | bcrypt (cost >= 12) | scrypt
# PBKDF2 with >= 600k iterations as fallback
# Per-user random salt, unique per password
# Use a password manager to generate and store unique passwords

# Enable MFA everywhere, especially on email & admin accounts
# Prefer: hardware key (FIDO2/WebAuthn) > TOTP app > SMS
# SMS is vulnerable to SIM-swapping — avoid for high-value accounts
# Backup codes: store offline, single-use, rotate after use

ss -tulnp                      # Listening TCP/UDP ports with PID
nmap -sT -p- localhost         # Scan all TCP ports locally
nmap -sV -sC example.com       # Version + default scripts scan
# Principle: close everything, open only what is needed
# Never expose admin panels (SSH, DB, web admin) to 0.0.0.0

# Default-deny: block all inbound, allow explicit exceptions
iptables -P INPUT DROP
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT
# Log dropped packets for review
iptables -A INPUT -j LOG --log-prefix "DROP: "

# Enforce TLS 1.2+ ; disable SSLv3, TLS 1.0/1.1
# Use strong ciphers: ECDHE + AES-GCM or ChaCha20-Poly1305
# Obtain certs via Let's Encrypt, enable HSTS, auto-renew
# Test: ssllabs.com, testssl.sh, nmap --script ssl-enum-ciphers

# SQL injection: use parameterized queries / prepared statements
#   db.query("SELECT * FROM users WHERE id = ?", [id])   # OK
#   db.query("... WHERE id = " + id)                     # VULNERABLE
# Validate input server-side; denylist is not enough
# ORM + schema validation + least-privilege DB account

# Output encoding for all user data, context-aware (HTML, JS, URL)
# Content-Security-Policy: default-src 'self'; script-src 'self'
# Set HttpOnly + Secure + SameSite on session cookies
# Frameworks (React/Vue) auto-escape; avoid dangerouslySetInnerHTML / v-html

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; frame-ancestors 'none'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), camera=(), microphone=()

# Symmetric: AES-256-GCM or ChaCha20-Poly1305 (AEAD)
# Asymmetric: Ed25519 (sign), X25519 (key exchange), RSA-OAEP >= 2048
# Hashing: SHA-256 / SHA-3 (use BLAKE3 for speed)
# Passwords: Argon2id > bcrypt > PBKDF2 (never MD5/SHA1 for passwords)
# RNG: use crypto.getRandomValues / secrets, never Math.random()

# Never hardcode secrets in source code or git
# Use env vars / vault (HashiCorp Vault, AWS Secrets Manager)
# Rotate keys regularly; separate per environment & service
# Minimum privilege: each key grants only what it needs
# Destroy revoked keys; log all access to secrets

# 1. Preparation: plans, tools, contacts, backups
# 2. Detection & Analysis: logs, SIEM alerts, IOC
# 3. Containment: isolate host, revoke creds, block IP
# 4. Eradication: remove malware, patch root cause
# 5. Recovery: restore from clean backups, monitor
# 6. Lessons learned: post-mortem, update playbooks

last                           # Recent logins
lastb                          # Failed login attempts
grep "Failed password" /var/log/auth.log
journalctl --since "1 hour ago" -p err
netstat -antp                  # Active connections + PID
lsof -i                        # Open files by network process
# Preserve evidence: copy logs before changes, record timestamps