Interview

• What is SSL?

  • SSL stands for Secure Sockets Layer, and it refers to a protocol for encrypting, securing, and authenticating communications that take place on the Internet. Although SSL was replaced by an updated protocol called TLS (Transport Layer Security) some time ago, "SSL" is still a commonly used term for this technology.
  • The main use case for SSL/TLS is securing communications between a client and a server, but it can also secure email, VoIP, and other communications over unsecured networks.
• What is a TLS handshake?

  • TLS is an encryption and authentication protocol designed to secure Internet communications. A TLS handshake is the process that kicks off a communication session that uses TLS. During a TLS handshake, the two communicating sides exchange messages to acknowledge each other, verify each other, establish the cryptographic algorithms they will use, and agree on session keys. TLS handshakes are a foundational part of how HTTPS works.

  
• TLS vs. SSL handshakes

  • SSL, or Secure Sockets Layer, was the original security protocol developed for HTTP. SSL was replaced by TLS, or Transport Layer Security, some time ago. SSL handshakes are now called TLS handshakes, although the "SSL" name is still in wide use.
• When does a TLS handshake occur?

  • A TLS handshake takes place whenever a user navigates to a website over HTTPS and the browser first begins to query the website's origin server. A TLS handshake also happens whenever any other communications use HTTPS, including API calls and DNS over HTTPS queries.
  • TLS handshakes occur after a TCP connection has been opened via a TCP handshake.
• What happens during a TLS handshake?

  During the course of a TLS handshake, the client and server together will do the following:

  • Specify which version of TLS (TLS 1.0, 1.2, 1.3, etc.) they will use
  • Decide on which cipher suites they will use
  • Authenticate the identity of the server via the server’s public key and the SSL certificate authority’s digital signature
  • Generate session keys in order to use symmetric encryption after the handshake is complete
• What are the steps of a TLS handshake?

  • TLS handshakes are a series of datagrams, or messages, exchanged by a client and a server. A TLS handshake involves multiple steps, as the client and server exchange the information necessary for completing the handshake and making further conversation possible.
  • The exact steps within a TLS handshake will vary depending upon the kind of key exchange algorithm used and the cipher suites supported by both sides. The RSA key exchange algorithm, while now considered not secure, was used in versions of TLS before 1.3. 
• Steps of TLS Handshake:

  1. The 'client hello' message: The client initiates the handshake by sending a "hello" message to the server. The message will include which TLS version the client supports, the cipher suites supported, and a string of random bytes known as the "client random."
  2. The 'server hello' message: In reply to the client hello message, the server sends a message containing the server's SSL certificate, the server's chosen cipher suite, and the "server random," another random string of bytes that's generated by the server.
• Steps of TLS Handshake:

  • 3. Authentication: The client verifies the server's SSL certificate with the certificate authority that issued it. This confirms that the server is who it says it is, and that the client is interacting with the actual owner of the domain.
  • 4. The premaster secret: The client sends one more random string of bytes, the "premaster secret." The premaster secret is encrypted with the public key and can only be decrypted with the private key by the server. (The client gets the public key from the server's SSL certificate.)
• Steps of TLS Handshake:

  • 5. Private key used: The server decrypts the premaster secret.
  • 6. Session keys created: Both client and server generate session keys from the client random, the server random, and the premaster secret. They should arrive at the same results.
  • 7. Client is ready: The client sends a "finished" message that is encrypted with a session key.
  • 8. Server is ready: The server sends a "finished" message encrypted with a session key.
  • 9. Secure symmetric encryption achieved: The handshake is completed, and communication continues using the session keys.
• All TLS handshakes make use of asymmetric cryptography (the public and private key), but not all will use the private key in the process of generating session keys. For instance, an ephemeral Diffie-Hellman handshake.
• Diffie-Hellman handshake

  1. Client hello: The client sends a client hello message with the protocol version, the client random, and a list of cipher suites.
  2. Server hello: The server replies with its SSL certificate, its selected cipher suite, and the server random. In contrast to the RSA handshake described above, in this message the server also includes the following (step 3):
• Diffie-Hellman handshake

  • 3. Server's digital signature: The server computes a digital signature of all the messages up to this point.
  • 4. Digital signature confirmed: The client verifies the server's digital signature, confirming that the server is who it says it is.
  • 5. Client DH parameter: The client sends its DH parameter to the server.
• Diffie-Hellman handshake

  • 6. Client and server calculate the premaster secret: Instead of the client generating the premaster secret and sending it to the server, as in an RSA handshake, the client and server use the DH parameters they exchanged to calculate a matching premaster secret separately.
  • 7. Session keys created: Now, the client and server calculate session keys from the premaster secret, client random, and server random, just like in an RSA handshake.
  • 8. Client is ready: Same as an RSA handshake.
  • 9. Server is ready
  • 10. Secure symmetric encryption achieved
• DH parameter:

  • DH stands for Diffie-Hellman. The Diffie-Hellman algorithm uses exponential calculations to arrive at the same premaster secret. The server and client each provide a parameter for the calculation, and when combined they result in a different calculation on each side, with results that are equal.
• TLS 1.3 Handshake:

  • TLS 1.3 does not support RSA, nor other cipher suites and parameters that are vulnerable to attack. It also shortens the TLS handshake, making a TLS 1.3 handshake both faster and more secure.
• TLS 1.3 Handshake:

  1. Client hello: The client sends a client hello message with the protocol version, the client random, and a list of cipher suites. Because support for insecure cipher suites has been removed from TLS 1.3, the number of possible cipher suites is vastly reduced. The client hello also includes the parameters that will be used for calculating the premaster secret. Essentially, the client is assuming that it knows the server’s preferred key exchange method (which, due to the simplified list of cipher suites, it probably does). This cuts down the overall length of the handshake.
• TLS 1.3 Handshake:

  • 2. Server generates master secret: At this point, the server has received the client random and the client's parameters and cipher suites. It already has the server random, since it can generate that on its own. Therefore, the server can create the master secret.
  • 3. Server hello and "Finished": The server hello includes the server’s certificate, digital signature, server random, and chosen cipher suite. Because it already has the master secret, it also sends a "Finished" message.
• TLS 1.3 Handshake:

  • 4. Final steps and client "Finished": Client verifies signature and certificate, generates master secret, and sends "Finished" message.
  • 5. Secure symmetric encryption achieved
• 0-RTT mode for session resumption

  • If the client and the server have connected to each other before (as in, if the user has visited the website before), they can each derive another shared secret from the first session, called the "resumption main secret." The server also sends the client something called a session ticket during this first session. The client can use this shared secret to send encrypted data to the server on its first message of the next session, along with that session ticket. And TLS resumes between client and server.
• What is a cipher suite?

  • A cipher suite is a set of algorithms for use in establishing a secure communications connection. There are a number of cipher suites in wide use, and an essential part of the TLS handshake is agreeing upon which cipher suite will be used for that handshake.
• How does SSL/TLS work?These are the essential principles to grasp for understanding how SSL/TLS works:

  • Secure communication begins with a TLS handshake, in which the two communicating parties open a secure connection and exchange the public key
  • During the TLS handshake, the two parties generate session keys, and the session keys encrypt and decrypt all communications after the TLS handshake
• How does SSL/TLS work?

  • Different session keys are used to encrypt communications in each new session
  • TLS ensures that the party on the server side, or the website the user is interacting with, is actually who they claim to be
  • TLS also ensures that data has not been altered, since a message authentication code (MAC) is included with transmissions

  With TLS, both HTTP data that users send to a website (by clicking, filling out forms, etc.) and the HTTP data that websites send to users is encrypted. Encrypted data has to be decrypted by the recipient using a key.
• The TLS handshake

  • TLS communication sessions begin with a TLS handshake. A TLS handshake uses something called asymmetric encryption, meaning that two different keys are used on the two ends of the conversation. This is possible because of a technique called public key cryptography.
  • In public key cryptography, two keys are used: a public key, which the server makes available publicly, and a private key, which is kept secret and only used on the server side. Data encrypted with the public key can only be decrypted with the private key.
• The TLS handshake

  • During the TLS handshake, the client and server use the public and private keys to exchange randomly generated data, and this random data is used to create new keys for encryption, called the session keys.
• Symmetric encryption with session keys

  • Unlike asymmetric encryption, in symmetric encryption the two parties in a conversation use the same key. After the TLS handshake, both sides use the same session keys for encryption. Once session keys are in use, the public and private keys are not used anymore. Session keys are temporary keys that are not used again once the session is terminated. A new, random set of session keys will be created for the next session.

  
• Authenticating the origin server

  • TLS communications from the server include a message authentication code, or MAC, which is a digital signature confirming that the communication originated from the actual website. This authenticates the server, preventing on-path attacks and domain spoofing. It also ensures that the data has not been altered in transit.
• What is an SSL certificate?

  • An SSL certificate is a file installed on a website's origin server. It's simply a data file containing the public key and the identity of the website owner, along with other information. Without an SSL certificate, a website's traffic can't be encrypted with TLS.
  • Technically, any website owner can create their own SSL certificate, and such certificates are called self-signed certificates. However, browsers do not consider self-signed certificates to be as trustworthy as SSL certificates issued by a certificate authority.
• How does a website get an SSL certificate?

  • Website owners need to obtain an SSL certificate from a certificate authority, and then install it on their web server (often a web host can handle this process). A certificate authority is an outside party who can confirm that the website owner is who they say they are. They keep a copy of the certificates they issue.
• Is it possible to get a free SSL certificate?

  • Many certificate authorities charge for SSL certificates. To help make the Internet more secure, Cloudflare offers free SSL certificates. Cloudflare was the first Internet security and performance company to do so. Cloudflare also has worked to optimize SSL/TLS performance so that websites moving from HTTP to HTTPS do not have their performance impacted.
• What is the difference between HTTP and HTTPS?

  • The S in "HTTPS" stands for "secure." HTTPS is just HTTP with SSL/TLS. A website with an HTTPS address has a legitimate SSL certificate issued by a certificate authority, and traffic to and from that website is authenticated and encrypted with the SSL/TLS protocol.
• What is the difference between HTTP and HTTPS?

  • To encourage the Internet as a whole to move to the more secure HTTPS, many web browsers have started to mark HTTP websites as "not secure" or "unsafe." Thus, not only is HTTPS essential for keeping users safe and user data secure, it has also become essential for building trust with users.
• How do you approach vulnerability assessment and penetration testing?

  1.Understand the Scope:

  • Begin by clearly defining the scope of the assessment. Understand the specific systems, networks, applications, and assets that are within the scope of the test.
  • Identify any limitations or constraints, such as testing during non-business hours or excluding certain critical systems.
• How do you approach vulnerability assessment and penetration testing?

  2. Information Gathering:

  • Collect as much information as possible about the target environment. This includes network topology, system architecture, IP addresses, domain names, and any publicly available information about the organization.
  • Utilize passive reconnaissance techniques to gather information without directly interacting with the target.
• How do you approach vulnerability assessment and penetration testing?

  3. Threat Modeling:

  • Develop a threat model to identify potential attack vectors and entry points. Consider both external and internal threats, and prioritize them based on their likelihood and potential impact.
  • This step involves understanding the business processes, assets, and potential attackers' motivations.
• How do you approach vulnerability assessment and penetration testing?

  4. Vulnerability Scanning:

  • Use automated tools to conduct vulnerability scans on the target systems. This helps identify known vulnerabilities and misconfigurations.
  • Regularly update vulnerability databases to ensure that the scans are comprehensive and up-to-date.
• How do you approach vulnerability assessment and penetration testing?

  5. Manual Testing:

  • Supplement automated scanning with manual testing to discover vulnerabilities that automated tools might miss.
  • Conduct manual analysis of web applications, network protocols, and other attack surfaces to identify weaknesses.

  6. Exploitation:

  • Once vulnerabilities are identified, attempt to exploit them to confirm their existence and assess the potential impact.
  • Conduct penetration testing in a controlled manner, avoiding any actions that could disrupt normal business operations.
• How do you approach vulnerability assessment and penetration testing?7. Post-Exploitation:

  • If successful in exploiting vulnerabilities, assess the extent of the compromise and potential lateral movement within the network.
  • Document the steps taken during the exploitation phase for later analysis and reporting.
• How do you approach vulnerability assessment and penetration testing?

  8. Analysis and Reporting:

  • Analyze the findings, categorize them by severity, and provide detailed reports to stakeholders.
  • Include recommendations for mitigating identified vulnerabilities, along with a risk assessment that helps prioritize remediation efforts.
  • Clearly communicate technical details to both technical and non-technical stakeholders.
• How do you approach vulnerability assessment and penetration testing?

  9. Remediation and Verification:

  • Work with the organization's IT and development teams to remediate identified vulnerabilities.
  • Verify that the fixes are effective and do not introduce new security issues.

  10. Continuous Improvement:

  • Implement a continuous improvement process, incorporating lessons learned from each assessment into future testing cycles.
  • Stay informed about emerging threats and adjust testing methodologies accordingly.
• Can you explain the difference between symmetric and asymmetric encryption?

  Symmetric Encryption:

  • Key Mechanism: Symmetric encryption uses a single shared key for both the encryption and decryption processes. This means that the same key is used by both the sender and the recipient to encrypt and decrypt the message.
  • Speed and Efficiency: Symmetric encryption is generally faster and more computationally efficient than asymmetric encryption because it involves simpler mathematical operations.