Emerging & Essential Concepts
Future of cybersecurity — AI, dark web, aur jo aage aane wala hai
Deepfake phishing (voice/video clone), AI-generated perfect spear phishing emails, automated vulnerability discovery, adversarial attacks on ML models, AI-generated malware.
Anomaly detection, automated threat response, behavior analytics (UEBA), log analysis at scale, vulnerability prediction, smart SIEM. Both sides use AI — arms race.
WormGPT (2023): ChatGPT jaise AI model, sans restrictions — phishing emails, malware code generate karta tha. Dark web pe subscribe kiya ja sakta tha. Ethics training ke bina AI = powerful criminal tool.
Linux/Unix mein "root" = superuser = god mode. Windows mein "Administrator". Full unrestricted access — files delete, users create, services install, anything. Attackers always try to escalate to root.
Low-level user access se root access tak jaana. Vertical privilege escalation (user → admin) or horizontal (user A → user B's data). Critical vulnerability class.
Proper systems passwords plain text nahi store karte — hash store karte hain. SHA256("password123") = fixed string. Attacker hash file chura ke offline crack karta hai.
Hashcat, John the Ripper — GPU-accelerated password cracking. RTX 4090 = 300 billion MD5 hashes/second. "password" = cracked instantly. "Tr0ub4dor&3" = years.
- bcrypt, Argon2, scrypt — slow hashing algorithms specifically designed for passwords
- Salt (random string add karo before hashing) — rainbow tables defeat karo
- Never use MD5 or SHA1 for passwords
DoS: Single machine se attack. Easy to block (IP ban karo). Limited bandwidth/impact.
DDoS: Distributed — thousands of sources. Can't block all IPs. Chapter 1 mein covered.
Volumetric (flood karo), Protocol (TCP SYN flood — half-open connections exhaust karo), Application layer (HTTP requests — web server crash). Each needs different defense.
Machine learning se user aur entity ka normal behavior baseline karo, phir deviations flag karo. John usually 9-5 India se login karta hai. Suddenly 3am Russia se login = red flag.
Insider threats, compromised accounts, data exfiltration, privilege abuse. Signature se nahi — behavior se detect karta hai. Zero-day threats bhi pakad sakta hai unusual behavior se.
Surface Web: Google index karta hai (4%)
Deep Web: Password-protected, not indexed — email, banking (90%)
Dark Web: Tor needed, anonymous, not indexed (6%)
Dark web = journalist whistleblowers (Tor Project made by US Navy), censorship bypass (Iran, China activists), privacy enthusiasts. But also: drugs, stolen credentials, hitmen (mostly scams), hacking services, child abuse material (ICAC investigates).
Ocean ki tarah. Surface = visible waala hissa. Deep = underwater (banks, gov databases — not evil, just inaccessible without access). Dark = Mariana Trench — reach karna mushkil, kuch genuinely dangerous creatures wahan.
Cyber attack jiske physical consequences hain. Power grids off karna, traffic lights hack, pacemaker attack, autonomous vehicle hijack, water poison — digital command = physical disaster.
Smart cities, connected infrastructure, Industry 4.0 — jitna zyada connectivity, utna zyada attack surface. OT (Operational Technology) security critical ho gayi hai.
Florida Water Treatment (2021): Hacker ne Oldsmar city ke water treatment plant ka SCADA system access kiya aur sodium hydroxide 111x badha diya — drinking water poison attempt. Operator ne catch kiya, disaster averted.
Cloud provider ke resources (S3, EC2, databases) tak access control. Roles, policies, permissions — kaunsa service kaunsa resource access kar sakta hai. Misconfigured Cloud IAM = most common cloud breach cause.
Least privilege — root account daily use mat karo. MFA on root. Roles use karo instead of long-lived access keys. Regular access review. CloudTrail logging enable karo.
Sensitive, confidential ya protected information unauthorized parties ke hands mein jaana. Intentional (hack) ya accidental (misconfigured database). Average cost: $4.45 million (IBM 2023).
GDPR notification 72 hours mein required. Stock price drop (avg 7.5%). Customer trust loss. Class action lawsuits. Regulatory fines. Executives fired. haveibeenpwned.com track karta hai breaches.
Aadhaar (2018): Report aaya ki 1.1 billion Indians ka Aadhaar data accessible tha for ₹500 via WhatsApp. UIDAI ne deny kiya, par investigation ne serious vulnerabilities found. Government data breach consequences are population-scale.
Most widely used. 5 functions:
1. Identify: Assets, risks samjho
2. Protect: Safeguards implement karo
3. Detect: Incidents identify karo
4. Respond: Action lo
5. Recover: Restore karo
ISO 27001: International standard
MITRE ATT&CK: Adversary tactics matrix — actual attack techniques documented
CIS Controls: Top 18 security actions
OWASP Top 10: Web vulnerabilities
Building code for architecture. Alag-alag engineers alag-alag sochein to inconsistency. Framework ek common language aur standard approach deta hai — security "building code."