Defensive Tools & Technologies
Yeh weapons tumhari taraf hain — organizations inhe use karti hain apna bachav karne ke liye
Network traffic monitor karta hai aur predefined rules ke basis pe allow ya block karta hai. Ek border guard ki tarah — passport check karo, phir andar jaane do.
Packet Filtering: IP/port check
Stateful: Connection state track
NGFW: Deep packet inspection, app-aware
WAF: Web apps ke liye specifically
Building ka security guard. Rules hai — employees andar, strangers stop. Firewall bhi aisa — trusted IP allow, unknown ports block. But smart attacker allowed port use karta hai (bypass).
Signature-based: Known malware ke "fingerprints" se match
Heuristic: Suspicious behavior detect karo (new malware ke liye)
Sandboxing: Isolated environment mein run karke dekho
Signature-based antivirus sirf known threats detect karta hai. Zero-day, fileless malware, polymorphic malware (jo apna code change karta hai) se bachna mushkil. Modern AV + behavior analysis zaroori hai.
Network/system traffic monitor karta hai suspicious activity ke liye. Kuch galat dikhta hai to alert bhejta hai security team ko. But khud kuch nahi karta — sirf bolta hai "kuch ho raha hai!"
NIDS: Network-based (poora network traffic dekhe)
HIDS: Host-based (ek specific machine dekhe)
Signature-based: Known attack patterns
Anomaly-based: Normal se deviation detect kare
Smoke detector. Aag lagti hai, alarm bajta hai. But khud aag nahi bujhaata — tumhe call karna padega fire brigade (human response). IDS detect karta hai, IPS block bhi karta hai.
IDS = passive (sirf alert), IPS = active (alert + automatically block karta hai). IPS network path mein inline hota hai — traffic isse hoke jaata hai, woh inspect karta hai, aur block kar sakta hai real-time mein.
False positives ka risk — legitimate traffic bhi block ho sakta hai. Production systems mein carefully configure karna padta hai nahi to business impact hota hai.
Poore organization ke saare security tools se logs collect karta hai ek jagah, correlate karta hai, patterns dhundta hai, aur threats identify karta hai. SOC team ka main tool.
Splunk, IBM QRadar, Microsoft Sentinel, LogRhythm. Large enterprises mein terabytes of daily logs ek dashboard pe analyze hote hain.
CCTV control room of a mall — hazaron cameras ek jagah. Guard sab dekh sakta hai ek monitor pe. Alag-alag cameras dekhen to pattern miss ho jaaye, SIEM central view deta hai.
Normal firewall packets block karta hai, WAF HTTP traffic ko analyze karta hai specifically. SQL injection, XSS, CSRF detect aur block karta hai web layer pe.
Web server aur internet ke beech. Cloudflare, AWS WAF, Imperva popular solutions hain. Har incoming web request ko scan karta hai malicious patterns ke liye.
Har individual device (endpoint) ko secure karna — laptops, phones, tablets, servers. Sirf antivirus nahi — EDR (Endpoint Detection & Response) tools real-time behavior monitor karte hain.
EDR tools (CrowdStrike, SentinelOne) behavior analytics, threat hunting, automated response sab karte hain. Zero-day bhi detect ho sakta hai anomalous behavior se.
Monitor aur control karta hai ki sensitive data (credit cards, SSN, confidential docs) organization se bahar na jaaye — email, USB, cloud uploads ke through.
Content inspection — emails scan karta hai "confidential" patterns ke liye. Block kar deta hai ya alert deta hai. Insider threats ke against especially useful.
Isolated virtual environment jahan suspicious files ya programs run kiye jaate hain safely. Agar malware hai to real system affect nahi hoga — sandbox ke andar hi confined.
Email attachments, unknown executables, browser extensions — pehle sandbox mein run karo, behavior dekho, phir decide karo. Automated malware analysis ke liye use hota hai.
Chemical lab mein hazardous material ke liye glove box. Bahar effects nahi pahunch sakte, andar jaake experiment kar sakte ho safely.
Deliberately vulnerable fake system jo attackers ko lure karta hai. Jab attacker ise target karta hai, security team unke tactics, techniques, tools study kar sakti hai real-time mein.
Early warning system. Attacker iska real system samajh ke attack karta hai, par actually decoy hai. Unke methods log hote hain — future defenses improve hote hain.
Police ka undercover operation ya bait car. Woh deliberately exposed car chodh ke thieves attract karte hain, phir catch karte hain ya unhe study karte hain patterns ke liye.