Network & Cloud Security
Data travel karta hai — usse protect karna aur cloud era ki challenges
Tumhare device aur VPN server ke beech encrypted tunnel. ISP, network admin, hackers — koi nahi dekh sakta tum kya browse kar rahe ho. Tumhara IP bhi VPN server ka IP dikhta hai.
Privacy (ISP se hide), regional content access, public WiFi pe safety, company network remote access. Free VPNs se beware — they sell your data.
Glass tunnel ke through jaana vs opaque armored tube. Normal internet = glass — sab dekh sakte hain. VPN = opaque tube — bahar se kuch nazar nahi.
Ek bada network ko smaller segments mein divide karna (VLANs, subnets). Finance network se developer network alag. Ek zone compromise ho to doosre safe rahein.
Lateral movement prevent karta hai. Attacker ek machine compromise kare par poore network mein freely nahi ghoom sakta. Colonial Pipeline worm bhi segmentation se rok sakte the.
DNS server ki cache mein fake records inject karna. "google.com = 1.2.3.4" — yeh galat IP hai par DNS ye record return karta hai. User google.com type kare, attacker site pe jaaye.
Phone book of internet. "google.com" → "142.250.195.46" translate karta hai. DNS poisoning is phonebook mein galat entries daalna.
Tumhare ghar ke saare devices ek public IP share karte hain (router ka). Router andar private IPs maintain karta hai. Internet se direct access nahi hota internal devices ko — security benefit.
Phone: 192.168.1.5, Laptop: 192.168.1.6 — private IPs. Router: 103.45.67.89 — public IP. Internet pe sirf router ka IP dikhta hai.
Traditional networks mein hardware configure karo manually. SDN mein software se network control hota hai centrally. Security policies dynamically apply ho sakti hain, faster response to threats.
Threat detect hote hi, SDN controller automatically affected segment isolate kar sakta hai. Micro-segmentation easily implement. Cloud networks aise hi work karte hain.
Employees cloud apps (Google Drive, Dropbox, Salesforce) use karte hain. CASB monitor karta hai kya data cloud pe ja raha hai, unauthorized apps ka use ("shadow IT") detect karta hai.
Employee ne confidential doc Dropbox personal pe upload kiya. CASB detect karta hai — alert ya block. DLP + cloud = CASB.
Smart devices jo internet se connected hain — smart bulbs, cameras, fridges, thermostats, wearables, industrial sensors, medical devices. Billions of devices globally.
2030 tak 75 billion+ IoT devices expected. Har device ek potential entry point. Most IoT devices have terrible security — no updates, weak passwords, old firmware.
Limited processing power (can't run complex security), no screen/keyboard for setup, vendors update nahi karte, users default passwords change nahi karte, long lifecycle (10-20 years).
Default passwords change karo, separate network/VLAN pe rakho IoT devices, firmware update karo, unnecessary features disable karo, network monitoring rakho.
Hospital hack via Fish Tank (2017): Casino ka smart fish tank thermometer hack hua. Attackers ne isse network access liya aur casino's high-roller database exfiltrate ki — 10GB data.
Policies, tools, aur practices jo network infrastructure protect karte hain — unauthorized access, misuse, modification, denial prevent karna. Firewall, IDS/IPS, VPN, segmentation sab iske components.
Defense in depth — ek layer breach ho to doosri catch kare. Firewall → IDS → WAF → Endpoint → SIEM — layered approach best practice hai.
Nation-State: Government-backed (Russia APT28, China APT40)
Cybercriminals: Financial motivation
Hacktivists: Political (Anonymous)
Insider Threat: Employees
Script Kiddies: Amateurs
Threat actor type se pata chalta hai motivation kya hai, resources kitne hain, aur defenses kaise adjust karein. Nation-state actors ka zero-day budget ≠script kiddie ka free tools.