Governance & Compliance
Rules, regulations, aur processes — security ko systematic banana
Risk = Threat × Vulnerability × Impact. Identify karo kya risks hain, kitni probability hai, agar hua to kitna damage — phir decide karo accept karo, mitigate karo, transfer karo (insurance) ya avoid karo.
Risk Assessment → Treatment → Monitoring → Repeat. Business decision — har risk ko eliminate karna practically/financially impossible. Acceptable risk level define karo.
GDPR: EU data privacy (fines up to 4% revenue)
PCI-DSS: Credit card data
HIPAA: US healthcare data
ISO 27001: Information security management
SOC 2: Cloud services
Critical distinction! Compliant system can still be insecure. Compliance is minimum bar. Real security goes beyond checkboxes. Many breached companies were "compliant."
Ransomware payment, data breach notification costs, legal fees, business interruption, regulatory fines, PR/crisis management. Premium increasingly expensive — ransomware surge se.
Insurers ab MFA, EDR, backups mandatory require karte hain policy ke liye. Poor security = no insurance ya very high premium.
Vulnerability: Weakness (unpatched software, misconfiguration)
Threat: Potential for harm (attacker wanting to exploit)
Exploit: Actual code/method to use the vulnerability
CVE: Common Vulnerabilities & Exposures — public database
0-10 severity rating. 9.0+ = Critical. CVE-2021-44228 (Log4Shell) = 10/10 — literally maximum severity. Patching priority = CVSS score.
Company authorize karta hai security professionals ko attack karne ke liye — vulnerabilities find karo before real attackers do. Ethical hackers = white hat hackers.
Black Box: No prior info (realistic)
White Box: Full access/info given
Grey Box: Partial info
Red Team: Extended adversary simulation
Bank apne security expert ko bolti hai "try to rob us" — legally. Expert koshish karta hai, gaps dhundhta hai, report karta hai. Fix hote hain before real robber try kare.
Prevention = attack hone mat do. Resilience = attack hone ke baad bhi business continue karo, jaldi recover karo. Modern philosophy: "assume breach" — it WILL happen, be ready.
Incident Response plan, backups, disaster recovery, business continuity plan, crisis communication, lessons learned. RTO (Recovery Time Objective) aur RPO define karo.
Threat actors, their tactics, techniques, procedures (TTPs), indicators of compromise (IoCs) ke baare mein collected aur analyzed information. Proactive defense ke liye use hota hai.
Strategic (board level — risk decisions), Operational (security team — active campaigns), Tactical (analysts — specific TTPs), Technical (SOC — IPs, hashes, domains).
Financial fraud, identity theft, ransomware, hacking, child exploitation, intellectual property theft, dark web drug markets, cyber stalking. $8 trillion+ global annual cost (2023).
IT Act 2000 (amended 2008) covers cyber crimes in India. Cyber cells in major cities. Incidents report karo: cybercrime.gov.in. Section 66 = unauthorized access, Section 67 = obscene content.
Digital platforms pe harassment, threatening, humiliation. Social media, gaming, messaging apps. Doxxing (private info public karna), revenge porn, trolling, fake profiles.
Serious mental health consequences. India mein IT Act aur state laws cover this. Screenshots rakho evidence ke liye, platform report karo, cyber cell complaint karo.
Incident ke baad digital evidence collect, preserve, analyze, aur present karna — court mein use hone ke liye. Disk images, memory dumps, network logs, deleted file recovery.
Evidence integrity — original tamper nahi hona chahiye. Write blockers use karo, hashes verify karo, chain of custody maintain karo. Tampered evidence court mein inadmissible.