Operations & Response
Day-to-day security operations — jab attack hota hai, kya karte hain
1. Preparation: Plan banaao pehle
2. Detection & Analysis: Incident identify karo
3. Containment: Spread rokko
4. Eradication: Root cause remove karo
5. Recovery: Normal operations restore
6. Lessons Learned: Post-mortem
IR Team = CSIRT (Computer Security Incident Response Team). SOC analysts detect karte hain, IR team respond karta hai, executives communicate karte hain. Playbooks pre-defined hote hain.
Dedicated team aur facility jo 24/7/365 organization ki security monitor karti hai. SIEM se alerts aate hain, analysts investigate karte hain, incidents respond karte hain. Tier 1-2-3 analysts.
SOC Analyst — cybersecurity mein most common entry point. Tier 1: alert triage. Tier 2: investigation. Tier 3: threat hunting, advanced analysis. Well paid career path.
Regular security practices jo risk significantly reduce karte hain — just like physical hygiene. 80% of attacks patching aur basic hygiene se prevent ho sakte the.
✅ Strong unique passwords + manager
✅ MFA everywhere
✅ Software updates promptly
✅ Regular backups
✅ Phishing awareness
✅ Least privilege
✅ Encrypt sensitive data
Documentation jo track karta hai evidence kahan hai, kisne handle kiya, kab, aur kaise. Criminal cases mein agar chain break ho to evidence inadmissible ho sakta hai court mein.
Disk image lena → hash verify → sealed storage → transport log → analysis. Har step documented. Original kabhi touch nahi — sirf forensic copy pe kaam karo.
Organization ke saare devices (laptops, phones, tablets) ek platform se manage karna — policies enforce karo, software deploy karo, remote wipe karo agar device lost ho.
BYOD (Bring Your Own Device) era mein employees apne phones pe corporate email use karte hain. UEM security policies enforce karta hai without fully controlling personal devices.
3 copies of data
2 different storage media types
1 offsite/offline copy
Offline backup = ransomware encrypt nahi kar sakta. Cloud backup alag account mein — not same credentials.
Backup hai par restore nahi kiya kabhi? Useless. Regular restore tests mandatory. Many organizations discover backup broken hai tab jab actual disaster ho.
Encryption keys ka lifecycle manage karna — generation, distribution, storage, rotation, destruction. Keys data ke saath same jagah store nahi karni (sabse common mistake).
Hardware Security Module — dedicated hardware jo keys physically protect karta hai. Banks, governments use karte hain. Keys kabhi HSM se bahar nahi jaate.
AWS/Azure/GCP → cloud infrastructure secure karte hain. Customer → data, access, application, configuration secure karna customer ki responsibility. Misconfigured S3 bucket = customer ka fault.
Public S3 buckets, weak IAM roles, no encryption at rest, default security groups allowing all traffic, exposed credentials in code repositories (GitHub).
Capital One (2019): Misconfigured AWS WAF se 100 million credit applications exposed. $190M settlement. Ex-Amazon employee ne exploit kiya. Misconfiguration, not AWS's fault.
SPF: Authorized mail servers list
DKIM: Email digital signature
DMARC: Policy for SPF/DKIM failures
Secure Email Gateway: Spam/malware filter
Sandboxing: Attachments isolate karo
91% of cyberattacks start from phishing email. Email sabse exploited vector hai. SPF+DKIM+DMARC configure karo apne domain pe — email spoofing prevent karta hai.
Best firewall bhi useless hai agar attacker physically server room mein ghus jaaye. Lock pick, RFID clone, tailgating — physical attacks real hain. Server rooms biometric access chahiye.
Keycards, biometrics, CCTV, guards, mantrap (double door airlock), cable locks on laptops, screen locks, clean desk policy, no USB drives policy, visitor logs.