Cyber security is the body of technologies, processes, and practices designed to Active attacks are unauthorized actions that

ons that alter the system or data. In an active

protect networks, computers, programs and digital data from attack, damage or attack, the attacker will directly interfere with the target to damage or gain
unauthorized access. unauthorized access to computer systems and networks. This is done by injecting
The CIA Triad is actually a security model that has been developed to help people hostile code into communications, masquerading as another user, or altering data to
think about various parts of IT security. Confidentiality: Confidentiality is about get unauthorized access. This may include the injection of hostile code into
preventing the disclosure of data to unauthorized parties. It also means trying to communications, alteration of data, and masquerading as another person to get
keep the identity of authorized parties involved in sharing and holding data private unauthorized access. Types are: Masquerade Attack, Modification of Messages,
and anonymous. Often confidentiality is compromised by cracking poorly encrypted Repudiation, Replay Attack, Denial of Service (DoS) Attack. In Masquerade attacks, the
data, Man-in-the-middle (MITM) attacks, disclosing sensitive data. Standard attacker disguises himself to pose as some other person and accesses systems or data.
measures to establish confidentiality include: • Data encryption • Two-factor It could either be impersonating a legal user or system and demanding other users or
authentication • Biometric verification • Security tokens. Integrity: Integrity refers systems to provide information with sensitive content or access areas that are not
to protecting information from being modified by unauthorized parties. Standard supposed to be accessed normally. This may even include behaving like an actual user
measures: • Cryptographic checksums • Using file permissions • Uninterrupted or even some component of the system with the intention of manipulating people to
power supplies • Data backups. Availability: Availability is making sure that give out their private information or allowing them into secured locations.Modification
authorized parties are able to access the information when needed. Standard
measure: • Backing up data to external drives • Implementing firewalls • Having of Messages: This is when someone changes parts of a message without permission, or
backup power supplies • Data redundancy mixes up the order of messages, to cause trouble. Imagine someone secretly changing
a letter you sent, making it say something different. This kind of attack breaks the trust
Denial of Service: It is an attack which meant to make a server or network in the information being sent. Repudiation attacks: some person does something
resource unavailable to the users. It accomplishes this by flooding the target damaging online, such as a financial transaction or sends a message one does not want
to send, then denies having done it. Such attacks can seriously hinder the ability to trace
with traffic or sending it information that triggers a crash. It uses the single down the origin of the attack or to identify who is responsible for a given action, making
system and single internet connection to attack a server. It can be classified it tricky to hold responsible the right person. Session replay: In this type of attack, a
into the following: Volume-based attacks- Its goal is to saturate the bandwidth hacker steals an authorized user’s log in information by stealing the session ID. The
of the attacked site, and is measured in bit per second. Protocol attacks- It intruder gains access and the ability to do anything the authorized user can do on site.
consumes actual server resources, and is measured in a packet. Application
layer attacks- Its goal is to crash the web server and is measured in request per …..Cyberstalking messages differ from ordinary spam in that a cyberstalker targets a
second. Prevention: 1. Using firewalls and intrusion detection systems to specific victim with often threatening messages, while the spammer targets a
monitor network traffic and block suspicious activity.2. Limiting the number of multitude of recipients with simply annoying messages. Cyber stalking works in many
requests or connections that can be made to a system or network.3. Using load ways: ●Multiple stalker utilize the services provided on the internet. ●Through
balancers and distributed systems to distribute traffic across multiple servers Datafurnishing companies that provide information on a person’s capability to function
or networks.4. Implementing network segmentation and access controls to in a society. ●other methods include: Spyware software, Phising, Juice Jacking, Wi-Fi
limit the impact of a DoS attack. DNS Spoofing is a type of computer security interface (Jacking), Caller ID Spoofing. Vulnerabilities are weaknesses in a system that
hacking. Whereby a data is introduced into a DNS resolver's cache causing the gives threats the opportunity to compromise assets. All systems have vulnerabilities.
name server to return an incorrect IP address, diverting traffic to the attackers Even though the technologies are improving but the number of vulnerabilities are
computer or any other computer. The DNS spoofing attacks can go on for a increasing such as tens of millions of lines of code, many developers, human
long period of time without being detected and can cause serious security weaknesses, etc. Vulnerabilities mostly happened because of Hardware, Software,
issues. Session Hijacking It is a security attack on a user session over a Network and Procedural vulnerabilities.1. Hardware Vulnerability: A hardware
protected network. Web applications create cookies to store the state and user vulnerability is a weakness which can used to attack the system hardware through
sessions. By stealing the cookies, an attacker can have access to all of the user physically or remotely. Eg: Old version of systems or devices, Unprotected storage,
data. Phishing is a type of attack which attempts to steal sensitive information Unencrypted devices, etc. 2. Software Vulnerability: A software error happen in
like user login credentials and credit card number. It occurs when an attacker development or configuration such as the execution of it can violate the security policy.
is masquerading as a trustworthy entity in electronic communication. Eg: Lack of input validation, Unverified uploads, Cross-site scripting, Unencrypted data,
etc. 3. Network Vulnerability: A weakness happen in network which can be hardware
or software. Eg: Unprotected communication, Malware or malicious software (eg:
….After acquiring admin privileges, the hackers can install malware, remote Viruses, Keyloggers, Worms, etc), Social engineering attacks, Misconfigured firewalls.
access, compromise devices and steal confidential data. Small and middle- 4. Procedural Vulnerability: A weakness happen in an organization operational
sized business are usually attacked by backdoor attack as they have fewer methods. Eg: Password procedure – Password should follow the standard password
resources (budgets and security experts) to close off entry points and policy, Training procedure – Employees must know which actions should be taken and
identify successful attacks. Hence, usually they remain unaware of backdoor what to do to handle the security. Employees must never be asked for user credentials
stacks. online. Make the employees know social engineering and phishing threats.
A virus is a program that attempts to damage a computer system and replicate
itself to other computer systems. A virus: ● Requires a host to replicate and
usually attaches itself to a host file or a hard drive sector. ● Replicates each Cyber warfare refers to the use of digital attacks -- like computer viruses and hacking -
time the host is used, increasing its spread and impact. ● Often focuses on - by one country to disrupt the vital computer systems of another, with the aim of
destruction or corruption of data. ● Usually attaches to files with execution creating damage, death and destruction. Future wars will see hackers using computer
capabilities such as .doc, .exe, and .bat extensions. ● Often distributes via e- code to attack an enemy's infrastructure, fighting alongside troops using conventional
mail. Many viruses can e-mail themselves to everyone in your address book. weapons like guns and missiles. Cyber warfare involves the actions by a nation-state
● Examples: Stoned, Michelangelo, Melissa, I Love You. or international organization to attack and attempt to damage another nation's
A Trojan horse is a malicious program that is disguised as legitimate software. computers or information networks through, for example, computer viruses or denial-
Discretionary environments are often more vulnerable and susceptible to of-service attacks. Cybercrime is criminal activity that either targets or uses a
Trojan horse attacks because security is user focused and user directed. Thus
the compromise of a user account could lead to the compromise of the entire computer, a computer network or a networked device. Cybercrime is committed by
environment. A Trojan horse: ● Cannot replicate itself. ● Often contains cybercriminals or hackers who want to make money. Cybercrime is carried out by
spying functions (such as a packet sniffer) or backdoor functions that allow a individuals or organizations. Some cybercriminals are organized, use advanced
computer to be remotely controlled from the network. ● Often is hidden in techniques and are highly technically skilled. Others are novice hackers. Cyber
useful software such as screen savers or games. ● Example: Back Orifice, Net terrorism is the convergence of cyberspace and terrorism. It refers to unlawful attacks
Bus, Whack-a-Mole. and threats of attacks against computers, networks and the information stored
therein when done to intimidate or coerce a government or its people in furtherance
of political or social objectives. Examples are hacking into computer systems,
Social engineering is a strategy through which people can mislead others into introducing viruses to vulnerable networks, web site defacing, Denial-of-service
delivering private data or accessing protected resources. Moreover, it attacks, or terroristic threats made via electronic communication.
attempts to influence one's behaviour to a point where one undertakes
actions beyond their normal range. Reasoner has been developed which has Adware tracks your browsing habits and causes particular advertisements to pop up.
used psychological pressure rather than technical methods. Social engineers Although this is common and often something one may even agree to, adware is
are competent in sparking emotions, managing trust, showing authority, or sometimes imposed upon one, without ones consent.
tapping into some curiosity that the individual will provide unauthorized Spyware is an intrusion that may steal sensitive data such as passwords and credit
information or do whatever serves the attacker. This can be done through card numbers from your internal systems.
different techniques, for example, phishing email creation, fake scenarios to
gain a relationship (pretexting), baiting, interviews, and social media Privilege escalation is a common way for attackers to gain unauthorized access to
impersonation. Types: ●Phishing ● Baiting: Baiting is a type of social systems within a security perimeter. Attackers start by finding weak points in an
engineering attack that involves leaving a tempting item, such as a USB drive, organization's defenses and gaining access to a system. In many cases that first point of
in a public place in the hope that someone will pick it up and plug it into their penetration will not grant attackers with the level of access or data they need. They will
computer. The USB drive is then used to infect the computer with malware. then attempt privilege escalation to gain more permissions or obtain access to additional,
● Tailgating: Tailgating is a type of social engineering attack that involves more sensitive systems. In some cases, attackers attempting privilege escalation find the
following an authorized individual into a secure area, such as a building or "doors are wide open" - inadequate security controls, or failure to follow the principle of
data center, without proper authorization. ● Pretexting: Pretexting is a type least privilege, with users having more privileges than they actually need. In other cases,
of social engineering attack that involves creating a false identity or situation attackers exploit software vulnerabilities, or use specific techniques to overcome an
in order to trick an individual into revealing sensitive information. For operating system's permissions mechanism. There are two types of privilege escalation:
example, an attacker might pretend to be a customer service representative Horizontal privilege escalation-an attacker expands their privileges by taking over another
in order to trick an individual into giving them their login credentials. ● account and misusing the legitimate privileges granted to the other user. To learn more
Vishing: Vishing is a type of social engineering attack that involves using voice about horizontal privilege escalation see our guide on lateral movement. Vertical
phishing, or “vishing,” to trick individuals into revealing sensitive information privilege escalation-an attacker attempts to gain more permissions or access with an
over the phone. ● Smishing: Smishing is a type of social engineering attack existing account they have compromised. For example, an attacker takes over a regular
that involves using SMS messages to trick individuals into revealing sensitive user account on a network and attempts to gain administrative permissions. This requires
information or downloading malware. Prevention: Timely monitor online more sophistication and may take the shape of an Advanced Persistent Threat.
accounts whether they are social media accounts or bank accounts, to ensure A firewall is a network security device, either hardware or software-based, which
that no unauthorized transactions have been made. ● Check for Email monitors all incoming and outgoing traffic and based on a defined set of security rules
headers in case of any suspecting mail to check its legitimate source. .● Avoid accepts, rejects, or drops that specific traffic. Accept: allow the traffic, Reject: block the
clicking on links, unknown files, or opening email attachments from unknown traffic but reply with an “unreachable error”, Drop: block the traffic with no reply.
senders. ● Beware of links to online forms that require personal information, Firewall filters incoming and outgoing network traffic with security policies that have
even if the email appears to come from a source. Phishing websites are the previously been set up inside an organization. Firewall maintains a distinct set of rules for
same as legitimate websites in looks. ● Adopt proper security mechanisms both the cases. Mostly the outgoing traffic, originated from the server itself, allowed to
such as spam filters, anti-virus software, and a firewall, and keep all systems pass. Still, setting a rule on outgoing traffic is always better in order to achieve more
updated, with anti-keyloggers. security and prevent unwanted communication. Incoming traffic is treated differently.
Ethical Hacking is also called as penetration Testing. It is an act of penetrating Most traffic which reaches on the firewall is one of these three major Transport Layer
networks or systems to find out threats and vulnerabilities in that system protocols- TCP, UDP or ICMP. All these types have a source address and destination
which the attacker would have exploited and caused the loss of data, financial address. Also, TCP and UDP have port numbers. ICMP uses type code instead of port
loss or other major damages to a business. The purpose of Ethical hacking is number which identifies purpose of that packet.
to build the security of the system or network by settling the vulnerabilities Attack vectors are the specific paths or methods that cyber attackers use to gain
which are detected while testing. Ethical hackers may use the same unauthorized access to a system, network, or application. These vectors serve as entry
techniques and mechanisms used by malicious hackers but with the points for attacks, allowing malicious actors to exploit vulnerabilities. Every ethical hacker
permission of the authorized person, the Ethical hackers help to develop the has their unique attack vector to check the security of the target application, this
security and defend the systems from attacks. application may be a web application or an android application. They take advantage of
weaknesses or flaws in the system to steal information, cause damage, or gain control.
A Passive attack attempts to learn or make use of information from the system but Cyberspace (coined by William Gibson) can be defined as an intricate
does not affect system resources. Passive Attacks are in the nature of eavesdropping environment that involves interactions between people, software, and
on or monitoring transmission. The goal of the opponent is to obtain information that services. It is maintained by the worldwide distribution of information and
is being transmitted. Passive attacks involve an attacker passively monitoring or communication technology devices and networks. With the benefits carried by
collecting data without altering or destroying it. Examples of passive attacks the technological advancements, the cyberspace today has become a common
include eavesdropping, where an attacker listens in on network traffic to collect pool used by citizens, businesses, critical information infrastructure, military
sensitive information, and sniffing, where an attacker captures and analyzes data and governments in a fashion that makes it hard to induce clear boundaries
packets to steal sensitive information. Types are: Software Attacks, The Release of among these different groups. The cyberspace is anticipated to become even
Message Content, Traffic Analysis, eavesdropping. more complex in the upcoming years, with the increase in networks and
Eavesdropping (tapping): the attacker simply listens to messages exchanged by two devices connected to it. Asset: An asset is any data, device or other component
entities. For the attack to be useful, the traffic must not be encrypted. Any of an organization’s systems that is valuable, often because it contains
sensitive data or can be used to access such information. A threat is any
unencrypted information, such as a password sent in response to an HTTP request, incident that could negatively affect an asset – for example, if it’s lost, knocked
may be retrieved by the attacker. Traffic analysis: the attacker looks at the metadata offline or accessed by an unauthorized party. Threats can be categorized as
transmitted in traffic in order to deduce information relating to the exchange and the circumstances that compromise the confidentiality, integrity or availability of
participating entities, e.g. the form of the exchanged traffic (rate, duration, etc.). In the an asset, and can either be intentional or accidental.
cases where encrypted data are used, traffic analysis can also lead to attacks by 0
cryptanalysis, whereby the attacker may obtain information or succeed in Brute force It is a type of attack which uses a trial and error method. This attack
unencrypting the traffic. Software Attacks: Malicious code (sometimes called generates a large number of guesses and validates them to obtain actual data
malware) is a type of software designed to take over or damage a computer user's like user password and personal identification number. This attack may be
operating system, without the user's knowledge or approval. It can be very difficult to used by criminals to crack encrypted data, or by security, analysts to test an
remove and very damaging. organization's network security. Dictionary attacks This type of attack stored
the list of a commonly used password and validated them to get original
password. URL Interpretation It is a type of attack where we can change the
Sniffing is the process of monitoring and capturing all the packets passing through a certain parts of a URL, and one can make a web server to deliver web pages for
given network using sniffing tools. It is a form of "tapping phone wires" and get to know which he is not authorized to browse. Man in the middle attacks It is a type of
about the conversation. It is also called wiretapping applied to the computer networks. attack that allows an attacker to intercepts the connection between client and
There is so much possibility that if a set of enterprise switch ports is open, then one of server and acts as a bridge between them. Due to this, an attacker will be able
their employees can sniff the whole traffic of the network. Anyone in the same physical to read, insert and modify the data in the intercepted connection.
location can plug into the network using Ethernet cable or connect wirelessly and sniff SQL Injection is a security flaw in web applications where attackers insert
the total traffic. Sniffing allows you to see all sorts of traffic, both protected and non- harmful SQL code through user inputs. This can allow them to access sensitive
protected. In the right conditions and with right protocols in place, an attacker can data, change database contents or even take control of the system. i.
gather information that can be used for further attacks or to cause other issues for the SQL Injection is a web page vulnerability that lets an attacker make queries
network or system owner. Following can be sniffed: Email traffic, FTP passwords, web with the database. ii. Attackers take advantage of web application vulnerability
traffics, telnet passwords, router configuration, chat sessions, DNS traffic. Process: A and inject an SQL command via the input from users to the application. iii.
sniffer normally turns the NIC of the system to the promiscuous mode so that it listens Attackers can SQL queries like SELECT to retrieve confidential information
to all the data transmitted on its segment. Promiscuous mode refers to the unique way which otherwise wouldn’t be visible. iv. SQL injection also lets the attacker to
of Ethernet hardware, in particular, network interface cards (NICs), that allows an NIC perform a denial-of-service (DoS) attacks by overloading the server requests.
to receive all traffic on the network, even if it is not addressed to this NIC. By default, a Impact of SQL Injection: 1.The hacker can retrieve all the user data present in
NIC ignores all traffic that is not addressed to it, which is done by comparing the the database such as user details, credit card information, and social security
destination address of the Ethernet packet with the hardware address (a.k.a. MAC) of numbers, and can also gain access to protected areas like the administrator
the device. While this makes perfect sense for networking, non-promiscuous mode portal. 2.It is also possible to delete user data from the tables.
makes it difficult to use network monitoring and analysis software for diagnosing
connectivity issues or traffic accounting. A worm is a self-replicating program that can be designed to do any number
Cyberstalking is a crime in which the attacker harasses a victim using electronic of things, such as delete files, steal sensitive information, or send documents
communication, such as e-mail or instant messaging (IM), or messages posted to a Web via e-mail without user consent. Unlike a virus, a worm does not require a host
site or a discussion group. A cyberstalker relies upon the anonymity afforded by the file to spread; it can propagate independently across networks and devices. A
Internet to allow them to stalk their victim without being detected. (PTO…) worm can negatively impact network traffic due to the sheer volume of
replication activities it performs, which can lead to congestion or denial of
service. A worm: ● Can install a backdoor in the infected computer, enabling
Malware is intrusive software that is designed to damage and destroy computers and remote access for unauthorized users to control the system or deploy
computer systems. Malware is a contraction for “malicious software”. Eg includes additional malicious software. ● Is usually introduced into the system through
viruses, worms, trojan viruses, spyware, adware and ransomware. Malware is a file or a vulnerability, such as unpatched software, weak passwords, or insecure
code, typically delivered over a network that infects, explores, steals or conducts network configurations. ● Infects one system and spreads rapidly to other
virtually any behaviour an attacker wants. Though varied in types and capabilities, systems on the network by exploiting shared resources or security
malware usually has one the following objectives: i.Provide remote control for an
attacker to use an infected machine. ii.Send spam from the infected machine to .weaknesses. ● Can potentially modify system files, disable security features,
or cause widespread disruption across networks. ● Example: Code Red, which
unsuspecting targets. iii.Investigate the infected user's local network. iv.Steal sensitive targeted Microsoft IIS servers, exploited vulnerabilities, defaced web pages,
data. Malware Removal: Antivirus software can remove most standard infection types and initiated denial-of-service attacks.
and many options exist for off-the-shelf solutions. Cortex XDR enables remediation on Backdoor attacks allow a cyber attacker to compromise a computer system
the endpoint following an alert or investigation giving administrators the option to begin while using administrative access without even being noticed by any security
a variety of mitigation steps starting with isolating endpoints by disabling all network software. It is a malware that is spread into the system through unsecured
access on compromised endpoints except for traffic to the Cortex XDR console, points of entry, such as outdated plug-ins or input fields. Normally, they
terminating processes to stop any running malware from continuing to perform fabricate worms or viruses to exploit an existing backdoor-for instance, from
malicious activity on the endpoint, and blocking additional executions, before previous attacks or those that the developers have created for testing. (PTO)
quarantining malicious files and removing them from their working directories if the
Cortex XDR agent has not already done so.
Malware Protection: To protect your organization against malware, you need a holistic, Threat modelling is a method of optimizing network security by locating
enterprise-wide malware protection strategy. Commodity threats are exploits that are vulnerabilities, identifying objectives, and developing countermeasures to
less sophisticated and more easily detected and prevented using a combination of either prevent or mitigate the effects of cyber-attacks against the system.
antivirus, anti-spyware, and vulnerability protection features along with URL filtering While security teams can conduct threat modelling at any point during
and Application identification capabilities on the firewall. development, doing it at the start of the project is best practice. This way,
threats can be identified sooner and dealt with before they become an
issue. Eg: STRIDE, DREAD, P.A.S.T.A, Trike, VAST, Attack tree.
Enterprise Information Security Architecture (EISA) is a key component of an
information security program. The primary function of EISA is to document
A buffer overflow occurs when more data are written to a buffer than it can hold. The and communicate the artefacts of the security program in a consistent
excess data is written to the adjacent memory, overwriting the contents of that location manner. As such, the primary deliverable of EISA is a set of documents
and causing unpredictable results in a program. Buffer overflows happen when there is connecting business drivers with technical implementation guidance. These
improper validation (no bounds prior to the data being written). It is considered a bug or documents are developed iteratively through multiple levels of abstraction.
weakness in the software. It is an is an exploit that takes advantage of a program that is Information security should define three dimensions, or viewpoints, into the
waiting on a user’s input. There are two main types of buffer overflow attacks: stack based architecture framework: 1.Business Viewpoint: Aligns information security
and heap based. Heap-based attacks flood the memory space reserved for a program but with business objectives, ensuring security measures support business goals,
the difficulty involved with performing such an attack makes them rare. In stack based risk management, and compliance. 2.Technology Viewpoint: Translates
business requirements into technical solutions, defining the tools, platforms,
attacks, the program being exploited uses a memory object called stack to store user and systems needed for security implementation.3. Process Viewpoint:
input. Normally, the stack is empty until the program requires user input. At that point, Focuses on operational aspects, including policies, standards, and procedures
the program writes a return memory address to the stack and then the user’s input is for maintaining security, monitoring, and incident response.
placed on top of it. When the stack is processed, the user’s input gets sent to the return An Insider Threat is a malicious activity against an organization that comes
address specified by the program. Prevention: A buffer overflow attack requires two from users with legitimate access to an organization's network, applications
things. First, a buffer overflow must occur in the program. Second, the after (must be able or databases. These users can be current employees, former employees, or
to use the buffer overflow to overwrite a Security sensitive piece of data (a security flag, third parties like partners, contractors, or temporary workers with access to
function pointer, return address, etc). So we must: 1. Prevent all buffer overflows or 2. the organization's physical or digital assets. While the term is most commonly
Prevent all sensitive information from being overwritten. Both these solutions are costly used to describe illicit or malicious activity, it can also refer to users who
unintentionally cause harm to the business. There are several types of insider
in terms of efficiency and many programs therefore settle for a partial goal, such as: threats: 1.Malicious Insider: an employee or contractor who knowingly looks
i.Prevent use of dangerous functions: gets, strcpy, etc. ii.Prevent return addresses from steal information or disrupt operations. They can sell the stolen information
being overwritten. iii. Prevent data supplied by the attacker from being executed or which can help them in their career, or to hurt an organisation. 2. Negligent
The 7 layers of cyber security should centre on the mission critical assets you are seeking Insider: an employee who does not follow proper IT procedures. For example
to protect. 1: Mission Critical Assets – This is the data you need to protect 2: Data Security someone who leaves without logging out, or did not change a default
– Data security controls protect the storage and transfer of data. 3: Application Security password or failed to apply a security patch. 3. Compromised Insider a
– Applications security controls protect access to an application, an application’s access common example is an employee whose computer has been infected with
to your mission critical assets, and the internal security of the application. 4: Endpoint malware. This typically happens via phishing scams or by clicking on links that
Security – Endpoint security controls protect the connection between devices and the cause malware downloads. Compromised insider machines can be used as a
"home base" for cybercriminals, from which they can scan file shares, escalate
network. 5: Network Security – Network security controls protect an organization’s privileges, infect other systems, and more.
network and prevent unauthorized access of the network. 6: Perimeter Security – STRIDE: A methodology developed by Microsoft for threat modelling, it offers
Perimeter security controls include both the physical and digital security methodologies a mnemonic for identifying security threats in six categories: Spoofing: An
that protect the business overall. 7: The Human Layer – Humans are the weakest link in intruder posing as another user, component, or other system feature that
any cyber security posture. Human security controls include phishing simulations and contains an identity in the modelled system. Tampering: The altering of data
access management controls that protect mission critical assets from a wide variety of within a system to achieve a malicious goal. Repudiation: The ability of an
human threats, including cyber criminals, malicious insiders, and negligent users. intruder to deny that they performed some malicious activity, due to the
absence of enough proof. Information Disclosure: Exposing protected data to
a user that isn't authorized to see it.
Information Assurance Model: The security model is multidimensional model Computer forensics, also referred to as computer forensic analysis, electronic discovery
based on four dimensions: 1. Information States - Information is referred to as electronic evidence discovery, digital discovery, data recovery, data discovery,
interpretation of data which can be found in three states stored, processed, or computer analysis, and computer examination, is the process of methodically
transmitted. 2. Security Services- This fundamental pillar of the model which examining computer media (hard disks, diskettes, tapes, etc.) for evidence. A thorough
provides security to system and consists of five services namely availability, analysis by a skilled examiner can result in the reconstruction of the activities of a
integrity, confidentiality, authentication and non-repudiation. 3. Security computer user. In other words, computer forensics is the collection, preservation,
Countermeasures- This dimension has functionalities to save system from analysis and prevention of computer-related evidence. Computer evidence can be
immediate vulnerability by accounting for technology, policy & practice and useful in criminal cases, civil disputes and human resources. There are various types of
people. 4. Time- This dimension can be viewed in many ways. At any given time computer forensic examinations. Each deals with a specific aspect of information
data may be available offline or online, information and system might be in flux technology. Some of the main types include the following: Database forensics: The
thus, introducing risk of unauthorized access. Therefore, in every phase of examination of information contained in databases, both data and related metadata.
System Development Cycle, every aspect of Information Assurance model must Email forensics: The recovery and analysis of emails and other information contained
be well defined and well implemented in order to minimize risk of unauthorized in email platforms, such as schedules and contacts. Malware forensics: Sifting through
access. Information States: 1. Transmission - It defines time wherein data is code to identify possible malicious programs and analyzing their payload. Such
between processing steps. Eg: In transit over networks when user sends email programs may include Trojan horses, ransomware or various viruses. Memory
to reader, including memory and storage encountered during delivery. 2. forensics: Collecting information stored in a computer's random access memory (RAM)
Storage - It defines time during which data is saved on medium such as hard and cache. Mobile forensics: The examination of mobile devices to retrieve and analyse
drive. Eg: Saving document on file server's disk by user. 3. Processing - It defines the information they contain, including contacts, incoming and outgoing texts, pictures
time during which data is in processing state. Eg: Data is processed in random and video files. Network forensics: Looking for evidence by monitoring network traffic,
access memory (RAM) of workstation. Security Services: 1. Confidentiality - It using tools suck as a firewall or intrusion detection system. Cyber Forensics
assures that information of system is not disclosed to unauthorized access and Advantages: ●Similar types of data and relevant data can be compared from different
is read and interpreted only by persons authorized to do so. Protection of source systems to get a complete understanding of the be scenario. ●Those data over
prevents malicious access and accidental disclosure of information. Information a period that is relevant can be made trending using cyber forensics. ●The entire data
that is confidentiality considered to be confidential is called as sensitive can be scanned to identify and extract specific risks for future analysis. ●The efficiency
information. To ensure confidentiality data is categorized into different of the control environment and policies can be tested by determining the attributes that
categories according to damage severity and then accordingly strict measures violate the rules. ●It is used to set the trends of identification which the company
are taken. Eg: Protecting email content to read by only desired set of users. This people, consultants and forensic analysts are not aware of. Types of computer forensic
can be insured by data encryption. 2. Integrity - Ensures that sensitive data is systems: Internet security systems: Internet and network security are topics that many
accurate and trustworthy and cannot be created changed, or deleted without executives and managers avoid talking about. Many feel that discussing their security
proper authorization. Maintaining integrity involves modification or implementations and policies will cause their companies to become vulnerable to
destruction of information by unauthorized access. To ensure integrity backups attack. Ironically, Internet security can provide a more secure solution, as well as one
should be planned and implemented in order to restore any affected data in that is faster and less expensive than traditional solutions to security problems of
case of security breach. (PTO) employees photocopying proprietary information, faxing or mailing purchase orders, or
placing orders by phone. (PTO)
Forensic audit is, in general, referred to as an examination of evidence Security policies are a formal set of rules which is issued by an organization to ensure
regarding an assertion to determine its correspondence to established criteria that the user who are authorized to access company technology and information assets
carried out in a manner suitable to the court. Forensic Audit is an examination comply with rules and guidelines related to the security of information. A security policy
and evaluation of a firm's or individual's financial information for use as also considered to be a "living document" which means that the document is never
evidence in court. A Forensic Audit can be conducted in order to prosecute a finished, but it is continuously updated as requirements of the technology and
party for fraud, embezzlement other financial claims. In addition, an audit may employee changes. We use security policies to manage our network security. Most
be conducted to determine negligence or even to determine how much spousal types of security policies are automatically created during the installation. We can also
or child support an individual will have to pay. Jack Bologna and Robert defined customize policies to suit our specific environment. Need of Security policies: 1) It
Forensic Audit as the application of financial skills and an investigative mentality increases efficiency. 2) It upholds discipline and accountability 3) It can make or break
to unresolved issues, conducted within the context of the rules of evidence. As a business deal 4) It helps to educate employees on security literacy. Important cyber
a discipline, it encompasses financial expertise, fraud knowledge, and a strong security policies: Virus and Spyware Protection policy: •It helps to detect threads in
knowledge and understanding of business reality and the working of the legal files, to detect applications that exhibits suspicious behavior. •Removes, and repairs
system. the side effects of viruses and security risks by using signatures. Firewall Policy: • It
ISO 27001:2013 is an international security standard that lays out best practices blocks the unauthorized users from accessing the systems and networks that connect
for how organizations should manage their data. It outlines how companies to the Internet. • It detects the attacks by cybercriminals and removes the unwanted
should manage their data. It outline how companies should manage sources of network traffic. Intrusion Prevention policy: •This policy automatically
information security risk by creating an information security management detects and blocks the network attacks and browser attacks. •It also protects
system(ISMS). This approach demands executive leadership while embedding applications from vulnerabilities and checks the contents of one or more data packages
data security at all organizational levels. The standard is voluntary, but and detects malware which is coming through legal ways. Application and Device
organizations that follow its guidelines can seek ISO 27001 certification. ISO Control: •This policy protects a system's resources from applications and manages the
27001 was developed in tandem by the International Organization for peripheral devices that can attach to a system. •The device control policy applies to
Standardization (ISO) and the International Electro technical Commission (IEC). both Windows and Mac computers whereas application control policy can be applied
It was originally released in 2005 and revised in 2013, thus its full title: ISО/IЕС only to Windows clients. Email Security Protocols: 1. SSL/TLS for HTTPS: SSL or Secure
27001:2013. For companies that earn ISO 27001 certification, it's a sign of their Sockets Layer, was first introduced in 1995. Due to security flaws, SSLv3 was eventually
commitment to data security. Essentially, all the guidelines in ISO 27001 add up superseded in 2015 and replaced by the Transport Layer Security (TLS) protocol in 1999.
to one thing: a guide for creating an ISMS. An ISMS describes the structures an Many people still refer to TLS as the predecessor to SSL. It is used for HTTP Secure
organization has in place to manage data, including technology, physical (HTTPS), which is employed for nearly all email exchanges between servers and users,
security, personnel policies, and organizational hierarchy that delegates even though it has no inherent role in email security. TLS is used by HTTPS to encrypt
responsibility for these issues. ISO 27001:2013 certification is an important network traffic streams between clients and servers. Although it is used for web traffic
thing to look for in any cyber security partner because it indicates an rather than email, webmail messages are encrypted using it. SMTP Secure (SMTPS)
organization-wide commitment to security. Working with such a partner can functions similarly to HTTPS for SMTP. It uses TLS to encrypt client-server message
benefit ones own organization's security. As Clause 6 states, sometimes the exchanges. Unless another encryption protocol, like StartTLS, is in use, encrypted TLS
most effective way to deal with data security risk is to either eliminate it or traffic is decrypted at its destination, meaning that cleartext messages may be
outsource it to a third- party. accessible on email servers as messages are routed.

Block Cipher encrypts data in fixed-size blocks usually 64 or 128 bits at a time. Block Cipher vs Stream Cipher: 1.Block Cipher Converts the plain text into cipher text
The encryption algorithm processes each block of data separately using by taking plain text’s block at a time. Stream Cipher Converts the plain text into cipher
the cryptographic key to transform the plaintext into the ciphertext. Block text by taking 1 bit plain text at a time. 2.Block cipher uses either 64 bits or more than
ciphers function on complex mathematical computation and permutation to 64 bits. While stream cipher uses 8 bits. 3.The complexity of block cipher is simple.
ensure that the data encrypted is safe. The choice of block size does not While stream cipher is more complex. 4. Block cipher uses confusion as well as
directly affect the strength of the encryption scheme. The strength of the diffusion. While stream cipher uses only confusion. 5.In block cipher, reverse encrypted
cipher depends upon the key length. However, any size of the block is text is hard. While in-stream cipher, reverse encrypted text is easy. 6.The algorithm
acceptable. The following aspects can be kept in mind while selecting the size modes which are used in block cipher are ECB (Electronic Code Book) and CBC (Cipher
of a block: Avoid very small block sizes, Do not have very large block sizes, and Block Chaining).The algorithm modes which are used in stream cipher are CFB (Cipher
Multiples of 8-bit. Features: •Fixed Block Size: The Data is encrypted Feedback) and OFB (Output Feedback). 7. Block cipher works on transposition
in a fixed-size block. •Complex techniques like rail-fence technique, columnar transposition technique, etc. While
Operations: In blockciphers, substitution combined with permutation forms t stream cipher works on substitution techniques like Caesar cipher, polygram
he operation to achieve encryption. •Modes of Operation: Block ciphers substitution cipher, etc. 8. Block cipher is slow as compared to a stream cipher. While
employ several modes such as ECB (Electronic Codebook) and CBC (Cipher stream cipher is fast in comparison to block cipher.
Block Chaining) for enhanced security. Eg: AES (Advanced Encryption Feistel Cipher model is a structure or a design used to develop many block ciphers such
Standard), DES (Data Encryption Standard) and Blowfish. as DES. Feistel cipher may have invertible, non-invertible and self invertible
Stream Cipher encrypts data one bit or one byte at a time rather than in components in its design. Same encryption as well as decryption algorithm is used. A
fixed-size blocks. It generates a keystream that is combined with the plaintext separate key is used for each round. However same round keys are used for encryption
to the produce ciphertext. Stream ciphers are made for the scenarios where as well as decryption. Algorithm: •Create a list of all the Plain Text characters. •Convert
data needs to be encrypted in the continuous stream making them suitable the Plain Text to Ascii and then 8-bit binary format. •Divide the binary Plain Text string
for the real-time applications. It can be categorized into the synchronous, self- into two halves: left half (L1)and right half (R1). •Generate a random binary keys (K1
synchronizing and one-time pad types. The Synchronous encryption requires and K2) of length equal to the half the length of the Plain Text for the two rounds. First
independently generated keystream from both the plaintext and the Round of Encryption: a.Generate function f1 using R1 and K1 as follows: f1= xor(R1,
ciphertext. They have to be in the same state, with the same key, in order to K1); b.Now the new left half(L2) and right half(R2) after round 1 are as follows: R2=
decode the data properly. Features: •Continuous Encryption: The data is xor(f1, L1); L2=R1; Second Round of Encryption: a.Generate function f2 using R2 and
encrypted in a stream that runs continuously, a bit or byte at a time. K2 as follows: f2= xor(R2, K2); b.Now the new left half(L3) and right half(R3) after round
•Keystream Generation: To create encryption keys, the Stream ciphers use a 2 are as follows: R3= xor(f2, L2); L3=R2; c.Concatenation of R3 to L3 is the Cipher Text
pseudorandom keystream generator. •Efficiency: Stream ciphers are d.Same algorithm is used for decryption to retrieve the Plain Text from the Cipher Text.
generally more efficient for encrypting data of variable length and in the
streaming applications. Eg: RC4, Salsa20, and ChaCha20.
Cryptanalysis is the process of transforming or decoding communications from non-
2. Transposition Ciphers are those forms of ciphers that work on the principle readable to readable format without having access to the real key. Cryptanalysis
of shifting the positions of the characters of the plaintext to create the frequently comprises a direct evaluation of the cryptosystem in use, which is essentially
ciphertext. While in substitution ciphers the actual letters are replaced, in an advanced concentrated mathematical attempt at decryption utilizing knowledge
transposition ciphers the letters’ positions are changed instead. ●Rail Fence about the encryption scheme that is already available. They can employ intercepted
Cipher: The plaintext is arranged in a manner of a zigzag pattern on the encrypted messages (ciphertext), intercepted complete, partial, likely, or similar
number of ‘rails’ and then read column wise. ●Columnar Transposition original messages (plaintext), or information (encrypted or original) that is known to be
Cipher: The plaintext is written into rows under a certain key. The columns used adaptively in subsequent trials. To determine the weak points of a cryptographic
are then arranged in order of the key names by using the sort function. system, it is important to attack the system. This attacks are called Cryptanalytic
3.Modern ciphers are far more sophisticated and are intended to offer better attacks.
Types of attacks include ciphertext-only attacks, where only encrypted messages are
security as compared to the traditional ciphers. These are of two types, available, known-plaintext attacks, where both plaintext and ciphertext are known,
the symmetric key ciphers and the asymmetric or public key ciphers. and chosen-plaintext/ciphertext attacks, where the attacker can encrypt or decrypt
specific data to expose the encryption scheme.
Intrusion Detection Systems: Intrusion detection systems help computer system ….Besides this cryptographic checksum can also be used for verification of data.
prepare for and deal with attacks. They collect information from a variety of vantage Eg: Implementation of measures to verify that e-mail content was not modified
points within computer systems and networks and analyze this information for in transit. This can be achieved by using cryptography which will ensure that
symptoms of security problems. Vulnerability assessment systems check systems and intended user receives correct and accurate information. 3. Availability - It
networks for system problems and configuration errors that represent security guarantees reliable and constant access to sensitive data only by authorized
vulnerabilities ● Monitoring and analysis of user and system activity ● Auditing of users. It involves measures to sustain access to data in spite of system failures
system configurations and vulnerabilities ●Assessing the integrity of critical system and and sources of interference. To ensure availability of corrupted data must be
data files ✓ Recognition of activity patterns reflecting known attacks ● Statistical eliminated, recovery time must be speed up and physical infrastructure must
analysis of abnormal activity patterns. Firewall Security Systems, Storage area be improved. Eg: Accessing and throughput of e-mail service. 4. Authentication
network security systems: SANs are a relatively new methodology for attaching - It is security service that is designed to establish validity of transmission of
storage, whereby a separate network (separate from the traditional LAN connects all message by verification of individual's identity to receive specific category of
storage and servers. This network would be a high-performance implementation, such information. To ensure availability of various single factors and multi-factor
as a fiber channel, that encapsulates protocols such as a small computer system authentication methods are used. A single factor authentication method uses
interface (SCSI). These are more efficient at transferring data blocks from storage and single parameter to verify user’s identity, whereas two-factor authentication
uses multiple factors to verify user’s identity. Eg: Entering username and
have hardware implementations offering buffering and delivery guarantees. This is not password when we log in to website is example of authentication. Entering
available using TCP/IP. The SAN development areas have not yet been realized, but correct login information lets website verify our identity and ensures that only
there is great potential with regard to centralized storage SAN management and we access sensitive information. 5.Non-Repudiation - It is mechanism to ensure
storage abstraction. Storage abstraction refers to an indirect representation of storage sender or receiver cannot deny fact that they are part of data transmission.
that has also been called virtualisation. Together with potential enhancements, SANs When sender sends data to receiver, it receives delivery confirmation. When
should be able to generate greater functionality than has been possible previously. receiver receives message it has all information attached within message
Network Forensics is the process of capturing, recording and conducting analysis of the regarding sender. Security Counter measures: 1. People - People are heart of
various network events in order to identify the origin of the security attacks and other information system. Administrators and users of information systems must
problems. This helps in figuring out the unauthorized access to the computer system follow policies and practice for designing good system. They must be informed
and conducts search for the evidence in such occurrences. Network Forensics has the regularly regarding information system and ready to act appropriately to
capability to conduct investigation at a network level as well as the events that take safeguard system. 2. Policy & Practice - Every organization has some set of rules
place across an IT system. Three parts of Network Forensics are Intrusion detection, defined in form of policies that must be followed by every individual working in
logging and Correlating intrusion detection and logging. The main aim of this network organization. These policies must be practiced in order to properly handle
forensics is to make available the sufficient evidence in order to impose punishment on sensitive information whenever system gets compromised. 3. Technology -
the criminal offenders. Network Forensics is applied in the major areas of hacking, Appropriate technology such as firewalls, routers, and intrusion detection must
fraud, insurance companies, theft of data, defamation, obscene publication, credit card be used in order to defend system from vulnerabilities, threats. The technology
cloning, software piracy, etc. used must facilitate quick response whenever information security gets
compromised.

Cybersec Laws: Information Technology Act, 2000: The Indian cyber laws are governed DIGITAL FORENSICS LIFECYCLE: Collection: The first step in the forensic process
by the Information Technology Act, penned down back in 2000. The principal impetus is to identify potential sources of data and acquire data from them.
of this Act is to offer reliable legal inclusiveness to eCommerce, facilitating registration Examination: After data has been collected, the next phase is to examine the
of real-time records with the Government. But with the cyber attackers getting data, which involves assessing and extracting the relevant pieces of information
sneakier, topped by the human tendency to misuse technology, a series of amendments from the collected data. This phase may also involve bypassing or mitigating OS
followed. The ITA, enacted by the Parliament of India, highlights the grievous or application features that obscure data and code, such as data compression,
punishments and penalties safeguarding the e-governance, e-banking, and e-commerce encryption, and access control mechanisms. Analysis: Once the relevant
sectors. Now, the scope of ITA has been enhanced to encompass all the latest information has been extracted, the analyst should study and analyze the data
communication devices. The IT Act is the salient one, guiding the entire Indian to draw conclusions from it. The foundation of forensics is using a methodical
legislation to govern cybercrimes rigorously: Section 43 - Applicable to people who approach to reach appropriate conclusions based on the available data or
damage the computer systems without permission from the owner. The owner can fully determine that no conclusion can yet be drawn. Reporting: The process of
claim compensation for the entire damage in such cases. Section 66 - Applicable in case preparing and presenting the information resulting from the analysis phase.
a person is found to dishonestly or fraudulently committing any act referred to in Many factors affect reporting, including the following: a. Alternative
section 43. The imprisonment term in such instances can mount up to three years or a Explanations: When the information regarding an event is incomplete, it may
fine of up to Rs. 5 lakh. Section 66B - Incorporates the punishments for fraudulently not be possible to arrive at a definitive explanation of what happened. When
receiving stolen communication devices or computers, which confirms a probable three an event has two or more plausible explanations, each should be given due
years imprisonment. This term can also be topped by Rs. 1 lakh fine, depending upon consideration in the reporting process. Analysts should use a methodical
the severity. Section 66C - This section scrutinizes the identity thefts related to imposter approach to attempt to prove or disprove each possible explanation that is
digital signatures, hacking passwords, or other distinctive identification features. If proposed. b. Audience Consideration. Knowing the audience to which the data
proven guilty, imprisonment of three years might also be backed by Rs.1 lakh fine. or information will be shown is important. c. Actionable Information. Reporting
Section 66 D - This section was inserted on-demand, focusing on punishing cheaters also includes identifying actionable information gained from data that may
doing impersonation using computer resources. National Cyber Security Policy is a allow an analyst to collect new sources of information.
policy framework by Department of Electronics and Information Technology. It aims at Cryptography is a technique of securing communication by converting plain
protecting the public and private infrastructure from cyberattacks. The policy also text into ciphertext. It is a technique of securing information and
intends to safeguard "information, such as personal information (of web users), communications through the use of codes so that only those persons for whom
financial and banking information and sovereign data". To create a secure cyber the information is intended can understand and process it. Thus preventing
ecosystem in the country, generate adequate trust and confidence in IT system and unauthorized access to information. In Cryptography, the techniques that are
transactions in cyberspace and thereby enhance adoption of IT in all sectors of the used to protect information are obtained from mathematical concepts and a
economy. Objectives: • To create an assurance framework for the design of security set of rule-based calculations known as algorithms to convert messages in ways
policies and promotion and enabling actions for compliance to global security standards that make it hard to decode them. These algorithms are used for cryptographic
and best practices by way of conformity assessment (Product, process, technology & key generation, digital signing, and verification to protect data privacy, web
people). • To strengthen the Regulatory Framework for ensuring a SECURE CYBERSPACE browsing on the internet and to protect confidential transactions such as credit
ECOSYSTEM. card and debit card transactions.

Rail Fence Cipher: Encryption: •In the rail fence cipher, the plain-text is written Types Of Cryptography: 1. Symmetric Key Cryptography: It is an encryption
downwards and diagonally on successive rails of an imaginary fence. •When we reach system where the sender and receiver of a message use a single common key
the bottom rail, we traverse upwards moving diagonally, after reaching the top rail, the to encrypt and decrypt messages. Symmetric Key cryptography is faster and
direction is changed again. Thus the alphabets of the message are written in a zig-zag simpler but the problem is that the sender and receiver have to somehow
manner. •After each alphabet has been written, the individual rows are combined to exchange keys securely. The most popular symmetric key cryptography
obtain the cipher-text. systems are Data Encryption Systems (DES) and Advanced Encryption Systems
Eg: Input: GeeksforGeeks; Key = 3; Output : GsGsekfrek eoe Decryption: As we’ve seen (AES). 2. Hash Functions: There is no usage of any key in this algorithm. A
earlier, the number of columns in rail fence cipher remains equal to the length of plain- hash value with a fixed length is calculated as per the plain text which makes
text message. And the key corresponds to the number of rails. •Hence, rail matrix can it impossible for the contents of plain text to be recovered. Many operating
be constructed accordingly. Once we’ve got the matrix we can figure-out the spots systems use hash functions to encrypt passwords.
where texts should be placed (using the same way of moving diagonally up and down 3. Asymmetric Key Cryptography: Here, a pair of keys is used to encrypt and
alternatively ). •Then, we fill the cipher-text row wise. After filling it, we traverse the decrypt information. A sender’s public key is used for encryption and a
receiver’s private key is used for decryption. Public keys and Private keys are
matrix in zig-zag manner to obtain the original text. Columnar Transposition cipher different. Even if the public key is known by everyone the intended receiver
involves writing the plaintext out in rows, and then reading the ciphertext off in columns can only decode it because he alone knows his private key. The most popular
one by one. Encryption: •The message is written out in rows of a fixed length, and then asymmetric key cryptography algorithm is the RSA algorithm.
read out again column by column, and the columns are chosen in some scrambled order. Applications: 1.Computer Passwords: Cryptography secures passwords by
•Width of the rows and the permutation of the columns are usually defined by a hashing and encrypting them, preventing unauthorized access even if the
keyword. •For example, the word HACK is of length 4 (so the rows are of length 4), and database is compromised. 2. Digital Currencies: Cryptography protects
the permutation is defined by the alphabetical order of the letters in the keyword. In transactions and prevents fraud in digital currencies like Bitcoin through
this case, the order would be “3 1 2 4”. •Any spare spaces are filled with nulls or left complex algorithms and cryptographic keys. 3. Secure Web Browsing:
blank or placed by a character (Example: _). •Finally, the message is read off in columns, Protocols like SSL/TLS use public key cryptography to encrypt data, ensuring
in the order specified by the keyword. Eg: Input: Geeks for Geeks; Key = HACK; Order of secure communication between web servers and clients. 4. Electronic
alphabets in HACK=3214; Output: e kefGsGsrekoe_ Decryption: •To decipher it, the Signatures: Digital signatures, created and verified using cryptography,
recipient has to work out the column lengths by dividing the message length by the key authenticate and secure electronic documents. 5. Authentication:
length. •Then, write the message out in columns again, then re-order the columns by Cryptography verifies identities and access rights in scenarios like logging into
reforming the key word. systems or secure networks. 6. Cryptocurrencies: Blockchain networks rely on
cryptographic methods to secure transactions and maintain integrity. 7. End-
to-End Encryption: Used in apps like WhatsApp, it ensures only intended
recipients can access encrypted messages, enhancing privacy and security.
Forms of Cryptanalysis: 1. Linear Cryptanalysis: Linear cryptanalysis is a general type
of cryptanalysis based on discovering affine approximations to a cipher’s action in A cipher is a technique that is used in transforming the readable data
(plaintext) into coded data (ciphertext) and the other way round. The first step
cryptography. Block and stream ciphers have both been subjected to attacks. Linear in converting regular text into an unrecognizable form is encryption and the
cryptanalysis is one of the two most common attacks against block ciphers, with process of converting the encoded text back into regular text is decryption.
differential cryptanalysis being the other. 2. Differential Cryptanalysis: Differential Ciphers are able to perform these transformation using keys; specific pieces of
cryptanalysis is a sort of cryptanalysis that may be used to decrypt both block and information. It guarantees that only the right person can get to the primary
stream ciphers, as well as cryptographic hash functions. In the widest sense, it is the data. Types: 1. Substitution Ciphers involve replacing each member of the
study of how alterations in information intake might impact the following difference at plaintext with another member which can be of the same set. •Caesar Cipher:
the output. In the context of a block cipher, it refers to a collection of strategies for It is a substitution cipher where each letter in the plaintext is replaced by
tracking differences across a network of transformations, finding where the cipher another letter shifted a fixed number of positions down the alphabet. •Simple
displays non-random behavior, and using such attributes to recover the secret key Substitution Cipher: A simple substitution cipher is a technique in which each
(cryptography key). letter in the plain text is replaced with another letter. The key is the alphabet
but in a random order.
SSL Protocol: •SSL Protocol stands for Secure Sockets Layer protocol, which is an Threat modelling methodologies: DREAD was proposed for threat modeling but due to
encryption-based Internet security protocol that protects confidentiality and inconsistent ratings, it was dropped by Microsoft in 2008. It is currently used by
integrity of data. - SSL is used to ensure the privacy and authenticity of data over OpenStack and many other corporations. It provides a mnemonic for risk rating security
the internet. - SSL is located between the application and transport layers. - At first, threats using five categories. The categories are: Damage Potential: ranks the extent of
SSL contained security flaws and was quickly replaced by the first version of TLS; damage that would occur if a vulnerability is exploited. • Reproducibility: ranks how easy
that’s why SSL is the predecessor of the modern TLS encryption. - TLS/SSL website it is to reproduce an attack. • Exploitability: Assigns a number to the effort required to
has “HTTPS” in its URL rather than “HTTP”. - SSL is divided into three sub-protocols: launch the attack. • Affected Users: A value characterizing how many people will be
the Handshake Protocol, the Record Protocol, and the Alert Protocol. impacted if an exploit becomes widely available. • Discoverability: Measures the
TLS Protocol: • Same as SSL, TLS which stands for Transport Layer Security is widely likelihood of how easy it is to discover the threat. Process for Attack Simulation and
used for the privacy and security of data over the internet. • TLS uses a pseudo- Threat Analysis (PASTA): It is a seven-step, risk-centric methodology. The purpose is to
random algorithm to generate the master secret, which is a key used for the provide a dynamic threat identification, enumeration, and scoring process. Upon
encryption between the protocol client and protocol server. • TLS is basically used completion of the threat model, security subject matter experts develop a detailed
for encrypting communication between online servers, like a web browser loading analysis of the identified threats. Finally, appropriate security controls can be
a web page in the online server. • TLS also has three sub-protocols, the same as the enumerated. This helps developers to develop an asset-centric mitigation strategy by
SSL protocol – Handshake Protocol, Record Protocol, and Alert Protocol. analyzing the attacker-centric view of an application. Trike: The focus is on using threat
Diff: Secure Socket Protocol supports Fortezza Algorithms where Transport layer models as a risk management tool. Threat models are based on the requirement model.
Protocol do not, also the versions of both protocols are very different SSL is version The requirements model establishes the stakeholder-defined “acceptable” level of risk
3.0 and TLS is version 1.0 protocol. The difference between SSL and TLS is that. In assigned to each asset class. Analysis of the requirements model yields a threat model
SSL the Message digest is used to create a master secret and provides the security from which threats are identified and assigned risk values. The completed threat model
services in communication. which are Authentication and confidentiality. While in is used to build a risk model based on assets, roles, actions, and calculated risk exposure.
TLS a randomly generated Pseudo function is used to create a master secret which
provides higher security as compared to SSL.

Types Of Cyber Security Vulnerabilities: Broken Authentication: In order to pose as “Software piracy is the copying and use of software without a proper license from the
the original user, malicious attackers can hack user sessions and identities by developer." Similarly, the simultaneous use of single-user licensed software by
compromising authentication credentials. In the past, multi-factor authentication multiple users, or the installation of single-user licensed software on multiple sites,
was vastly popular, but due to its difficulties in use, password authentication also amounts to software piracy. Using trial version software for commercial gains is
prevailed. Two-factor authentication, on the other hand, is still a widely also considered piracy. Piracy is punishable if you install pirated software, use it for
implemented security process that involves two methods of verification. One your work, and then delete the software from the machine, even if there is enough
method is usually password verification. Frequently used types of authentication evidence to show its prior usage.
technology are username/password, one-time password and biometric Any copyright infringement is the unauthorized use of copyrighted material in a
authentication. Injection: An injection flaw is a vulnerability which allows an manner that violates one of the copyright owner’s exclusive rights, such as the right
attacker to relay malicious code through an application to another system. This can to reproduce or to make derivative works that build upon it. For electronic and audio-
include compromising both backend systems as well as other clients connected to visual media, such unauthorized reproduction and distribution of copyrighted work
the vulnerable applications. Security Misconfiguration: Security misconfiguration are often referred to as piracy (however, there is no legal basis for the term "piracy").
gives attackers a chance to gain unauthorized access to some system data or There are different types of software piracy, such as copying copyrighted materials
functionality. Generally, such flaws evolve into a complete system compromise, The and using multiple copies of the same without a license. Even if a person installs and
business impact depends on the protection needs of the application and data. Poor uses a copy of the material and then removes it from the system, it will still be
Resource Management: Resource management practices include transferring, reported as software piracy. This includes installation on a hard drive or servers and
using, creating and even destroying the resources within a system. When clients with the same version and no license. If a company illegally sells the product of
management of resources is poor or risky, your organization is prone to have another company without their permission or authorization, with or without
vulnerabilities like path traversal, use of potentially dangerous functions, buffer alteration of the original product, it can be considered piracy.
overflow, and much more. Insecure Connection Between Elements: When the
interaction between components of your system and/or network is insecure, your
organization is exposed to many threats including SQL injection, open redirect, cross-
site scripting, and much more. In order to ensure that your organization is free from
such vulnerabilities, it is critical to pay the utmost attention to how data circulates
across your networks and systems. If you can secure the circulation of data, most
aforementioned vulnerabilities and threats can be considered solved. Yet you must
also consider unique vulnerabilities and develop appropriate solutions for each.
VAST: VAST is an acronym for Visual, Agile, and Simple Threat modeling. The The SSL and TLS handshake establishes a system for SSL/TLS clients and servers to
methodology provides actionable outputs for the unique needs of various stakeholders start communication between them in other words it is a negotiation between two
like application architects and developers, cyber security personnel, etc. It provides a parties on a network. Handshake Protocol is used to establish sessions. This protocol
unique application and infrastructure visualization scheme such that the creation and allows the client and server to verify each other by transferring a series of messages
use of threat models do not require specific security subject matter expertise.Attack to each distance. Handshake protocol uses four phases to finalize its
Tree: Attack trees are the conceptual diagram showing how an asset, or target, might circle. Handshake protocol uses four phases to finalize its circle.
be attacked. These are multi-level diagrams consisting of one root node, leaves, and Phase-1: Deciding which version of the Protocol to use. The system decides which
children nodes. From bottom to Top, child nodes are conditions that must be satisfied protocol to use. Client and Server exchange hello-packets with each other to
to make the direct parent node true. An attack is considered complete when the root confirm. In this IP session, cipher suite, and Agree on which version of the protocol
is satisfied. Each node may be satisfied only by its direct child nodes. Suppose there is to use. Phase-2: Server sends his certificate and Server-key-exchange. The server
1 grandchild below the root node. In such a case multiple steps must be taken to carry end phase-2 by exchanging the hello packet. Phase-3: Verification, in this phase, the
out an attack first the grandchild’s conditions must be satisfied for the direct parent Client replies to the server by sending his certificate and Client-exchange-key. Phase-
node to be true and then the direct parent node condition must be satisfied to make 4: In this phase, the Change Cipher suite is passed and all the verifications and
the root node true. It also has AND and OR options which represent alternatives and security checks are done after this Handshake Protocol ends.
different steps toward achieving that goal.Common Vulnerability Scoring System
(CVSS): It provides a way to capture the principal characteristics of a vulnerability and
produce a numerical score (ranging from 0-10, with 10 being the most severe) depicting
its severity. The score can then be translated into a qualitative representation (such as
low, medium, high, and critical) to help organizations properly assess and prioritize
their vulnerability management processes.T-MAP: T-MAP is an approach that is used in
Commercial Off The Shelf (COTS) systems to calculate the weights of attack paths. This
model is developed by using UML class diagrams, access class diagrams, vulnerability
class diagrams, target asset class diagrams, and affected Value class diagrams.

Forgery: Offenses of computer forgery and counterfeiting have become rampant, as Types Of Malware: Adware, Spyware, Botnets -Short for "robot network," these
it is very easy to counterfeit a document, such as a birth certificate, and use it to are networks of infected computers under the control of single attacking parties
perpetrate a crime. The authenticity of electronic documents, therefore, needs to be using command-and-control servers. Botnets are highly versatile and adaptable,
safeguarded by explicitly making forgery with the help of computers an offense able to maintain resilience through redundant servers and by using infected
punishable by law. computers to relay traffic. Botnets are often the armies behind today's distributed
When a perpetrator alters documents stored in computerized form, the crime denial-of-service (DDoS) attacks. Cryptojacking is malicious cryptomining (the
committed may constitute forgery. In such instances, computer systems are the
target of criminal activity. However, computers can also be used as instruments to process of using computing power to verify transactions on a blockchain network
commit forgery. A new generation of fraudulent alteration or counterfeiting and earning cryptocurrency for providing that service) that happens when
emerged with the advent of computerized color laser copiers. These copiers are cybercriminals hack into both business and personal computers, laptops, and
capable of high-resolution copying, document modification, and even the creation of mobile devices to install software. Malvertising is a portmanteau of "malware +
false documents without the need for an original. They produce documents of a advertising" describing the practice of online advertising to spread malware. It
quality indistinguishable from authentic ones, except to an expert. typically involves injecting malicious code or malware-laden advertisements into
Such schemes require very little computer knowledge to execute. Counterfeit legitimate online advertising networks and webpages. Ransomware – A criminal
checks, invoices, and stationery can be produced using scanners, color printers, and
graphic design software. These forgeries are difficult for an untrained eye to detect. business model that uses malicious software to hold valuable files, data, or
It is relatively easy to scan a logo into a computer system and proceed from there. information for ransom. Victims of a ransomware attack may have their operations
severely degraded or shut down entirely. Remote Administration Tools (RATs) –
Software that allows a remote operator to control a system. These tools were
originally built for legitimate use but are now used by threat actors. RATs enable
administrative control, allowing an attacker to do almost anything on an infected
computer. They are difficult to detect, as they don’t typically show up in lists of
running programs or tasks, and their actions are often mistaken for the actions of
legitimate programs. Rootkits – Programs that provide privileged (root-level)
access to a computer. Rootkits vary and hide themselves in the operating system.