Cyber security lecture
27/01/2026
• Cyber security is the process of using best practices to protect
computers, servers, systems, networks, and programs from digital
attacks such as viruses, worms, ransomware, and other threats aimed
at accessing, changing, or destroying sensitive data, extorting money
from users, or interrupting normal business processes.
• The main idea behind cyber security is to:
• Identify and fix security vulnerabilities.
• Prevent unauthorized access and data breaches.
• Protect systems from malicious attacks and disruptions.
• Ensure confidentiality, integrity, and availability of information.
• Cybersecurity is the practice of protecting digital devices, networks,
and sensitive data from threats like hacking, malware, and phishing.
Also known as Information Security (INFOSEC), Information Assurance
(IA), or System Security.
• Types of Cybersecurity
• There are seven types of cyber security, each explained below in
detail with uses and functions:
• 1. Network Security
• It focuses on securing computer networks from unauthorized access,
data breaches, and other network-based threats. This involves
implementing technologies such as Firewalls, Intrusion detection
systems (IDS), Virtual private networks (VPNs), and Network
segmentation as well as deploying antivirus software
• Application Security
Concerned with securing software applications and preventing vulnerabilities
that could be exploited by attackers. It involves secure coding practices,
regular software updates and patches, and application-level firewalls.
• Most of the Apps that we use on our cell phones are Secured and work
under the rules and regulations of the Google Play Store.
• There are 3.553 million applications in Google Play, Apple App Store has
1.642 million, and Amazon App Store has 483 million available for users to
download. With so many choices, it’s easy to assume all apps are safe—but
that’s not true.
• Some apps pretend to be secure, but once installed, they collect personal
data and secretly share it with third-party companies.
• The app must be installed from a trustworthy platform, not from some 3rd
party website in the form of an APK (Android Application Package).
• 3. Information or Data Security
Focuses on protecting sensitive information from unauthorized access,
disclosure, alteration, or destruction. It includes Encryption, Access
controls, Data classification, and Data loss prevention (DLP) measures.
• Encryption is the process of converting information into an
unreadable format (ciphertext) to protect it from unauthorized
access.
• 4. Cloud Security
It involves securing data, applications, and infrastructure hosted on cloud
platforms, and ensuring appropriate access controls, data protection, and
compliance. It uses various cloud service providers such as AWS, Azure,
Google Cloud, etc., to ensure security against multiple threats.
• Cloud-based data storage has become a popular option over the last
decade. It enhances privacy if configured and managed correctly and saves
data on the cloud, making it accessible from any device with proper
authentication.
• These platforms offer free tiers for limited usage, and users must pay for
additional storage or services
• It is a cloud service provider that offers a wide range of services, including
storage, computing, and security tools.
• 5. Endpoint Security
• Refers to securing individual devices such as computers, laptops,
smartphones, and IoT devices. It includes antivirus software, intrusion
prevention systems (IPS), device encryption, and regular software
updates.
• 6. Operational Security
• Refers to the processes and policies organizations implement to
protect sensitive data from internal threats and human errors.
• 7. Internet of Things (IoT) Security
• Refers to protecting internet-connected devices such as smart home
gadgets, industrial sensors, medical equipment, and wearable
technology from cyber threats. IoT security ensures that these
devices do not become entry points for hackers to exploit networks
and steal sensitive data.
• Device Authentication & Encryption ensures that only authorized
devices can connect to networks. Encryption protects data
transmitted between IoT devices and servers from interception.
• Firmware & Software Updates are crucial to patch security
vulnerabilities. Regular updates help prevent exploitation by
cybercriminals who target outdated IoT firmware.
• Network Segmentation isolates IoT devices from critical systems,
reducing the risk of widespread attacks if one device is compromised.
This approach limits unauthorized access and lateral movement
within a network.
• IoT Security Standards & Compliance include implementing industry
security frameworks like Zero Trust Architecture (ZTA) and following
best practices such as strong password policies, secure APIs, and
endpoint protection to enhance IoT device security.
• Major Cybersecurity Threats & Attacks
• Hackers use advanced techniques to find weaknesses in systems, steal
or change data, and break into networks without permission. Below
are the most common cybersecurity threats that target businesses,
cloud storage, and personal devices:
• 1. Malware Attacks :Malware is a type of harmful software created to
enter, attack, and compromise systems. It includes trojans, rootkits,
and spyware.
• 2. Phishing & Spear Phishing Attacks
• Phishing uses tricks and manipulation to steal login details, session
tokens, and financial information. Spear phishing is a more targeted
version that uses open-source intelligence (OSINT) to create
personalized fake messages.
• 3. Ransomware Attacks
• Ransomware locks important system files by encrypting them using
asymmetric cryptography (like RSA, ECC) or hybrid encryption (AES-
RSA). It then demands a ransom, usually in cryptocurrency, to unlock
the data.
• 4. Distributed Denial-of-Service (DDoS) Attacks
• DDoS attacks overload a network by flooding it with massive amounts
of traffic at different levels volumetric, protocol, or application-layer
causing servers to crash and making services unavailable.
• 5. SQL Injection (SQLi) & NoSQL Injection
• SQL injection attacks take advantage of weak web application queries
by inserting malicious SQL code to modify database records, steal
login credentials
• Man-in-the-Middle (MITM) Attacks
• Man-in-the-Middle (MITM) attacks secretly intercept and modify
data exchanged between two parties by exploiting weak encryption
or unsecured communication channels.
• Rising Cyber Threats: How Hackers Exploit Weak Security
• Cybercriminals exploit weak security using tactics like phishing,
ransomware, social engineering, and AI-driven attacks to steal data,
disrupt systems, and cause financial loss.
• Example: While shopping online, a fake email posing as Flipkart or
Amazon may lure users with an offer; entering saved details can let
hackers steal card and personal information, leading to financial loss.
• Consequences of Cyber Attacks
• Cyber attacks cause severe financial, reputational, and personal
damage to both businesses and individuals.
• OSI Security Architecture
• Last Updated : 17 Dec, 2025
• The OSI Security Architecture is an internationally recognized framework
that standardizes how security measures are applied, focusing on security
attacks, mechanisms, and services to protect data and communications.
OSI model has seven layers which are as follows:
• The Physical Layer
• The Data Link Layer
• The Network Layer
• The Transport Layer
• The Session Layer
• The Presentation Layer
• The Application Layer
• Classification of OSI Security Architecture
• The OSI Security Architecture provides a standardized framework for
applying security services and mechanisms across all seven OSI layers,
ensuring data confidentiality, integrity, and availability in network
[Link] Security Architecture focuses on these concepts:
• Security Attack
• Security mechanism
• Security Servic
• Security Mechanisms
• Security mechanisms are tools and techniques designed to detect,
prevent, and respond to security breaches and attacks.
• Encryption protects data during storage and transmission
• Digital signatures ensure data authenticity and integrity
• Traffic padding hides communication patterns
• Routing control secures data transmission paths
• 3. Security Services
• Security services provide structured protection to maintain system
safety, prevent risks, and ensure trust in digital communication.
• Authentication verifies user or device identity
• Access control restricts unauthorized resource usage
• Data confidentiality prevents unauthorized data disclosure
• Data integrity ensures data remains unaltered
• Non-repudiation prevents denial of sent messages
• What is CIA Triad?
• The CIA Triad is a core framework in information security that helps
organizations protect data and maintain secure, reliable systems.
• Three principles: Confidentiality, Integrity, Availability
• Guides policies for protecting sensitive information
• Ensures data is secure, accurate, and accessible
• Confidentiality
• Confidentiality ensures that sensitive data is accessible only to authorized
individuals or systems. Its purpose is to prevent unauthorized viewing, access, or
misuse of private information.
• Risks to Confidentiality
• Unauthorized Access: Attackers exploit vulnerabilities to access protected data.
• Weak Encryption: Outdated or weak encryption can be easily broken, exposing
sensitive information.
• Insider Threats: Employees or trusted users may leak or accidentally expose
confidential data.
• How to Ensure Confidentiality
• Encryption: Use strong encryption methods like AES or RSA to protect data from
unauthorized reading, even if intercepted. (Note: DES is outdated and insecure.)
• VPN: A Virtual Private Network creates an encrypted tunnel for internet
communication, preventing eavesdropping or interception.
• Integrity
• Integrity ensures that data remains accurate, authentic, and unaltered
during storage or transmission. Any unauthorized modification or
corruption compromises the reliability of data.
• Risks to Integrity
• Data Tampering: Attackers intentionally alter or corrupt data for malicious
purposes.
• Malware & Ransomware: Malicious software can modify, encrypt, or
destroy data, leading to loss and system disruption.
• How Integrity Is Ensured
• To detect whether data has been modified, hash functions are
[Link] Hash Functions:
• MD5: Produces a 128-bit hash value.
• SHA Family: Includes SHA-1 (160-bit), SHA-0, SHA-2, and SHA-3.
• Working of Hash Functions
• 1. Host A Sends Data: Host A creates a hash value (H1) using a hash
function.
• 2. Attach Hash: H1 is sent along with the data.
• 3. Host B Verifies: Host B generates a new hash (H2) from the
received data.
• 4. Compare:
• If H1 = H2, the data is unchanged (integrity preserved).
• If H1 ≠ H2, the data was altered or corrupted.
Even a tiny change in the input completely changes the output hash.
• Availability
• Availability ensures that systems, networks, and data are accessible to
authorized users whenever needed. Disruptions can halt operations
and cause major losses.
• Risks to Availability:
• DoS and DDoS Attacks: Denial of Service (DoS) or Distributed Denial
of Service (DDoS) attacks flood network resources with excessive
traffic, making them unavailable to legitimate users.
• Impact: Such attacks can cause major service disruptions, downtime,
and financial losses for companies.
• How to Ensure Availability
• To ensure availability, network administrators should focus on the
following factors:
• Hardware Maintenance: Regularly maintain and upgrade hardware to
prevent failures and ensure smooth operations.
• Regular Upgrades: Keep systems and software updated to maintain
performance and security.
• Failover Plan: Implement failover systems so that if one component
fails, another can take over, minimizing downtime.
• Preventing Bottlenecks: Monitor and manage network traffic to avoid
congestion or bottlenecks, ensuring consistent performance.
• Active and Passive attacks in Information Security
• Active and Passive attacks are two major categories of cybersecurity
threats in information security, where active attacks disrupt or modify
systems, while passive attacks secretly monitor and collect
information.
• Cyber attacks are broadly classified into Active and Passive attacks
• Active attacks directly alter data, systems, or network operations
• Passive attacks focus on eavesdropping and information gathering
without modification
• Active attacks affect integrity and availability, while passive attacks
target confidentiality
• Understanding both helps in designing effective security measures
• What is a Cyber Attack?
• A cyber attack is a deliberate attempt to gain unauthorized access to
computer systems or networks in order to steal data, disrupt
operations, or cause damage to digital resources.
• Targets individuals, organizations, or government systems
• Aims to steal information, disrupt services, or cause financial and
reputational damage
• Common types include malware, phishing, denial-of-service (DoS),
and man-in-the-middle (MitM) attacks
• Can lead to data breaches, system downtime, and financial loss
• Awareness and security measures help protect digital assets and
personal information
• Classification of Cyber Attacks
• Cyber attacks are mainly divided into two categories:
• Active Attacks
• Passive Attacks
• Sometimes, attackers combine both techniques to increase the
impact of the attack.
• Active Attacks
• An active attack is one in which the attacker directly interacts with the
target system to modify, disrupt, or destroy data or services. These
attacks are easier to detect because they affect system operations.
• Characteristics of Active Attacks
• Directly alter data or system resources
• Can disrupt normal operations
• Usually leave evidence of intrusion
• Aim to cause damage or gain unauthorized control
• Types of active attacks are as follows:
[Link] Attack
[Link] of Messages
[Link]
[Link] Attack
[Link] of Service (DoS) Attack
• There are several types of masquerading attacks, including:
• Username and Password Masquerade: In this masquerade attack, a
person uses either stolen or even forged credentials to authenticate
themselves as a valid user while gaining access to the system or
application.
• IP address masquerade: This is an attack where the IP address of a
malicious user is spoofed or forged such that the source from which the
system or the application is accessed appears to be trusted.
• Website masquerade: A hacker creates a fake website that resembles as a
legitimate one in order to gain user information or even download
malware.
• Email masquerade: This is an e-mail masquerade attack through which an
attacker sends an apparently trusted source email so that the recipient can
mistakely share sensitive information or download malware.
• 2. Modification of Messages
• In this attack, the attacker alters the content of transmitted messages
or changes their order.
• Example:
“Allow JOHN to read confidential file X” →
“Allow SMITH to read confidential file X”
• Impact: Loss of data integrity and trust
• 3. Repudiation
• Repudiation attacks are a type of cyber attack wherein some person
does something damaging online, such as a financial transaction or
sends a message one does not want to send, then denies having done
it.
• There are several types of repudiation attacks, including:
• Message repudiation attacks: In this attack, a message has been sent
by an attacker, but the attacker later denies the sending of the
message. This can be achieved either through spoofed or modified
headers or even by exploiting vulnerabilities in the messaging system.
• Transaction repudiation attacks: Here, in this type of attack, a
transaction-for example, monetary transaction-is made, and at after
some time when the evidence regarding the same is being asked to
be give then the attacker denies ever performing that particular
transaction.
• Data repudiation attacks: In a data repudiation attack, data is
changed or deleted. Then an attacker will later pretend he has never
done this. This can be done by exploiting vulnerabilities (weakness) in
the data storage system or by using stolen or falsified credentials.
• 4. Replay
• It is a passive capturing of a message with an objective to transmit it
for the production of an authorized effect.
• In this type of attack, the main objective of an attacker is saving a
copy of the data that was originally present on that particular
network and later on uses it for personal uses.
• Once the data gets corrupted or leaked it becomes an insecure and
unsafe tool for its users.
• Impact: Unauthorized access, session hijacking, data misuse
• 5. Denial of Service (DoS) Attack
• A DoS attack aims to make a system or network unavailable by
overwhelming it with excessive traffic or requests.
• Types of DoS attacks:
• Flood Attacks: Overloading systems with excessive packets
• Amplification Attacks: Using third-party systems to amplify traffic
• Prevention Measures:
• Firewalls and intrusion detection systems
• Load balancers and distributed architectures
• Network segmentation and access control
• Rate limiting and traffic filtering
• Passive Attacks
• A passive attack involves monitoring or eavesdropping on
communications without modifying data. These attacks are difficult to
detect because they do not affect system operations.
• Characteristics of Passive Attacks
• No modification of data
• Focus on information gathering
• Hard to detect
• Target confidentiality rather than availability or integrity
• Types of Passive Attacks
• Below are the two types of Passive Attacks:
• 1. The Release of Message Content
• Telephonic conversation, an electronic mail message, or a transferred
file may contain sensitive or confidential information. We would like
to prevent an opponent from learning the contents of these
transmissions.
• 2. Traffic Analysis
• Suppose that we had a way of masking (encryption) information, so that
the attacker even if captured the message could not extract any
information from the message.
• The opponent could determine the location and identity of communicating
host and could observe the frequency and length of messages being
exchanged.
• This information might be useful in guessing the nature of the
communication that was taking place.
• The most useful protection against traffic analysis is encryption of SIP
traffic.
• To do this, an attacker would have to access the SIP proxy (or its call log) to
determine who made the call.
Threat actors and attack vectors; Types of Threat Actors and Attack
Vectors
• Threat Actors: Threat actors are individuals or groups that
intentionally or unintally cause harm to systems, networks, or data.
• Threat actors, also known as cyberthreat actors or malicious actors,
are individuals or groups that intentionally cause harm to digital
devices or systems.
• Threat actors exploit vulnerabilities in computer systems, networks
and software to perpetuate (Sustain) various cyberattacks, including
phishing, ransomware and malware attacks.
• Types of Threat Actors
• 1.1 Script Kiddies: (calling someone a scripit kiddie implies they only
have surface level knowledge of computer systems and are
inexperienced)
• Beginners with little technical knowledge
• Use ready-made tools and scripts
• Script kiddies Motivation: Fun, curiosity, bragging
• Example: Using phishing kits or DDoS tools downloaded online.
• 1.2 Cyber Criminals
• Financially motivated attackers
• Steal money, data, or credentials
• Example: Banking fraud, ransomware attacks
• पैशासाठ' ह*ले करणारे
• बँ2कंग 5ॉड, डेटा चोर<
• उदाहरण: Online fraud, ransomware
• Hacktivists (a person who gains unauthorized access to computer
files or networks in order to further social or political ends.
• Politically or socially motivated attackers
• Attack organizations to spread a message
• Example: Website defacement, data leaks
• 1.4 Insider Threats
• Employees, ex-employees, contractors
• Have authorized access
• Can be malicious or accidental
• Example: Leaking data, misconfiguring systems
• 1.5 Nation-State / APT (Advanced Persistent Threats) An advanced
persistent threat (APT) is a covert cyber attack in which the attacker gains
unauthorized access to a network and remains undetected for an
extended period.
• Government-sponsored attackers
• Highly skilled and well-funded
• Long-term espionage or sabotage
• Example: Cyber warfare, spying on critical infrastructure
• 1.6 Organized Crime Groups
• Professional cyber gangs
• Operate like businesses
• Example: Ransomware-as-a-Service (RaaS) groups
• Attack Vectors
• Attack vectors are the paths or methods used by threat actors to gain unauthorized
access.
• 2. Types of Attack Vectors
• 2.1 Phishing
• Fraudulent emails/messages
• Trick users into revealing credentials
• Variants:
• Spear phishing
• Whaling
• Smishing (SMS)
• Vishing (voice calls)
• 2.2 Malware
• Malicious software
• Types: Virus, Worm, Trojan, Spyware, Ransomware
• Spread via email attachments, downloads, USB drives
• 2.3 Social Engineering
• Psychological manipulation
• Exploits human trust
• Example: Fake tech support calls
• 2.4 Password Attacks (Password attack is also known as Password
cracking where hackers try multiple attempts to crack your password
digitally)
• Brute force
• Dictionary attacks (A dictionary attack is a cyberattack that
systematically enters common words, phrases, and previously
breached passwords from a predefined list ("dictionary") to guess
user passwords and gain unauthorized access to accounts or
systems).
• Credential stuffing (Credential stuffing is an automated cyberattack
where criminals use lists of stolen usernames and passwords (from
one breach) to try and log in to other, unrelated services, banking on
users reusing the same credentials)
• 2.5 Web Application Attacks
• SQL Injection
• Cross-Site Scripting (XSS) Cross-site scripting (XSS) is a client-side code injection
attack where attackers inject malicious scripts (usually JavaScript) into trusted
websites. These scripts execute in the victim's browser, allowing attackers to steal
session cookies, impersonate users, deface websites, or spread malware.
• CSRF (Cross-site request forgery)
• 2.6 Network-Based Attacks
• Man-in-the-Middle (MITM)
• Packet sniffing
• DDoS attacks
• 2.7 Insider Misuse
• Data theft
• Privilege abuse
• Accidental data exposure
• 2.8 Zero-Day Exploits (A zero-day exploit is a cyberattack vector that
takes advantage of an unknown or unaddressed security flaw in
computer software, hardware or firmware.) A zero-day exploit is
named "zero" because the software vendor or developer has had
• zero days—no time at all—to fix a security vulnerability before
hackers start using it to attack systems
• Exploit unknown vulnerabilities
• Very dangerous and hard to detect
• Cyber Kill Chain
• What is Cyber Kill Chain?
• The Cyber Kill Chain is a model that explains the step-by-step process
of a cyber attack. It was developed by Lockheed Martin to help
organizations understand and stop attacks at early stages.
• Stages of Cyber Kill Chain
1. Reconnaissance (Foundation Steps)
1. Attacker collects information about the target
2. Example: Using social media, websites
2. Weaponization second phase of the cyber kill chain
1. Where Attacker convert intelligence gathered during Reconnaissance into a functional , malicious payload ,
such as weaponized documents, to exploit identified vulnerabilities.
3. Delivery
1. Malware (any code or program designed to intentionally disrupt damage or gain unauthorized access) is
delivered to the victim
2. Example: Phishing email, malicious website
4. Exploitation
1. Vulnerability in the system is exploited
5. Installation
1. Malware or backdoor is installed
6. Command and Control (C2)
1. Attacker gains remote control of the system
7. Actions on Objectives
1. Data theft, system damage, or spying
Cyber Kill Chain
• Case Study: Phishing-Based Ransomware Attack on a College
Network
• Background
• ABC Engineering College uses email, LMS, and online fee payment
systems. One of the administrative staff members received an email
appearing to be from the University IT Department regarding an
“urgent password reset.”
• The email contained a link asking the user to log in immediately to
avoid account suspension.
• Cyber Kill Chain Analysis
• 1. Reconnaissance
• The attacker collected information about:
• College website
• Staff email formats
• University events and announcements
(Source: LinkedIn, college website, social media)
• 👉 Goal: Identify vulnerable targets.
• 2. Weaponization
• The attacker:
• Created a fake university login webpage
• Embedded ransomware malware into a downloadable file
• 👉 Goal: Prepare malicious payload.
• 3. Delivery
• A phishing email was sent to the admin staff
• Email subject: “Urgent: University Email Password Reset Required”
• 👉 Delivery Method: Email (Social Engineering)
• 4. Exploitation
• Staff member clicked the link
• Entered username and password
• Malware executed due to outdated antivirus
• 👉 Vulnerability: Human trust + unpatched system
• 5. Installation
• Ransomware installed silently
• Created persistence by modifying system registry
• 👉 Effect: System compromised
• 6. Command and Control (C2)
• Infected system connected to attacker’s remote server
• Attacker monitored file encryption process
• 👉 Control: Remote communication channel
• 7. Actions on Objectives
• Important files encrypted
• Ransom message displayed demanding payment in Bitcoin
• College operations disrupted
• 👉 Impact: Data loss and financial risk
• Outcome
• IT team disconnected affected systems
• Data restored from backups
• Cyber awareness training conducted for staff
MITRE ATT&CK Framework
• he MITRE ATT&CK Framework is a globally used knowledge base
that describes how cyber attackers operate based on real-world
attack data.
• The MITRE ATT&CK framework is a universally accessible,
continuously updated knowledge base of cybercriminals' adversarial
behaviours.
• ATT&CK stands for:
Adversarial (malicious technique)Tactics, Techniques, and Common
Knowledge
• It helps security professionals understand, detect, and prevent cyber
attacks.
• Purpose of MITRE ATT&CK
• To document attacker behavior
• To improve threat detection and response
• To standardize cyber attack analysis
• To train students and professionals
• Case Study: Credential Theft and Data Breach Using MITRE ATT&CK
Framework
• Background
• XYZ University uses an online Learning Management System (LMS)
and email services for students and faculty. Several students reported
unauthorized access to their LMS accounts and leakage of internal
documents.
• On investigation, it was found that attackers had gained access
through phishing emails sent to students and staff.
• Attack Analysis Using MITRE ATT&CK Framework
• Tactic 1: Initial Access
• Technique: Phishing (T1566)
• The attacker sent fake emails pretending to be from the university IT cell asking
users to verify their LMS accounts.
• 📌 ATT&CK Mapping:
Initial Access → Phishing
• Tactic 2: Execution
• Technique: User Execution (T1204)
• Victims clicked on the malicious link and entered their credentials.
• 📌 ATT&CK Mapping:
Execution → User Execution
• Tactic 3: Credential Access
• Technique: Credential Harvesting (T1555)
• Login credentials were captured through a fake login page.
• 📌 ATT&CK Mapping:
Credential Access → Credential Harvesting
• Tactic 4: Persistence
• Technique: Valid Accounts (T1078)
• The attacker reused stolen credentials to maintain access.
• 📌 ATT&CK Mapping:
Persistence → Valid Accounts
• Tactic 5: Discovery
• Technique: Account Discovery (T1087)
• Attacker explored user roles and accessible files.
• 📌 ATT&CK Mapping:
Discovery → Account Discovery
• Tactic 6: Lateral Movement
• Technique: Remote Services (T1021)
• Access spread from student accounts to shared academic resources.
• 📌 ATT&CK Mapping:
Lateral Movement → Remote Services
• Tactic 7: Exfiltration
• Technique: Exfiltration Over Web Services (T1567)
• Confidential documents were uploaded to an external server.
• 📌 ATT&CK Mapping:
Exfiltration → Web Services
• Tactic 8: Impact
• Technique: Data Manipulation (T1565)
• Internal academic data was altered and leaked.
• 📌 ATT&CK Mapping:
Impact → Data Manipulation
• Impact of the Attack
• Compromise of student and staff accounts
• Leakage of confidential academic data
• Loss of trust in university IT systems
• Mitigation Measures (Mapped to ATT&CK)
• Enable Multi-Factor Authentication (MFA)
• Conduct phishing awareness training
• Implement email filtering and monitoring
• Regular log auditing and incident response drills
• Learning Outcomes for Students
• ✔ Understand real-world attacker behavior
✔ Learn mapping of attacks using MITRE ATT&CK
✔ Differentiate tactics and techniques
• 1. Classification and Categories of Cybercrime
• Cybercrime can be classified based on the target of the crime.
• A. Cybercrime Against Individuals
• Crimes where an individual person is the primary victim.
• Examples:
• Phishing & Online Fraud – Fake bank emails asking for OTP
• Identity Theft – Using someone’s Aadhaar/PAN details
• Cyber Stalking & Harassment – Threatening messages on social media
• Email Spoofing – Sending fake emails in someone else’s name
• Real-World Example:
👉 Fraudsters sending fake “KYC update” messages leading to bank account
theft.
• B. Cybercrime Against Property
• Crimes involving data, systems, or digital assets.
• Examples:
• Ransomware Attacks – Encrypting files and demanding money
• Data Theft – Stealing customer databases
• Intellectual Property Theft – Stealing software source code
• Malware Attacks – Virus, Trojan, Spyware
• Real-World Example:
👉 WannaCry (Wannacrypt)ransomware attack affecting hospitals
and organizations worldwide.
• C. Cybercrime Against Organizations
• Crimes targeting companies, institutions, or universities.
• Examples:
• DDoS Attacks – Making websites unavailable
• Insider Attacks – Employees leaking data
• Corporate Espionage – Stealing business secrets
• Website Defacement – Hacking organizational websites
• Real-World Example:
👉 Attack on a university LMS system causing exam data leakage
• D. Cybercrime Against Government
• Crimes that threaten national security or public services.
• Examples:
• Cyber Terrorism
• Attacks on Government Websites
• Critical Infrastructure Attacks (power grid, railways)
• Real-World Example:
👉 Cyber attacks on government portals during elections.
• 2. Organizational Security Implications
• Cybercrime has serious consequences for organizations.
• Major Security Implications
[Link] Loss – Fraud, ransom payments
[Link] Breach – Loss of sensitive customer or student data
[Link] Damage – Loss of public trust
[Link] & Compliance Issues – Penalties under IT Act / GDPR
[Link] Disruption – System downtime, halted services
• 3. Governance in Cyber Security
• What is Security Governance?
• Security governance refers to the policies, roles, and processes used
by an organization to manage cyber security risks.
• Key Elements of Governance
• Management commitment
• Risk management framework
• Compliance with laws and standards
• Clear roles and responsibilities
• Examples of Standards:
• ISO/IEC 27001
• NIST Cybersecurity Framework
• Types of Security Policies
• 1. Information Security Policy
• Protects data confidentiality, integrity, and availability
• 2. Access Control Policy
• Defines who can access what
• Example: Role-based access control
• 3. Password Policy
• Strong passwords
• Regular password changes
• 4. Acceptable Use Policy (AUP)
• Rules for using internet, email, and systems
• 5. Incident Response Policy
• Steps to handle cyber attacks and breaches
• 5. Relationship Between Cybercrime, Governance & Policies
• Cybercrime creates threats
• Governance provides oversight and strategy
• Security policies provide rules and controls
• Together, they help organizations prevent, detect, and respond to
cyber attacks.
• Why Cyber Security Policies Are Important
• Companies face a range of potential threats to their systems and their
data. Many cyberattacks take advantage of an organization’s
employees in some way, exploiting negligence or tricking them into
taking action via a phishing or social engineering attack. The rise of
remote work has also introduced new threats due to the growth of
BYOD (Bring your own Devices Policies) policies and the potential for
compromised devices to be connected to corporate networks.
• cyber security policies help to protect the organization against cyber
threats and ensure that it remains compliant with applicable
regulations. These policies can reduce an organization’s risk by
training employees to avoid certain activities and can enable more
effective incident response by defining protocols for detecting,
preventing, and remediating them.
Types of Cyber Security Policies
• Types of Cyber Security Policies
• An organization may implement various cyber security policies. Some of
the most common ones include the following:
• IT Security Policy: An organization’s IT security policy defines the rules and
procedures for protecting the organization against cyber threats.
• Email Security Policy: An email security policy defines the acceptable use
of corporate email systems to help protect the organization against spam,
phishing, and malware (such as ransomware) and to prevent misuse of
corporate email.
• BYOD Policy: A BYOD policy defines rules for personal devices that are used
for work. These policies commonly define security requirements for these
devices, such as the use of an endpoint security solution, strong passwords,
and a virtual private network (VPN) when connecting to corporate
networks and IT assets via an untrusted network.
• Who Should Write Cyber Security Policies?
• How to Create a Cyber Security Policy