Nasscom Digital Edge 101
Module - 8
Module 8 – Cybersecurity and Data
Protection
Topic 1: An Overview of Cybersecurity
Introduction to Cybersecurity
Cybersecurity is the comprehensive practice of deploying technology, defensive
controls, operational processes, and architectural frameworks to protect digital
networks, computer systems, devices, software programs, and sensitive data from
unauthorized access, malicious exploitation, damage, or sudden inaccessibility. It
balances the three pillars of the CIA Triad: Confidentiality (restricting data access to
authorized entities), Integrity (ensuring information is accurate and unaltered), and
Availability (guaranteeing that authenticated users have uninterrupted access to
resources).As a core technical discipline, cybersecurity focuses on identifying
infrastructure vulnerabilities, evaluating systemic threat vectors, and implementing
robust security frameworks to eliminate risks before they can impact corporate or
personal assets.
10 Steps to Cybersecurity
A resilient corporate cybersecurity posture requires a multi-layered defensive strategy.
The 10 essential steps for establishing enterprise-wide data and infrastructure
protection include:
1. Risk Management Regime: Establish an organizational risk governance
framework backed by leadership to continuously assess vulnerabilities, track
data patterns, and legally document accepted operational risks.
2. Secure Configuration Management: Create strict system configuration
baselines across all hardware, software, and operating systems to eliminate
default factory setups that adversaries routinely exploit.
3. Network Security Engineering: Enforce rigid perimeter defenses using firewalls,
intrusion prevention systems (IPS), demilitarized zones (DMZs), and software-
defined network segmentation to isolate critical business assets.
4. Managing User Privileges (Least Privilege Principle): Implement strict Identity
and Access Management (IAM) systems to ensure employees only hold the
minimum access levels required to perform their specific job functions.
1|Page
5. User Education and Awareness Training: Conduct systematic simulations and
training programs to cultivate a security-first culture, reducing human error and
vulnerability to social engineering.
6. Incident Response and Operations Control: Build a dedicated Incident
Response Plan (IRP) managed by a Security Operations Center (SOC) to detect,
isolate, contain, and remediate cyber breaches.
7. Malware Protection Defenses: Deploy Next-Generation Antivirus (NGAV)
solutions and anti-malware scanners across all layers of infrastructure to block
unauthorized software execution.
8. Continuous Monitoring and Logging: Establish real-time threat monitoring
platforms to log network events, trace credential usage, and parse machine-
generated logs for anomalous system activity.
9. Removable Media and Asset Controls: Restrict or heavily encrypt data moving
onto portable drives, and enforce data loss prevention (DLP) rules to stop
unauthorized information extraction.
10. Home and Remote Working Security: Implement multi-factor authentication
(MFA), virtual private networks (VPNs), and strict endpoint logging to protect off-
site systems accessing the corporate network.
Future of Cybersecurity in Healthcare
The healthcare industry is experiencing a rapid influx of medical digital data, driven by
Connected Health platforms, Electronic Health Record (EHR) integrations, and
wearable health trackers.
• Expanded Attack Surface: While these integrated platforms improve real-time
patient monitoring and diagnostic speed, they also create a highly attractive
target for deep exploitation.
• Targeted Vulnerabilities: Malicious threat actors target legacy medical legacy
systems, such as unpatched hospital equipment running vulnerable firmware.
• The Next Gen Horizon: The future of healthcare cybersecurity relies heavily on
deploying machine learning algorithms to identify anomalous behavior within
medical storage grids. Advanced encryption architectures must protect Personal
Health Information (PHI) both at rest and in transit across decentralized care
networks.
2|Page
Types of Cybersecurity
Modern digital infrastructure requires deploying distinct subcategories of cybersecurity
solutions:
Cybersecurity Core Technical Focus
Primary Operational Scope
Category Areas
Protects multi-tenant Firewalls, IPS, network
Network
networking lines and traffic segregation, port filtering,
Security
routers. and protocol verification.
Web AppSec, Web
Prevents unauthorized Application Firewalls
Application
software exploitation at the (WAF), secure code
Security
application layer. reviews, and SSDLC
frameworks.
Shared Responsibility
Safeguards cloud instances,
Models, automated
Cloud Security multi-cloud platforms, and
compliance, and API
virtualized assets.
security governance.
Critical Shields national digital assets SCADA system isolation,
Infrastructure (energy, public transit, network air-gapping, and
Security utilities). operational compliance.
Maintains integrity and Drive encryption, File
confidentiality of Integrity Monitoring (FIM),
Data Security
structured/unstructured and data destruction
databases. wiping.
Extended Detection and
Hardens user entry devices Response (XDR), EDR
Endpoint
(laptops, mobile phones, tools, and automated
Security
workstations). security patch
management.
3|Page
Cybersecurity Core Technical Focus
Primary Operational Scope
Category Areas
Minimizes vulnerabilities Firmware threat mitigation,
IoT Security introduced by connected network isolation, and
physical devices. device classification.
Mobile Device
Protects smartphones and
Management (MDM),
Mobile Security portable tablets from
containerization, and safe
malicious data leaks.
credential storage.
Access logging, user
Operational Sets operational protocols for behavior analytics, and
Security data handling and tracking. operational role
verification.
Explicit identity
Replaces legacy perimeter
Zero Trust verification, least privilege
defenses with strict micro-
Architecture access, and assumed
segmentation.
system breach lanes.
Essential Elements of Cybersecurity & Three Critical Components
To safeguard enterprise assets effectively, an architecture must unify three foundational
layers: People, Processes, and Technology.
• People (The Human Defense): Security awareness training is essential to
transform workers into human defensive firewalls. Employees must be trained to
identify phishing attacks, report suspicious emails, and follow corporate integrity
standards.
• Processes (The Operational Guardrails): Operational processes dictate how an
enterprise monitors risks, enforces security rules, and responds to active
network breaches. This includes maintaining system asset inventories and
setting strict guidelines for multi-user database sharing.
4|Page
• Technology (The Defensive Toolset): Technological solutions provide the
physical and software-based defenses needed to execute policy directives.
These include deploying virtual firewalls, automated vulnerability scanners, next-
gen antivirus engines, and database secure gateways.
Topic 2: Applications of Cybersecurity
Why Cybersecurity Is Important?
Cybersecurity is no longer just a technical support requirement; it is a core business
necessity that directly impacts corporate survival and brand value.
• Preventing Financial Exploitation: Proactively addressing and preventing cyber
risks shields organizations from devastating financial extortion, high-cost
ransom demands, and legal non-compliance penalties.
• Preserving Business Reputation: Customers want assurance that their
sensitive financial records and personal tracking details live in secure hands. A
single major data breach can instantly break consumer trust, damage corporate
integrity, and lead to a significant decline in share value.
Cybersecurity in Cloud Computing
Cloud security uses a combination of procedures and technologies designed to manage
internal and external threats targeting cloud-hosted virtual infrastructure.
The Shared Responsibility Model
Cloud environments function under a explicit Shared Responsibility Model split
between the enterprise and the cloud service provider (CSP). Under this framework:
• The CSP Secures the Cloud: The provider manages the physical security of data
centers, hypervisors, server virtualization engines, and the underlying storage
grid.
• The Customer Secures in the Cloud: The customer remains responsible for
data governance, network traffic rules within their virtual cloud network, custom
application code, data encryption, and Identity and Access Management (IAM)
permissions.
Crucial Cloud Risks and Systemic Threats
• Misconfigured Cloud Storage: Organizations often struggle to securely manage
settings across multiple cloud providers with varying default security
5|Page
parameters. This can accidentally leave cloud databases exposed to the public
internet.
• Advanced Persistent Threats (APTs): Highly sophisticated, long-term
cyberattacks where an intruder establishes a stealthy presence inside cloud
networks. APT actors hide within systems for months, moving across active
workloads to steal intellectual property.
• Shadow IT Operations: The accessibility of cloud computing allows developers
or departments to connect third-party APIs or launch undocumented workloads
without the security team's knowledge, introducing unmanaged vulnerabilities
into the perimeter.
Cybersecurity Essentials to Safeguard Web Apps
Web Application Security (Web AppSec) builds defensive guardrails directly into web
applications to protect databases and code from malicious exploitation throughout the
software development life cycle (SDLC). Key technical defenses include:
• Input Filtration and Parameter Validation: Rigidly filter and sanitize user inputs
across web forms to strip out executable code snippets or malformed
parameters.
• Web Application Firewalls (WAF): Deploy high-performance WAF solutions at
the logical network edge to inspect incoming HTTP/HTTPS traffic and block
common attack payloads.
• Database Secure Gateways (DSG): Route all data retrieval and entry requests
through a DSG layer to verify query structures before they interact with the
primary database server.
Cybersecurity Frameworks
Cybersecurity frameworks are structured sets of internationally recognized guidelines,
standardized policies, and prescriptive controls designed to help organizations
establish and maintain a strong security posture.
NIST Cybersecurity Framework (NIST CSF)
The NIST CSF is a widely adopted policy document that creates a common language for
identifying, managing, and reducing technical risks. The core framework maps security
operations across five continuous functions:
[ IDENTIFY ] [ PROTECT ] [ DETECT ] [ RESPOND ] [ RECOVER ]
6|Page
1. Identify (ID): Gain an operational understanding of system assets, organizational
context, and vulnerable risks (e.g., Asset Management: [Link]).
2. Protect (PR): Implement targeted safeguards like identity access management,
data encryption, and firewalls to protect critical services.
3. Detect (DE): Deploy real-time threat monitoring systems to identify anomalies
and verify cybersecurity events quickly (e.g., Detection Processes: [Link]-3).
4. Respond (RS): Execute structured containment plans and communication
protocols immediately upon discovering an active breach (e.g., Response
Planning: [Link]).
5. Recover (RC): Execute resilience and business continuity plans to restore
capabilities and systems impacted by an incident.
CIS Controls (Center for Internet Security)
The CIS Controls framework provides a prioritized, highly prescriptive set of 18 technical
best practices aimed at mitigating the most common real-world cyberattacks. CIS
Controls Version 8 is specifically optimized to protect hybrid networks and multi-tenant
cloud environments.
ISO/IEC 27001 and 27002 Standards
ISO 27001 is an internationally recognized standard for building, operating, and auditing
an Information Security Management System (ISMS). It provides a comprehensive
approach to risk management, control implementation, and data tracking across
technology and human systems.
COBIT Framework
Developed by ISACA, the Control Objectives for Information and Related Technologies
(COBIT) acts as an IT governance and strategic management framework. It links
complex technical issues directly with corporate risk targets and control requirements.
Topic 3: Types of Cyber Attacks
Common Types of Cyber Attacks
1. SQL Injection (SQLi)
• Attack Vector: Relational databases communicate using Structured Query
Language (SQL) to manipulate records. When user forms lack input validation,
hackers can input malicious SQL string commands (e.g., ' or 1=1 --) into login or
search fields. If the web app processes this input unfiltered, the query evaluates
7|Page
as permanently "true", granting the attacker unauthorized access to hidden
tables or administrative functions.
• Technical Mitigation: Implement parametrized queries, prepared statements,
and rigid server-side input sanitization.
2. Cross-Site Scripting (XSS)
• Attack Vector: Attackers inject malicious JavaScript code directly into trusted
web applications, web forums, or review fields. When an innocent user opens
the affected page or clicks an infected hyperlink, the malicious script runs
automatically within their browser. This allows the attacker to steal session
cookies, hijack user credentials, or alter website contents.
• Technical Mitigation: Apply Context-Aware Output Encoding and strict Content
Security Policies (CSP).
3. Distributed Denial of Service (DDoS)
• Attack Vector: Hackers infect thousands of internet-facing devices with
malware to form a coordinated network of compromised systems, known as a
botnet. The attacker instructs the botnet to flood a target server with massive
volumes of fake data requests. This traffic spike quickly consumes the server's
processing power and network bandwidth, causing the application to crash or
become unavailable to real users.
• Technical Mitigation: Implement packet filtration tools to drop spoofed or
malformed packets, and configure aggressive connection timeouts.
4. Cross-Site Request Forgery (CSRF)
• Attack Vector: This exploit targets a web application after a user has
authenticated a session. The attacker tricks the authenticated user into clicking
a malicious link that forces their browser to send unauthorized commands
directly to the web app. Because the user is already logged in, the application
accepts the request, allowing attackers to modify account details or transfer
funds without permission.
• Technical Mitigation: Enforce unique cryptographic anti-CSRF tokens for all
state-changing requests and inspect incoming HTTP headers.
5. DNS Spoofing / Cache Poisoning
• Attack Vector: Attackers introduce fraudulent entries into a domain name
system (DNS) resolver's storage cache. When a user requests a legitimate
website URL, the poisoned DNS resolver maps the domain name to an
8|Page
unauthorized, malicious IP address controlled by the hacker, leaving both the
user and the site owner completely unaware of the redirection.
• Technical Mitigation: Deploy Domain Name System Security Extensions
(DNSSEC) and limit Time-To-Live (TTL) data durations.
6. Social Engineering (Phishing, Baiting, Pretexting)
• Attack Vector: Focuses on human manipulation rather than software flaws.
Phishing uses fraudulent emails designed to mimic trusted brands to steal bank
details or distribute malware. Baiting lures users with promises of free software
or digital gifts, tricking them into downloading infected files. Pretexting involves
an attacker fabricating scenarios to impersonate an authority figure,
manipulating employees into revealing confidential system access keys.
• Technical Mitigation: Implement strict continuous multi-factor authentication
(MFA) and conduct regular user security awareness training.
7. Non-Targeted Exploits
• Attack Vector: These automated attacks target broad software platforms rather
than single organizations. Automated scripts scan the internet for web hosting
setups, plugins, or Content Management Systems (CMS) like WordPress running
outdated, vulnerable versions.
• Technical Mitigation: Enforce automated software patch management and
continuous system updates.
8. Memory Corruption & Buffer Overflows
• Attack Vector: Memory corruption occurs when an attacker modifies specific
memory areas to install unauthorized, malicious software. A buffer overflow
happens when an application writes more data into a fixed memory storage
buffer than it can hold, overwriting adjacent memory spaces. This allows
attackers to execute malicious code payloads with administrative system
privileges.
• Technical Mitigation: Use memory-safe programming languages and run regular
anti-malware scans.
9|Page
Precautionary Defenses to Avoid Attacks
To build an effective defense against evolving cyber threats, organizations must
implement these eight core principles:
1. Maintain an exhaustive hardware and software asset inventory.
2. Deploy automated vulnerability scans matched against current CVE registries.
3. Enforce end-to-end data encryption for assets both at rest and in motion.
4. Implement network micro-segmentation to isolate critical data environments.
5. Establish multi-factor authentication (MFA) across all endpoints and access
routes.
6. Perform regular security audits and structural penetration testing.
7. Deploy Extended Detection and Response (XDR) tools for real-time anomaly
tracking.
8. Maintain a robust backup and recovery strategy to restore systems if an attack
occurs.
Topic 4: Data Privacy & User Data Control
What Is Data Privacy?
Data privacy is a specialized domain within data governance that regulates the ethical,
transparent, and legal collection, usage, processing, and sharing of personal and
sensitive data. It focuses on safeguarding Personally Identifiable Information (PII) and
Personal Health Information (PHI)—such as national identities, banking logs, and health
records—to ensure this data is never misused or accessed without explicit
authorization.
Data Privacy vs. Data Security
While closely linked, these two fields focus on distinct areas of data management:
DATA GOVERNANCE
DATA PRIVACY:
- Ethical Mandates - User Consent Rules - Policy Controls
DATA SECURITY:
- Technical Defenses - Firewalls - Hashing - Encryption
10 | P a g e
• Data Privacy Focuses on the "Why" and "Who": It defines user consent rules,
regulatory compliance mandates, individual autonomy, and the ethical
parameters governing how data is shared and used.
• Data Security Focuses on the "How": It provides the technical mechanisms—
such as access control lists (ACLs), encryption, and network monitoring—
needed to protect data from unauthorized access or destruction.
Core Data Privacy Laws
• General Data Protection Regulation (GDPR): A strict European framework
regulating data processing. Violations can trigger massive non-compliance fines
up to €20 million or 4% of an enterprise's global annual revenue.
• California Consumer Privacy Act (CCPA): Grants consumers specific rights
over their personal information, allowing them to track what data is collected
and opt out of its sale.
• HIPAA: A US federal framework designed to secure personal medical records
and protect health information.
Data Control & Security Controls
Data control provides the management oversight and policy audit frameworks needed
to verify information integrity and compliance across an enterprise.
Key Objectives and Quality Dimensions
• Timeliness: Ensuring data is consistently available within predefined
operational timeframes.
• Currency: Keeping data records updated and properly synchronized across all
production environments.
• Completeness: Verifying that mandatory data attributes and record inputs are
fully populated.
• Consistency: Maintaining standard formatting and presentation styles across
diverse systems.
Technical Implementations of Security Controls
Organizations categorize data security controls under the three pillars of the CIA Triad:
11 | P a g e
• Confidentiality Controls: Restrict resource access using multi-tenant Access
Control Lists (ACLs), OAuth frameworks, token authorizations, and multi-factor
authentication.
• Integrity Controls: Verify that data has not been altered using cryptographic
hashing algorithms, digital signatures, and write-access tracking logs.
• Availability Controls: Maintain data accessibility through high-availability
distributed storage, reliable databases, and automated backup solutions.
From an operational standpoint, these defenses are broken down by execution type:
DATA SECURITY TIMELINE
PREVENTIVE DETECTIVE CORRECTIVE
CONTROLS CONTROLS CONTROLS
- Least Privilege Access - Continuous Scanning - Incident Response
- Multi-Factor Auth - Anomalous Monitioring - System Recove
• Preventive Controls: Designed to actively block threats before they impact
systems (e.g., system hardening, multi-factor authentication, enforcing least
privilege access).
• Detective Controls: Monitor environments to catch active security events in real
time (e.g., continuous data threat scanning and intrusion detection monitoring).
• Corrective Controls: Applied to remediate systems and patch vulnerabilities
following a security event (e.g., executing incident response playbooks and
running antivirus remediation tools).
12 | P a g e
3 Data Privacy Challenges and Solutions
1. Consumer Trust Deficits: Consumers are often unaware of how their personal
details are stored or managed. Solution: Use clear, explicit privacy agreements,
emphasize data transparency, and offer simple opt-out controls.
2. Fragmented Global Legal Environments: Enterprises face a complex
patchwork of conflicting regional regulations. Solution: Build a unified global
compliance strategy that aligns with the strictest legal requirements, and hire
dedicated data privacy experts.
3. Rapid AI and Technical Innovation: Fast-paced technology adoptions outpace
standard policy controls, creating data exposure risks. Solution: Conduct
rigorous risk assessments before adopting new technologies, and establish an
internal Data Privacy Council to review AI algorithm development.
Topic 5: Deepfake
Deepfake Technology: The Threat Landscape
Deepfakes are highly realistic, AI-generated pieces of media—including text, images,
videos, and audio tracks—created using advanced machine learning models to depict
individuals saying or doing things they never actually did.
The Architecture of Deepfakes: GANs
Deepfake creation is typically powered by Generative Adversarial Networks (GANs). A
GAN operates by pitting two machine learning models against each other in an iterative
optimization loop:
• The Generator Node: Creates synthetic media inputs trying to mimic real data.
• The Discriminator Node: Evaluates the generated media against a real dataset
to identify structural flaws and errors.
This loop repeats until the generator creates synthetic outputs that the discriminator
can no longer distinguish from real footage, resulting in hyper-realistic deepfakes.
Types of Deepfakes
• Textual Deepfakes: AI-generated text blocks created using Natural Language
Processing (NLP) models to produce fake news or scale automated
misinformation.
13 | P a g e
• Deepfake Video (Face-Swapping): Swapping one person's facial attributes onto
another's body, used to create fake public statements or facilitate blackmail.
• Deepfake Images: Editing or synthesizing realistic profile pictures to build fake
online identities or bypass verification systems.
• Deepfake Audio (Voice Cloning): Replicating a specific individual’s vocal tones
and speech patterns to launch voice phishing scams.
• Live/Real-Time Deepfakes: Modifying video streams during live broadcasts or
virtual meetings to impersonate trusted individuals.
5 Dangerous Deepfake Scenarios for Businesses
Cybercriminals leverage deepfakes to launch sophisticated corporate attacks:
1. Digital Extortion Schemes: Using AI tools to generate explicit, non-consensual
media of corporate executives to blackmail them into leaking intellectual
property.
2. Executive Voice Cloned Vishing (Voice Phishing): Attackers clone an
executive's voice to contact financial departments, tricking them into authorizing
wire transfers to fraudulent accounts.
3. Zoombombing Impersonation: Scammers use real-time face-swapping
software during virtual video calls to impersonate company leadership and
manipulate business transactions.
4. Bypassing Biometric Security Systems: Using high-fidelity synthetic faces or
voice prints to trick identity verification gates used by banking and passport
applications.
5. Corporate Espionage and Synthetic Identity Fraud: Threat actors build entirely
synthetic personas backed by fake video and audio profiles to pass remote hiring
screens and gain access to corporate networks.
Detection Techniques and Business Mitigation Strategies
While AI advancements make deepfakes harder to catch by removing visible processing
artifacts, businesses can protect themselves using a mix of technical and operational
strategies:
• Analyze Behavioral Inconsistencies: Train teams to spot deepfakes by looking
for unnatural human facial movements, missing or irregular blinking patterns,
distorted lip movements, and background inconsistencies.
14 | P a g e
• Deploy AI-Powered Detection Tools: Use specialized security software
designed to analyze video streams for micro-pixel anomalies, vocal boundary
errors, and synthetic signatures.
• Implement Out-of-Band Authentication Protocols: Move past pure biometric
verification for high-value tasks. Require secondary confirmation channels—
such as custom verbal passphrases, digital security keys, or cryptographic
fingerprinting—before executing major financial operations.
15 | P a g e