UNIT – I : SYSTEM SECURITY (With These attacks do not change data, only read

Explanations) or observe.

1. Model of Network Security Examples:

A network security model explains how  Eavesdropping – attacker listens to

information is protected while traveling communication
between a sender and receiver.  Traffic analysis – attacker studies
pattern of messages
Components:
Explanation:
 Sender → Creates and sends the Passive attacks are dangerous because the
message victim never knows someone is watching.
 Receiver → Receives the message No data is changed, only privacy is lost.
 Attackers → Try to intercept or
change the message
 Security services → Provide
protection methods B. Active Attacks
 Security mechanisms → Tools and
techniques used to apply these The attacker modifies or disrupts normal
protections operations.
 Cryptography → Converts data to
unreadable form to maintain security Examples:

How it works (Explanation)  Masquerade – pretending to be

someone else
1. The sender encrypts the message  Replay attack – resending captured
using a key. messages
2. The encrypted message travels  Modification – changing data
through the network.  DoS (Denial of Service) – making
3. Even if attackers capture it, they service unavailable
cannot understand it.
4. The receiver uses a decryption key Explanation:
to recover the original message. Active attacks cause direct damage. They
can delete files, change messages, or
This model ensures safe communication overload systems.
over insecure networks (like the Internet).

3. Security Services (X.800 Standard)

2. Security Attacks
Confidentiality
Security attacks harm confidentiality,
integrity, or availability of information. Keeps data secret.
Example: Encryption.
A. Passive Attacks
Integrity  Intrusion detection systems
 Access control mechanisms
Data must not be altered without
authorization. Explanation:
Example: Hash functions. If security services are “what we want,”
mechanisms are “how we get them.”
Availability

System/services should be available when

needed. 5. OSI Security Architecture
Example: Backup, DoS protection.
A framework that:
Authentication
 Defines types of security attacks
Verifies identity of user/system.  Defines security services
Example: Username-password, digital  Defines mechanisms to implement
certificates. the services

Non-repudiation Explanation:
OSI security architecture helps standardize
A person cannot deny his/her actions. security so that all networks can follow a
Example: Digital signatures. common security model.

Access Control

Restricts who can access which resources. 6. Cryptography Primer

Example: ACLs, role-based control.
Cryptography = science of protecting
Explanation: information.
Security services are the goals of network
security. Every system must provide these to Symmetric Key Cryptography
be safe.
 One key for encryption + decryption
 Fast
 Example: AES, DES
4. Security Mechanisms
Asymmetric Key Cryptography
These are tools/techniques used to achieve
security services.  Two keys: public and private
 Used in secure email, digital
Examples: signatures
 Example: RSA, ECC
 Encryption
 Digital signatures Hash Functions
 Authentication systems
 Firewalls  No key
  One-way function Web apps are vulnerable because they are
 Produces fixed-length output (hash) publicly accessible.
 Example: SHA-256
Important protections:
Explanation:
Cryptography is the heart of network  Input validation
security. Without it, we cannot protect data  Authentication & authorization
in transit.  Session management
 HTTPS encryption
 Prevent SQL Injection, XSS, CSRF

7. Intrusion Detection System (IDS) Explanation:

Web security focuses on ensuring that
Monitors network/system for suspicious websites cannot be hacked easily.
behavior.

Types:
10. OWASP Top 10 (2021)
 Network IDS – monitors entire
network Most critical web app risks:
 Host IDS – monitors a single system
 Signature-based – matches known 1. Broken Access Control
attack patterns 2. Cryptographic Failures
 Anomaly-based – detects unusual 3. Injection
behavior 4. Insecure Design
5. Security Misconfiguration
Explanation: 6. Vulnerable Components
IDS does not stop attacks; it alerts 7. Auth Failures
administrators. 8. Software/Data Integrity Failures
9. Logging Failures
10. SSRF

8. Intrusion Prevention System (IPS) Explanation:

OWASP gives global standards for
 Works like IDS but also blocks identifying and fixing web security risks.
attacks automatically
 Placed directly in network path Unit2

Explanation: 1. INTERNET SECURITY

IPS is proactive; it stops attacks in real time.
Definition:

Internet security refers to protecting data,

9. Security for Web Applications systems, and communication over the public
Internet from attacks.
Need for Internet Security  Insider attacks
 Unauthorized access
 The Internet is open and untrusted  Malware spreading inside
 Data travels through many organization
intermediate networks
 Attackers can intercept or modify
data
3. LOCAL AREA NETWORK (LAN)
Major Components SECURITY

 Firewalls – filter unwanted traffic Definition:

 Antivirus – protects end devices
 IDS/IPS – detect and prevent LAN security ensures the safety of devices
intrusions connected within a small area like a building
 SSL/TLS – secure communication or campus.
 HTTPS – encrypted web browsing
 VPN – secure tunnel for safe Threats
communication
 ARP spoofing
Threats  MAC address spoofing
 Rogue devices
 Phishing  Packet sniffing
 Malware attacks
 Man-in-the-middle attacks Security Measures
 Denial of Service (DoS)
 Switch Port Security
 MAC filtering
 802.1X Authentication
2. INTRANET SECURITY  VLANs
 Regular updates of routers &
Definition: switches

Intranet security protects an organization’s Diagram (Text Form)

internal private network.
[PC] --\
Security Measures [PC] ---- Switch ---- Router ---- Internet
[PC] --/
 Access control policies (Switch protected using MAC filtering
 Internal firewalls and port security)
 Authentication mechanisms
 Patch management
 Network segmentation 4. WIRELESS NETWORK SECURITY
 Monitoring and logging
Definition:
Threats
Protection of Wi-Fi networks from  Node capture
unauthorized access and attacks.  Sinkhole attack
 Sybil attack
Threats  Wormhole attack

 Eavesdropping Security Requirements

 Rogue Access Points
 WPA cracking  Lightweight encryption
 Man-In-The-Middle attacks  Authentication
 Secure routing
Security Protocols  Node monitoring

 WEP – outdated and insecure

 WPA – better
 WPA2 – widely used, strong 6. CELLULAR NETWORK SECURITY
 WPA3 – most secure (GSM/3G/4G/5G)

Security Techniques Definition:

 Strong Wi-Fi passwords Cellular security protects mobile

 Disable WPS communication.
 MAC filtering
 Hidden SSID (optional) Security Mechanisms
 Wireless IDS
 SIM-based authentication
 Encryption algorithms (A5/x for
GSM)
5. WIRELESS SENSOR NETWORK  Mutual authentication in 3G/4G
(WSN) SECURITY  Strong privacy and slicing security in
5G
Definition:
Threats
WSNs are networks of tiny sensors that
collect data (temperature, vibration,  Fake base stations (IMSI catcher)
environment, etc.).  SIM cloning
 Location tracking
Challenges

 Limited power
 Limited memory 7. MOBILE SECURITY
 Wireless communication is easy to
intercept Definition:
 Deployed in open areas
Protecting smartphones from hardware,
Common Attacks software, and network threats.
Threats Kali Linux is a specialized operating system
used for ethical hacking, penetration testing,
 Malicious apps and security auditing.
 Phishing
 Spyware Features
 Insecure Wi-Fi
 600+ preinstalled security tools
Security Measures  Free and open-source
 Supports digital forensics and
 App sandboxing network analysis
 App permissions
 Secure boot Popular Tools in Kali Linux
 Anti-malware
 Regular OS updates  Nmap – network scanning
 Biometric locks  Metasploit – exploit framework
 Wireshark – traffic capture
 Aircrack-ng – Wi-Fi security testing
 Burp Suite – web security testing
8. IoT SECURITY (Internet of Things
Security) Use Case

Definition: Helps cybersecurity analysts identify and fix

weaknesses before attackers exploit them.
Protection of interconnected smart devices
like sensors, cameras, wearables, appliances. 1. Information Security Essentials for IT
Managers
Challenges
Definition:
 Weak default passwords
 No regular updates Information security essentials are the basic
 Many devices = large attack surface principles and practices IT managers must
follow to protect organizational information
Security Solutions from threats.

 Device authentication Key Areas

 Secure firmware updates
 Strong encryption 1. Confidentiality – Only authorized
 Network segmentation persons can access information.
 Cloud-based monitoring 2. Integrity – Information must not be
altered illegally.
3. Availability – Systems and data
must be available when needed.
9. CASE STUDY: KALI LINUX 4. Risk Management – Identify,
assess, and control risks.
Definition: 5. Incident Response – Detect, report,
and resolve security incidents.
 6. Compliance – Follow legal and implemented, monitored, and updated
security standards (ISO 27001, regularly.
GDPR).

Explanation:
3. Policy-Driven System Management
IT managers ensure that an organization’s
information is secure from internal and Definition:
external threats by implementing correct
policies, training employees, and monitoring Policy-driven management refers to
systems. managing IT systems based on pre-defined
rules and policies created by the
organization.

2. Security Management System Types of Policies

Definition:  Password policies

 Email policies
A Security Management System (SMS) is a  Internet usage policies
structured framework that manages and  Backup policies
controls all security processes of an  Access control policies
organization.  Encryption policies

Components Benefits

 Security Policy  Keeps system behavior consistent

 Risk Assessment  Prevents unauthorized activities
 Security Controls (Technical +  Helps comply with standards
Administrative)  Reduces insider threats
 Security Monitoring  Defines what users can and cannot
 Security Auditing do
 Incident Management
Explanation:
Diagram (Text-form)
The organization writes rules (policies), and
Security Policy IT systems automatically follow them using
| software tools.
Risk Management --> Controls --> Example: Password must be 12 characters;
Monitoring --> Audit --> Improvement enforced by system.

Explanation:

SMS works in a continuous cycle to keep 4. IT Security

the organization secure.
It ensures that security is planned, Definition:
IT Security refers to protecting all identified and how they get access to IT
information technology resources such as resources.
computers, networks, servers, databases, and
cloud systems. Key Functions of IAM

Components 1. Identity creation (user accounts)

2. Authentication (proving identity)
 Network Security 3. Authorization (what user can
 Application Security access)
 Database Security 4. Single Sign-On (SSO)
 Endpoint Security 5. Password management
 Cloud Security 6. Privileged Access Management
(PAM)
Threats
Authentication Methods
 Malware
 Data breaches  Password
 Insider threats  OTP
 Ransomware  Biometrics
 Unauthorized access  Tokens
 Certificate-based authentication
Security Controls
IAM Models
 Firewalls
 Antivirus  RBAC (Role-Based Access
 IDS/IPS Control)
 Encryption  ABAC (Attribute-Based Access
 User authentication Control)
 MAC (Mandatory Access Control)
Explanation:
Explanation:
IT security protects all IT resources that
support business operations. IAM ensures that the right people access the
It covers hardware, software, data, and right resources at the right time.
networks. It prevents unauthorized access and insider
attacks.

5. Online Identity and User Management

System (IAM) 6. Case Study: Metasploit

Definition: Definition:

Identity and Access Management (IAM) is a Metasploit is a powerful penetration testing

system that manages how users are framework used to test system
vulnerabilities.
Features  Identify what happened
 Identify how it happened
 Large library of exploits  Identify who is responsible
 Easy-to-use console  Collect evidence that is legally
 Payload generation acceptable
 Post-exploitation modules
 Automated scanning features Steps (Forensic Process)

Common Modules 1. Identification

2. Collection
 Exploit modules – attack 3. Preservation
vulnerabilities 4. Analysis
 Payloads – code executed on target 5. Documentation
 Auxiliary modules – scanning, 6. Presentation
sniffing
 Encoders – evade antivirus

Use Cases 2. DISK FORENSICS

 Testing security of networks Definition:

 Finding vulnerabilities
 Training cybersecurity students Disk forensics deals with analyzing hard
 Demonstrating attacks ethically drives, SSDs, USB drives, and storage
devices.
Explanation:
Activities
Metasploit helps ethical hackers find
weaknesses in systems before real attackers  Recover deleted files
do.  Analyze file systems (NTFS, FAT,
It supports multiple platforms (Windows, EXT)
Linux, Android).  Extract metadata
 Clone disks using write blockers
UNIT – IV : CYBER SECURITY AND  Examine hidden or encrypted data
CLOUD SECURITY (NOTES)
Tools

 Autopsy
1. CYBER FORENSICS  FTK Imager
 EnCase
Definition:
Explanation:
Cyber forensics is the process of collecting,
analyzing, and preserving digital evidence Disk forensics helps retrieve data even after
for use in investigations and legal cases. it is deleted or formatted.

Goals
3. NETWORK FORENSICS

Definition: 5. DATABASE FORENSICS

Network forensics analyzes network traffic Definition:

to detect intrusions and attacks.
Examines databases and logs to find
Activities unauthorized activities.

 Capture packets Activities

 Analyze suspicious traffic
 Detect DoS, DDoS, MITM attacks  Log analysis
 Trace attackers  SQL injection trace
 Examine logs  Recovery of deleted records
 Transaction analysis
Tools
Explanation:
 Wireshark
 Tcpdump Database forensics is important because
 Snort attackers often target data stored in
databases (customer data, financial data).
Diagram (Text)

Network Traffic -> Packet Capture ->

Analysis -> Evidence 6. MALWARE FORENSICS

Definition:
4. WIRELESS FORENSICS
Analysis of malicious software to
Definition: understand its behavior and impact.

Wireless forensics focuses on incidents Types of Analysis

involving Wi-Fi and wireless networks.
 Static analysis – study malware
Tasks without running it
 Dynamic analysis – run malware in
 Capture wireless frames sandbox
 Identify rogue access points  Memory forensics – examine RAM
 Detect unauthorized devices for malicious code
 Analyze WPA/WPA2 encryption
attacks Tools

Tools  IDA Pro

 OllyDbg
 Aircrack-ng  Cuckoo Sandbox
 Kismet
7. MOBILE FORENSICS 9. Best Security Practices for Automation

Definition: Automation improves security by reducing

human errors and speeding up responses.
Mobile forensics involves examining
smartphone data (Android/iOS). Best Practices

Data Extracted  Automate patch management

 Automated vulnerability scanning
 Call logs  Continuous monitoring
 SMS  Use DevSecOps
 WhatsApp chats  Automated backups
 Photos  Automated log analysis
 Location info
 Deleted files Explanation:

Challenges Automation helps organizations react

quickly to threats and maintain consistent
 Encryption security.
 Device lock
 Cloud backups

10. CLOUD INFRASTRUCTURE

MANAGEMENT
8. EMAIL FORENSICS
Definition:
Definition:
Process of managing cloud resources like
Email forensics analyzes email messages for virtual machines, storage, networking, and
evidence. applications.

Activities Tasks

 Header analysis  Provisioning resources

 Phishing investigation  Monitoring performance
 Trace sender IP  Backup and disaster recovery
 Identify forged emails  Patch management
 Attachment investigation  Identity and access control

Explanation: Cloud Deployment Models

Email is commonly used for fraud and  Public cloud

phishing, so email forensics is important for  Private cloud
cyber investigations.  Hybrid cloud
  Community cloud  Multi-tenancy protection
 Strong authentication
Cloud Service Models  Access logging

 IaaS Explanation:
 PaaS
 SaaS Cloud customers must trust the provider to
protect:

 virtual resources (IaaS)

11. Establishing Trust in Cloud (IaaS,  development platforms (PaaS)
PaaS, SaaS)  user data (SaaS)

A. IaaS (Infrastructure as a Service)

Examples: AWS EC2, Google Compute 12. CASE STUDY: DVWA (Damn
Vulnerable Web App)
Security Requirements
Definition:
 Virtual machine isolation
 Secure APIs DVWA is a deliberately insecure web
 Network segmentation application used for learning and testing web
 Hypervisor security security.

Purpose

B. PaaS (Platform as a Service)  Practice ethical hacking

 Understand web vulnerabilities
Examples: Heroku, Google App Engine  Learn security testing

Security Requirements Vulnerabilities in DVWA

 Secure runtime environment  SQL Injection

 Trusted libraries  XSS
 Protection against malicious code  CSRF
injection  File Inclusion
 Broken Authentication
 Command Injection

C. SaaS (Software as a Service) Explanation:

Examples: Gmail, Office 365 DVWA is widely used in cybersecurity labs

to teach students how vulnerabilities work
Security Requirements and how to secure applications.

 Data encryption
UNIT – V : PRIVACY AND STORAGE PETs are tools and techniques that protect
SECURITY (NOTES) user data and identity online.

Common PETs

1. PRIVACY ON THE INTERNET  Encryption – protects

communication
Definition:  Anonymization – removes
identifying details from data
Privacy on the Internet means protecting  Pseudonymization – hides real
personal information while using websites, identities behind fake names
apps, emails, and online services.  Tor Browser – anonymous
browsing
Threats to Internet Privacy  Mix networks – hide
communication patterns
 Tracking (cookies, browser  Differential privacy – adds noise to
fingerprinting) data for privacy
 Data leaks  Zero-Knowledge Proofs – verify
 Phishing attacks without revealing data
 Social engineering
 Malware Explanation:
 Unsecure websites (HTTP)
PETs help users stay anonymous, secure,
Ways to Protect Privacy and private while using digital services.

 Use HTTPS
 Use VPN
 Private browsing mode 3. PERSONAL PRIVACY POLICIES
 Strong passwords
 Avoid sharing sensitive info Definition:
 Disable unnecessary tracking
 Use privacy-focused browsers Rules created by individuals or
organizations on how personal data should
Explanation: be collected, used, stored, and shared.

When users browse the Internet, companies Examples

and attackers may collect personal data.
Proper privacy practices help keep user data  App permission settings
safe.  Browser privacy policies
 Social media privacy settings
 Website cookies consent
 Do-not-track preference
2. PRIVACY ENHANCING
TECHNOLOGIES (PETs) Key Elements

Definition:  Data collection methods

  Purpose of usage Conflicting policies reduce security and
 Storage period cause improper access.
 User control options Detecting and fixing conflicts ensures safe
 Data sharing rules and correct policy enforcement.

Explanation:

Privacy policies give transparency and allow 5. PRIVACY AND SECURITY IN

users to decide how much personal ENVIRONMENTAL MONITORING
information they want to share. SYSTEMS

Environmental monitoring systems (EMS)

use sensors to collect environmental data
4. DETECTION OF CONFLICTS IN like temperature, pollution, humidity, etc.
SECURITY POLICIES
Security Challenges
Definition:
 Wireless communication is
A conflict occurs when two or more security vulnerable
policies contradict each other.  Sensors are deployed in open areas
 Data manipulation attacks
Common Types of Conflicts  Node capture attacks

1. Access Control Conflicts Privacy Challenges

o Example: One rule allows
access, another denies it.  Sensitive environmental data can be
2. Firewall Rule Conflicts misused
o Overlapping or contradictory  Location-based data can reveal
rules. patterns
3. Privacy vs. Security Conflicts
o Security requires logging, Security Measures
privacy demands minimal
data collection.  Lightweight encryption
4. Role-based conflicts  Secure key distribution
o Users assigned conflicting  Authentication of sensors
roles.  Redundant sensors for integrity
 Regular monitoring
Detection Methods
Explanation:
 Rule dependency analysis
 Policy comparison EMS are used in agriculture, weather
 Consistency checking tools monitoring, and smart cities, so data must be
 Automated conflict detection protected for accuracy and reliability.
systems

Explanation:
6. STORAGE AREA NETWORK (SAN) 1. SAN Switches
SECURITY o Provide zoning and traffic
control.
Definition: 2. Encryption Appliances
o Encrypt SAN traffic and
A Storage Area Network (SAN) is a high- protect storage data.
speed dedicated network that provides 3. Tape Libraries
block-level storage to servers. o Store backup data securely.
4. Firewalls for SAN
SAN Components o Filter unauthorized traffic.
5. HBA (Host Bus Adapters)
 Storage devices o Ensure secure server-to-SAN
 SAN switches communication.
 Host bus adapters (HBA)
 Management software Explanation:

SAN Vulnerabilities These devices help prevent unauthorized

access and safeguard sensitive enterprise
 Unauthorized access to storage data.
 Data theft
 Eavesdropping on SAN traffic
 Misconfigured zoning
8. RISK MANAGEMENT
SAN Security Measures
Definition:
 Zoning – divides SAN into isolated
zones Risk management is the process of
 LUN Masking – restricts which identifying, assessing, and controlling risks
devices can access which storage to an organization’s assets.
blocks
 Encryption – protects data at rest Steps in Risk Management
and in transit
 Secure management interfaces – 1. Risk Identification
restrict administrative access 2. Risk Analysis
3. Risk Evaluation
Diagram (Text) 4. Risk Treatment
o Avoid
Server --> Fiber Switch --> Storage o Reduce
| (Zoning) (LUN Masking) o Share/Transfer (insurance)
o Accept
5. Monitoring and Review
7. STORAGE AREA NETWORK (SAN)
SECURITY DEVICES Explanation:

Devices used in SAN Security

Risk management helps organizations
reduce potential losses and maintain
business continuity.

9. PHYSICAL SECURITY ESSENTIALS

Definition:

Physical security protects hardware,

facilities, people, and infrastructure from
physical threats.

Physical Security Controls

A. Preventive Controls

 Security guards
 Access badges
 Biometric locks
 Fencing
 CCTV
 Fire alarms

B. Detective Controls

 Motion sensors
 Video recording
 Intrusion detection devices

C. Corrective Controls

 Fire suppression systems

 Emergency exits
 Backup power (UPS)

Explanation:

Physical attacks can cause huge damage, so

organizations must ensure facilities are
protected just like digital assets.