Confidentiality
Only authorized people can see the information. Tools: passwords, encryption, access control.
01 Definition
What is cyber security?
Cyber security (also written cybersecurity) is the set of technologies, processes, and habits used to protect computers, mobile phones, servers, networks, applications, and data from theft, damage, and unauthorized access. It covers everything from a strong password on your phone to a bank’s round the clock security center.
KEY POINT
Security has one goal: keep information confidential, accurate, and available to the right people at the right time. These three ideas are called the CIA triad.
A complete overview
Almost everything we do now depends on digital systems. We pay with UPI and cards, store photos in the cloud, learn and work online, and even control home appliances from a phone. Each of these systems holds valuable information, and that makes it a target. Attackers may want money, secrets, control, revenge, or simply attention. A single stolen password can lead to an emptied bank account, a hospital can be forced to stop work by ransomware, and a company can lose years of trust after a data leak. Cyber security exists to make such attacks harder, to notice them quickly, and to limit the damage when they happen.
Good security is never one tool. It is a set of layers that work together: strong identities and passwords, software that is kept up to date, encryption that protects data in storage and in travel, firewalls and monitoring that watch the network, backups that allow recovery, and trained people who can spot a scam. Because the weakest layer is often a human being who clicks a convincing link, awareness matters as much as technology. Attackers and defenders are also in a constant race. As defenders close one weakness, attackers search for another, and new technology such as cloud computing, smart devices, and artificial intelligence keeps changing the battlefield. Learning how attacks work, and how to defend against them, is now a basic digital skill for students, professionals, and businesses alike.
The CIA triad
Integrity
Data is accurate and has not been changed without permission. Tools: hashing, digital signatures, version control.
Availability
Systems and data are there when needed. Tools: backups, redundancy, protection against DDoS attacks.
Main areas of cyber security
| Area | What it protects | Examples |
|---|---|---|
| Network security | Networks and the traffic moving through them | Firewalls, VPNs, intrusion detection |
| Application security | Software and websites | Secure coding, code review, web testing |
| Information security | Data in storage and in transit | Encryption, data loss prevention |
| Endpoint security | Laptops, phones, and servers | Antivirus, endpoint detection and response |
| Cloud security | Cloud accounts and services | Access policies, configuration checks |
| Identity and access | Who can enter and what they can do | Passwords, multi factor login, single sign on |
| Operational security | Daily handling of data and permissions | Policies, least privilege, monitoring |
| IoT and mobile security | Smart devices and phones | Firmware updates, app permissions |
| Disaster recovery | Getting back to work after an incident | Backups, recovery plans, drills |
02 History
The history of cyber security
Cyber security grew with computers. Every new technology brought new ways to misuse it, and new ways to defend it.
- 1960s
Passwords and the first break ins
Shared computers at universities introduce passwords. It is widely reported that a student at MIT in 1962 printed out the password file, one of the earliest known cases of password theft.
- 1971
Creeper and Reaper
Creeper, written by Bob Thomas, is an experimental program that moves between computers on ARPANET and is often called the first computer worm. A second program, Reaper, was made to find and remove it, an early form of antivirus.
- 1970s
Cryptography goes public
Diffie and Hellman publish public key ideas in 1976, and the RSA method follows in 1977. This makes secure communication between strangers possible.
- 1983
WarGames and the first hacker panic
The film WarGames shows a teenager breaking into a military computer. The same year, a group of teenagers known as the 414s are caught after breaking into several US systems. Governments begin to take computer crime seriously.
- 1986
The Cuckoo’s Egg and computer crime laws
Astronomer Clifford Stoll traces a hacker who was stealing information for a foreign intelligence service, a story he later turned into a famous book. The United States passes the Computer Fraud and Abuse Act.
- 1988
The Morris Worm
Robert Tappan Morris releases one of the first major internet worms, which slows a large part of the early internet. It leads to the creation of the first Computer Emergency Response Team, CERT.
- 1990s
The internet goes public
Websites, email, and online shopping spread. SSL, the ancestor of today’s TLS and the lock icon in browsers, is introduced in 1995. Antivirus and firewall products become common. Famous hacker Kevin Mitnick is arrested in 1995.
- 1999 to 2003
Mass email viruses and fast worms
Melissa (1999) and ILOVEYOU (2000) spread through email to millions of computers. The SQL Slammer worm (2003) infects vulnerable servers worldwide within minutes.
- 2000 to 2004
Laws and agencies in India
India passes the Information Technology Act in 2000, and the national agency CERT In is set up in 2004 to handle cyber incidents.
- 2007
Cyber attacks on a country
Estonia faces large scale attacks on government, bank, and media websites, one of the first widely discussed examples of cyber conflict between nations.
- 2010
Stuxnet
Stuxnet, a highly advanced worm, is discovered. It targeted industrial equipment and showed that software can cause physical damage.
- 2013 and 2014
Mega breaches and public awareness
The Target retail breach (2013), the Snowden disclosures about mass surveillance (2013), the Heartbleed bug in a widely used encryption library (2014), and the Sony Pictures hack (2014) make security a boardroom topic.
- 2016 and 2017
Botnets and ransomware
The Mirai botnet uses hacked cameras and routers to launch a huge DDoS attack in 2016. In 2017 the WannaCry ransomware hits hospitals and companies in over 100 countries, and was slowed when researcher Marcus Hutchins found a kill switch. NotPetya causes major damage the same year.
- 2018
Privacy laws
The European GDPR comes into force, setting strict rules for protecting personal data and requiring breach reporting. Many countries follow with their own laws.
- 2020 and 2021
Supply chain and critical infrastructure
The SolarWinds attack (found in December 2020) shows how a trusted software update can spread an intrusion. In 2021 ransomware halts the Colonial Pipeline in the United States, and the Log4Shell flaw affects countless systems.
- 2023 onward
AI, deepfakes, and new privacy rules
Attackers use AI for convincing phishing and voice and video fakes, and defenders use AI to detect threats. India passes the Digital Personal Data Protection Act in 2023. Zero trust, passkeys, and preparation for quantum computers become key themes.
03 Hackers
Who are hackers?
A hacker is someone who uses technical skill to explore, change, or break into computer systems. The word is not always bad. Many hackers work to protect systems. What matters is permission and intention.
LEGAL WARNING
Entering or testing a system you do not own, without written permission, is a crime in almost every country, even if you mean no harm. In India, the Information Technology Act, 2000 (for example sections 43 and 66) covers unauthorized access. Practice only on your own devices or in legal training labs.
Types of hackers
| Type | Who they are | Motive | Legal? |
|---|---|---|---|
| White hat | Ethical hackers and security testers hired to find weaknesses | Protect systems, earn a living | Yes, with permission |
| Black hat | Criminals who attack for gain or harm | Money, theft, damage | No |
| Grey hat | Find flaws without permission but often report them | Curiosity, recognition | Often not, even with good intent |
| Script kiddie | Beginners who run tools made by others | Fun, bragging | No |
| Hacktivist | Attackers with a political or social cause | Protest, publicity | No |
| State backed group | Skilled teams linked to governments, often called APTs | Spying, disruption, strategy | Not for ordinary law, but a major global issue |
| Cybercriminal gang | Organized groups running ransomware and fraud | Large profits | No |
| Insider | Employees or partners who misuse their access | Revenge, money, or by mistake | Depends |
Red team, blue team, purple team
Red team
Plays the attacker, with permission, to test how well the organization can resist a real attack.
Blue team
Defends. Monitors systems, detects intrusions, and responds to incidents.
Purple team
Red and blue teams work together and share findings so defenses improve faster.
How attackers think: the attack lifecycle
- ReconnaissanceCollect information about the target: people, systems, and weak points.
- WeaponizationPrepare a tool or message, such as a malicious file or a fake page.
- DeliverySend it by email, message, website, or a removable drive.
- ExploitationUse a software flaw or trick a person to gain a foothold.
- InstallationPlant software that lets the attacker stay inside.
- Command and controlThe attacker remotely controls the compromised system.
- Actions on goalsSteal data, lock files, or cause damage.
Defenders use this model to stop attacks at an early step. The earlier an attack is broken, the smaller the damage.
Famous hackers and incidents
Kevin Mitnick
A well known hacker of the 1980s and 1990s who mostly used social engineering, meaning tricking people. After prison he became a respected security consultant and author. He passed away in 2023.
Robert Tappan Morris
Created the 1988 Morris Worm as an experiment that spread out of control. He was the first person convicted under the US Computer Fraud and Abuse Act and later became a professor.
Gary McKinnon
A British man who accessed US military and NASA computers in the early 2000s. His case led to a long fight over extradition, which was eventually blocked.
Marcus Hutchins
A security researcher who helped stop the spread of WannaCry in 2017 by registering a web address that acted as a kill switch.
Anonymous
A loose collective of activists, known for protest style attacks and the Guy Fawkes mask. It has no formal leaders or membership.
Lazarus Group
A hacking group that several governments and security companies link to North Korea, associated with major heists and the Sony Pictures attack.
Ethical hacking and bug bounties
Many companies pay researchers to find and report flaws responsibly. Programs on platforms such as HackerOne and Bugcrowd, and company run bug bounty programs, let skilled people earn money and recognition legally. Typical certifications include CEH, CompTIA Security Plus, eJPT, and OSCP.
04 Attacks
Common cyber attacks
Viruses, worms, and trojans
Harmful software. Viruses attach to files, worms spread by themselves, and trojans pretend to be useful programs.
Ransomware
Locks or encrypts your files and demands payment to unlock them. Often spread through phishing or weak remote access.
Spyware and keyloggers
Secretly watch what you do or record what you type to steal passwords and information.
Phishing
Fake emails, messages, or sites pretending to be a bank or company to steal logins. Variants include spear phishing, SMS phishing, and voice phishing.
Social engineering
Manipulating people, not machines. Attackers pose as staff, bank officers, or support to get secrets.
DoS and DDoS
Flooding a service with traffic from many devices so real users cannot get in.
Man in the middle
Secretly sitting between you and a website to read or change the traffic, often on unsafe public Wi Fi.
SQL injection and XSS
Flaws in websites that let attackers run unwanted database commands or scripts. They come from poor input checking.
Brute force and credential stuffing
Guessing passwords, or trying leaked passwords from one site on many other sites.
Zero day exploits
Attacks that use a flaw the vendor does not know about yet, so no fix exists.
Supply chain attacks
Compromising a trusted supplier or software update to reach many customers at once.
Deepfakes and AI scams
Fake voices, videos, and messages that look real. Always confirm unusual requests through a second channel.
Attack and defense at a glance
| Attack | How it succeeds | Best defense |
|---|---|---|
| Phishing | A person is tricked into clicking or sharing a login | Training, multi factor login, checking the sender and link |
| Ransomware | Malware encrypts files after a user opens it or after a weak entry point | Offline backups, updates, email filtering |
| DDoS | Traffic overwhelms the service | Traffic filtering and a content delivery network |
| SQL injection | The site trusts user input inside a database command | Parameterized queries and input validation |
| Password attacks | Weak or reused passwords | Long unique passwords, a password manager, passkeys |
| Man in the middle | Unencrypted or fake networks | HTTPS, trusted networks, VPN when needed |
Understanding SQL injection (defender’s view)
The danger comes from building a database command by joining raw user input. The safe way is to send the input as a separate value so it is never treated as a command.
BAD: query = "SELECT * FROM users WHERE name = '" + user_input + "'"
GOOD: query = "SELECT * FROM users WHERE name = ?"
run(query, [user_input]) # input is treated only as data05 Defense
How defense works
Core security principles
Defense in depth
Use many layers, so if one fails another still protects you.
Least privilege
Give each person and program only the access it needs, nothing more.
Zero trust
Never trust automatically, even inside the network. Verify every user and device.
Security by design
Build security into software and systems from the start, not as an afterthought.
Patch quickly
Install updates to close known flaws before attackers use them.
Assume breach
Plan as if an attacker will get in someday, and be ready to detect and recover.
Key defenses
| Defense | What it does |
|---|---|
| Firewall | Filters network traffic by rules and blocks unwanted connections |
| IDS and IPS | Detect, and in some cases block, suspicious activity on a network |
| Antivirus and EDR | Find and stop malware and strange behavior on devices |
| Encryption | Scrambles data so only someone with the key can read it |
| Multi factor login | Needs a second proof, like a code or device, besides the password |
| VPN | Creates an encrypted tunnel for your traffic |
| Backups | Allow recovery after loss or ransomware. Follow the 3 2 1 rule: 3 copies, 2 types of storage, 1 offsite |
| SIEM and SOC | Collect logs and watch for threats, run by a security operations center |
| Vulnerability scanning | Finds weaknesses before attackers do |
Cryptography basics
One shared key
The same key locks and unlocks data. Fast. Example: AES, used for storing and moving large amounts of data.
Public and private keys
A public key locks, and only the private key unlocks. Used for secure connections and digital signatures. Example: RSA.
One way fingerprint
Turns data into a fixed code that cannot be reversed. Used to check integrity and to store passwords safely. Example: SHA 256.
Incident response steps
- PreparePlans, tools, backups, and trained people.
- DetectNotice and confirm that something is wrong.
- ContainIsolate affected systems so the problem cannot spread.
- EradicateRemove the cause, such as malware or a stolen account.
- RecoverRestore systems and data and return to normal.
- LearnReview what happened and improve defenses.
06 Tools
Tools used in cyber security
USE LEGALLY
Use these tools only on devices and networks you own or have written permission to test, or in legal practice labs.
| Category | Popular tools | Used for |
|---|---|---|
| Operating systems | Kali Linux, Parrot OS | Security testing toolkits in one system |
| Network scanning | Nmap | Finding devices and open ports |
| Traffic analysis | Wireshark | Inspecting network packets |
| Web testing | Burp Suite, OWASP ZAP | Finding weaknesses in websites |
| Vulnerability scanners | Nessus, OpenVAS | Checking systems for known flaws |
| Exploitation frameworks | Metasploit | Authorized penetration testing |
| Password auditing | John the Ripper, Hashcat | Testing how strong stored passwords are |
| Intrusion detection | Snort, Suricata, Zeek | Detecting suspicious network activity |
| Monitoring and SIEM | Splunk, Wazuh, Elastic Security | Collecting logs and raising alerts |
| Endpoint protection | Microsoft Defender, CrowdStrike, other EDR tools | Protecting laptops and servers |
| Forensics | Autopsy, Volatility | Investigating what happened after an incident |
| Reverse engineering | Ghidra, IDA | Analyzing how a program works |
| Password managers | Bitwarden, KeePass, and others | Storing unique passwords safely |
Legal places to practice
TryHackMe
Guided, beginner friendly lessons and labs.
Hack The Box
Challenge machines for growing skills.
OverTheWire
Command line games that teach basics step by step.
PortSwigger Web Security Academy
Free web security lessons and labs.
picoCTF
Capture the flag contests for students.
Your own home lab
Virtual machines on your own computer that you can safely break and fix.
07 Laws and standards
Laws, standards, and reporting
| Name | What it is |
|---|---|
| IT Act, 2000 (India) | Main Indian law on cyber crime and electronic records |
| DPDP Act, 2023 (India) | Law about how personal data is collected, used, and protected |
| CERT In (India) | National agency that handles cyber incidents and advisories |
| GDPR (European Union) | Strict data protection and privacy law |
| ISO 27001 | International standard for managing information security |
| NIST Cybersecurity Framework | A widely used guide to identify, protect, detect, respond, and recover |
| PCI DSS | Security rules for handling payment card data |
IF YOU ARE A VICTIM
In India, report financial cyber fraud quickly on the national helpline 1930 and on the cyber crime portal cybercrime.gov.in. Acting fast improves the chance of stopping the money. Check the official sites for the latest details.
08 Stay safe
How to stay safe online
Strong and unique
Use long passwords or passphrases, a different one for every account, and a password manager.
Turn on two step login
Use an authenticator app or passkey, especially for email, banking, and social media.
Keep software updated
Turn on automatic updates for your phone, computer, and apps.
Think before you click
Check the sender and the link. Be careful with urgent messages and prizes.
Never share OTP, PIN, or card details
A real bank never asks for them. Remember, you never enter a PIN to receive money.
Be careful on public networks
Avoid banking on open Wi Fi. Use mobile data or a trusted VPN.
Back up important files
Keep a copy offline or in a separate cloud account.
Install only trusted apps
Use official stores, read permissions, and avoid cracked software.
Share less online
Limit personal details on social media, as scammers use them to look believable.
RED FLAGS
Be suspicious if a message creates urgency, asks for secret codes, offers too good to be true rewards, or asks you to install a remote control app. Stop and verify using the official number or website.
For businesses
Basics to cover
- Multi factor login for all staff
- Regular patching and backups
- Least privilege access
- Employee phishing training
- A written incident response plan
Go further
- Endpoint and network monitoring
- Regular security testing
- Vendor and supply chain checks
- Encryption of sensitive data
- Compliance with standards and laws
09 Careers and future
Careers, learning path, and what is next
SOC analyst
Monitors alerts and investigates threats. A common entry role.
Penetration tester
Ethically tests systems to find weaknesses before criminals do.
Security engineer
Designs and builds protections for systems and networks.
Incident responder
Leads the response when a breach happens.
Malware analyst
Studies harmful software to understand and stop it.
GRC and compliance
Handles governance, risk, laws, and audits.
Cloud security engineer
Protects cloud accounts and services.
CISO
Chief Information Security Officer, the leader of a company’s security program.
Six month learning path
- Month 1Computer, networking, and Linux basics.
- Month 2Security fundamentals, cryptography, and the CIA triad.
- Month 3Web security basics and safe practice labs.
- Month 4Python scripting and network tools such as Nmap and Wireshark.
- Month 5Defense: logs, monitoring, and incident response.
- Month 6Practice challenges, a certification, and a portfolio.
The future of cyber security
AI on both sides
Attackers use AI for better scams and faster attacks. Defenders use it to detect threats and respond quickly.
Post quantum cryptography
Future quantum computers could break some current encryption. New quantum resistant standards are being adopted.
Zero trust everywhere
More organizations verify every request instead of trusting the network.
Life beyond passwords
Passkeys and biometrics reduce phishing and password theft.
Billions of connected devices
More smart devices mean more entry points, so secure design matters.
Talent shortage
The world needs many more security professionals, which makes it a strong career path.
10 FAQ
Frequently asked questions
Is cyber security the same as ethical hacking?
No. Cyber security is the whole field of protecting systems. Ethical hacking is one part, where permitted testers try to find weaknesses.
Can any system be 100 percent secure?
No. The goal is to make attacks hard and costly, notice them quickly, and recover fast.
What is the most common way people get hacked?
Phishing and weak or reused passwords are among the most common causes. Two step login greatly reduces the risk.
Is antivirus enough?
No. It helps, but you also need updates, strong passwords, multi factor login, backups, and careful habits.
Do I need to be good at coding to work in cyber security?
Not for every role, but basic scripting in Python or similar helps a lot. Networking and Linux knowledge matter even more at the start.
What should I do if I think I have been hacked?
Disconnect the device from the internet, change your passwords from a safe device, turn on two step login, check your bank and email activity, and report fraud quickly to the right authorities.
Is it safe to use a VPN?
A trusted VPN helps protect traffic on unsafe networks, but it does not protect you from phishing or malware. Free VPNs of unknown origin can themselves be risky.