Lesson 3 — Beginner

Cyber Threats & Attack Types

CIA goals toh samajh aa gaye — ab dekhte hain unhe todne ke liye attacker kya karta hai. Is lesson mein hum threat, vulnerability aur risk ka farak, threat actors ke type aur attack vectors (raaste) samjhenge.

⏱ 14 min• Beginner• CIA Triad

Threat, Vulnerability aur Risk — farak

WHAT

Threat = koi bhi potential harm karne wala (attacker ya event). Vulnerability = us harm ko asaan karne wali kamzori. Risk = likelihood × impact (kitna chance × kitna nuksaan).

WHEN

Jab bhi koi system audit ho, koi incident aaye, ya koi naya feature deploy ho — ye teeno term saath saath aate hain.

WHERE

Server, app, employee, process, vendor — har jagah kamzori ho sakti hai aur har jagah threat maujood hai.

Ek kahawat yaad rakho: Threat hamesha hai, vulnerability option hai, risk computation hai. Tumhari kamzori hi batati hai ki attacker kitni mehnat karega.

Threat actors — kaun karta hai

Script kiddie  : skills kam, ready tools use karta hai (ego)
Hacktivist     : ideology/group ke liye (defacement, DDoS)
Cybercriminal  : organized crime — paisa (ransomware gangs)
Insider        : andar ka banda — naraz employee ya careless
Nation-state / APT : sarkari backed, targeted, mahino chhupa
Competitor     : business espionage (IP chori)

APT trait : targeted, patient, multi-stage (state-level, mahino chhupa)

Common confusion: Insider threat ko aksar ignore kiya jaata hai — par reports kehti hain ki bade breaches mein andar ke log (ya unki galti) bhi aksar shaamil hote hain. Sirf bahar se nahi andar se bhi darwaza band rakho.

Attack vectors — attack ke raaste

Email: phishing attachment ya link — aaj bhi #1 entry point.
Web: website/app ki vulnerability (injection, weak auth).
USB/removable media: infected pen drive lagaa di.
Public Wi-Fi: unencrypted traffic beech mein pakadna.
Supply chain: update/vendor ke through apna code andar.
Human: social engineering — call, message, curiosity.
Misconfiguration: default password, open cloud bucket — attack ki zarurat hi nahi padti.

Ek line: attack ka raasta aksar machine se nahi, insaan se guzarta hai. Isliye har breach ka "human factor" check hota hai.

Risk, zero-day aur APT ka concept

Risk = Likelihood × Impact

Example:
  Threat      : data chori ka intent
  Vulnerability : default password chalu hai
  Likelihood  : high (scan se turant mil jaayega)
  Impact      : high (poora database)
  Risk        : HIGH → pehle fix karo

Zero-day : flaw vendor ko abhi pata nahi / patch nahi aaya
           (attacker ko pata hai — "zero days" to fix)

APT : targeted, layered, patience-wala attack
      pehle foothold → lateral move → chori → chhupna

Priority rule : HIGH RISK pehle, phir medium, phir low

Risk score isliye banaaya jaata hai kyunki sab kuch ek saath fix karna possible nahi — paisa aur time limited hain. Pehle jo zyada nuksaan kar sakta hai, wahi fix karo.

Exercise

Question: Vulnerability ka matlab kya hai — (kamzori / attack / nuksaan)? Sirf ek shabd likho.

Question: APT ka full form kya hai? (teen words, space se)

Question: Risk kis cheez ka product hota hai? (likelihood, impact — comma se, koi bhi order)

Common mistakes

Threat aur vulnerability ko same samajhna: Threat = potential harm (attacker, event). Vulnerability = uski kamzori (toota darwaza). Storm hai tooda darwaza — dono alag hain.
Insider threat ko ignore karna: Bahar wale attackers dikh jaate hain, andar ki galti nahi. Careless employee bhi threat actor hai.
Zero-day ka matlab jaadu samajhna: Zero-day ka matlab sirf hai ki fix (patch) abhi nahi tha. Koi anjaan power nahi — bas time ka farak hai.

Desi example: HR se salary revision wala mail

Ek employee ko "HR Department" se mail aaya — naam likha tha, salary revision form ka link tha. Page asli jaisa dikh raha tha. Ye spear phishing tha — attacker ko company ka aur naam ka andaza tha:

Vector : targeted email (spear phishing)
Vuln  : curiosity + bina verify kiye click
RISK  : credentials gaye -> account takeover
Bachao: form URL check, HR se seedha confirm,
        report karo IT ko — forward karne se pehle

Exam mapping (CUET / TCS / UGC)

CUET: threat vs vulnerability vs risk difference direct question.
TCS NQT: "Risk = ?" — likelihood × impact.
UGC-NET: attack vector types (phishing, insider).
Trap: "Zero-day means unknown attack type" — galat, wo known flaw hai jiska patch nahi tha.

Lesson complete?

Threat landscape samajh aa gaya. Agla lesson — Malware — mein dekhenge attackers ka sabse purana hathiyar, harmful software ke type.