Cybersecurity Basics
Press Next → or use ← → arrow keys
The Digital Underworld
Every second, thousands of attacks probe the internet — most never make headlines because they succeed silently. Firewalls and antivirus aren't your first line of defence. You are.
Over 82% of all data breaches involve a human element — a click, a reply, a reused password, a moment of trust. The strongest firewall can't stop an employee who voluntarily opens the door.
You cannot become hack-proof. You can become a harder target than the next person — and that is the entire game.
Malware — The Four Faces of Malicious Code
Malware is any program designed to harm, steal, spy, or take over a device — without the owner's consent. It has four classic faces:
Cybersecurity Ventures found over 1 in 3 cracked apps contains hidden malware. You save ₹5,000 on a licence — and pay with your bank account.
How Malware Actually Infects You
Every malware infection follows the same 5-stage lifecycle — from arrival to objective.
Real Malware That Changed History
| Year | Malware | What It Did | Damage |
|---|---|---|---|
| 2000 | ILOVEYOU | Email worm — destroyed files, mass-mailed itself via Outlook contacts | $10B+ / 50M PCs |
| 2010 | Stuxnet | Nation-state worm that physically destroyed Iranian uranium centrifuges | Delayed Iran's nuclear program 2+ years |
| 2016 | Mirai Botnet | Infected internet cameras & routers using default passwords | 1.2 Tbps peak attack |
| 2020 | SolarWinds | Malicious code slipped into legitimate software updates — 18,000 orgs, incl. US Treasury & Microsoft | $100B+ cleanup |
| 2023 | Pegasus (India) | Spyware on phones of journalists, opposition leaders, activists | SC probe ongoing |
Every case above had one thing in common — a human weakness: a default password, an unpatched system, a signed update that shouldn't have been trusted.
Ransomware — Digital Kidnapping
For 15 days, one of the world's busiest hospitals ran on paper registers. Surgeries were postponed. Admissions delayed. Data of ~40 million patients was accessed by attackers, traced back to a Chinese-origin ransomware group.
Not one line of malware was manually typed inside AIIMS. Someone, somewhere, clicked the wrong link — and India's healthcare crown jewel fell to its knees.
Locks your files with military-grade encryption and demands crypto (Bitcoin, Monero) for the key. Modern gangs use "double extortion" — they steal your data first, then threaten to leak it if you don't pay.
Anatomy of a Ransomware Attack
Most ransomware attacks unfold in six near-identical stages — often over weeks, silently.
Ransomware That Made Global News
| Year | Target | What Happened | Loss |
|---|---|---|---|
| 2017 | WannaCry (global) | Worm-ransomware hybrid crippled UK's NHS — 19,000 appointments cancelled. Hit FedEx, Renault, Telefónica. | $4B+ |
| 2021 | Colonial Pipeline (USA) | Largest US East Coast fuel pipeline shut down. Petrol shortages in 17 states. | $4.4M paid |
| 2021 | JBS Foods | World's biggest meat processor stopped in US, Canada, Australia. REvil ransomware. | $11M in Bitcoin |
| 2022 | AIIMS Delhi | India's top hospital paralysed for 2 weeks. 40M patient records at risk. | Ransom refused |
| 2023 | MGM Resorts | Slot machines, hotel keys, ATMs disabled across Las Vegas. Cracked via IT help desk. | $100M lost |
Should You Pay the Ransom?
| Only ~60% of payers get working keys |
| Funds the next attack — on schools, hospitals |
| You go on a "pays" list. Repeat target. |
| Doesn't stop leaked data from being sold |
| In the US (OFAC) and UK, may be illegal |
| Isolate the machine — pull cable, kill Wi-Fi |
| Report to cybercrime.gov.in / dial 1930 |
| Preserve evidence — don't wipe |
| Restore from offline, air-gapped backups (3-2-1) |
| Check nomoreransom.org — free decryptors for 170+ families |
3 copies of your data, on 2 different media types, with 1 copy stored offline and off-site. An untested backup is a hope, not a plan — test restore quarterly.
Phishing — The Art of Digital Deception
Over two years, they wired $121 million to his accounts. No malware. No zero-day. Just plausible emails and matching bank details. Arrested in 2019 — only half the money was recovered.
Two of the most secure companies on Earth were beaten by paperwork.
Impersonating a trusted person or brand — over email, SMS or phone — to trick you into handing over credentials, money, or installing malware. Verizon's 2024 report: 36% of all breaches start with phishing.
The Phishing Family Tree
Spot a Phishing Email in 30 Seconds
support@arnazon-in.com is not Amazon. Extra letters, hyphens, weird domains..zip .exe .iso .html or Office files asking "Enable Content" (macros). Never open.When in doubt, pause for 30 seconds and call the company on a number you already trust — not the one in the suspicious email. Scammers survive on urgency. Slowness kills them.
Phishing in the Indian Context
| Scam | Method | Real Example |
|---|---|---|
| Fake KYC Update | SMS/WhatsApp — "Bank/PAN/Aadhaar KYC expired"; link steals credentials | RBI issued 6+ warnings on SBI & HDFC KYC scams (2022–24) |
| Electricity Bill Scam | SMS threatening disconnection; fake payment portal | Millions hit in Delhi, Mumbai, Bengaluru in 2023 |
| Courier / Customs | Vishing — "parcel contains contraband, transfer to clear" | Bengaluru software engineer lost ₹1.2 crore in one day |
| Digital Arrest | Fake CBI/police video calls — "Aadhaar misused for money laundering" | PM Modi warned citizens in Oct 2024 Mann Ki Baat |
| Job Offer Scam | WhatsApp part-time work (like YouTube videos for ₹150). Small payouts build trust, then "invest" for big returns | Est. ₹1,000 crore+ lost by Indians in 2023 |
Dial 1930 or file at cybercrime.gov.in within the "Golden Hour". Banks can freeze fraudulent transfers if reported fast. Delays caused by shame lose the money.
Social Engineering — Hacking the Human
He wore the right uniform. Spoke with confidence. People handed him access. Spielberg's Catch Me If You Can (2002) tells the story.
Modern hackers do exactly the same thing — with digital uniforms.
Attackers found an MGM IT employee on LinkedIn, then called the help desk pretending to be that person and asked for a password reset. 10 minutes on the phone → access to a $100M infrastructure. No malware. No exploit. Just a phone call.
Social engineering hacks psychology, not technology. It exploits trust, authority, fear, urgency, curiosity, greed. A $10M firewall can be walked around with a $1 phone call.
Classic Social Engineering Techniques
Watch: Catch Me If You Can (2002), Mr. Robot (2015), Sneakers (1992), Blackhat (2015), and India's Jamtara — Sabka Number Ayega on Netflix. Better cybersecurity training than most corporate courses.
Defence Playbook — What Actually Protects You
Golden Rules — Non-Negotiable Cyber Hygiene
Golden Rules — Rules 5 to 8
Stay Curious. Stay Skeptical. Stay Safe.
You will never be "hack-proof". Aim to be a harder target than the next person. Attackers are opportunists — raise the cost of attacking you, and they'll move on. That is the entire game.
Read Verizon DBIR yearly. Follow Krebs on Security and The Hacker News. Watch Mr. Robot. The threat landscape changes every quarter — your defences should too.
🛡️ End of tutorial · Press ← to review, or click Restart