हिंदी में: साइबर सुरक्षा की बुनियादी बातें — अपने डेटा, अकाउंट और सिस्टम को हमलों से कैसे बचाएं।
What is cybersecurity?
Cybersecurity is the practice of protecting systems, networks, programs and data from digital attacks, damage and unauthorized access.
The CIA triad
- Confidentiality – only authorized people can see the data (encryption, access control).
- Integrity – data is not altered without permission (hashes, digital signatures).
- Availability – systems and data are accessible when needed (backups, redundancy, DDoS protection).
Related goals: authentication (who are you?), authorization (what are you allowed to do?) and non-repudiation (you cannot deny an action you took).
Common threats
| Threat | What it is |
|---|---|
| Virus / worm | Malicious code that spreads; worms spread without user action |
| Trojan | Malware disguised as useful software |
| Ransomware | Encrypts files and demands payment |
| Spyware / keylogger | Secretly records activity or keystrokes |
| Phishing | Fake emails, SMS or websites that trick people into revealing passwords or OTPs |
| Social engineering | Manipulating people rather than breaking technology |
| DoS / DDoS | Flooding a service so real users cannot reach it |
| Man-in-the-middle | Intercepting communication between two parties |
Web application attacks
- SQL injection – malicious input changes a database query. Prevent with prepared statements.
- Cross-site scripting (XSS) – injected scripts run in other users’ browsers. Prevent by escaping output and using Content Security Policy.
- CSRF – tricks a logged-in user’s browser into sending unwanted requests. Prevent with anti-CSRF tokens and SameSite cookies.
- Broken authentication / access control – weak sessions or missing permission checks.
The OWASP Top 10 is a widely used list of the most critical web application security risks.
Cryptography basics
- Symmetric encryption – the same key encrypts and decrypts (AES). Fast; the challenge is sharing the key safely.
- Asymmetric encryption – a public key encrypts, a private key decrypts (RSA, elliptic-curve cryptography). Used for key exchange and digital signatures.
- Hashing – a one-way fingerprint of data (SHA-256). Passwords should be stored with slow, salted hashes such as bcrypt or Argon2.
- Digital signatures and certificates – prove who sent data and that it was not changed; HTTPS relies on certificates issued by certificate authorities.
Network security
- Firewalls filter traffic using rules.
- IDS/IPS detect or block suspicious activity.
- VPNs create encrypted tunnels over public networks.
- Network segmentation limits how far an attacker can move.
- Use WPA3/WPA2 on Wi-Fi and change default router passwords.
Secure development habits
- Validate all input and apply the principle of least privilege.
- Keep dependencies and frameworks updated; patch quickly.
- Never commit passwords or API keys to Git.
- Log security events and review them.
- Take regular, tested backups (the 3-2-1 rule: 3 copies, 2 kinds of media, 1 off-site).
Personal safety checklist
- Use a unique, long password for every account and a password manager.
- Turn on two-factor authentication (2FA).
- Never share OTPs, UPI PINs or passwords — banks and genuine services do not ask for them.
- Check links and sender addresses before clicking.
- Install apps only from official stores and keep your phone and PC updated.
- In India, cyber fraud can be reported on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or the helpline 1930.
Careers
Roles include security analyst, SOC analyst, penetration tester (ethical hacker), security engineer and cloud security specialist. Common certifications: CompTIA Security+, CEH, OSCP, CISSP (for experienced professionals).
Quick revision
- CIA = Confidentiality, Integrity, Availability.
- Symmetric = one shared key; asymmetric = public/private key pair.
- Prevent SQL injection with prepared statements; prevent XSS by escaping output.
- 2FA blocks most password-only attacks.