Cyber Security

Cyber Crimes

Published: 2026-08-16

Level: postgraduate

Audience: Postgraduate students in Cyber Security

Prerequisite Knowledge

This lecture builds on the following concepts from earlier lectures. If any feel unfamiliar, review the linked notes before proceeding.

Previously Covered in This Subject

Defense in depth and the layered control stack — covered in Lecture 12
Stateless, stateful, and next-generation firewalls — covered in Lecture 12
IDS/IPS, SIEM, EDR, and XDR detection — covered in Lecture 12
Web application firewall (WAF) — covered in Lecture 12
The risk formula — covered in Lecture 12
Single sign-on and MFA — covered in Lecture 12
The incident response lifecycle — covered in Lecture 9
Bug bounty programs — covered in Lecture 9
Phishing and email security: SPF, DKIM, DMARC — covered in Lecture 11
Ransomware — covered in Lecture 11
Denial of service and DDoS attacks — covered in Lecture 11
Malware families: virus, worm, trojan, spyware — covered in Lecture 11
Zero-day exploits — covered in Lecture 11
Insider threats — covered in Lecture 8
Physical, administrative, and technical controls — covered in Lecture 3

13.1 Recap: Defense in Depth and the Controls We Have Covered

Hook: If a bank vault has a single door, one lost key opens everything. What changes when there are three doors, each with its own lock, and a guard who checks every visitor? That is the whole idea of defense in depth — and it is the frame we use to think about every attack in the rest of this lecture.

13.1.1 Technological controls from perimeter to host

The previous session walked through the full stack of controls that implement defense in depth — the strategy of placing controls at multiple layers, from physical to administrative to technological, so that a failure at one layer does not leave the organization exposed. Think of it as a series of locked gates along the same road: an attacker who slips past one gate still has to get through the next one. The layers are ordered roughly from the network edge to the individual device, and each layer looks at the traffic in a little more depth than the one before it.

At the perimeter level the first line is the firewall. A stateless firewall judges each incoming request on its own: it looks at the request and allows or rejects it without remembering any earlier connection. That is its drawback — a packet that belongs to an established session looks no different from a brand-new request. A stateful firewall fixes this by also checking whether a previous connection exists and which state it is in, so the decision is based on the IP address plus the connection history, which makes it more secure.

Worked contrast — stateless versus stateful. Suppose your browser opens a connection to a web server and asks for a page. The server's reply comes back in several pieces (packets). A stateless firewall inspects each reply packet in isolation: it sees a packet that was not requested from inside, and may drop it — breaking the page load. A stateful firewall remembers "this internal host opened a connection to that web server," sees the reply belongs to that recorded session, and lets it through. The same difference explains why stateful firewalls are the default choice today: they track connection state, so legitimate replies pass while unsolicited traffic is still blocked.

Firewalls are mostly rule-based: whatever rules have been configured decide whether the packet is allowed or rejected. One drawback: if a tunnel has been established through an approved rule, the firewall simply allows the traffic through. Deeper analysis needs deep packet inspection, which is where the intrusion detection system (IDS) and intrusion prevention system (IPS) come in. An IDS or IPS inspects the content of the packet, not just the envelope; it can be signature-based or anomaly-based, and depending on how the sensors are configured it identifies malicious or suspicious activity at the host level or the network level. In that way the conversation moved from firewalls to IDS and IPS.

Intuition: a firewall is like the security guard at the gate who checks your ID card (the packet header). An IDS/IPS is the analyst who opens your bag and looks at what is actually inside (the payload). Signature-based detection is a wanted-poster list: it catches known criminals but misses anyone new. Anomaly-based detection is a "this person is acting oddly" rule: it can catch the new criminal but also raises false alarms about normal behaviour.

The next generation of these devices: endpoint detection and response (EDR) detects and responds at the endpoint level. When you want the same capability for the whole organization's traffic, the security information and event management (SIEM) tool collects all the logs from systems, networks, and servers into one central place and correlates them to find out if any abnormal or suspicious activity is happening, then detects and responds to it. The next-generation version of SIEM is extended detection and response (XDR) — the current latest technology that most security operations center (SOC) teams use.

Recap of the stack, perimeter to host: stateless firewall → stateful firewall → IDS/IPS (deep packet inspection) → EDR (endpoint) → SIEM (central log collection and correlation) → XDR (extended detection and response). Each layer answers a question the previous one could not: "is this packet part of a session?", "is this packet content malicious?", "is this endpoint compromised?", "are events across the whole network connected?"

13.1.2 Administrative and physical controls

Most attacks succeed through a lack of awareness about information security, which is the root of social engineering — people sending spam emails to a specific group or to all employees of an organization. Email security plays a major role in protecting the organization from external cyber attacks. To improve the email security posture, organizations use SPF, DKIM, and DMARC checks, which verify the identity of the incoming email even when someone tries to send a spoofed email through readily available spoofing tools. Then comes hardening: hardening laptops, networks, servers, and reviewing firewall rules. With all these controls in place, the chances of an external attack landing are minimized, and incident response planning (IRP) through the SOC team adds continuous monitoring: with the latest AI/ML technology, if abnormal activity is found it triggers immediately, so the quicker the incident is detected, the smaller the impact.

The three email checks, in one line each: SPF (Sender Policy Framework) checks that the sending server is allowed by the domain owner to send its mail; DKIM (DomainKeys Identified Mail) cryptographically signs the mail so tampering shows up; DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do with mail that fails SPF or DKIM — reject it, quarantine it, or just report it. Together they make a spoofed "from your bank" email much easier to catch.

From the administrative side, controls are about management commitment — the organization's policies and procedures, and how effectively they are implemented so that every department and every employee adheres to them. Internal audits verify this, and external third parties audit the same policies for ISO 27001 certification or SOC 2 (Service Organization Controls) Type 1 or Type 2 certification by an accredited body such as AICPA. In this way the organization proves to its clients its commitment to implementing both technical and administrative controls, so the client's data is safe — meaning it meets confidentiality, integrity, and availability requirements. Physical security controls make sure only authorized persons can enter the organization. The web application firewall (WAF), a layer-7 firewall that monitors and blocks traffic, is one of the best tools against zero-day attacks.

Scope of the controls: technical controls stop automated external attacks; they do nothing against an employee who hands over a password, an auditor who finds policies are not enforced, or a visitor who walks into the server room. Administrative controls (policy, audit, certification) close the human gap, and physical controls close the building gap. A zero-day attack exploits a vulnerability the vendor has not yet patched, so no signature list can catch it — which is exactly why the WAF, which inspects application-level (layer 7) traffic against general attack patterns rather than known signatures, is valuable for that class of attack.

13.1.3 Where all this fits

All of these controls reduce organizational risk down to a value the organization accepts — the risk appetite. The cyber security engineer's job is: based on the risk assessment performed by the organization, propose the technical controls to be implemented; the organization performs a cost-benefit analysis; if the control turns out to be valuable and the risk drops to within the acceptable range, the organization goes ahead and implements it. Defense in depth means deploying multiple controls at multiple regions, so if an attacker slips past one layer, another layer catches them — the landscape for external cyber attacks is minimized.

Recap + bridge: defense in depth means no single control is trusted alone — if an attacker slips past one layer, another layer catches them. That layered picture is the lens for everything that follows: the attack types in this lecture (hacking, data breach, identity theft, fraud) succeed exactly when several layers fail at once. Next, we turn the lens around and learn how an incident analysis report turns a real breach into a structured, five-part story.

Real-world: ISO 27001, SOC 2, and AICPA are the certification frameworks that external auditors use to verify an organization's controls — a bank outsourcing its customer data processing asks "show me your ISO 27001 or SOC 2 report" before signing, because the certificate is cheaper than auditing the vendor themselves.

13.2 The Incident Analysis Report and the Risk Calculation

Hook: The same security incident makes the news for one company and is a non-event for another company. How can one incident be a "crisis" for one organization and "no impact" for the next? The answer is the risk calculation — and the five-part incident report is the assignment that teaches you to do it.

13.2.1 The five parts of the report

The assignment asks each group to pick a recent cyber security issue or data breach and analyze it. The report should cover five parts, and it should stay short — one or two pages is enough — with meaningful content rather than page count. The whole point is to apply the critical knowledge gathered across the chapters.

Issue description — from the management perspective, written non-technically. If you are the CISO or CIO of the organization and not deeply familiar with cyber security concepts, you should still understand what the incident is about: what happened, when it was reported, who reported it.
Technical analysis — from the cyber security perspective. Here the CISO wants to understand how the incident actually occurred, what services were involved, and how it interlinks with the organization's own setup.
Risk calculation — how the risk of this incident is calculated for the organization.
What went wrong — which existing controls failed and allowed the incident to impact the organization. The idea is: we had these controls in place, but because of a lack of control effectiveness, the incident still reached us.
Recommendations — the more preventive and detective controls that should be updated or added so the impact is minimized and the incident is detected quickly, plus lessons learned.

Exam note: this five-part structure — management description, technical analysis, risk calculation, failed controls, and recommendations — is exactly the structure expected for the report, and the same analysis lens is the one to apply in any incident discussion.

13.2.2 Worked example: the Okta incident

To make the report structure concrete, take the Okta incident. The issue description is a one-name statement of what it is all about: what happened, when it was reported, and who reported it. The technical analysis looks at it from the cyber security perspective. The risk calculation considers two scenarios. If the organization is not using Okta as a single sign-on provider, then there is no impact and no further analysis is needed — the organization was simply not impacted by this incident. If the organization is using Okta as its single sign-on, then based on the technical analysis — which services are being taken from Okta, and how far this incident can be interlinked with the organization's applicability — the risk can be justified as low, medium, or high. Even though the Okta incident itself is high-profile, the risk to a given organization can still be low, because of the specific services that organization takes from Okta, and that judgment must be justified with reasons. The risk keeps on changing with the organization's context; it does not have to be a fixed answer.

Worked walkthrough — the two-scenario risk judgment. Scenario A: a small company whose employees log in directly to their own application servers, never touching Okta. The Okta breach cannot reach them, so risk is nil and the technical analysis can be brief. Scenario B: a company that authenticates employees and partners through Okta, and also uses Okta for the most sensitive service — access to its production databases. Now the same incident is high risk, because the compromised component sits directly in the path to the company's crown jewels. Scenario C (the interesting middle case): a company using Okta only for a low-sensitivity tool such as internal wikis. The incident touches the same provider, but what it can reach is limited, so the justified risk is low even though the breach made headlines. The judgment — low, medium, or high — is never a fixed answer; it changes with the organization's context and must always be justified with reasons.

13.2.3 The risk calculation

The way to calculate risk was described verbally: the risk of an incident is the probability of the threat combined with its impact rate. Written as a formula:

$Risk = P (threat) \times I (impact)$

where $P (threat)$ is the probability that the threat actually happens, and $I (impact)$ is the impact rate — how severe the effect is if it does. The result is expressed qualitatively as low, medium, or high, and the same incident can produce different risk levels for different organizations: the risk is judged against which services the organization actually takes, so the answer depends on the organization context.

Building the formula step by step. Risk is a product of two factors, and each factor is judged per organization, not globally.

$P (threat)$ — the probability (a number between 0 and 1, or a qualitative chance such as "low/medium/high") that the threat event actually occurs for this organization. A phishing campaign aimed at everyone on the internet has some base probability; a campaign aimed specifically at a bank's employees may have a higher one.
$I (impact)$ — the impact rate: how severe the damage is if the threat does occur, measured by what the organization loses (data, money, availability, reputation).

Multiply the two: a threat that is very likely but nearly harmless gives low risk; a threat that is unlikely but catastrophic can still give high risk if the impact is large enough. The product is then mapped onto the qualitative scale: low, medium, or high. The same incident scores differently for two organizations because the factors — especially impact — depend on which of the incident's components each organization actually uses.

Standard form (from reference): the textbook treatment of IT risk assessment writes the same relationship as

$Risk = (Probability that threat occurs) \times (Cost to organization)$

which is the same product: the professor's $I (impact)$ is the textbook's "cost to organization." Either form is acceptable; the exam convention is the professor's $P (threat) \times I (impact)$ .

Numerical illustration of the product. Give the factors numbers to see how the multiplication works. For organization A: probability of the Okta-related attack reaching it is low, say $P = 0.1$ , and the impact, if reached, is high, say $I = 9$ on a 0–10 scale: $Risk = 0.1 \times 9 = 0.9$ — low. For organization B: same probability $P = 0.1$ , but the impacted service is the production database, so impact is maximal, $I = 10$ : $Risk = 0.1 \times 10 = 1.0$ — still borderline. For organization C: the probability is high because employees were directly targeted, $P = 0.9$ , with impact $I = 9$ : $Risk = 0.9 \times 9 = 8.1$ — high. The numbers are illustrative, but they show the mechanics: risk grows when either factor grows, and a single factor of zero (organization A's services not involved at all) makes risk zero. Sense-check: the ranking — C high, B medium/low, A low — matches the qualitative reasoning of the Okta walkthrough above.

13.2.4 Student questions and answers

Q: Some of our groups have more than five members. Is that a problem? A: There is no strict constraint of maintaining four or five. The overall intention is not administrative matching; it is to get meaningful output from you. Groups with more members are fine.

Q: Can you briefly walk through a topic so we get an idea before we start? A: Take the Okta incident as an example: a one-name statement of what is all about, when it was reported and who reported it for the issue description; then the technical analysis from the cyber security perspective; then the risk calculation with two scenarios — using Okta as single sign-on or not; then what went wrong and which controls failed; and finally recommendations. That is the full structure to follow.

Q: How will the marks be split among the group members? A: That is discretionary, an internal call taken by the faculty and management. Do not worry about the marks; focus on completing the assignment and participate equally with the rest of the group.

Q: If a name is missing from the group list, what should that person do? A: Anyone whose name is missing can join whichever group they want, from group one through ten. There is no restriction and no group assignment from the instructor's side; just make sure your name is reflected in the report you submit.

13.2.5 What went wrong and recommendations

The last two parts of the report are the ones where the analysis becomes practical. In the Okta example, suppose the incident had been triggered about six months earlier, but the security team never subscribed to incident alerts or bulletins from CERT or any other well-recognized organization — so nobody in the organization knew about it. Only when a client approached after six months to check the impact of the Okta incident did the organization realize it was also part of it. The lesson learned: the security team had not subscribed to incident alerts from CERT or similar bodies, and the delay in awareness extended the exposure. Another example of a failed control: no password reset for administrators every 30 days. Recommendations are about updating preventive and detective controls — for example, enforcing the admin password reset cycle and subscribing to incident alerting — so that the impact is minimized and the incident is detected quickly.

Pitfalls in writing part 4 and part 5: (1) Listing controls without checking their effectiveness — the report must say which control existed and why it failed, not just name products; (2) writing recommendations that are not tied to the failed control — every recommendation should close the specific gap found in part 4; (3) confusing "detective" controls (alerting, monitoring — they find the incident faster) with "preventive" controls (patch cycles, password policy — they stop the incident); the six-month delay in the Okta example is a detective-control failure.

Recap + bridge: the report is a five-part discipline — describe, analyze technically, calculate risk, find the failed controls, recommend fixes — and the risk calculation is a product of threat probability and impact that is always judged in the organization's own context. With this analytical tool in hand, the lecture now turns to naming the enemies: what a cyber crime actually is.

13.3 What Is a Cyber Crime?

Hook: Someone who breaks a window and steals a television is a burglar. What do we call someone who never touches the building, but makes its entire payment system stop working from the other side of the world? That is the question this section answers.

13.3.1 The definition

A cyber crime is any criminal activity performed using a computer, a network, or any electronic device. The person doing it has a bad intention — an unlawful intention — and carries out that activity through a device. If the act uses the internet as the platform, or the computer as the platform, it counts as cyber crime. A criminal activity here does not mean something like killing a person; it means making a system go down, deleting data, or making data accessible to people who should not see it. Every one of those is a cyber crime.

The three ingredients of the definition. Break the definition into its parts so any example can be tested against it:

An act. Something is actually done — a system is made unavailable, data is deleted, or data is exposed to people who should not see it.
Unlawful intention. The act is done on purpose, and the purpose is a bad one. An accidental delete of a colleague's file is an error, not a cyber crime; the same action done deliberately to harm is a crime.
A technological platform. The act is performed through a computer, a network, or an electronic device. The device is not incidental — the crime is carried out on and through it.

All three must be present. Without intention there is an accident; without the act there is only a thought; without the platform it is an ordinary (physical) crime. And the ordinary world can mirror the digital one: making a system go down is the digital equivalent of breaking the shop's front door; exposing data is the digital equivalent of leaving the safe open for anyone to read.

13.3.2 Civil crime, criminal crime, and cyber crime

Looking at it from the law side, there are different codes and different courts. Civil courts deal with civil issues — for example, if somebody occupies your property, that is where you go. Criminal courts deal with crimes like killing somebody. Cyber crime is a third category that uses the internet and the computer as its platform: it is still a criminal activity, but performed through technology. Making a system unavailable, deleting data, or exposing data — these are the acts that come under cyber crime, and whoever performs them is considered a criminal.

Comparison — civil versus criminal versus cyber. The three categories differ in what they protect and who brings the case:

Category	Typical harm	Who takes it to court	Example
Civil	Disputes between private parties (property, contracts)	The harmed party sues	Someone occupies your property
Criminal (classic)	Harm to person or society (violence, theft)	The state prosecutes	Killing somebody
Cyber crime	Harm through technology (unavailable systems, deleted or exposed data)	The state prosecutes; the platform is technology	Making a system go down

The important point is not that cyber crime is a different kind of law — it is still criminal activity with criminal consequences — but that the platform changes: the crime travels through the internet and the computer, which creates the special challenges of this lecture (anonymity, attribution, jurisdiction). When you need to label an example on the quiz, do not ask "is it civil or criminal?" first — ask "was it carried out through a computer, network, or electronic device, with unlawful intention?" If yes, it is cyber crime regardless of which court would hear it.

13.3.3 Who can be the target

The target of a cyber crime can be a single person, an organization, or an entire nation — for example, making a nation's database go down. That is why everything implemented as defense in depth matters here: those controls are what keep the chances of cyber crime low for the organization.

Recap + bridge: a cyber crime is an unlawful act with bad intention carried out through a computer, network, or electronic device, and its target can be as small as one person or as large as a whole nation. The next sections take the definition apart by actor — who performs these crimes — starting with the most famous label of all: hacking.

Real-world: the scale of the target changes the kind of harm: attacks on a person (identity theft, stalking) destroy individual trust, attacks on an organization (fraud, breach) destroy corporate trust, and attacks on a nation (making a national database go down) can disable public services such as payments or healthcare — which is why governments run national cyber security agencies and response teams rather than leaving defence to individual firms.

13.4 Hacking and the Three Kinds of Hackers

Hook: The same door-opening skill that lets a thief enter a house at night is what a locksmith uses during the day to prove the lock is weak. Hacking is exactly that skill — and the difference between the thief and the locksmith is not ability, but intent and permission.

13.4.1 What hacking is

Hacking is the act of compromising devices and networks by gaining unauthorized access. The objective is to gain access to systems that have not been authorized. Organizations today respond by developing in-house hacking capability — the different kinds of hackers — and the classification follows the hat metaphor.

The definition's two parts. Hacking always has two ingredients: (1) compromise — the attacker finds and exploits a weakness (a vulnerability) in a device or network; (2) unauthorized access — the attacker enters a system they were not given permission to enter. Both ingredients are about access, not about what happens afterwards: the theft, damage, or notice comes later and depends on the kind of hacker. That is why the same act — breaking in — can be performed by three different kinds of people with completely different outcomes, which is the point of the hat metaphor below.

13.4.2 White hat hackers

White hat hackers are the good guys. Their main job is to prevent the success of black hat hackers proactively: they perform the same activity a cyber criminal would, but before the criminal gets there. They break into the systems, assess, and test the level of security in the organization. Employees who behave like cyber criminals to check the implemented controls are doing what is called ethical hacking — following the organization's ethics while trying to hack the system in an ethical way. Because white hats run the same attacks first, the actual criminals find that the weaknesses are already closed. This only works if white hat hackers have enough skill — more than the minimum required — so that the chances of a black hat exploiting weaknesses are minimized.

Professor's intuition (kept): white hat hackers run the same attacks black hats run, but before them — the weaknesses are already closed when the criminal arrives. And the professor's warning: they need enough skill, more than the minimum required, because a half-skilled tester leaves the weaknesses open while believing they are closed. A tester who can only confirm "no obvious hole" has not beaten a skilled attacker who looks one layer deeper.

13.4.3 Black hat hackers

Black hat hackers are the opposite — the bad guys. They find the loopholes in the system, which are the vulnerabilities, and exploit them. The purpose can be fun, financial gain, gaining reputation, or a national hacking campaign — any reason, but always with a bad intention. Their job is to continuously do reconnaissance — finding all possible vulnerabilities at different entry points, and then using those entry points to perform a malicious activity: deleting data, encrypting data, downloading data and keeping it in the dark web somewhere and asking for money to give it back, or damaging the reputation of the organization. What they perform has serious damage both at the organization level and at the individual level.

The reconnaissance stage. The professor's spoken word for the first stage is often heard as "reconciliation phase"; the standard term is reconnaissance — the survey of the target before any attack. Reconnaissance is the "look before you leap" of hacking: the attacker maps the target's devices, open ports, software versions, and entry points, hunting for any vulnerability that can be exploited. It is the first step of the cyber crime modus operandi covered later in this lecture (13.18), and it is exactly what the black hat does "continuously" — every time the defender patches one entry point, the attacker re-surveys to find the next one. White hats do the same survey in a penetration test — which is why the word appears in both ethical and criminal contexts; the intention, not the technique, differs.

13.4.4 Gray hat hackers

Gray hat hackers are neither bad nor good. Like black hats, they attempt to violate an organization's network or systems, but without intending to cause harm or financial damage. For example, they may exploit a vulnerability to raise awareness that it exists — but unlike white hats, they do so publicly, just to show their presence. Hacking can be classified into these three groups: white hat, black hat, and gray hat.

Comparison — the three hats side by side.

Hat	Intention	Permission	Typical outcome
White	Improve security; prevent black hats	Authorized (employee or hired tester)	Vulnerability reported and fixed; weakness closed before criminals arrive
Black	Harm: money, fun, reputation, national campaign	None	Theft, encryption for ransom, defacement, data exposure
Gray	No harm intended, but no permission either; wants to prove the weakness exists	None	Weakness made public (sometimes to the vendor, sometimes publicly)

The one-line rule for the quiz: white = authorized and helpful, black = unauthorized and harmful, gray = unauthorized but not intending harm. The gray hat's boundary problem is that "no harm intended" is still a violation — the organization did not ask to be tested, and a public disclosure can help attackers as easily as it helps defenders.

13.4.5 Bug bounty programs

Real-world: many organizations subscribe to bug bounty programs. Instead of waiting for black hat hackers to take a system or application down, the organization offers a bounty for identifying a bug. On sites like Facebook or Flipkart, a group of white hat researchers continuously looks for loopholes in the application; the moment one is found, they email the security team: "this is how I was able to exploit the weakness." They do not do any damage — they do not access your data or tamper with it; they just record the path they took and share the recording via email. The organization's security researchers verify and validate whether it is a real vulnerability in that infrastructure. If it is, the payment depends on the priority — high, medium, or low — with amounts defined in advance. A third party may handle the payout: the organization pays the platform, and the platform pays the researchers. The more critical the vulnerabilities a researcher finds, the more awards they receive.

Real-world: bug bounty results build portfolios. Young security researchers join bug bounty programs, read how previous researchers successfully exploited a system, and try the same operations on other organizations — a way to learn different ways of exploiting application-level and database-level weaknesses. Application security engineers list their awards on resumes — silver, bronze, or gold categories — and the higher the category, the more expert the researcher looks at finding vulnerabilities in other organizations' networks, systems, or applications. It is a way to increase your portfolio and also earn income.

Recap + bridge: hacking is unauthorized compromise of devices and networks; white hats do it first with permission so the holes are closed, black hats do it for profit or harm, and gray hats do it without permission but without destructive intent — and bug bounty programs turn the white hat's skill into a paid, portfolio-building profession. Next, we follow what happens when a hacker succeeds: the data breach.

13.5 Data Breach

Hook: An organization's most valuable asset is not its buildings — it is the confidential information of its customers. What happens the day that information stops being confidential? That single event has a name, a legal obligation attached to it, and a cost that can outlive the attack itself.

13.5.1 What counts as a data breach

A data breach is any security incident that results in unauthorized access to confidential information — in other words, data has been exposed to the public. When attackers post that they successfully logged into an organization's network and gained access to all sensitive personal information — for example SSN numbers or credit card numbers — that is a data breach. When there is unauthorized access or infiltration of data, whether at the system level, the network level, or the database level, and the attacker gains access to clients' confidential information or personal information, that is a data breach.

The definition's three parts. A data breach is a security incident (an event that goes against the organization's security expectations) that produces unauthorized access (someone reaches data they were not allowed to reach) to confidential information (personal data such as SSNs, credit card numbers, passwords). Two details matter for labelling examples:

The access does not need to be deep — any level (system, network, or database) counts.
The exposure decides the label: the data need not be published on the dark web to count; it is a breach the moment someone without authorization gets it.

Notice how the definition connects to defense in depth (13.1): a breach is what happens when the layers of control — firewall, IDS/IPS, access control, physical security — all fail to keep one unauthorized person out.

13.5.2 The obligation to inform

Organizations are liable to inform regulators once a breach is confirmed. The sequence: first the organization must confirm that data was really exposed or not; only after confirmation do the obligations kick in. Contracts with vendors usually say that whenever a data breach happens, the organization must inform all clients who are part of the contract within 48 hours or within 24 hours, telling them what happened, what the issue was, and the current status. On top of that there are regulatory requirements: under GDPR, a data processor — an organization processing the data of its clients — must inform the GDPR authorities within 72 hours. If the organization tries to hide the breach, it is penalized very heavily.

The confirmation-first rule. The obligations do not trigger on suspicion — the organization must first confirm that data was really exposed. Only after confirmation do the clock-based duties start: contract duties to clients (commonly within 24 or 48 hours, depending on the contract, covering what happened, what the issue was, and the current status) and the GDPR duty to the regulator (within 72 hours for a data processor). The danger of skipping the confirmation step is crying wolf to clients on a false alarm; the danger of skipping the notification step is much worse — hiding a confirmed breach brings heavy penalties, which is exactly why regulators treat delayed or hidden notifications as a second offence.

13.5.3 What a breach costs the organization

Once a data breach happens, there will be financial loss, reputation loss — because the reputation damage is there — and legal implications. Rebuilding the trust of clients and customers after a breach is very challenging.

Scope of a breach — three cost channels. (1) Financial loss: the direct theft or fraud losses, plus fines and legal penalties. (2) Reputation loss: customers and partners lose confidence; the brand is damaged in a way that is hard to measure and harder to repair. (3) Legal implications: regulatory penalties (including GDPR's), and the contracts with clients that the breach violated. The one-line summary the professor emphasizes: rebuilding the trust of clients and customers after a breach is very challenging — trust is lost in a day and rebuilt over years.

13.5.4 Phishing as the simplest breach path

A simple example of a data breach is a phishing attack. In a phishing attack, the attacker sends a deceptive email — a fake email — that tricks individuals into revealing their sensitive information, such as their passwords or card information. Using social engineering techniques, the attacker enters the systems and gathers information. That is why data breaches are considered very critical to an organization.

Worked example — a phishing email as a breach. An employee receives an email that appears to come from the company's own IT department: "Your mailbox is nearly full. Log in within 24 hours to keep it active." The login link leads to a page that looks identical to the company's portal, but it is the attacker's page. The employee types in their username and password. The attacker now has valid credentials. With those credentials, the attacker logs into the real portal, reaches the customer database, and copies the customer list. This sequence is a data breach in three stages: the deceptive email (phishing) → the volunteer disclosure of credentials (social engineering) → the unauthorized access to confidential customer information (the breach itself). Sense-check: every element of the definition is present — a security incident (the login), unauthorized access (attacker using stolen credentials), and confidential information (customer data). The quiz pattern to remember: phishing that exposes passwords counts as a data breach.

Exam note + recap: for the quiz, identify whether an example is a data breach — phishing that exposes passwords is one; a breach is a security incident that gives unauthorized access to confidential information; once confirmed, the organization must inform clients (contract windows, commonly 24–48 hours) and regulators (GDPR, 72 hours). Next we look at what attackers do with the stolen confidential information: assume the victim's identity.

Real-world: the Verizon Data Breach Investigations Report — the industry's most cited breach study, built with data shared by the U.S. Secret Service and other agencies — repeatedly shows that stolen credentials and phishing are among the leading paths into organizations, which is why email authentication (SPF, DKIM, DMARC from 13.1) and confirmation procedures are such prominent controls.

13.6 Identity Theft

Hook: Your name, your account number, your card details — these are not just data; they are the keys to "you" in the digital world. What happens when someone else gets hold of those keys? They do not need to impersonate your face — they only need to impersonate your identity.

13.6.1 What identity theft is

Identity theft happens when a person's identity is stolen, and someone else uses that identity to log into systems without permission. The attacker takes the identity and performs fraudulent activities on behalf of that name. Cyber criminals use stolen identities to perform sophisticated cyber attacks, social engineering, or to send malware. Identity theft is one of the ways personal information feeds other crimes.

The definition's two stages. Identity theft is a two-stage crime: (1) stealing the identity — the attacker gathers enough personal information (passwords, user IDs, account numbers, personal details) to represent a specific person; (2) using the identity — the attacker logs into systems as that person, without permission, and performs fraudulent activities on their behalf. The second stage is what makes identity theft different from a plain data breach (13.5): the breach exposes data, while identity theft activates it — the stolen information is put to work as a false "self" that logs in, moves money, sends messages, or opens new accounts. Note the chain: identity theft is often fed by data breaches and phishing, and it in turn feeds other crimes (fraud, social engineering, malware campaigns), which is why the professor calls it one of the ways personal information feeds other crimes.

13.6.2 Random user IDs as a control

Recall identity and access management: identification is how an end user is identified. Some companies tag individuals with their corporate email ID; others tag them with a random number. Banking companies, for example, give employees a user ID like "xllhbrc" so that nobody can trace back directly by looking at the user ID who the person is. Internally the database knows which specific user "xllhbrc" belongs to, but externally, even if somebody captures those identities, they cannot tell whose identity it is. Even admin-level accounts avoid obvious IDs: instead of "admin123", which makes it clear to 90 percent of people that this is an admin account, banks create user IDs so that nobody can trace whether it is an individual user or an admin. Most other organizations are less strict and just use the employee's email ID for login, which is why the banking practice stands out.

Worked example — the random user ID as a control. A bank issues its employees user IDs such as "xllhbrc", "qk8f3mz", and "tpd7v2a". Nothing in any of these strings reveals the person behind it: no name, no role, no department. Internally, the bank's identity database holds the mapping — user "xllhbrc" is employee Meera Nair, role: senior teller. Externally, an attacker who captures the user ID list (say, through a phishing email or a leaked database) sees only meaningless strings. Compare that with an organization that uses email IDs as logins: the captured list reads "meera.nair@company.com" — the attacker now knows exactly which person each account belongs to, which feeds further social engineering. And even the admin account follows the same rule: a bank's admin ID is not "admin123" — a label that immediately signals "this is a privileged account worth attacking" to 90 percent of people — but another random string, so that nobody can even tell an individual user account from an administrator account. Sense-check: the control does not stop the credentials from being stolen; it stops the stolen credentials from revealing who they belong to, which slows the attacker's next step (targeting a high-value person or admin).

13.6.3 The physical-world analogy

The physical world shows the same failure mode. If a security guard checks that a person is wearing an organization ID card but never verifies the photo inside the card against the person wearing the tag, an unknown person can walk into the organization by wearing someone else's card. That is identity theft in physical form — and the same idea transfers to the IT infrastructure level, where criminals steal personal information to perform criminal acts.

Professor's analogy (kept and extended): a guard checks that a person is wearing an organization ID card but never verifies the photo against the person wearing the tag — so anyone can walk in wearing someone else's card. The check that a card exists is like the system's identification step; the check that the card matches the wearer is like authentication (the password or biometric that proves the person is really that user). In the IT world the same failure happens when a system trusts the presented identity without properly authenticating it — a stolen user ID plus a guessed or phished password passes the check because nothing binds the login to the true person. Where the analogy breaks: in the physical world the guard can look at the face; in the digital world there is no face — which is exactly why authentication factors (something you know, something you have, something you are) exist.

13.6.4 Dumpster diving

One way identity information is gathered is dumpster diving: going through the dustbins of an organization that does not shred its physical data. From the bins an attacker can capture the organization's architecture diagram, the last sales report, or whatever is needed. The ultimate goal is to steal enough information about the victim so the attacker can assume the compromised identity.

Scope and pitfall. Dumpster diving shows that identity theft is not purely a technical crime: information is gathered from the physical world (unshredded documents) as well as the digital one (phishing, breaches, skimming). The pitfall for organizations is thinking that identity protection is only an IT problem — if the physical data in the dustbin is not shredded, the attacker does not need to hack anything. The pitfall for individuals: documents such as bank statements, bills, and pre-approved card offers are enough, piece by piece, to reconstruct an identity — which is why the professor's ultimate goal statement matters: the attacker collects enough information, from any source, to assume the compromised identity.

Exam note + recap: identify whether an example is identity theft — someone logging into systems using a stolen identity without permission. The identity is stolen (through breaches, phishing, or even dumpster diving) and then used to log in and commit fraud. The random user ID control makes stolen identities harder to use, and the guard-without-photo-check analogy explains the underlying failure. Next, we look at the crime that identity theft so often enables: cyber fraud.

Real-world: banks adopt random user IDs because their customers' accounts are directly reachable from employee credentials — a real bank theft, such as the 1995 Citibank case in which a Russian group moved millions of dollars out of customer accounts, shows how valuable even a single stolen bank credential can be, which is why the banking practice of non-revealing IDs stands out.

13.7 Cyber Fraud

Hook: Most cyber crime is not about breaking machines — it is about breaking trust to take money. Fraud is a lie with financial consequences, and the internet has become the cheapest, largest stage for lies in history.

13.7.1 What cyber fraud is

Cyber fraud is a crime with the intention to corrupt an individual's personal information — doing fraud by corrupting personal information. The fraud is performed using methods like hacking or identity theft, so identity theft can itself be an example of cyber fraud. When a cyber fraud happens, the result is financial loss — a classic example is somebody transferring all the money from an account into their own account. The loss can go beyond financial: it can leak sensitive information and cause reputational damage that is irreparable, because rebuilding trust with clients and customers becomes very challenging.

The definition's key move: corruption of information. Notice the professor's precise wording — cyber fraud is fraud performed by corrupting personal information. The information is not just read (that is a breach) and not just used to impersonate someone (that is identity theft) — it is corrupted or misused to deceive and extract money. The classic example makes it concrete: an attacker gets access to an account and transfers all the money into their own account. The method can be hacking or identity theft — which is why identity theft can itself be an example of cyber fraud: it is a method (stealing the identity) used to reach a fraudulent goal (stealing money or value). This nesting matters for the quiz: the same example can be both identity theft and cyber fraud, depending on which label the question asks for.

13.7.2 Forms of cyber fraud

Phishing attacks, ransomware attacks, and online shopping scams are all different types of cyber fraud. Ransomware corrupts or encrypts data and demands payment; online shopping scams deceive buyers; phishing uses deceptive email to harvest credentials — each is a fraud carried out through technology.

Comparison — three forms of cyber fraud. All three are frauds — deception for money — but each uses a different deception:

Form	The deception	The fraud payoff
Phishing	A fake email pretends to be a trusted party	Harvested credentials or card details are used to steal money or sell data
Ransomware	Malware encrypts or corrupts data	Victim pays to get the data back (a threat, not a promise)
Online shopping scam	A fake store or fake offer deceives the buyer	The buyer pays and the goods never arrive (or are worthless)

The one-line rule: fraud is the outcome — financial or reputational loss through deception — and phishing, ransomware, and shopping scams are the mechanisms. Identity theft is a mechanism too, which is why it can also be called cyber fraud.

Worked example — a shopping scam traced end to end. A buyer sees an offer on a website that looks like a well-known retailer: a popular phone at half price. The buyer pays online. Two things can happen next. In the simpler version, the goods never arrive and the store disappears — the buyer has paid money to a lie. In the more dangerous version, the payment page is a phishing page: the card details typed there go to the attacker, who then uses the card to make purchases elsewhere. Either way the elements of cyber fraud are present: personal information (the card details) was corrupted/misused, and the result was financial loss to the buyer. Sense-check: no system was broken into in version one — the deception alone was enough — which is why fraud is considered the most accessible cyber crime: it does not require the technical skill of hacking (recall from the reference material that fraud is popular with con artists precisely because it needs little technical expertise).

Exam note + recap: in the quiz, cyber fraud is the label for examples where personal information is corrupted or misused for financial or reputational loss — the outcome matters. Identity theft can be a method of cyber fraud; phishing, ransomware, and shopping scams are the common forms. Next, the lecture switches to a crime with a completely different target: not your money, but you.

13.8 Cyber Bullying

Hook: Stealing money is a crime everyone recognizes. But what about the crime that does not take a single rupee — and still destroys a person's life? The law had to invent a name for it: cyber bullying.

13.8.1 What cyber bullying is

Cyber bullying is using technology to harass, threaten, or embarrass a person. The main intention is to target one specific person by continuously sending unsolicited messages or fake messages — pulling someone's leg becomes bullying when it is done through technology and aimed at one person.

The definition's three parts. Cyber bullying needs: (1) technology as the platform — the harassment travels through messages, posts, or calls, not in person; (2) harassment, threats, or embarrassment as the act; (3) one specific person as the target, attacked continuously with unsolicited or fake messages. The professor's boundary line is the memorable one: pulling someone's leg becomes bullying when it is done through technology and aimed at one person. A joke at a party is leg-pulling; a joke repeated to one person relentlessly, through fake accounts, until they are afraid to open their phone — that is bullying. The "one specific person" part matters: an attack on everyone in general (spam to a whole mailing list) is not bullying in this sense; the crime is personal by design.

13.8.2 Cyber fraud versus cyber bullying

The intention behind cyber fraud and cyber bullying is different, and this distinction matters for example identification. Cyber fraud corrupts or spoils an individual's personal information and results in financial loss to the individual or organization. Cyber bullying uses technology as a platform to harass, threaten, or embarrass one specific person. Same platform, different aim: one goes after information and money, the other goes after a person.

Comparison — cyber fraud versus cyber bullying. Both use the same platform (technology), so the platform cannot decide the label — the intention and the target do.

Dimension	Cyber fraud	Cyber bullying
Intention	Financial or reputational loss through corruption of information	Harass, threaten, embarrass a specific person
Target	The victim's information and money	The victim as a person
Typical act	Transferring funds, harvesting credentials, fake stores	Unsolicited/fake messages aimed at one person
Loss	Financial loss (often with reputational damage)	Emotional/psychological harm to the person

The professor's summary: same platform, different aim — one goes after information and money, the other goes after a person. When the quiz asks "is this example cyber bullying, identity theft, or a data breach?", do not look at the medium (it is always technology) — read the intention and the target before answering.

Worked example — labelling by intention and target. A student receives, over three weeks, dozens of messages from anonymous accounts calling them a failure, mocking their family, and threatening to spread a private photo. The messages are aimed at this one student, continuously. Label: cyber bullying — technology as platform, harassment, one specific person. Now the same platform, different example: an email pretending to be the student's bank asks for the account password, and the attacker later empties the account. Label: cyber fraud (with identity theft as its method) — the aim was money, not the person. One more: the attacker also downloaded the student's private photo and posted it publicly — that becomes a data breach if the photo was confidential data, and the act of exposing it adds to the harassment. Sense-check: intention (money versus hurting the person) and target (information versus person) cleanly separate the labels, exactly as the professor instructs.

Exam note + recap: the quiz asks exactly this — "is this example cyber bullying, identity theft, or a data breach?" Read the intention and the target before answering. Cyber bullying = technology used to harass, threaten, or embarrass one specific person; cyber fraud goes after information and money. Next, we see a quieter cousin of bullying: not harassment by messages, but surveillance by posts — cyber stalking.

13.9 Cyber Stalking and Privacy

Hook: You do not need to hack a phone to know where its owner is — you only need to read the posts they publish. The quieter the crime, the easier it is to commit: stalking needs no exploit, only public information.

13.9.1 What cyber stalking is

Cyber stalking is tracking someone's real-time activities through their posts. If you post on Facebook "today I am at this location," someone can trace where you are right now and which locations you traveled that day; from the real-time posts, the tracker reconstructs the entire activity of your whole day. Cyber stalking carries real privacy risk. One simple safeguard: if a post is restricted to friends only, strangers cannot see it — but if it is posted publicly, anyone outside the friend group can follow the whole day's movement.

The definition's two ingredients: tracking and real-time. (1) Tracking — the stalker follows the victim's movements over time, not just reads one post; (2) real-time — the tracking works through live posts, so the stalker knows where the person is right now, not just where they were last week. That "right now" is what raises the risk from curiosity to danger: a posted "today I am at this location" tells a stranger exactly where to find the poster. The professor's safeguard is a simple audience control: a post restricted to friends cannot be read by strangers, while a public post lets anyone outside the friend group follow the whole day's movement. Notice the link to the threat model: the stalker needs no hack — the victim's own sharing settings are the control that either protects or exposes them.

Worked example — reconstructing a day from public posts. Suppose a student posts: (1) at 8:30 a.m., "Morning run at the lake park with a selfie"; (2) at 12:10 p.m., "Lunch at City Mall, food court"; (3) at 5:45 p.m., "Reached home, time to study". A stranger reading these three public posts reconstructs: the student runs at the lake park every morning (habit), studies at home from early evening (routine), and can be located at City Mall around noon. If the student posts "Today I am at this location" while actually there, the stranger also knows where to find them right now. Now change one setting — restrict the posts to friends only — and the same stranger sees nothing. Sense-check: the whole day's activity was reconstructed from three innocent-looking posts; the safeguard (audience restriction) is cheap, but it only works if applied, which is why the professor highlights it as the simple fix.

13.9.2 Apps that capture more than they need

The reason cyber stalking succeeds is often that applications capture personal information beyond what their function needs. Take Truecaller: its main job is to inform the end user whether an incoming call or message is spam. But during installation it captures access to the phone contacts, the location, and the memory — information not required to perform its function. The gap between what the functionality is intended to do and what information is actually captured is a violation of privacy.

The over-collection problem. The app's function (tell me if this caller is spam) is far smaller than the permissions it requests (contacts, location, memory). That gap — between intended functionality and captured information — is a privacy violation even if the app never abuses the data, because the data exists to be leaked, sold, or stolen. Truecaller is the professor's example: a caller-ID app whose core job needs only a number lookup, yet requests access to the entire contact list, the phone's location, and the memory. The real-world consequence for stalking: the more personal data sits in one place (contacts, location history, photos), the more value a single compromised account or app database has for someone tracking a specific person. The design lesson: permission requests should match the function — nothing more.

13.9.3 Privacy by design

Privacy by design is the principle organizations must apply whenever an application or functionality pulls out personal information of an individual: capture only the information needed for the intended purpose. Whatever information is captured should be only what the required function needs. This is what organizations need to consider when building software — the stalking problem and the over-collecting app problem are two sides of the same privacy issue.

The principle, stated as a design rule. Privacy by design is applied when building the software, not after a complaint: for every piece of personal information an app could capture, the builder must ask "does the intended function need this?" — and capture only what the required function needs. It has three practical consequences: (1) minimal capture — fewer permissions at install time (Truecaller-style apps would request only the number lookup); (2) minimal retention — data not kept longer than the function needs it; (3) minimal exposure — less data in one place means less damage if that place is breached. The professor's closing point ties the section together: the stalking problem (13.9.1) and the over-collecting app problem (13.9.2) are two sides of the same privacy issue — too much personal information, in too many hands, is what makes surveillance of a person possible.

Recap + bridge: cyber stalking tracks a person's real-time activities through public posts; apps that capture more data than their function needs feed the problem; privacy by design — capture only what the function needs — is the builder's answer. Next, the lecture steps back from the crime to the criminal: why do they do it at all?

13.10 Why Cyber Criminals Do It

Hook: Not every cyber criminal wants money. Some want revenge, some want their name on a leaderboard, and some simply enjoy the chaos. If you cannot name the motive, you cannot predict the attacker — and this lecture gives you the four motives.

13.10.1 Financial gain

The main motive is financial gain: stealing money through fraudulent activities, extorting victims by threatening to release sensitive data, and disrupting operations — for example through ransomware attacks that demand payment to undo the encryption. Most cyber crime is financially motivated.

The dominant motive, with its three routes. Financial gain is the main motive — most cyber crime is financially motivated. It arrives by three routes: (1) stealing money directly through fraudulent activities (account transfer fraud, card theft); (2) extorting victims by threatening to release sensitive data (the victim pays to keep the data private); (3) disrupting operations — the ransomware route, where systems are encrypted and the payment "undoes" the encryption. Note the pattern that appears repeatedly in this lecture: the disruption itself is often just a way to get paid — which is why ransomware demands are the fastest-growing form of financial cyber crime.

13.10.2 Revenge

Technology becomes the platform for revenge against individuals, organizations, or even nations: defacing websites, stealing data from a national database, or disrupting operations. Disrupting operations can mean making systems unavailable — including electrical power substations that are controlled over the internet: shut those down and there is no power for the country. Revenge at national scale is one of the reasons power infrastructure is a sensitive target.

The scale of revenge. Revenge does not have to stay personal. The professor's example escalates it to national scale: electrical power substations are controlled over the internet, and shutting them down means no power for the country. That one example explains why critical infrastructure is a sensitive target: the revenge motive meets a system whose failure hurts everyone. The security consequence (developed later in 13.16–13.17): an attacker who does not want money cannot be stopped by making payments impossible — they must be stopped by making the systems hard to reach in the first place (defense in depth, 13.1) and by patching, which is exactly where governments are weakest.

13.10.3 Power and recognition

Some cyber criminals are motivated by power or recognition. Search for the top ten cyber criminals and you will find a list — when criminals see their name in the top ten, they feel recognized as a number-one cyber criminal. The motivation can also be proving hacking skills or causing widespread disruption.

The leaderboard motive. For this group the attack is a performance: the goal is the name, not the money. The professor's image is concrete — search for the top ten cyber criminals and you will find a list; criminals whose names appear feel recognized as the number-one cyber criminal. The two sub-motives are proving hacking skill and causing widespread disruption. This motive predicts attacker behaviour that the other three do not: these criminals want to be found (in the list), so they leave signs, boast, and reuse names — which is useful for attribution (13.13) even though many do not care about being caught.

13.10.4 Vandalism

Finally there is vandalism: simple enjoyment. Some attackers enjoy causing chaos and destruction — launching denial of service or distributed denial of service attacks against websites, or defacing them. Whenever systems go down, it is a fun activity for them. So the motivation set is: financial gains, revenge against an organization or government, worldwide recognition, and vandalism.

Recap + bridge: the motivation set is financial gain (the main one), revenge (personal to national), power and recognition (the leaderboard), and vandalism (enjoyment of chaos). The motive matters because it predicts the target and the behaviour: money-driven attackers follow the money (13.15), revenge and vandalism target what hurts (infrastructure, reputation), and recognition-seekers want to be seen. Next, we sort the crimes themselves — by who or what they are aimed at.

Real-world: the Verizon Data Breach Investigations Report measures motives directly and consistently finds that roughly three-quarters of data breaches are financially motivated, with espionage a distant second — the professor's "most cyber crime is financially motivated" is a statistical fact, not just a guess.

13.11 Classifying Cyber Crimes by Target

Hook: Burglars break into houses; what do cyber criminals break into? The answer splits the whole subject into four boxes — person, property, government, and society — and every example in the quiz lands in exactly one of them.

13.11.1 Against the person

A crime can be committed against a person or individual by emailing, spamming, defamation, or harassment.

The person box. The target decides the box: when the direct victim is an individual person, the crime sits here — sending harmful email, spamming, defamation (false statements that damage the person's reputation), and harassment (repeated unwanted attention). This is the box where the crimes of 13.6–13.9 (identity theft, fraud, bullying, stalking) usually land, because their direct victim is one person — a useful check when labelling quiz examples.

13.11.2 Against property and intellectual property

Against property, the crimes include credit card fraud and claims on your intellectual property. Intellectual property is whatever you developed using your intellectual knowledge: trademarks, trade logos, or a new formula for which you applied for a patent. When a new research formula is patented, whoever wants to use that formula pays a licensing fee to the inventor — for 20 years or 40 years depending on the country where the patent is registered. Physical property cannot be attacked through the internet — nobody attacks your house over the internet — but intellectual property can: the exclusive rights you hold as inventor or creator get damaged, and the licensing income flows to the attacker instead of you. Intellectual property covers copyrights (a book you prepared), patents, trademarks, and trade secrets — the Coca-Cola formula or the Maggi formula are trade secrets, and if somebody performs a cyber crime against them, the intellectual property can effectively be transferred to their name.

Why property crimes work differently online. Physical property cannot be attacked through the internet — nobody attacks your house over the internet — but intellectual property can. The reason is what intellectual property is: whatever you developed using your intellectual knowledge, protected by exclusive rights — copyrights (a book you prepared), patents (a new formula, protected for roughly 20–40 years depending on the country, with users paying a licensing fee to the inventor), trademarks and trade logos, and trade secrets (the Coca-Cola formula or the Maggi formula). Stealing these does not require touching anything physical — a copy of the formula, the book, or the logo is enough — so the internet is the perfect theft platform. When the theft succeeds, the exclusive rights are effectively transferred to the attacker's name: the licensing income that should flow to the inventor now flows to the attacker.

13.11.3 Against government

Against the government, the attacks are denial of service, virus attacks, email bombing (continuously sending emails to the people who work there, until their mailboxes are loaded and they cannot perform day-to-day operations), and sending trojans. A trojan is similar to a virus, but its main job is exfiltration: whatever activity happens in the system — whatever usernames and passwords are typed — is sent back to the person who installed the trojan. Denial of service means making systems unavailable to legitimate users.

The government box — four attack tools. (1) Denial of service (DoS): making systems unavailable to legitimate users — the digital version of blocking the government office's only door. (2) Virus attacks: malicious software that spreads and damages systems. (3) Email bombing: continuously sending emails to the people who work there until their mailboxes are full and they cannot perform day-to-day operations — the attack needs no exploit, only volume. (4) Trojans: the professor stresses the distinction from a virus — a trojan looks like a normal program but its main job is exfiltration: whatever happens in the system, whatever usernames and passwords are typed, is sent back to the person who installed it. So the virus damages, the trojan watches and reports; and a DoS attack on government systems means citizens cannot use government services, which is why it appears so often in the cyber terrorism material later (13.16).

13.11.4 Against society

Against society, the crimes are forgery operations, cyber terrorism (terrorist attacks performed using cyber technology), and web jacking. Web jacking is when attackers gain control of an organization's or an individual's website, hijacking it. A common implementation: the attackers develop another website, and whenever you click on the original site you are taken to the fraudulent website instead. There is also the logic bomb: malicious code injected into software that stays dormant until a condition triggers it — one of the ways cyber crimes are performed against government.

The society box. When the harm spreads beyond one person, one company, or one office to the public, the crime lands here: forgery operations (creating fake documents or money), cyber terrorism (terrorist attacks performed using cyber technology — the subject of 13.16), and web jacking — attackers gain control of an organization's or individual's website and hijack it; a common implementation is to build another website so that clicking the original address takes you to the fraudulent site instead. Alongside them, the professor adds the logic bomb: malicious code injected into software that stays dormant until a condition triggers it — a classic way of performing cyber crimes against government, and one of the reasons insider-placed malware is so dangerous: the bomb can sit silently inside the software for years before its trigger.

13.11.5 Internet time theft

Internet time theft is the use of internet hours that were paid for by another person. If you pay for a broadband subscription of 10 GB of download for 400 rupees, and somebody with a weak Wi-Fi password connects to your router and downloads as much as they want, you are paying for their usage — that is internet time theft. The numbers make it concrete: as a prepaid subscriber you pay for a maximum download of 200 GB; out of those $200$ GB you actually used only $5$ GB, so the remaining $200 - 5 = 195$ GB got used by the cyber criminal. That $195$ GB is stolen internet time. The attack succeeds because of a weak Wi-Fi password — a control failure on the victim's side.

Worked example — the 195 GB arithmetic. As a prepaid subscriber you pay for a maximum download of $200$ GB. Across the month you used only $5$ GB of it. Your router's Wi-Fi password is weak, so a neighbour connected to it and used your connection heavily.

$Stolen internet time = Paid allowance - What you actually used = 200 - 5 = 195 GB$

That $195$ GB — the difference between what you paid for and what you used — is internet time the criminal consumed while you paid for it. The second example uses the same idea at a smaller scale: a $10$ GB download plan bought for $400$ rupees lets anyone with the weak Wi-Fi password download as much as they want, and you pay for their usage. Sense-check: the victim suffers no loss of data — their files are untouched — but a real loss of paid resource; the professor's label, internet time theft, captures exactly that. The professor's diagnosis of the failure: a weak Wi-Fi password is a control failure on the victim's side, which ties the example back to defense in depth — the home router is a boundary control, and a weak password defeats it.

Exam note + recap: the classification runs against the person (spam, defamation, harassment), property (credit card fraud, intellectual property), government (denial of service, virus, email bombing, trojans), and society (forgery, cyber terrorism, web jacking) — plus internet time theft. Know the definitions of each word; the quiz presents examples and asks which category fits. Next, we move from the targets of the crimes to the people who commit them.

13.12 Types of Cyber Criminals

Hook: The most dangerous person in your organization is not the hacker outside the firewall — it is the employee already inside it. This section sorts cyber criminals by what they want: recognition, silence, or a reason to hurt the very company that employs them.

13.12.1 Those who want recognition

Some cyber criminals need recognition. This group includes hobby hackers, IT professionals, politically motivated hackers, and terrorist organizations. Their motive is the name, the skill, or the cause.

The recognition box. The first group attacks for attention: hobby hackers (hacking as a hobby or a thrill), IT professionals (proving skill), politically motivated hackers (hacktivists — attacks for a cause), and terrorist organizations (attacks for an ideology). The shared motive is the name, the skill, or the cause — not money. Recognizing this group matters for two reasons: their attacks often carry signs (claimed credit, manifesto-like messages, defaced pages with political statements), and they are the group most likely to be stopped by being given nothing to prove to — the opposite of the quiet professionals below.

13.12.2 Those who do not want recognition

Others do not need recognition but still perform attacks: state-sponsored actors — states that sponsor attacks on other countries — and organized crime teams. They operate quietly, for money or for national purposes.

The quiet box — and why silence is harder to stop. State-sponsored actors and organized crime teams do not want recognition: their goal is money or national purposes, and every piece of attention raises the chance of being caught. The professor's practical point is the behavioural one — they operate quietly. Where the recognition-seekers leave boastful traces, the quiet professionals hide: no claimed credit, no defacement statements, careful removal of logs. This is the group the Tor problem of 13.13 is really about, and the reason detection must come from behaviour (anomalies, exfiltration patterns) rather than from the attackers' own announcements.

13.12.3 Insiders

The third and most difficult category is the insider: disgruntled employees who are not happy with the organization — maybe because of salary hikes they were not given, or manager pressure, or how employees are treated. No matter how many technical, administrative, or physical controls are implemented, insider threats are among the most challenging threats today. That is why companies perform continuous monitoring on all desktops and laptops of all employees, watching for suspicious activities that could harm the organization; the latest tools, including UEBA-style analytics built on AI/ML, have options for finding insider threats.

The insider — why no control stops them. The insider is an employee (or former employee) with legitimate access: not a hacker breaking in, but someone already inside the perimeter. The professor names the classic triggers: salary hikes not given, manager pressure, how employees are treated — disappointment that turns to harm. The warning is the lecture's clearest: no matter how many technical, administrative, or physical controls are implemented, insider threats are among the most challenging threats today. The reason is structural — every control in 13.1 is designed to keep outsiders out; the insider already passed them. The countermeasure is so monitoring, not walls: companies perform continuous monitoring on all desktops and laptops of all employees, watching for suspicious activities that could harm the organization — and the latest tools, including user and entity behavior analytics (UEBA) built on AI/ML, find insider threat indicators by learning what "normal" looks like for each user and flagging departures from it.

The insider pitfall for defenders. The two failures to avoid: (1) trusting that access controls protect the organization from its own employees — the insider already holds legitimate credentials, so technical controls only limit what they can reach, not whether they act; (2) treating monitoring as a privacy-free zone — continuous monitoring is justified because the insider's actions are exactly what it must catch, but it must be applied within policy so the organization does not create a second insider problem of its own. The professor's recommendation stands: monitoring, especially UEBA-style behaviour analytics, is the practical answer to the hardest threat category.

Recap + bridge: three types of cyber criminals: those who want recognition (hobby hackers, IT professionals, hacktivists, terrorists — motive: name, skill, cause), those who do not (state-sponsored actors and organized crime — quiet, for money or national purpose), and insiders (disgruntled employees — the most challenging because controls cannot keep them out, only monitoring can catch them). Next, we ask where our knowledge of all this crime comes from — and why the data is incomplete.

Real-world: user and entity behavior analytics (UEBA) built into modern monitoring tools is how organizations surface insider threat indicators in practice — an employee who suddenly downloads customer records at 2 a.m., or copies gigabytes to a USB drive, trips the anomaly score that a pattern of normal behaviour makes visible.

13.13 Where Cyber Crime Data Comes From, and the Tor Problem

Hook: Every statistic about cyber crime is built on what is reported — and most cyber crime is never reported. So how do we know anything about the attacks at all, and how do we catch an attacker who has made themselves untraceable?

13.13.1 Sources of cyber crime data

Cyber crime data comes from several sources. Law enforcement agencies collect data on reported cyber crimes. Security companies track attacks — Verizon and similar organizations publish reports on the latest trends in attacks and their statistics. Industry organizations and research firms conduct surveys and publish reports on the impact of cyber crime on specific sectors. Academic researchers analyze cyber crime data to understand trends and develop solutions to overcome the challenges.

The four sources, and what each contributes. (1) Law enforcement agencies collect data on reported cyber crimes — the official count, but only of what victims brought forward. (2) Security companies track attacks directly — Verizon and similar organizations publish reports on the latest attack trends and statistics (Verizon's Data Breach Investigations Report is built from actual investigated breaches, shared with law enforcement partners). (3) Industry organizations and research firms conduct surveys and publish reports on the impact of cyber crime on specific sectors. (4) Academic researchers analyze cyber crime data to understand trends and develop solutions. The four sources are complementary: law enforcement sees the crimes people report, security companies see the attacks on their networks, surveys see what organizations admit to, and academia sees the patterns across all of them.

13.13.2 The underreporting problem

Law enforcement data does not reflect the full scope of the problem because many cyber crimes go unreported. Reasons: fear of embarrassment, lack of awareness, and difficulty in attributing the attack. Attribution — tracing the attack to a specific actor — is hard when attackers use anonymization techniques.

Why the official numbers undercount. Law enforcement data does not reflect the full scope of the problem because many cyber crimes go unreported, for three reasons: fear of embarrassment (victims who fell for a phishing email or a scam do not want to admit it), lack of awareness (victims do not realize a crime happened to them at all), and difficulty in attributing the attack (if no one can say who did it, reporting seems pointless). Attribution — tracing the attack to a specific actor — is hard when attackers use anonymization techniques, and it is the exact problem the next subsection turns to. The consequence for the whole lecture: every statistic must be read as a floor, not a ceiling — the true amount of cyber crime is unknown because the reporting is voluntary and partial.

13.13.3 Tor and attribution

Tor is a free open-source software that anonymizes traffic. When an attacker launches an attack through Tor, the traffic is redirected through a worldwide network of relays — roughly seven hops — so the source IP address cannot be traced back. If the cyber criminal had used their own IP address, it would be easy to trace and catch them; by routing the connection through Tor they analyze the traffic path so that nobody can determine where the attack is coming from. Tor protects the attacker's communication.

How Tor breaks attribution. Tor (The Onion Router) is a free open-source software that anonymizes traffic. When an attacker launches an attack through Tor, the traffic is redirected through a worldwide network of relays — the connection is wrapped in layers of encryption, one per relay, each peeled off like an onion's skin as the traffic hops from relay to relay — so the source IP address cannot be traced back. The professor's contrast carries the whole idea: if the cyber criminal had used their own IP address, it would be easy to trace and catch them (your connection carries your address like a return address on an envelope); by routing the connection through Tor, the attacker splits the trail across many relays, so nobody can determine where the attack is coming from. Tor protects the attacker's communication — and the same technology also protects journalists, activists, and whistle-blowers, which is why Tor itself is legal and widely used; it is the use that determines the label.

The onion-routing picture. Imagine a letter sealed inside three envelopes. The first relay can open only the outer envelope and learns only the next hop; it forwards the letter, unable to read the inner contents. The second relay opens the next layer and learns only its next hop. Only the final relay opens the innermost envelope and sees the actual destination. Any single relay can see only one hop — the sender's IP is known only to the entry relay, and the destination only to the exit relay, and the two relays never compare notes. The result: no single point on the path can attribute the traffic. That is why an attacker's own IP is easy to trace (the first hop is their house) while a Tor-routed attack is effectively un-attributable at the network level.

13.13.4 How XDR detects Tor traffic

Q: How do we detect and track the location of an anonymous cyber criminal connected through the Tor network? A: XDR with AI/ML capability can identify Tor connections. XDR products maintain a list of IP addresses that are considered Tor exit nodes — a Tor IP list — so when a communication is established between our server and a Tor network node, the XDR immediately checks whether the IP address belongs to a known Tor connection. This is the current approach followed by most organizations: keep the Tor IP database updated. Many systems, like Falco, detect unexpected behavior or intrusions in real time using Tor traffic — the Tor network nodes keep changing dynamically, so the detection must happen as soon as any anomalous behavior appears. The AI/ML engine continuously learns what a legitimate connection looks like, for inbound and outbound traffic, and flags requests that come from anonymized connections. Even ISPs (internet service providers) have their own controls for checking whether a request comes from such systems.

The detection challenge: the Tor IP addresses change dynamically. With AI/ML techniques, the first time a specific Tor request arrives from these cyber addresses, the anomaly is flagged as suspicious because of the abnormal activity or the anonymity present in the request. In the incident response process — command and control, or data exfiltration scenarios — Tor detection plays a major role. Real-world: most vendors, such as Splunk, have inbuilt capabilities to detect requests triggered from the Tor network. Another real-time source: the dark web, where Tor exit node information is continuously posted, feeding the detection databases.

The detection strategy — lists plus behaviour. Since Tor breaks attribution at the source, defenders flip the problem: they do not trace the attacker, they flag the traffic. Two layers do the work. (1) List-based detection: XDR products maintain a list of IP addresses that are considered Tor exit nodes — a Tor IP list — and when a communication is established between our server and a Tor network node, the XDR immediately checks whether the IP address belongs to a known Tor connection; most organizations keep this database updated. (2) Behaviour-based detection: because Tor nodes change dynamically, the lists are never complete — so the AI/ML engine continuously learns what a legitimate connection looks like (inbound and outbound) and flags requests that come from anonymized connections the first time they appear; the anomaly is the anonymity itself. Even ISPs run their own controls for checking whether a request comes from such systems. In incident response terms, Tor detection matters most in command-and-control and data exfiltration scenarios: a compromised machine quietly phoning an anonymized server is exactly the pattern the lists and the behaviour models are looking for.

Recap + bridge: cyber crime data comes from law enforcement, security companies (Verizon), industry research, and academia — and is undercounted because of embarrassment, unawareness, and attribution difficulty; Tor defeats attribution by onion routing through a worldwide relay network, and the answer is XDR with AI/ML: Tor IP lists plus anomaly detection of anonymized connections. Next, we look at what the imperfect data shows: trends, and the true cost of cyber crime.

Real-world: most vendors, such as Splunk, have inbuilt capabilities to detect requests triggered from the Tor network, and the dark web itself feeds the detection databases — Tor exit node information is continuously posted there, keeping the Tor IP lists fresh as nodes rotate.

13.14 Trends and the Cost of Cyber Crime

Hook: Attacks are more frequent every year, and each one costs more than the money taken. The price tag of cyber crime has two parts — the visible loss and the hidden costs — and the hidden part decides what an organization is willing to spend on defence.

13.14.1 Frequency and shifting targets

The frequency of attacks keeps increasing — reports from security companies and industry associations constantly show a rise in the number of attacks. The targets are shifting: cyber criminals started with individual victims, moved to businesses, and are now moving on to critical infrastructure.

The two trends. (1) Frequency: the number of attacks keeps increasing — reports from security companies and industry associations constantly show a rise. (2) Targets: the shift is a ladder — cyber criminals started with individual victims, moved to businesses, and are now moving on to critical infrastructure. Each rung is richer than the last: an individual's bank account is smaller than a business's payment systems, which is smaller than a power grid or a transportation system whose failure affects everyone. The trend matters because it is a prediction: the organisations that must invest in defence next are the ones the criminals are moving toward.

13.14.2 Ransomware on the rise

Every month or every quarter, new trends of ransomware attacks appear, demanding huge amounts of money to decrypt the data the hackers encrypted. The frequency is rising along with the demands.

The ransomware escalation. Every month or every quarter, new ransomware trends appear — and each wave demands huge amounts of money to decrypt the data the hackers encrypted. Both numbers rise together: frequency and demand size. Ransomware deserves the warning because it sits at the intersection of the lecture's themes: it is financially motivated (13.10), it reaches individuals, businesses, and infrastructure alike (13.11), it is a signature outcome of organized crime (13.15), and its hidden costs (below) usually dwarf the payment itself.

13.14.3 The hidden costs

The financial implications are enormous — estimates put cyber crime costs at trillions of dollars globally each year, with the number of attacks and the amount of loss growing day by day. On top of the direct loss there are hidden costs: the cost of implementing controls (more defense in depth, more sophisticated SIEM tools, more XDR features with enhanced detection for attacks where IP addresses keep changing), the cost of investigation — which takes time and involves people, process, and technology — the cost of remediation to get back to normal, and reputation damage. The more attacks increase, the more controls and strategy changes are needed, and the hidden costs climb. Based on the type of business, the criticality of the data processed, and the sensitivity of that data, the amount of controls that must be implemented grows — which is why a cost-benefit analysis is essential: how much cost will be incurred versus what benefit the organization gets, and that decides the amount of controls to implement.

The four hidden costs. The direct loss is only the visible part. The hidden costs are: (1) controls — more defense in depth, more sophisticated SIEM tools, more XDR features with enhanced detection for attacks where IP addresses keep changing (the Tor lesson of 13.13 costs money); (2) investigation — it takes time and involves people, process, and technology; (3) remediation — getting systems back to normal after the incident; (4) reputation damage — the loss of client trust that 13.5 warned about. The logic is a cycle: more attacks → more controls and strategy changes needed → hidden costs climb. And the amount of controls is not uniform: based on the type of business, the criticality of the data processed, and the sensitivity of that data, the required controls grow — which is why the cost-benefit analysis of 13.1 returns here as the decision rule: how much cost will be incurred versus what benefit the organization gets decides the amount of controls to implement.

Recap + bridge: attacks are more frequent, targets are moving up the ladder to critical infrastructure, ransomware demands keep growing — and the true cost combines direct loss with four hidden costs (controls, investigation, remediation, reputation), so the right control budget is set by cost-benefit analysis, not by fear. Next, we look at who is behind the biggest share of the attacks: organized crime.

Real-world: industry cost studies (such as the annual Ponemon cost-of-cybercrime research and the McAfee global estimates) consistently put the global cost in the hundreds of billions to trillions of dollars a year — the professor's "trillions" reading matches the top of that range, and every study agrees that the number keeps growing.

13.15 Organized Cyber Crime

Hook: The lone hacker in a basement is a movie character. The real threat looks more like a company — with a team leader, a coder, and a money specialist — running about 80 percent of the attacks. This section explains how cyber crime industrialized.

13.15.1 From lone wolves to rings

Hackers are no longer lone wolves; they are bending toward running fewer yet much larger target attacks. Around 80 percent of cyber attacks are driven by organized crime rings — attackers grouping together, combining expertise, and spreading sophisticated techniques. Organized cyber criminal groups train employees on advanced hacking techniques, exploit zero-day vulnerabilities (the ones nobody knows about yet — a term discussed earlier in the course), and develop custom malware to bypass all the security measures an organization has implemented. Their prime motive is financial gain.

The industrialization of cyber crime. Hackers are no longer lone wolves — the pattern is fewer yet much larger target attacks, with around 80 percent of cyber attacks driven by organized crime rings. The reference material matches the professor's figure: up to 80 percent of all major cyber crime is now committed by organizations. Three capabilities define the rings: (1) training — groups train their people on advanced hacking techniques, so skill no longer limits the operation; (2) zero-day exploitation — they exploit zero-day vulnerabilities, the ones nobody knows about yet, which no signature-based control can catch (recall the WAF discussion of 13.1); (3) custom malware — they develop malware tailored to bypass the specific security measures an organization has implemented. The prime motive is financial gain — this is a business, not a hobby.

13.15.2 Roles inside a criminal team

Large cyber fraud operations run like companies. Inside the group there is a team leader, a coder, someone playing the network administrator role, an intrusion specialist, a data man who handles the stolen data, and a money specialist who manages the proceeds. When a big cyber fraud happens, it is a group of people with these roles targeting an organization or financial institution.

Worked example — the team in action. Map the roles onto one big fraud against a bank: the team leader decides the target (a bank whose customers use online banking); the intrusion specialist performs the reconnaissance (13.4) and finds the entry point; the coder develops or customizes the malware and the phishing pages; the network administrator role manages the infrastructure — the servers, the bulletproof hosting, the anonymization through Tor (13.13); the data man handles the stolen data — filters it, prices it, sells it; and the money specialist manages the proceeds — laundering the transferred funds so the team can spend them. When the big cyber fraud happens, it is this group of people, each with a role, targeting an organization or financial institution. Sense-check: every specialist capability the organization's defenders have — network admin, developer, analyst — is mirrored inside the criminal team, which is why organized crime can move as fast as, or faster than, the defenders.

13.15.3 What they target

The common targets follow the money. Financial institutions hold sensitive and critical information — credit card information — so successful attacks there bring high payoffs. Critical infrastructure (power grids, transportation systems) is increasingly targeted because those organizations focus on keeping power available, not on security: bring a power grid down for a couple of minutes and the entire population is impacted, so they immediately pay the requested amount. Businesses that collect very sensitive data — customer information, intellectual property, trade secrets — are also targets. Individuals are less common but still attacked: phishing campaigns, ransomware, identity theft — with highly profiled individuals more likely to be picked. Long-term planning matters: cyber attacks are meticulously planned and executed; attackers conduct extensive reconnaissance to learn the organization's infrastructure, then develop custom tools and may establish a persistent presence — maintaining a connection so that whenever they want to exploit or exfiltrate data, they can.

Targets that follow the money. The common targets follow the money, ranked by payoff: (1) Financial institutions — sensitive and critical information (credit card data), so successful attacks bring high payoffs; (2) Critical infrastructure (power grids, transportation systems) — increasingly targeted because those organizations focus on keeping power available, not on security: bring a power grid down for a couple of minutes and the entire population is impacted, so they immediately pay the requested amount (the revenge motive of 13.10 meets the money motive here); (3) Businesses that collect very sensitive data — customer information, intellectual property, trade secrets; (4) Individuals — less common but still attacked through phishing, ransomware, and identity theft, with highly profiled individuals more likely to be picked. And the professor closes with the planning factor: attacks are meticulously planned and executed — extensive reconnaissance to learn the organization's infrastructure, custom tools, and possibly a persistent presence: maintaining a connection so that whenever they want to exploit or exfiltrate data, they can (the command-and-control stage of the modus operandi in 13.18).

Recap + bridge: organized crime rings drive about 80 percent of attacks, run like companies with specialized roles (leader, coder, network admin, intrusion specialist, data man, money specialist), and follow the money — institutions, infrastructure, data-rich businesses, then individuals — with meticulous planning and persistent access. Next, we climb from money to politics: cyber terrorism.

13.16 Cyber Terrorism

Hook: The attack that takes money is a crime. The attack that takes a country's trust in its own government is something else — a political act fought through technology. Where do crime ends and terrorism begin? This section draws that line.

13.16.1 Cyber crime versus cyber terrorism

Cyber terrorism uses organization networks and digital technologies to disrupt critical infrastructure, cause widespread damage or destruction of systems, and instill fear and panic — psychological warfare. The difference from cyber crime is the motive: cyber crime is motivated by financial gain, while cyber terrorism aims to achieve political or ideological objectives. When the impact is at a national level — when national security is impacted — the act counts as terrorism; when that terrorism is carried out through cyber media, it is cyber terrorism.

The dividing line: motive, then scale. Cyber terrorism uses organization networks and digital technologies to (1) disrupt critical infrastructure, (2) cause widespread damage or destruction of systems, and (3) instill fear and panic — the professor's one-word summary is psychological warfare. The dividing line from cyber crime is the motive: cyber crime is motivated by financial gain, while cyber terrorism aims at political or ideological objectives. The scale test then follows: when the impact is at the national level — when national security is impacted — the act counts as terrorism; when that terrorism is carried out through cyber media, it is cyber terrorism. So the label is decided in two steps: first the motive (money versus politics), then the scale (local damage versus national impact). A politically motivated attack that only inconveniences one site stays on the crime side of the line; the same motive aimed at national security crosses it.

13.16.2 Motivations

The motivations are political agendas — promoting a particular ideology or overthrowing a government — religious extremism (extremist groups using cyber terrorism to spread fear and intimidate opponents or societies they consider against their beliefs), nationalism (nationalist groups attacking another nation's critical infrastructure or disrupting its economy), and revenge for perceived injustice, carried out against a government or an organization using cyber technology as the platform.

The four motivations. (1) Political agendas — promoting a particular ideology or overthrowing a government; (2) religious extremism — extremist groups using cyber terrorism to spread fear and intimidate opponents or societies they consider against their beliefs; (3) nationalism — nationalist groups attacking another nation's critical infrastructure or disrupting its economy; (4) revenge for perceived injustice — carried out against a government or an organization using cyber technology as the platform. Compare with the motive set of 13.10: revenge and recognition appear in both lists, but here every motive is political — there is no vandalism-for-fun and no money. That is the point: the same techniques (DoS, defacement, malware) become terrorism the moment the objective is political and the impact is national.

13.16.3 The impact at national level

The damage happens at the national level: critical infrastructure gets damaged, public trust in digital governance and government institutions erodes, and the internet is used to spread propaganda, intimidate the population, and destabilize societies.

Why the damage is psychological, not just physical. The professor's impact list has three channels: physical (critical infrastructure gets damaged), trust (public trust in digital governance and government institutions erodes), and informational (the internet is used to spread propaganda, intimidate the population, and destabilize societies). The reference definition matches this: an attack qualifies as cyber terrorism when it generates enough harm to create fear — violence, severe economic loss, or serious damage to critical infrastructure — while attacks that are mainly a costly nuisance stay below the threshold. The warning for defenders: fear and distrust spread faster and last longer than the physical damage, which is why terrorism's goal is stated as psychological warfare rather than destruction for its own sake.

13.16.4 The cooperation problem

International cooperation is the biggest challenge. Only specific countries manage to perform cyber terrorist attacks, and others fail to defend, precisely because there is not enough cooperation among countries. With mutual cooperation, countermeasures would keep the chance of impact minimal. The second problem is improving cyber defense: most countries focused on development and welfare but not on the e-governance systems they use, so those systems became easy platforms for attackers. Compare sectors: corporate networks are hard to attack because the due diligence, governance, and oversight of security controls is huge — a defined patch management process runs monthly scanning for the latest patches, with enough preventive controls in place. Government servers, by contrast, may sit unpatched for three or four years. That gap is why government systems get attacked successfully.

The two defence gaps. The first gap is international: only specific countries manage to perform cyber terrorist attacks, and others fail to defend, precisely because there is not enough cooperation among countries — with mutual cooperation, countermeasures would keep the chance of impact minimal. The second gap is domestic: most countries focused on development and welfare but not on the e-governance systems they use, so those systems became easy platforms for attackers. The professor's sector comparison makes the second gap concrete:

Sector	Security posture	Result
Corporate networks	Huge due diligence, governance, oversight of controls; defined patch management with monthly scanning for the latest patches; enough preventive controls	Hard to attack
Government servers	May sit unpatched for three or four years	Successfully attacked

That gap — months of patching cadence versus years of unpatched servers — is why government systems get attacked successfully. Every control from 13.1 is worthless if the patches that close the vulnerabilities are never applied; the professor's warning is that the sector with the most sensitive data (the nation's own) is the sector with the weakest hygiene.

Recap + bridge: cyber terrorism is politically or ideologically motivated disruption of critical infrastructure aimed at national-level impact — psychological warfare; its motivations are political agendas, religious extremism, nationalism, and revenge; the two defence gaps are missing international cooperation and unpatched government systems. Next, we raise the scale once more: not terrorist groups, but states at war.

13.17 Cyber War

Hook: A criminal attacks a company for money; a terrorist attacks a nation for a cause; and a state attacks another state — with the resources of a government behind it. That is cyber war, and it changes the defence problem from "who did this?" to "what did they just start?"

13.17.1 State-sponsored attacks

Cyber war goes beyond individual crime: a state sponsors attacks to disrupt or damage another country's critical infrastructure or systems. A supporting country backs hackers who exploit the opponent nation. While cyber crime is motivated by financial gain or personal agenda, in cyber warfare the state is the leader — for example, Russia, which has advanced cyber capabilities and attacks the countries it considers opponents to prove dominance.

The defining feature: the state is the leader. Cyber war goes beyond individual crime because a state sponsors the attacks — the target is another country's critical infrastructure or systems, and the supporting country backs the hackers who exploit the opponent nation. The dividing line from everything earlier is the sponsor: cyber crime is motivated by financial gain or personal agenda, and cyber terrorism by political goals of non-state groups; in cyber warfare the state is the leader — the professor's example is Russia, a country with advanced cyber capabilities that attacks the countries it considers opponents to prove dominance. The scale consequence: a state-backed attacker has resources, intelligence, and patience that no lone criminal or even criminal ring (13.15) can match — which is why the same techniques appear at far higher sophistication.

13.17.2 Techniques

The techniques of state-sponsored cyber war include hacking of systems, deploying malware, disrupting operations with distributed denial of service, manipulating the organization's or the client's data, and stealing sensitive personal information. All of these are deployed by countries wanting to prove domination over other countries.

Techniques — familiar tools, new operator. None of the techniques is new: hacking of systems, deploying malware, disrupting operations with distributed denial of service, manipulating the organization's or the client's data, and stealing sensitive personal information. What changes is the operator and the objective — these are deployed by countries wanting to prove domination over other countries. The DDoS here is "distributed" (DDoS): the attack floods the target from many machines at once, so it cannot be blocked by blocking one source. The warning for defenders: when the attacker is a state, assume the attack is long-planned, backed by intelligence about the target's infrastructure, and aimed at dominance — denial of service to the opponent, not just theft — which is why the potential impact below is so much larger than for ordinary crime.

13.17.3 Potential impact

The potential impact of cyber war includes disruption of critical infrastructure, possible loss of life, huge economic damage, and escalation into traditional warfare between nations.

Recap + bridge: cyber war is state-sponsored attack against another country's critical infrastructure and systems — the state is the leader; the techniques are familiar (hacking, malware, DDoS, data manipulation, information theft) but the operator is national and the aim is dominance; the potential impact escalates from infrastructure disruption to possible loss of life, huge economic damage, and even traditional warfare. With the full scale of actors mapped — criminal, terrorist, state — the lecture now zooms into the attack itself: the step-by-step modus operandi every one of them follows.

13.18 The Cyber Crime Modus Operandi

Hook: However different the attackers look — lone criminal, crime ring, terrorist, or state — their way of working is the same five-step sequence. Learn the sequence once, and you can recognize every attack in this lecture as a stage of it.

13.18.1 The attack lifecycle

The modus operandi — the way criminals follow to perform a cyber crime — has a recognizable sequence of steps:

Gather information about the target. Find the vulnerabilities in the target organization's system.
Exploit the vulnerability and gain unauthorized access to the system or network.
Exploit the access. With access gained, the attacker installs malware, steals data, deletes data, or performs disruptive operations.
Establish command and control. The attacker takes command of the compromised systems and uses them to install more malware and steal more data.
Open covert channels. The attacker establishes hidden communication channels with the compromised systems to issue commands, collect the stolen data, and update the malware.

This lifecycle can run against individuals, organizations, or at the national level.

The five stages, with the reasoning behind each. The modus operandi — the way criminals follow to perform a cyber crime — is a repeatable sequence, and every stage exists for a reason:

Gather information about the target (reconnaissance, 13.4): the attacker finds the vulnerabilities in the target organization's system. No entry point, no attack — so this stage decides everything after it.
Exploit the vulnerability and gain unauthorized access: the attack proper — the entry that all the controls of 13.1 exist to stop.
Exploit the access: with access gained, the attacker installs malware, steals data, deletes data, or performs disruptive operations — the payoff of the entry.
Establish command and control: the attacker takes command of the compromised systems and uses them to install more malware and steal more data — the entry point becomes a base of operations, which is the persistent presence of 13.15.
Open covert channels: the attacker establishes hidden communication channels with the compromised systems to issue commands, collect the stolen data, and update the malware — the data now travels out through a channel nobody is watching, exactly the Tor problem of 13.13.

The lifecycle runs against individuals, organizations, or at the national level — the stages do not change with the scale. Every attack in this lecture is this sequence: the phishing of 13.5 is the entry (stage 2) after reconnaissance of the victim; the ransomware of 13.14 is stage 3 with a payment demand; the organized crime operation of 13.15 is stages 4–5 done patiently.

Worked trace — the lifecycle on one victim organization. Stage 1 (reconnaissance): the attacker studies the organization's public job postings and finds the finance team uses a specific email platform. Stage 2 (exploit + unauthorized access): the attacker sends a spear-phishing email (see below) to a finance employee, who clicks the link; the attacker now has a foothold with valid credentials. Stage 3 (exploit the access): the attacker moves through the systems, installing a trojan (13.11) that records typed usernames and passwords, and copies customer records. Stage 4 (command and control): the attacker's software phones home and receives instructions — a C2 channel of the kind the XDR detection of 13.13 is built to flag. Stage 5 (covert channels): the stolen customer records are exfiltrated through the hidden channel in small batches to avoid notice. Sense-check: each stage depends on the previous one — stop the reconnaissance (stage 1) or the entry (stage 2) and the whole sequence fails; that is precisely why defense in depth (13.1) puts controls at every stage.

Social engineering exploits human psychology to manipulate victims into divulging sensitive information or clicking malicious links. The finance team, for example, may not have much cyber security knowledge — so attackers send fake phishing emails and trick employees into clicking. Pretexting creates a false scenario or impersonates a trusted activity to gain the victim's trust and extract sensitive information. Baiting offers something desirable — free software, "click here to get your Amazon gift card" — so victims are impressed and click the malicious link.

The three named techniques. Social engineering exploits human psychology rather than software: the target is the person, which is why the professor's example picks the finance team — a department with valuable access but often little cyber security knowledge, so a fake email tricks employees into clicking. The three named techniques:

Phishing — a deceptive email that impersonates a trusted party (bank, IT department, colleague) to harvest credentials or make the victim click (the entry technique of 13.5).
Pretexting — creating a false scenario or impersonating a trusted activity to gain the victim's trust and then extract sensitive information (a "repair technician" who needs the password to "fix" the system).
Baiting — offering something desirable — free software, "click here to get your Amazon gift card" — so victims are impressed and click the malicious link; the bait is the promise, the hook is the link.

All three attack the same weakness — trust — and all three are stages 1–2 of the modus operandi performed on a human instead of a system.

13.18.3 Malware as a tool

Malware comes in the familiar families: worms, viruses, trojans, ransomware, and spyware — each a different tool for performing cyber attacks.

The malware families in one line each. Malware — malicious software — comes in familiar families, each a different tool for a different stage of the lifecycle: a worm spreads itself across networks without any help (stage 3 at scale); a virus attaches to programs or files and replicates when they run; a trojan hides inside a legitimate-looking program and its main job is exfiltration (13.11 — it watches and reports); ransomware encrypts data and demands payment (the financial crime of 13.14); spyware quietly records activity, such as keystrokes, to feed reconnaissance or exfiltration. One question separates them on the quiz: how does it spread? (worm: itself; virus: via host files) and what does it do after arrival? (damage, exfiltrate, encrypt, spy).

13.18.4 Other techniques: brute force, espionage, insiders

Brute force attacks hammer credentials until they break. Password spraying tries common passwords against multiple accounts instead of one account. At the organizational level, the same outcomes show up as data breaches, virus attacks, and malware attacks; insider threats come from employees or contractors with authorized access who, because of their privileged level of access, can cause harm to the organization; cyber espionage means stealing IP, trade secrets, or other confidential information from a company for competitive advantage.

Credential attacks and the remaining players. Brute force attacks hammer credentials until they break — every combination is tried. Password spraying is the smarter variant: it tries common passwords (like "123456" or "password") against multiple accounts instead of one account — so it stays under the account-lockout threshold while still sweeping the whole company. At the organizational level the same outcomes show up as data breaches, virus attacks, and malware attacks (the outcomes of 13.5 and 13.11); insider threats come from employees or contractors with authorized access who, because of their privileged level of access, can cause harm to the organization (the hardest category of 13.12 — here again, at the tool level); and cyber espionage means stealing IP, trade secrets, or other confidential information from a company for competitive advantage — the intellectual-property crime of 13.11 as performed by competitors or states (13.17).

Exam note + recap: know the order of the modus operandi — recon (gather information), exploit (unauthorized access), control (command and control), exfiltrate (covert channels) — and the social engineering names: phishing, pretexting, and baiting, with their definitions. The malware families (worm, virus, trojan, ransomware, spyware) and techniques like brute force and password spraying are the tools the stages use. Next, the lecture closes with the other side of the story: how society defends.

13.19 Domestic and International Response

Hook: The attacker's modus operandi ends with a covert channel. The defender's response has its own structure — and its own bottleneck: the moment an investigation crosses a border, the attacker gains the advantage of distance.

13.19.1 Laws and law enforcement

The response to cyber crime runs from domestic to international. Law enforcement investigates, cyber laws and legislation exist at national and international levels and protect against these attacks to some extent.

The response ladder. The response to cyber crime runs from domestic to international. At the bottom rung, law enforcement investigates — the detectives, forensics, and prosecutions of individual cases. Around them stand cyber laws and legislation at national and international levels, which protect against these attacks — the professor's honest qualifier is to some extent: laws deter and punish, but they cannot stop an attack at the network level; they work only when an attacker can be found, identified, and brought to a court with jurisdiction. That last condition is exactly the problem the final subsection names.

13.19.2 Public awareness

Public awareness educates people about the threats and how to protect themselves. This is why security agencies send messages — the cyber security response team (CERT-In style advisories) warns people not to click on suspicious links, and banks and financial institutions send common messages about protecting accounts from cyber attacks.

Awareness as the cheapest control. Public awareness educates people about the threats and how to protect themselves — and because most attacks begin with a person (social engineering, 13.18), educating the person is a direct defence. The professor's examples are everywhere in daily life: the cyber security response team (CERT-In style advisories — named after India's national Computer Emergency Response Team) warns people not to click on suspicious links, and banks and financial institutions send common messages about protecting accounts from cyber attacks. This is the human-layer version of defense in depth: the same phishing email that would have worked against an unaware employee is harmless to one who has read the advisory.

13.19.3 International cooperation and the UNODC

International treaties and agreements promote law enforcement support during investigations and enable cyber threat intelligence exchange between countries. The United Nations Office on Drugs and Crime (UNODC) plays a leading role in promoting international cooperation on cyber crimes. Public-private partnerships — collaboration between the government sector and the private sector — also help implement effective cyber security strategies and techniques.

The international rungs. Because cyber crime crosses borders in a click, the response must too. International treaties and agreements promote law enforcement support during investigations — the mechanism by which a country whose servers hosted the attack helps the country whose citizens were harmed — and enable cyber threat intelligence exchange between countries, so an attack pattern seen in one country can be blocked in another. The United Nations Office on Drugs and Crime (UNODC) plays a leading role in promoting international cooperation on cyber crimes. And the private sector joins the ladder through public-private partnerships — collaboration between the government sector and the private sector — which help implement effective cyber security strategies and techniques (the private sector holds most of the expertise and much of the data, as 13.13 showed).

13.19.4 Jurisdictional challenges

The main challenge is jurisdictional: every country has its own laws, and every location has its own challenges, which creates problems for international cooperation in investigating and prosecuting cyber crime.

The jurisdictional bottleneck. The main challenge is jurisdictional: every country has its own laws, and every location has its own challenges — one country's crime is another country's legal grey area — and that creates problems for international cooperation in investigating and prosecuting cyber crime. The practical consequence: an attacker who routes through three countries (a natural move given the modus operandi of 13.18 and the Tor problem of 13.13) forces the investigator to coordinate three legal systems with three different definitions, evidence rules, and extradition standards — and while the coordination happens, the attacker is gone. This is why 13.16 called international cooperation the biggest challenge in cyber defence: the technology is global, but the law is national.

Recap + bridge: the response runs from law enforcement and national cyber laws, through public awareness (CERT-In style advisories, bank messages), to international treaties, intelligence exchange, the UNODC, and public-private partnerships — with jurisdiction as the bottleneck. This closes the lecture's arc: the crime wave of 13.3–13.18 is fought with the layered controls of 13.1, the analysis discipline of 13.2, and the cooperation ladder of this section. The quiz follows the same pattern as quiz one: definitions, classifications, and example identification.

Exam Guidance Summary

The report assignment uses a fixed five-part structure: management-perspective issue description (non-technical), technical analysis, risk calculation (probability of threat × impact, expressed as low/medium/high), what went wrong (which controls failed), and recommendations plus lessons learned. Expect to apply this same analysis lens to any incident.
Risk is context-dependent: the same high-profile incident can mean low, medium, or high risk for different organizations depending on which services they take. Justify the risk level with reasons.
The quiz asks for definition-based example identification: "is this an example of cyber bullying, identity theft, or a data breach?" Read the intention and the target of the example before choosing. Worked quiz patterns from the lecture: a phishing email that exposes passwords counts as a data breach; logging in with a stolen identity is identity theft; bullying and fraud are separated by intention and target. The same identification skill applies across the cyber crime definitions — hacking (white/black/gray hats), data breach, identity theft, cyber fraud, cyber bullying, cyber stalking, internet time theft, and the classification of crimes against person, property, government, and society (know the definition of each word in the classification, including internet time theft).
Know the modus operandi order: gather information → exploit → gain unauthorized access → command and control → covert channels to issue commands and collect stolen data.
Know the social engineering techniques by name and definition: phishing, pretexting, baiting — plus the malware families (worm, virus, trojan, ransomware, spyware) and techniques like brute force and password spraying.
The second quiz follows the same pattern as the first quiz.
The next session moves to cyber security case studies; three examples were mentioned and more will be added.

Key Industry Applications

Okta: identity and single sign-on provider; the Okta incident is the running example for incident analysis and risk calculation (a scenario-based approach: using SSO or not changes the risk).
Slack: mentioned as one of the incident topics available for the report assignment.
Facebook: bug bounty program example, and the cyber stalking example (public location posts).
Flipkart: bug bounty program example.
Bug bounty platforms: organizations pay researchers by severity tier (high/medium/low); researchers build resumes with silver, bronze, and gold award categories — a real path into application security roles.
CERT: incident alert subscriptions are a preventive/detective control; missing them delayed breach discovery in the Okta example.
GDPR: the 72-hour breach notification obligation for data processors; hiding a breach brings heavy penalties.
SPF, DKIM, DMARC: email authentication checks against spoofed email.
IDS/IPS, SIEM, EDR, XDR, WAF, SOC: the detection and response stack used by security operations teams.
ISO 27001 and SOC 2 Type 1/Type 2 (AICPA): third-party audit certifications that prove control implementation to clients.
Truecaller: the over-collection example driving privacy by design.
Tor: the anonymization network; XDR vendors like Splunk maintain Tor IP lists, and Falco detects unexpected behavior including Tor traffic.
Verizon: security company that publishes attack trend reports.
UNODC (United Nations Office on Drugs and Crime): leading role in international cooperation on cyber crime.
Amazon gift cards: the bait used in baiting attacks.

CS Lecture 13 notes · Cyber Crimes

Cyber Security· postgraduate· 2026-08-16

Sections Breakdown

113.1 Recap: Defense in Depth and the Controls We Have Covered

Recap of defense in depth: the layered stack of technical controls (stateless/stateful firewall, IDS/IPS, EDR, SIEM, XDR, SOC), administrative controls (policies, audits, ISO 27001, SOC 2, AICPA), and physical controls, all tuned by risk appetite and cost-benefit analysis so that no single failure exposes the organization.

213.2 The Incident Analysis Report and the Risk Calculation

The incident analysis report has five parts (management issue description, technical analysis, risk calculation, failed controls, recommendations); risk is the product of threat probability and impact rate, judged low/medium/high in the organization's own context, as shown by the Okta single sign-on two-scenario walkthrough.

313.3 What Is a Cyber Crime?

A cyber crime is any criminal activity performed using a computer, a network, or any electronic device, requiring an unlawful intention and a technological platform; it stands beside civil and classic criminal law as a third category, and its target can be a person, an organization, or a nation.

413.4 Hacking and the Three Kinds of Hackers

Hacking is compromising devices and networks by gaining unauthorized access; hackers split into white hats (authorized, proactive testers who close weaknesses before criminals arrive), black hats (unauthorized attackers seeking money, fun, reputation, or national goals), and gray hats (unauthorized but not intending harm), with bug bounty programs paying white hats to find and report bugs.

513.5 Data Breach

A data breach is any security incident that gives unauthorized access to confidential information; once confirmed, the organization must notify contract clients within 24-48 hours and GDPR regulators within 72 hours, or face heavy penalties; costs run through financial, reputational, and legal channels, and phishing is the simplest breach path.

613.6 Identity Theft

Identity theft is stealing a person's identity and using it to log into systems without permission and commit fraud; banks counter it with random user IDs (xllhbrc) that hide the person behind the account, the physical-world guard-without-photo-check analogy shows the failure mode, and dumpster diving shows information can be gathered from unshredded physical data.

713.7 Cyber Fraud

Cyber fraud is fraud performed by corrupting or misusing personal information, resulting in financial or reputational loss; identity theft can be a method of cyber fraud, and the common forms are phishing, ransomware, and online shopping scams.

813.8 Cyber Bullying

Cyber bullying is using technology to harass, threaten, or embarrass one specific person with continuous unsolicited or fake messages; unlike cyber fraud (which goes after information and money), bullying goes after the person, so the quiz label is decided by intention and target.

913.9 Cyber Stalking and Privacy

Cyber stalking tracks someone's real-time activities through their public posts; the problem is fed by apps that capture more data than their function needs (Truecaller reading contacts, location, and memory), and the builder's answer is privacy by design — capture only what the intended function needs.

1013.10 Why Cyber Criminals Do It

Four motives drive cyber criminals: financial gain (the main one, via stealing, extortion, or ransomware disruption), revenge (from personal up to national scale, e.g., power substations), power and recognition (the top-ten leaderboard), and vandalism (simple enjoyment of chaos).

1113.11 Classifying Cyber Crimes by Target

Cyber crimes classify by target into person (spam, defamation, harassment), property (credit card fraud, intellectual property: copyrights, patents, trademarks, trade secrets), government (DoS, virus, email bombing, trojans), and society (forgery, cyber terrorism, web jacking, logic bombs), plus internet time theft with the 195 GB worked example.

1213.12 Types of Cyber Criminals

Cyber criminals divide into those who want recognition (hobby hackers, IT professionals, politically motivated hackers, terrorist organizations), those who operate quietly (state-sponsored actors and organized crime teams), and insiders — disgruntled employees, the most challenging category because controls cannot keep them out and continuous monitoring with UEBA is the countermeasure.

1313.13 Where Cyber Crime Data Comes From, and the Tor Problem

Cyber crime data comes from law enforcement, security companies (Verizon), industry research, and academia, but underreporting (embarrassment, unawareness, attribution difficulty) hides the true scope; Tor anonymizes traffic through a worldwide relay network to defeat attribution, and XDR with AI/ML detects Tor traffic via maintained Tor IP lists plus anomaly detection of anonymized connections.

1413.14 Trends and the Cost of Cyber Crime

Attack frequency keeps rising and targets shift from individuals to businesses to critical infrastructure; ransomware demands grow alongside frequency; and the true cost combines direct loss with hidden costs — controls, investigation, remediation, and reputation damage — so control budgets are set by cost-benefit analysis.

1513.15 Organized Cyber Crime

Hackers are no longer lone wolves: about 80 percent of cyber attacks are driven by organized crime rings that train members, exploit zero-day vulnerabilities, and build custom malware for financial gain; large operations run like companies with roles (team leader, coder, network administrator, intrusion specialist, data man, money specialist) and target institutions, critical infrastructure, data-rich businesses, and highly profiled individuals with meticulous planning.

1613.16 Cyber Terrorism

Cyber terrorism uses digital technologies to disrupt critical infrastructure and instill fear — psychological warfare — differing from cyber crime by its political or ideological motive and national-level impact; motivations are political agendas, religious extremism, nationalism, and revenge; the two defence gaps are weak international cooperation and government servers that sit unpatched for years.

1713.17 Cyber War

Cyber war is state-sponsored attack on another country's critical infrastructure or systems, where the state is the leader (e.g., Russia) rather than a financially or personally motivated criminal; the techniques are familiar (hacking, malware, DDoS, data manipulation, information theft) but deployed for dominance, with potential impact including loss of life, huge economic damage, and escalation to traditional warfare.

1813.18 The Cyber Crime Modus Operandi

The cyber crime modus operandi is a five-stage lifecycle (gather information, exploit and gain unauthorized access, exploit the access, establish command and control, open covert channels) that runs at individual, organizational, and national scale; social engineering (phishing, pretexting, baiting), malware families, and brute force/password spraying are the tools used at its stages.

1913.19 Domestic and International Response

The response to cyber crime runs from domestic law enforcement and national/international cyber laws, through public awareness (CERT-In style advisories, bank messages), to international treaties, threat intelligence exchange, the UNODC, and public-private partnerships — with jurisdiction across different legal systems as the main challenge.

20Exam Guidance Summary

Exam guidance for the report (five-part structure, context-dependent risk) and the quiz (definition-based example identification across the cyber crime labels, modus operandi order, social engineering names, malware families), with quiz two following the same pattern as quiz one.

21Key Industry Applications

The named companies, standards, and tools of the lecture: Okta and Slack (incident analysis), Facebook and Flipkart (bug bounties), CERT, GDPR, SPF/DKIM/DMARC, the detection stack (IDS/IPS, SIEM, EDR, XDR, WAF, SOC), ISO 27001/SOC 2/AICPA, Truecaller, Tor (Splunk, Falco), Verizon, UNODC, and Amazon gift cards.

Postgraduate students in Cyber Security

Exam Revision Notes

Below is the distilled, exam-ready core. Every entry comes from the full explanation above. Use this section for rapid review; return to the main notes when a point needs more context.

13.1 Recap: Defense in Depth and the Controls We Have Covered

Must-know: Defense in depth deploys multiple controls at multiple layers so a failure at one layer is caught by another; the stack runs from firewall through IDS/IPS, EDR, SIEM to XDR, and is backed by administrative (policy/audit/certification) and physical controls, chosen through cost-benefit analysis against risk appetite.

⚠️ Top pitfall: Treating a single control (e.g., one firewall) as sufficient: a stateless firewall cannot see session state, rule-approved tunnels pass through, and a zero-day attack defeats signature lists — layered controls plus WAF are the answer.

Self-check: Why can a stateful firewall accept a reply packet that a stateless firewall would drop?

Connects to: 13.2

13.2 The Incident Analysis Report and the Risk Calculation

Must-know: The report has exactly five parts: issue description (non-technical management view), technical analysis, risk calculation, what went wrong (failed controls), recommendations plus lessons learned; risk = probability of threat times impact rate, expressed as low/medium/high and justified by which services the organization actually uses.

$Risk = P (threat) \times I (impact)$

⚠️ Top pitfall: Treating the risk level of a high-profile incident as fixed: the same incident can be low, medium, or high risk for different organizations, and the justification must explain which services the organization takes from the affected provider.

Self-check: Why is the Okta incident zero-risk for an organization that does not use Okta as its single sign-on provider?

Connects to: 13.1

13.3 What Is a Cyber Crime?

Must-know: Cyber crime = criminal activity with unlawful intention carried out through a computer, network, or electronic device (making systems unavailable, deleting data, exposing data); it is a third legal category alongside civil and classic criminal law, and the target can be a person, an organization, or a nation.

⚠️ Top pitfall: Confusing an accident (no unlawful intention) with a cyber crime, or thinking a crime stops being a cyber crime because it would also be an ordinary crime — the platform (computer/network/device) decides the label.

Self-check: What are the three ingredients that must all be present for an act to be a cyber crime?

Connects to: 13.4

13.4 Hacking and the Three Kinds of Hackers

Must-know: White hats run the same attacks as black hats but first, with permission, so weaknesses are closed before criminals arrive — and they need more than minimal skill for this to work; black hats exploit vulnerabilities with bad intention (fun, financial gain, reputation, national campaigns) after continuous reconnaissance; gray hats violate without authorization but without intent to harm.

⚠️ Top pitfall: Thinking skill alone defines the hat: the same attack technique is white, gray, or black depending on permission and intention, not on how well it is performed.

Self-check: Why must a white hat hacker be more skilled than the minimum required?

Connects to: 13.18

13.5 Data Breach

Must-know: A data breach is a security incident with unauthorized access to confidential information (SSNs, credit cards, passwords); confirmation comes first, then contract notification to clients (24-48 hours) and GDPR regulator notification (72 hours); hiding a breach brings heavy penalties; phishing that exposes passwords counts as a data breach.

⚠️ Top pitfall: Declaring a breach without confirming the data was actually exposed (false alarm), or delaying notification of a confirmed breach to avoid embarrassment — the delay itself becomes a heavily penalized violation.

Self-check: Within how many hours must a data processor inform GDPR authorities of a confirmed breach?

Connects to: 13.1, 13.6

13.6 Identity Theft

Must-know: Identity theft = stealing a person's identity and using it to log into systems without permission for fraudulent activities; random user IDs (like xllhbrc) hide the person behind the account even if captured; the guard-checking-card-not-photo analogy shows the failure; dumpster diving gathers identity information from unshredded physical data.

⚠️ Top pitfall: Thinking identity protection is only a digital problem: unshredded physical documents (dumpster diving) give attackers enough information to assume an identity without hacking anything.

Self-check: Why does a bank give employees random user IDs like xllhbrc instead of email IDs?

Connects to: 13.5, 13.7

13.7 Cyber Fraud

Must-know: Cyber fraud = crime that corrupts or misuses personal information for financial or reputational loss; identity theft can itself be an example of cyber fraud; phishing, ransomware (encrypts data, demands payment), and online shopping scams are the main forms.

⚠️ Top pitfall: Forgetting that identity theft can be both identity theft and cyber fraud at once — it is a method (stealing identity) used to reach a fraudulent goal (financial loss); the label depends on which question is asked.

Self-check: Why can identity theft also be called an example of cyber fraud?

Connects to: 13.6, 13.8

13.8 Cyber Bullying

Must-know: Cyber bullying = technology used to harass, threaten, or embarrass one specific person, continuously; cyber fraud corrupts personal information for financial loss; same platform, different aim — one goes after information and money, the other after a person; quiz labels are decided by intention and target.

⚠️ Top pitfall: Labelling an example by its medium instead of its aim: since both fraud and bullying use technology, you must read the intention (money versus harassment) and the target (information versus person) before choosing cyber bullying, identity theft, or data breach.

Self-check: What two things must you read before labelling an example on the quiz?

Connects to: 13.7, 13.9

13.9 Cyber Stalking and Privacy

Must-know: Cyber stalking = tracking real-time activities through posts; public posts let anyone reconstruct a person's whole day, while friends-only restrictions block strangers; apps that capture more than their function needs (Truecaller) violate privacy; privacy by design captures only what the function needs.

⚠️ Top pitfall: Assuming apps only use what their function needs: an app's job (caller ID) can be far smaller than the permissions it requests (contacts, location, memory), and the gap itself is a privacy violation feeding stalking.

Self-check: What is the one simple safeguard against public-post cyber stalking?

Connects to: 13.8, 13.10

13.10 Why Cyber Criminals Do It

Must-know: The motivation set: financial gain (main motive — stealing, extorting, ransomware disruption), revenge (individual to national; power substations are a sensitive target), power and recognition (top-ten criminal lists), and vandalism (enjoyment of chaos via DoS and defacement).

⚠️ Top pitfall: Assuming every attacker wants money: revenge, recognition, and vandalism motives do not respond to financial incentives, so defence must make the target hard to reach, not just costly to buy out.

Self-check: Why is electrical power infrastructure a sensitive target for revenge-motivated attackers?

Connects to: 13.11, 13.15

13.11 Classifying Cyber Crimes by Target

Must-know: Classification by target: person (spam, defamation, harassment), property (credit card fraud, IP: copyrights, patents, trademarks, trade secrets), government (DoS, virus, email bombing, trojans — exfiltration), society (forgery, cyber terrorism, web jacking); internet time theft = using internet hours paid for by another (195 GB from a 200 GB plan); a weak Wi-Fi password is a control failure.

$Stolen internet time = Paid allowance - What you actually used$

⚠️ Top pitfall: Labelling a trojan as just another virus: a virus damages, while a trojan's main job is exfiltration — sending typed usernames and passwords back to its installer.

Self-check: Why can intellectual property be attacked over the internet when physical property cannot?

Connects to: 13.12, 13.16

13.12 Types of Cyber Criminals

Must-know: Three types: recognition-seekers (hobby hackers, IT professionals, hacktivists, terrorist organizations — motive: name, skill, cause), quiet operators (state-sponsored actors, organized crime — money or national purpose), and insiders (disgruntled employees; the most challenging because no technical/administrative/physical control keeps them out — continuous monitoring with UEBA-style AI/ML analytics is the answer).

⚠️ Top pitfall: Thinking controls protect against insiders: the insider already has legitimate access, so the answer is continuous monitoring of desktops and laptops for suspicious activity, not more perimeter walls.

Self-check: Why is the insider the most challenging type of cyber criminal despite all controls?

Connects to: 13.1, 13.13

13.13 Where Cyber Crime Data Comes From, and the Tor Problem

Must-know: Data sources: law enforcement, security companies (Verizon reports), industry surveys, academia; underreporting comes from embarrassment, lack of awareness, and attribution difficulty; Tor onion-routes traffic through worldwide relays so the source IP cannot be traced; XDR with AI/ML detects Tor via Tor IP lists (exit nodes) and anomaly detection of anonymized connections; systems like Falco and Splunk do this in real time.

⚠️ Top pitfall: Believing law enforcement statistics reflect the full scope of cyber crime — most crimes go unreported (embarrassment, unawareness, no attribution), so official numbers are a floor, not a ceiling.

Self-check: Why can no single relay on a Tor path attribute the traffic to its sender?

Connects to: 13.12, 13.14

13.14 Trends and the Cost of Cyber Crime

Must-know: Trends: frequency rises; targets shift individual → business → critical infrastructure; ransomware frequency and demands both rise; hidden costs = controls (more SIEM/XDR), investigation (people, process, technology), remediation, reputation damage; control budget is decided by cost-benefit analysis, scaled by business type and data criticality/sensitivity.

⚠️ Top pitfall: Budgeting only for the direct loss of an attack: hidden costs (controls, investigation, remediation, reputation) usually exceed it, so the control budget must be set by cost-benefit analysis against the full cost picture.

Self-check: Name the four hidden costs that sit on top of the direct loss of a cyber attack.

Connects to: 13.1, 13.13, 13.15

13.15 Organized Cyber Crime

Must-know: Around 80 percent of attacks come from organized crime rings (fewer, larger attacks); groups train members, exploit zero-days, and build custom malware; the team has a leader, coder, network administrator role, intrusion specialist, data man, and money specialist; targets follow the money: financial institutions, critical infrastructure (pays fast when power is down), sensitive-data businesses, and profiled individuals; attacks are meticulously planned with persistent presence.

⚠️ Top pitfall: Imagining the modern attacker as a lone wolf: the 80 percent figure means defence planning must assume a team with roles, custom malware, and long-term persistence, not a one-off hobbyist.

Self-check: Why are critical infrastructure organizations considered attractive targets by organized crime rings?

Connects to: 13.10, 13.16, 13.18

13.16 Cyber Terrorism

Must-know: Cyber terrorism: disrupt critical infrastructure + widespread damage + fear/panic (psychological warfare); motive (political/ideological, not financial) and national impact draw the line from cyber crime; motivations: political agendas, religious extremism, nationalism, revenge; defence gaps: international cooperation and the patch gap — corporate networks patch monthly, government servers may sit unpatched for 3-4 years.

⚠️ Top pitfall: Labelling by technique instead of motive: the same DoS or defacement is crime when financially motivated and terrorism when politically motivated with national impact — check the motive and the scale first.

Self-check: Why do government systems get attacked successfully despite having more sensitive data than corporations?

Connects to: 13.10, 13.15, 13.17

13.17 Cyber War

Must-know: Cyber war = a state sponsors attacks to disrupt or damage another country's critical infrastructure; the state is the leader, not a financially motivated criminal; techniques: hacking, malware, DDoS, data manipulation, stealing sensitive personal information; impact: infrastructure disruption, possible loss of life, huge economic damage, escalation to traditional warfare.

⚠️ Top pitfall: Treating state-sponsored attacks like ordinary crime: the sponsor, resources, and aim (dominance over an opponent nation) make the attack longer-planned and higher-impact, so defence assumes state-level sophistication.

Self-check: What distinguishes cyber war from cyber crime and cyber terrorism?

Connects to: 13.15, 13.16, 13.18

13.18 The Cyber Crime Modus Operandi

Must-know: Modus operandi order: 1) gather information about the target, 2) exploit the vulnerability and gain unauthorized access, 3) exploit the access (install malware, steal/delete data, disrupt), 4) establish command and control, 5) open covert channels (issue commands, collect data, update malware); social engineering names: phishing (deceptive email), pretexting (false scenario to gain trust), baiting (desirable offer to click); malware families: worm, virus, trojan (exfiltration), ransomware, spyware; brute force and password spraying (common passwords across many accounts).

⚠️ Top pitfall: Confusing the stages of the modus operandi: the exam expects the order recon → exploit → control → exfiltrate, and social engineering names with their definitions — mixing up pretexting (false scenario) with baiting (desirable offer) is a classic error.

Self-check: Why is stage 5 (covert channels) the natural place where the Tor problem of section 13.13 bites?

Connects to: 13.4, 13.13, 13.19

13.19 Domestic and International Response

Must-know: Response runs domestic to international: law enforcement investigates under national/international cyber laws; public awareness (CERT-In style advisories, bank messages) educates people; international treaties enable law enforcement support and threat intelligence exchange; UNODC leads international cooperation on cyber crimes; public-private partnerships implement strategies; jurisdiction (each country's own laws) is the main challenge.

⚠️ Top pitfall: Expecting a single country's law to stop a cross-border attack: jurisdiction differs per country, so international cooperation is required to investigate and prosecute — the attack that crosses borders beats the law that stays at home.

Self-check: Why is jurisdiction the main challenge in international cyber crime prosecution?

Connects to: 13.13, 13.16, 13.18

Exam Guidance Summary

Must-know: Five-part report structure; risk = probability of threat × impact, judged low/medium/high in context; quiz identifies examples by intention and target (phishing exposing passwords = data breach; stolen identity login = identity theft; bullying vs fraud by intention/target); modus operandi order (gather → exploit → access → C2 → covert channels); social engineering names (phishing, pretexting, baiting) and malware families; quiz two follows quiz one's pattern.

Connects to: 13.2, 13.5, 13.6, 13.8, 13.11, 13.18, 13.19

Key Industry Applications

Must-know: Named real-world anchors: Okta (SSO incident example), Slack (report topic), Facebook/Flipkart (bug bounties), CERT (incident alerts), GDPR (72-hour notification), SPF/DKIM/DMARC (email auth), IDS/IPS/SIEM/EDR/XDR/WAF/SOC (detection stack), ISO 27001/SOC 2/AICPA (certifications), Truecaller (over-collection), Tor with Splunk Tor IP lists and Falco (anonymization detection), Verizon (trend reports), UNODC (international cooperation), Amazon gift cards (baiting bait).

Connects to: 13.1, 13.2, 13.4, 13.5, 13.9, 13.13, 13.19

Previous LectureLecture 12 · Strategic Defense in Depth

Next LectureLecture 14 · Cybersecurity Case Studies

Was this lecture useful?

Loading comments…

🤖

BitsNotes AI Assistant

Subject Notes Assistant

Configure AI Chat

Choose how to access the chatbot

Have your own API key?

Switch to "Bring Your Own Key" tab above for unlimited access with any OpenAI-compatible provider.

AI Provider Preset

API Endpoint URL (OpenAI-Compatible)

API Key

Model Name

🔑 Enter API key above to fetch live models from provider, or enter model name manually.

Remember key for this session (until tab closes)

OpenAI-Compatible API Support

Choose any provider preset (Gemini, DeepSeek, Kimi, GLM, MiniMax, Qwen, OpenAI, Groq, Ollama, etc.) or enter a custom endpoint URL.

Security & Privacy First

Your API key is sent directly from your browser to your specified provider. BitsNotes servers never store or see your key.