इस विषय में
Vulnerabilities · Ransomware · Identity · Incident response · Cloud security
Build a practical cybersecurity baseline
How do you build a useful cyber defence? Connect protected assets, access paths, detection signals and actual restoration capability. This guide provides six checks to turn an inventory into an action plan. The expected output is a dated register covering the asset, exposure, business consequence, control, evidence, owner and next check. Examples describe working protocols, not completed audit results.
मार्गदर्शिका पढ़ें ENसमाचार निगरानी
सभी अंतरराष्ट्रीय समाचार →सहेजी गई सुर्खियाँ · अद्यतन अनुपलब्ध · अंतिम सफल प्राप्ति : 22 अक्तू॰ 2026, 9:25 pm
Sant Kabir Nagar News: छात्रों-शिक्षकों को साइबर सुरक्षा के उपाय बताए गए - Amar Ujala
via Google News · aggregatorबैंक डेटा लीक के बाद नया संकट, हैकर्स के निशाने पर PHP सर्वर; आईटी मंत्रालय सतर्क - Jagran
via Google News · aggregatorAmroha News: हर सोमवार होगा बिजली संबंधी समस्याओं का समाधान, एक्सईएन करेंगे सुनवाई - Hindustan
via Google News · aggregatorबैंक हड़ताल टली, सोमवार को सामान्य रूप से खुलेंगे बैंक; पांच दिन कामकाज पर बनेगी समिति - Business Standard
via Google News · aggregatorसंदर्भ: डेटा, उपयोग और सीमाएँ
दस्तावेज़ जाँच की तारीख .
इस संस्करण में विस्तृत संदर्भ टिप्पणियाँ अंग्रेज़ी में उपलब्ध हैं।
| स्रोत और उद्देश्य | सत्यापित डेटा या मानक | उपयोग कैसे करें | ध्यान में रखने योग्य सीमा |
|---|---|---|---|
| FIRST · CVSS Describe technical vulnerability severity using an explicit method and vector. |
CVSS 4.0 scores run from 0.0 to 10.0. Base, Threat, Environmental and Supplemental metric groups serve different purposes. | Retain the score version, vector and date. Compare it with the installed version, access paths and business consequences before ordering remediation. | A high score is not evidence of exploitation; a low score does not mean a service has no risk. |
| FIRST · EPSS Estimate exploitation probability for a published CVE. |
The model looks ahead 30 days. Its score is a probability; its percentile ranks that score relative to other CVEs. | Record the data date and distinguish probability from percentile. Add asset exposure and confirmed exploitation evidence. | The model does not predict harm to your organisation. Low probability does not cancel a critical exposure. |
| CISA · Known Exploited Vulnerabilities Identify vulnerabilities listed by CISA as known to be exploited. |
The catalogue includes CVE, product, date added and required action. Its official repository also provides the data schema. | Check applicability to your products and retain the access date. Review the requested action and vendor advisory before confirming remediation. | Absence from the catalogue does not establish safety. Administrative deadlines in it are not automatically binding on every organisation. |
| CVE Program Link discussions to the same vulnerability record. |
A JSON schema defines the CVE record format. An identifier and the published contents of its record are distinct things. | Open the record and references; check its state, described affected versions and supplier information. Keep the identifier in action tracking. | A CVE identifier is neither a severity score nor proof that your installation is affected. |
पहचान: कारक, सत्र और पुनर्प्राप्ति
इस संस्करण में विस्तृत संदर्भ टिप्पणियाँ अंग्रेज़ी में उपलब्ध हैं।
Identity protection continues after sign-in
A phishing-resistant factor alone does not address new-authenticator binding, recovery or existing sessions. Describe these paths for accounts controlling critical services.
- Separate user presence (UP) and user verification (UV) evidence.
- Document syncable methods and their recovery account.
- Test loss, revocation and existing sessions with observable outcomes.
Open the authenticator and recovery comparison →
Sources consulted on · NIST SP 800-63B-4 · final publication NIST · Authenticator Event Management W3C · WebAuthn Level 3
साइबर घटनाएँ: निर्णय और पुनर्प्राप्ति साक्ष्य
इस संस्करण में विस्तृत संदर्भ टिप्पणियाँ अंग्रेज़ी में उपलब्ध हैं।
Prepare the decisions connecting response and recovery
Response capability is tested through the connection between signal, authority, evidence and usable service.
- Link provisional triage to facts and a planned reassessment.
- Exercise recovery initiation and the two integrity checks, before and after restoration.
- Retain closure criteria, decision maker and residual actions.
Explore NIST outcomes and the timeline →
References reviewed · NIST SP 800-61r3 · pp. 27–29, 34–35 · CSF 2.0 · Appendix A
security.txt और प्रकटीकरण
इस संस्करण में विस्तृत संदर्भ टिप्पणियाँ अंग्रेज़ी में उपलब्ध हैं।
Check that an external report reaches a team
Cyber exposure also includes the ability to receive a useful report. A security.txt file can make the contact discoverable, but its presence alone establishes neither channel availability nor case follow-through.
- Check /.well-known/security.txt, HTTPS, Contact fields and exactly one Expires.
- Preserve the exact host, redirects and policy link; do not extend scope to subdomains by default.
- Assign a publication owner and a report handler; distinguish receipt, assessment and remediation.
Read the security.txt reference and disclosure cases →
Sources checked on · IETF · RFC 9116 · §2.5, §3, §5
CVSS, EPSS, KEV और VEX
इस संस्करण में विस्तृत संदर्भ टिप्पणियाँ अंग्रेज़ी में उपलब्ध हैं।
Preserve the facts justifying remediation order
An exposure review is more useful when each vulnerability connects to an instance and decision. Keep generic scores identifiable and dated, then relate them to the exposed service.
- Separate CVSS severity, EPSS probability, KEV listing and VEX applicability assertions.
- Establish product, version, access paths and owner before declaring local exposure.
- Record decision, interim control and verification evidence; an available patch is not a deployed fix.
Read the CVSS, EPSS, KEV and VEX reference →
Sources checked on · FIRST · CVSS 4.0 Specification · FIRST · EPSS Frequently Asked Questions · CISA · KEV official data schema · OpenVEX · Specification v0.2.0
समयरेखाएँ: UTC और समय क्षेत्र
इस संस्करण में विस्तृत संदर्भ टिप्पणियाँ अंग्रेज़ी में उपलब्ध हैं।
Reconcile logs without inventing their order
A later-received record can describe earlier activity. Clock changes and collection retries add ambiguity; sorting local strings does not produce a reliable incident timeline.
- Reconcile UTC instants while retaining received representations.
- Test repeated time, missing time and inconsistent offsets.
- Isolate conflicting identifiers and preserve every dated analysis snapshot.
Read the 12 cases and three dated snapshots →
Sources reviewed on · IETF · RFC 3339 · Python · PEP 495 · Python 3.12 · zoneinfo · IANA · Time Zone Database 2026e · IANA · 2026e Europe rules · OpenTelemetry · Logs Data Model
फ़ाइलें: क्वारंटीन और पहुँच वापसी
इस संस्करण में विस्तृत संदर्भ टिप्पणियाँ अंग्रेज़ी में उपलब्ध हैं।
Include late tasks in file acceptance tests
Acceptance tests should trigger withdrawal or replacement while analysis is running. Expected behavior concerns final state and actual access, beyond the task’s own success status.
- Test failure, incomplete checks and retry.
- Change version or policy during a task and verify rejection.
- Withdraw access before a derivative returns, then replay permitted and forbidden reads.
View the three journeys and late task results →
Sources reviewed on · OWASP · File Upload Cheat Sheet · OWASP · Authorization Cheat Sheet · WHATWG · HTML input accept · PostgreSQL 18 · Transaction isolation