Goals of security: the CIA triad
- Confidentiality – only authorised people can read data (encryption, access control).
- Integrity – data is not altered without authorisation (hashing, digital signatures).
- Availability – systems are usable when needed (backups, protection against DoS).
Authentication checks who you are (password, OTP, fingerprint); authorization decides what you may access. Two-factor / multi-factor authentication combines two different factors: something you know (PIN), something you have (phone OTP, card) and something you are (biometrics).
Malware types
| Malware | Behaviour |
|---|---|
| Virus | Attaches to a host file or program; spreads when the infected file is run |
| Worm | Self-replicates across networks without a host program or user action |
| Trojan horse | Looks like useful software but performs hidden harmful actions; does not self-replicate |
| Ransomware | Encrypts files and demands ransom (WannaCry, 2017) |
| Spyware | Secretly collects user information |
| Keylogger | Records keystrokes to steal passwords |
| Adware | Displays unwanted advertisements |
| Rootkit | Hides deep in the OS and conceals other malware |
| Logic bomb / time bomb | Activates when a condition or date is met |
| Backdoor | Secret way to bypass normal authentication |
| Botnet | Network of infected "zombie" computers controlled remotely |
| Scareware | Fake alerts that frighten users into buying useless software |
Common attacks and frauds
| Attack | How it works |
|---|---|
| Phishing | Fake e-mails or websites that imitate a bank to steal credentials |
| Vishing | Voice-call phishing (fake "bank official" asking for OTP) |
| Smishing | Phishing through SMS |
| Spear phishing / Whaling | Targeted phishing / phishing aimed at top executives |
| Pharming | Redirects users to a fake site even when the correct URL is typed (DNS poisoning) |
| Spoofing | Faking an e-mail address, caller ID, IP or website identity |
| DoS / DDoS | Flooding a server so genuine users cannot reach it; DDoS uses many machines (often a botnet) |
| Man-in-the-middle | Attacker secretly intercepts or alters communication, e.g. on public Wi-Fi |
| Brute force / dictionary attack | Trying all combinations / common words to guess a password |
| SQL injection | Malicious SQL entered in input fields to read or change a database |
| Zero-day exploit | Attack on a flaw before the vendor releases a fix |
| Social engineering | Manipulating people rather than machines to reveal secrets |
| Spam | Unsolicited bulk e-mail |
Encryption
Encryption converts plaintext into unreadable ciphertext; decryption reverses it. The study of these methods is cryptography.
| Type | Keys | Examples |
|---|---|---|
| Symmetric | One shared secret key encrypts and decrypts; fast | AES, DES, 3DES, Blowfish |
| Asymmetric (public key) | Public key and private key pair; solves key distribution | RSA, ECC, Diffie-Hellman (key exchange) |
| Hashing | One-way; produces a fixed-length digest; cannot be reversed | SHA-256, MD5 (now considered weak) |
To send a secret message, encrypt with the receiver's public key; only the receiver's private key can decrypt it. A digital signature is created with the sender's private key and verified with the sender's public key; it provides authentication, integrity and non-repudiation. Digital certificates are issued by Certifying Authorities (CAs). HTTPS uses TLS (successor of SSL); the browser shows a padlock.
Defences
- Firewall – hardware or software that monitors and filters incoming and outgoing traffic according to rules; it does not clean infected files.
- Antivirus – detects and removes malware; keep definitions updated.
- Patches and updates close known vulnerabilities.
- Strong passwords – long, mixed case, numbers, symbols; never share OTP, PIN or CVV.
- CAPTCHA – Completely Automated Public Turing test to tell Computers and Humans Apart.
- Honeypot – decoy system to attract and study attackers.
- Backups – the best protection against ransomware.
Cyber law and agencies in India
- Information Technology Act, 2000 – legal recognition of electronic records and digital signatures; defines cybercrimes; amended in 2008 (Section 66C identity theft, 66D cheating by personation using computers).
- CERT-In (Indian Computer Emergency Response Team) – national nodal agency for cyber incidents, under MeitY.
- Digital Personal Data Protection Act, 2023 – governs processing of personal data.
- Cyber fraud can be reported on the national helpline 1930 and the portal cybercrime.gov.in.
Exam tip: Virus needs a host, worm does not, Trojan pretends. Phishing = e-mail, Vishing = voice, Smishing = SMS, Pharming = fake redirection.