23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

SJB Institute of Technology

Department of Computer Science & Engineering

CYBER SECURITY
PRINCIPLES
AND PRACTICES
Course Code: 23CSE423 | Credits: 3 | Semester: 4

MODULE 1 & MODULE 2

Detailed Teaching Notes with Explanations and Examples

Module Topic Hours RBT

Levels
Module 1 Introduction to Cyber Security 5 Hrs L1, L2
Module 2 Mobile and Digital Payments Security 5 Hrs L1, L2, L3,
L4

Dept. of CSE | Page 1 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

MODULE 1
Introduction to Cyber Security

1.1 Basic Cyber Security Concepts

Cyber Security is the discipline of protecting computers, networks, servers, mobile
devices, electronic systems, and data from digital attacks, unauthorized access,
damage, or theft. As every aspect of modern life — banking, healthcare, education,
government — depends on digital systems, cyber security has become one of the
most critical fields in engineering and technology.

Cyber Security is the body of technologies, processes, and

Definition practices designed to protect networks, devices, programs, and
data from attack, damage, or unauthorized access. — NIST

To understand cyber security, we must first understand the CIA Triad — the
three foundational objectives that every security control aims to achieve:

Principle Meaning What Happens if Example Control

Violated
Confidentiality Only authorized Data leak — customer Encryption, access
people can view the passwords exposed on controls, MFA
information the internet
Integrity Data is accurate, Attacker changes a bank Digital signatures,
complete, and transaction amount from checksums, audit logs
unmodified Rs.100 to Rs.10,000
Availability Systems and data are Hospital unable to access Redundancy, backups,
accessible when patient records during DDoS protection
needed emergency

Example — CIA Triad in practice: When you log in to net banking

— Confidentiality is maintained by encrypting your password.
Real-World
Example
Integrity is maintained by ensuring your account balance cannot be
tampered with. Availability is maintained by keeping the bank
servers running 24/7 so you can always access your funds.

Additional Core Concepts

Dept. of CSE | Page 2 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

• Threat: Any potential event or action that could cause harm. Example: A
hacker trying to break into a company server is a threat.
• Vulnerability: A weakness that a threat can exploit. Example: Using the
default password 'admin' on a router is a vulnerability.
• Risk: The probability and impact of a threat exploiting a vulnerability.
Example: A server with an unpatched OS running on the internet has HIGH
risk.
• Asset: Anything of value that needs protection — data, hardware, software,
or people. Example: A hospital's patient database is a critical asset.
• Exploit: A piece of code or technique that takes advantage of a vulnerability.
Example: A hacker using SQL injection code to extract a database.
• Patch: A software update that fixes a known vulnerability. Example:
Microsoft releasing a security patch to fix a Windows flaw.

1.2 Layers of Security (Defense in Depth)

Defense in Depth is a security strategy that uses multiple overlapping security layers
so that if one layer fails, others continue to protect the system. This approach comes
from military strategy — building multiple defensive barriers so an attacker must
break through all of them, not just one.

Analogy: Think of it like protecting valuables in your home. You

Real-World have a gate (perimeter), a door lock (entry control), a safe (data
Example protection), and an alarm system (detection). An attacker must
bypass all layers, not just one.

Layer Description Tools / Examples

Physical Security Prevent unauthorized physical CCTV cameras, biometric doors,
access to hardware and premises security guards, server room locks
Perimeter Security Protect the boundary between Firewalls, DMZ, border routers,
trusted internal network and the intrusion prevention systems
internet
Network Security Protect data moving across the VLANs, network segmentation,
internal network IDS/IPS, secure Wi-Fi (WPA3)
Endpoint Security Protect individual devices such Antivirus, EDR (Endpoint Detection
as PCs, laptops, mobiles & Response), disk encryption
Application Secure software applications Input validation, WAF (Web
Security from code-level vulnerabilities Application Firewall), OWASP
guidelines

Dept. of CSE | Page 3 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

Layer Description Tools / Examples

Data Security Protect data itself regardless of AES-256 encryption, DLP (Data
where it is stored or transmitted Loss Prevention), tokenization
User / Identity Ensure only authorized users MFA, RBAC (Role-Based Access
Security can access systems Control), PAM, SSO
Monitoring & Detect and respond to incidents SIEM (Security Information and
Response in real time Event Management), SOC, audit
logs

1.3 Vulnerability, Assets and Threat

Assets — What We Are Protecting
An asset is anything of value that an organization needs to protect. Before designing
any security solution, we must first identify what needs protecting. Assets are
grouped into four categories:
• Hardware Assets: Physical devices — servers, laptops, routers, storage
devices, CCTV cameras. Example: The main application server of a bank.
• Software Assets: Operating systems, applications, databases, firmware.
Example: The banking application software, Oracle database.
• Data Assets: The most valuable category — customer records, financial data,
intellectual property, login credentials. Example: 50 million customer
records in an e-commerce database.
• Human Assets: Employees, administrators, and contractors who possess
knowledge and access. Example: A systems administrator with root access to
all servers.

Example: In the 2017 Equifax data breach, the most critical assets
Real-World were the personal and financial records of 147 million Americans.
Example The asset was the data — and its loss resulted in $575 million in
penalties.

Threats — What We Are Protecting Against

A threat is any potential danger that could harm an asset. Threats can be intentional
(a hacker) or accidental (an employee mistakenly deleting files). They can be internal
(from within the organization) or external (from outside).

Dept. of CSE | Page 4 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

Threat Category Description Real-World Example

Cybercriminal / Individuals or groups who attack Ransomware group encrypting
Hacker systems for financial gain or a hospital systems and
disruption demanding $1M
Insider Threat Malicious or careless employees An employee selling customer
who misuse their access data to competitors for money
Nation-State Actor Government-sponsored hackers SolarWinds attack (2020) —
targeting other nations Russian hackers compromised
18,000 organizations
Natural Disasters Environmental events that damage 2004 Indian Ocean Tsunami
physical infrastructure destroying data centers in
coastal areas
Accidental / Human Unintentional mistakes by IT admin accidentally deletes
Error employees production database — no
backup available
Hardware / Software Technology breaking down RAID storage failure causing
Failure unexpectedly permanent data loss

Vulnerabilities — The Weaknesses Threats Exploit

A vulnerability is a flaw or weakness in a system, process, or control. Threats need
vulnerabilities to succeed. Removing vulnerabilities reduces risk even when threats
cannot be eliminated.
• Unpatched Software: Software with known bugs that have not been fixed.
Example: WannaCry ransomware (2017) exploited an unpatched Windows
vulnerability — patched 2 months earlier but many organizations had not
applied it.
• Weak Passwords: Easily guessable passwords. Example: Using '123456' or
'password' — still the most common passwords globally.
• Misconfiguration: Systems set up with incorrect security settings. Example:
An AWS S3 bucket left publicly accessible — exposing millions of files.
• Lack of Encryption: Sensitive data stored or transmitted in plain text.
Example: A website using HTTP instead of HTTPS — passwords visible on
the network.
• No Input Validation: Applications accepting malicious input without
checking it. Example: A login form that accepts SQL commands, allowing
attackers to dump the database.
• Unaware Users: Employees who click phishing links or share passwords.
Example: A staff member receiving a fake 'IT Department' email and
providing their login.

Dept. of CSE | Page 5 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

1.4 Motive of Attackers

Understanding why attackers target systems is as important as understanding how
they do it. Different motives lead to different types of attacks, different targets, and
different levels of sophistication. Defenders must think like attackers.
Motive Detailed Explanation Example
Financial Gain The most common motive. Attackers REvil ransomware gang
steal money, credit card data, bank attacked Kaseya (2021),
credentials, or deploy ransomware to demanding $70 million to
extort payments. restore 1,500+ companies'
data.
Corporate Competitors steal trade secrets, product A pharmaceutical company's
Espionage designs, source code, or business new drug formula stolen
strategies to gain competitive advantage. before launch — saving
competitor years of R&D.
Political / Nation-states steal military secrets, Chinese hackers (APT41)
National government communications, or stole COVID-19 vaccine
Espionage infrastructure data from rivals. research from US
pharmaceutical companies in
2020.
Hacktivism / Hackers use cyber attacks to protest Anonymous took down
Ideology organizations, governments, or policies PayPal, Visa, and Mastercard
they oppose. websites in 2010 after they
refused payments to
WikiLeaks.
Revenge / Grudge Disgruntled employees or individuals A fired IT administrator at a
attack out of anger over perceived water treatment plant in
injustice. Florida (2021) tried to poison
water supply using remote
access.
Terrorism / Causing maximum damage to critical Cyberattack on Ukraine's
Disruption infrastructure — power grids, hospitals, power grid (2015) left
water — to create panic. 230,000 people without
electricity during winter.
Thrill / Challenge Some attackers are motivated purely by 15-year-old hacker Gary
the intellectual challenge or desire for McKinnon broke into NASA
recognition. and US military computers in
2001-02 out of curiosity.

Ask students: If you were a bank, which attacker motive would you
Teaching fear most? Financial gain (ransomware) or espionage (competitor
Tip stealing algorithms)? This discussion helps students think like
security architects.

Dept. of CSE | Page 6 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

1.5 Active and Passive Attacks

Attacks are broadly classified as active (attacker modifies or disrupts) or passive
(attacker only observes). This classification determines the type of defense required.

Passive Attacks — Listening Without Acting

In a passive attack, the attacker silently observes, monitors, or intercepts
communication without making any changes. Because no modification occurs,
passive attacks are extremely difficult to detect. The goal is usually to gather
intelligence.
• Eavesdropping / Packet Sniffing: Using tools like Wireshark to capture
unencrypted network packets and read sensitive data. Example: On an
unencrypted public Wi-Fi at a coffee shop, an attacker captures login
credentials being transmitted in plain HTTP.
• Traffic Analysis: Even when data is encrypted, the attacker studies patterns
— who communicates with whom, how often, how much data — to extract
intelligence. Example: Monitoring that a defense contractor suddenly
increases encrypted communication with a foreign embassy before a
weapons deal.
• Shoulder Surfing: Physically watching someone type a PIN or password.
Example: Standing behind someone at an ATM or in a coffee shop to
observe their password.
• Dumpster Diving: Searching through discarded documents or hardware for
sensitive information. Example: Finding printed salary slips, network
diagrams, or old hard drives in a company's trash.

Active Attacks — Modifying, Disrupting, or Impersonating

In active attacks, the attacker takes direct action — modifying data, impersonating
users, or disrupting services. These attacks are more dangerous but also more
detectable because they leave traces.
• Masquerade (Identity Spoofing): Attacker pretends to be an authorized user.
Example: An attacker uses stolen credentials to log into an admin account
and create new backdoor users.
• Replay Attack: Attacker captures a valid authentication message and
retransmits it later. Example: Capturing a valid login token and replaying it
hours later to gain access — countered by timestamps and nonces.
• Man-in-the-Middle (MitM): Attacker secretly intercepts and possibly
modifies communication between two parties who believe they are

Dept. of CSE | Page 7 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

communicating directly. Example: Attacker on public Wi-Fi intercepts

communication between a user and their bank, modifying the account
number in a transfer request.
• Message Modification / Tampering: Altering the content of messages in
transit. Example: Changing a supply order from '100 units' to '10 units' to
disrupt a competitor's supply chain.
• Denial of Service (DoS): Flooding a system with requests until it becomes
unavailable. Example: Sending 1 million requests per second to a web
server, causing it to crash and deny service to legitimate users.
• Distributed DoS (DDoS): Using a botnet (thousands of compromised
computers) to launch a coordinated DoS attack. Example: The 2016 Mirai
botnet attack used 600,000 IoT devices (cameras, routers) to take down
major websites including Twitter, Netflix, and Amazon.

Feature Passive Attack Active Attack

Attacker Action Only observes — no modification Modifies, disrupts, or
impersonates
Detectability Very hard — nothing changes in Easier — system behavior, logs
the system show anomalies
Primary Goal Collect intelligence, steal data Disrupt, destroy, impersonate, or
silently steal
Prevention Method Encryption, secure channels, VPN Firewalls, IPS, strong
authentication, rate limiting
Example Attack Wireshark packet sniffing on DDoS attack on e-commerce site
public Wi-Fi during sale season
Damage Confidentiality breach — victim Availability or integrity breach —
may never know usually noticed

Example — Active vs Passive in Banking: Passive: An attacker

silently captures all HTTP traffic at a bank branch's unsecured Wi-
Real-World Fi and collects 50 customer login credentials over 2 hours —
Example nobody notices. Active: The same attacker then uses those
credentials to log in, transfer funds, and lock accounts. Now alarms
trigger, logs show unusual logins, and the bank detects the breach.

Dept. of CSE | Page 8 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

1.6 Software Attacks

Software attacks exploit vulnerabilities in operating systems, applications, or user
behavior through malicious code or deceptive techniques. They are the most
prevalent type of cyber attack today.

Malware (Malicious Software)

Malware is any software intentionally designed to cause disruption, damage, or
unauthorized access. It is the umbrella term for all malicious code.
• Virus: A malicious program that attaches itself to legitimate files and spreads
when those files are executed. It requires human action (opening a file) to
spread.
○ Example: The ILOVEYOU virus (2000) spread via email attachment, overwrote files,
and caused $10 billion in damage worldwide.
• Worm: A self-replicating malware that spreads across networks
automatically without requiring user interaction.
○ Example: WannaCry (2017) spread automatically across 150+ countries, encrypting
files in hospitals, banks, and telecoms — 200,000+ computers infected in 24 hours.
• Trojan Horse: Disguises itself as legitimate, useful software but secretly
performs malicious actions once installed.
○ Example: A free 'PDF converter' app on a shady website that installs a keylogger to
steal passwords in the background.
• Ransomware: Encrypts the victim's files and demands a ransom payment for
the decryption key. Has become the most damaging malware type
financially.
○ Example: Colonial Pipeline attack (2021) — DarkSide ransomware shut down a fuel
pipeline supplying 45% of US East Coast fuel. Company paid $4.4 million ransom.
• Spyware: Secretly monitors user activity — keystrokes, browsing history,
screenshots, camera/mic access — and sends data to the attacker.
○ Example: Pegasus spyware (NSO Group) — installed on journalists' and activists'
phones, recording calls and reading messages without any visible sign.
• Adware: Displays unwanted advertisements; less dangerous but degrades
performance and can lead to more serious infections.
• Rootkit: Hides itself and other malware deep in the operating system,
making it extremely difficult to detect or remove. Often installed at the
kernel level.
○ Example: Sony BMG in 2005 secretly installed rootkits on users' computers through
music CDs to prevent copying — without consent.

Dept. of CSE | Page 9 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

Social Engineering Attacks

Social engineering exploits human psychology rather than technical vulnerabilities.
These attacks are often the entry point for larger technical attacks.
• Phishing: Mass emails impersonating trusted entities (banks, government,
Amazon) to steal credentials or install malware. Example: An email saying
'Your HDFC account has been suspended — click here to verify' that leads
to a fake bank website.
• Spear Phishing: Targeted phishing using the victim's name, role, and
personal details to appear more convincing. Example: An email to the CFO
saying 'Hi Ravi, please approve the attached invoice from our Singapore
supplier' — CFO clicks and downloads malware.
• Whaling: Spear phishing targeting senior executives (CEO, CFO, CTO).
Example: CEO Fraud — attacker impersonates the CEO to instruct finance
team to urgently wire $500,000 to a new vendor account.
• Vishing: Voice phishing — phone calls impersonating tech support, banks,
or government agencies. Example: 'This is Microsoft Support. Your
computer has a virus. Please install this remote access tool so we can fix it.'

Technical Software Attacks

• SQL Injection: Attacker inserts malicious SQL code into a web form input
field to manipulate or dump the database. Example: Entering ' OR '1'='1 in a
login field to bypass authentication entirely — this is one of the oldest and
most common web vulnerabilities.
• Cross-Site Scripting (XSS): Injecting malicious scripts into a webpage that
runs in other users' browsers. Example: An attacker posts a comment on a
forum containing JavaScript code that steals the session cookies of every
user who views that comment.
• Zero-Day Attack: Exploiting a vulnerability that is unknown to the software
vendor — so no patch exists. Example: Stuxnet worm used four zero-day
vulnerabilities simultaneously — an unprecedented level of sophistication.
• Buffer Overflow: Sending more data than a program's buffer can hold,
causing it to execute arbitrary code. Example: Early video game cheats used
buffer overflows to inject cheat codes — malware uses the same technique to
execute shell code.

Dept. of CSE | Page 10 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

1.7 Hardware Attacks

Hardware attacks target physical components of computers and networks. They often
bypass software security controls entirely because they operate at a level below the
operating system.
• Hardware Keylogger: A small physical device plugged between a keyboard
and computer that records every keystroke. Example: An attacker walks into
an office posing as a maintenance technician and plugs a keylogger into the
back of a receptionist's computer — collecting usernames, passwords, and
emails for weeks.
• Evil Maid Attack: Named because it assumes the attacker has physical
access to an unattended device. They modify the BIOS or bootloader to
install persistent malware. Example: A hotel room attack where a laptop left
in a room has its boot sector modified overnight.
• Cold Boot Attack: RAM retains data for seconds to minutes after power is
cut. Attacker quickly transfers RAM chips to another computer and reads
encryption keys from memory. Example: Used to defeat full-disk encryption
(BitLocker, FileVault) by reading the AES key still in RAM.
• Supply Chain Attack: Hardware is compromised during manufacturing or
distribution before it reaches the organization. Example: Bloomberg's 'Big
Hack' report (2018) alleged tiny chips were implanted in Supermicro server
motherboards used by Apple and Amazon during manufacturing.
• USB Drop Attack (Baiting): Infected USB drives are deliberately left in
parking lots, restrooms, or lobbies. Curious employees plug them in,
infecting the network. Example: A 2016 experiment dropped 297 USB
drives around a university — 48% were plugged in within minutes.
• Side-Channel Attack: Extracts secrets by observing physical properties —
power consumption, electromagnetic emissions, timing, or sound — rather
than attacking the algorithm itself. Example: Differential Power Analysis
(DPA) can extract cryptographic keys from smart cards by analyzing power
fluctuations during encryption.

Real-World Example — Supply Chain Hardware Attack: In 2019,

the US government warned that Huawei network equipment may
Real-World
Example
contain backdoors installed during manufacturing that could allow
the Chinese government to intercept communications. Many
countries subsequently banned Huawei from 5G infrastructure.

Dept. of CSE | Page 11 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

1.8 Cyber Threats — Warfare, Terrorism, and Espionage

Cyber Warfare
Cyber Warfare refers to the use of digital attacks by nation-states as instruments of
war or national security strategy. These attacks target another country's critical
infrastructure, military systems, financial institutions, or government networks.
Cyber warfare is now considered the 'fifth domain of warfare' alongside land, sea,
air, and space.
• Characteristics: Highly sophisticated, well-funded, often uses zero-days and
custom malware, attacks are persistent (months/years), sometimes causes
physical damage.
• Targets: Power grids, water treatment plants, nuclear facilities, military
command systems, financial markets, election infrastructure.

Most Famous Example — Stuxnet (2010): A joint USA-Israel

cyber weapon designed to destroy Iran's uranium enrichment
centrifuges at Natanz nuclear facility. The worm subtly sped up
Real-World
Example
centrifuges while showing normal readings on control screens —
physically destroying equipment while operators saw no problem.
It set back Iran's nuclear program by 2+ years. This was the world's
first known cyber weapon to cause physical destruction.

Recent Example — Ukraine Power Grid Attack (2015-2016):

Russian hackers (Sandworm group) attacked Ukraine's electricity
Real-World
Example
distribution companies, causing power outages affecting 230,000
people in the dead of winter. This was the first publicly confirmed
cyber attack to cause a power blackout.

Cyber Terrorism
Cyber Terrorism is the use of digital attacks by non-state terrorist groups to cause
mass disruption, fear, loss of life, or advance political/religious goals. Unlike nation-
state warfare, cyber terrorists typically have fewer resources but may still cause
significant damage targeting soft targets.
• Typical Targets: Hospitals, transport systems, water supply, nuclear plants,
financial markets, emergency services.
• Goal: Create public panic, undermine confidence in government, force
policy changes, or cause economic damage.
• Key Difference from Hacking: Cyber terrorism requires clear
political/ideological intent and aims to intimidate a population.

Dept. of CSE | Page 12 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

Example — Hospital Ransomware as Cyber Terror: In 2020, a

Duesseldorf University Hospital in Germany was hit by
Real-World ransomware, forcing staff to reroute emergency patients. A patient
Example requiring urgent treatment died after being redirected to a hospital
32 km away. This was considered the first death attributable to a
cyber attack — and debated as cyber terrorism.

Cyber Espionage
Cyber Espionage is the covert use of digital techniques to steal sensitive information
— government secrets, military plans, corporate intellectual property, or personal
information on key individuals. Unlike warfare, espionage aims to stay undetected
as long as possible.
• Methods Used: Advanced Persistent Threats (APTs), spear phishing,
watering hole attacks, zero-days, insider recruitment, supply chain
compromise.
• APT (Advanced Persistent Threat): A prolonged, targeted attack where the
attacker maintains a hidden presence in a network for months or years,
quietly stealing data.

Example — SolarWinds Attack (2020): Russian SVR intelligence

hackers inserted malicious code into SolarWinds' Orion software
update. When 18,000 organizations (including US government
Real-World
Example
agencies — Treasury, Commerce, Homeland Security, Pentagon)
installed the update, the hackers had undetected access for 9
months. This is considered one of the most sophisticated cyber
espionage operations ever conducted.

Feature Cyber Cyber Terrorism Cyber Espionage

Warfare
Actor Nation-states Terrorist organizations Intelligence agencies,
(military) nation-states
Goal Weaken enemy Create fear, panic, political Steal secrets, intelligence
infrastructure, pressure gathering
achieve military
objectives
Visibility Sometimes Intended to be visible — Designed to be invisible
visible maximum fear — stay hidden

Dept. of CSE | Page 13 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

Feature Cyber Cyber Terrorism Cyber Espionage

Warfare
(blackouts,
explosions)
Duration Acute attacks Single high-impact events Long-term persistent
during conflict presence (months/years)
Famous Stuxnet — Iran Duesseldorf Hospital SolarWinds — US
Example nuclear ransomware government infiltration
centrifuges

1.9 Comprehensive Cyber Security Policy

A Cyber Security Policy is a formal, written document that defines an organization's
rules, responsibilities, and procedures for protecting its information assets. It is the
foundation of an organization's entire security program — without it, security
decisions are ad hoc and inconsistent.

Think of it as the constitution of an organization's security — all other security

documents (standards, procedures, guidelines) are derived from and must comply
with the policy.

Without a policy, there is no agreed standard to measure against,

Why
no clear accountability, no legal standing to discipline employees
Policies
Matter who violate rules, and no basis for compliance with laws like
GDPR, IT Act, or ISO 27001.

Structure of a Comprehensive Cyber Security Policy

1. Purpose and Scope: What the policy covers, why it exists, and who it applies
to. Example: 'This policy applies to all employees, contractors, and third
parties who access company systems.'
2. Information Classification Policy: How data is categorized by sensitivity and
the controls required for each level. Example: Customer financial data =
Restricted; internal memos = Internal; press releases = Public.
3. Access Control Policy: Who can access which systems, under what
conditions, using what authentication. Example: All admin accounts require
MFA; no shared login credentials are permitted.

Dept. of CSE | Page 14 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

4. Password Policy: Minimum length, complexity, expiry, and history

requirements. Example: Minimum 12 characters, include uppercase,
numbers, and symbols; change every 90 days.
5. Acceptable Use Policy (AUP): Rules for how employees may use company
IT resources. Example: No personal social media on work computers; no
downloading unlicensed software.
6. Network Security Policy: Rules for firewall configuration, VPN use,
wireless security, and network segmentation. Example: All remote access
must use company VPN; public Wi-Fi requires VPN.
7. Incident Response Policy: Steps to detect, report, contain, eradicate, and
recover from security incidents. Example: All incidents must be reported
within 1 hour to the SOC; escalation path defined.
8. Data Backup and Recovery Policy: Frequency, location, and testing
requirements for backups. Example: Daily incremental backup, weekly full
backup; restore test monthly; offsite copy mandatory.
9. Physical Security Policy: Securing physical premises, devices, and media.
Example: Visitors must be escorted; server rooms require biometric access;
clean desk policy enforced.
[Link] and Legal: Mapping policy to relevant laws and regulations.
Example: GDPR Article 32 requires encryption; India's IT Act Section 43A
requires reasonable security practices.

For the examination, be able to: Define all key terms (L1), Explain
RBT Levels the CIA Triad with examples (L2), Describe different attack types
1&2 and give examples (L2), Compare active vs passive attacks (L2),
Explain the components of a cyber security policy (L2).

Dept. of CSE | Page 15 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

MODULE 2
Mobile and Digital Payments Security

2.1 Security Challenges in Mobile Devices

Mobile devices — smartphones, tablets, and wearables — have become the primary
computing platform for billions of people. They contain banking apps, health data,
personal photos, emails, contacts, and corporate data. This makes them extremely
valuable targets for attackers.
Unlike desktop computers that are locked in offices, mobile devices travel
everywhere — to cafes, airports, hospitals, and foreign countries — greatly
expanding the attack surface.

Major Security Challenges

• Lost or Stolen Devices: Mobile devices are small and portable — they get
lost or stolen frequently. If unprotected, a thief has instant access to all apps,
emails, banking, and stored passwords. Example: A company executive loses
their phone at an airport — it contains all corporate emails, VPN credentials,
and the authenticator app for admin access.
• Insecure Wi-Fi Networks: Public Wi-Fi hotspots in cafes, airports, hotels are
unencrypted and often not authenticated — anyone on the same network can
perform packet sniffing or ARP poisoning. Example: Attacker sets up a fake
Wi-Fi hotspot named 'Cafe_FreeWifi' — users connect, and attacker
captures all unencrypted traffic.
• Malicious / Fake Apps: Apps from unofficial stores (APK download sites,
third-party stores) may contain malware, spyware, or banking trojans.
Example: 'COVID Contact Tracer' fake app in 2020 secretly recorded calls
and uploaded them to an attacker's server.
• Outdated Operating Systems: Android fragmentation means many devices
run Android versions 2-3 years old with known vulnerabilities that Google
has already patched — but manufacturers and carriers haven't pushed
updates. Example: 40% of active Android devices still run versions with
known critical vulnerabilities.
• Jailbreaking / Rooting: Removing OS restrictions removes all built-in
security protections — no sandboxing, no app signing verification, no secure
boot. Example: A jailbroken iPhone can install any unsigned app —
including malware — and attackers can exploit root access to access all data.

Dept. of CSE | Page 16 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

• Bluetooth and NFC Vulnerabilities: Short-range wireless technologies can be

exploited if not configured properly. Example: BlueBorne (2017) — a
Bluetooth vulnerability that allowed attackers within range to silently take
full control of a device without any user interaction.
• SIM Swapping: Attacker calls mobile carrier, impersonates the victim, and
convinces them to transfer the victim's phone number to a new SIM the
attacker controls. All OTPs and voice calls now go to the attacker. Example:
Twitter CEO Jack Dorsey's account was hijacked in 2019 through a SIM
swap, and tweets were posted from his account without his knowledge.

2.2 Types of Attacks on Mobile Devices

Attack Type Detailed Explanation Prevention
Mobile Malware / Malicious apps that steal banking Install apps only from Play
Trojans credentials, intercept OTPs, or take Store/App Store. Check app
control of the device. Banking trojans permissions carefully.
overlay fake screens on top of real
banking apps.
Smishing (SMS Fake SMS messages with malicious Never click links in SMS.
Phishing) links or requests. Often impersonate Always access banking
banks, TRAI, delivery services, or directly via app or official
government. Example: 'Your KYC is website.
expired. Click here to update within
24 hours or account will be blocked'
Man-in-the-Mobile Mobile malware that intercepts SMS Use authenticator apps instead
(MitMo) OTPs and forwards them to the of SMS OTP where possible.
attacker, allowing account takeover Keep OS updated.
even with 2FA enabled.
Spyware / Covertly installed software that Regularly check installed apps
Stalkerware records calls, reads messages, tracks for unknown ones. Factory
GPS location, activates reset if device behaves
camera/microphone without consent. strangely.
Bluesnarfing Exploiting Bluetooth vulnerabilities to Turn off Bluetooth when not
covertly access contacts, messages, in use. Keep device non-
emails, and calendar on a Bluetooth- discoverable.
enabled device.
GPS Spoofing Sending fake GPS coordinates to the Be aware when navigation
device to deceive location-based apps gives unexpected routes. Use
or navigation systems. certificate-pinned apps.
Overlay Attack Malware displays a fake screen Enable Google Play Protect.
(identical to the real banking app) on Use MFA beyond just
top of the genuine app — user enters password.
credentials into the fake overlay.

Dept. of CSE | Page 17 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

Attack Type Detailed Explanation Prevention

SIM Swap Attacker fraudulently gets the victim's Set a SIM lock PIN with your
mobile number transferred to their carrier. Use authenticator
own SIM, intercepting all OTPs and apps, not SMS OTP for
2FA codes. important accounts.

Real-World Example — Overlay Attack in India: BankBot

malware was found on the Google Play Store disguised as a
Real-World flashlight app. When the user opened their banking app, BankBot
Example displayed a pixel-perfect fake login screen on top. Credentials
entered were sent to attackers in Eastern Europe. By the time
Google removed it, 10,000+ devices had been infected.

2.3 Security for Mobile Apps

Mobile app security is a specialized field focused on identifying and fixing
vulnerabilities during the app development lifecycle. The OWASP (Open Web
Application Security Project) Mobile Top 10 is the global reference for mobile app
vulnerabilities.

OWASP Mobile Top 10 — Explained with Examples

[Link] Platform Usage: Misusing Android/iOS platform features or
bypassing built-in security mechanisms. Example: An app storing the user's
password in Android SharedPreferences (plain text) instead of using the
Android Keystore System.
[Link] Data Storage: Storing sensitive data (passwords, tokens, PII) in
plain text on device storage, logs, or databases. Example: A banking app
storing the account balance and last 4 digits of card in an unencrypted
SQLite database that any app with storage permission can read.
[Link] Communication: Transmitting data without TLS/SSL encryption, or
using weak/outdated TLS configurations. Example: App sends user's GPS
location and identity to a server over plain HTTP — attacker on same Wi-Fi
intercepts and tracks the user.
[Link] Authentication: Weak login mechanisms — no MFA, persistent
login tokens that never expire, easily guessable PINs. Example: A health app
that remains logged in forever with a 4-digit PIN that is never reset — stolen
phone gives permanent access to medical records.
[Link] Cryptography: Using MD5 or SHA-1 (broken algorithms) to
hash passwords, or using AES with ECB mode (insecure). Example: An e-

Dept. of CSE | Page 18 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

commerce app hashing user passwords with MD5 — a rainbow table attack
can crack most MD5 passwords instantly.
[Link] Authorization: App allows users to access data or perform actions
beyond their permission level. Example: Changing the user ID in an API
request from 'user_id=1234' to 'user_id=1235' reveals another user's order
history — called IDOR (Insecure Direct Object Reference).
[Link] Code Quality: Buffer overflows, format string vulnerabilities, and
memory management errors in the app's native code. Example: A game app's
ad library has a buffer overflow — an attacker crafts a malicious ad that
exploits it to run code on the device.
[Link] Tampering: Attacker modifies the app's binary (repackages it) to
remove license checks, add malware, or insert ad fraud code. Example: A
cracked version of a paid app on a third-party site — looks identical but has
a keylogger added.
[Link] Engineering: Decompiling the APK/IPA to extract API keys,
hardcoded passwords, encryption logic, or business logic secrets. Example:
Reverse engineering a banking app reveals a hardcoded API key that
provides admin access to the transaction server.
[Link] Functionality: Test code, debug backdoors, or hidden features
left in production builds. Example: A developer accidentally leaves a debug
menu in the production app that allows bypassing payment verification.

Secure Mobile App Development Best Practices

• Use HTTPS/TLS 1.3 for ALL network communication — never allow plain
HTTP connections.
• Implement Certificate Pinning — the app only accepts specific server
certificates, preventing MitM even with a compromised CA.
• Store sensitive data in secure storage — Android Keystore, iOS Secure
Enclave — never in SharedPreferences, files, or databases unencrypted.
• Implement proper session management — tokens expire, require re-
authentication for sensitive operations.
• Use code obfuscation tools (ProGuard for Android) to make reverse
engineering harder.
• Request only necessary permissions — an expense tracking app has no
business accessing the microphone.
• Test with SAST (Static Analysis) tools during development and DAST
(Dynamic Analysis) before release.

2.4 Mobile Device Management (MDM)

Dept. of CSE | Page 19 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

MDM is a category of software that allows IT departments to enroll, configure,

monitor, and manage mobile devices used in an organization. It is essential in today's
environment where employees use personal devices for work (BYOD) or where
companies issue corporate devices that travel outside office premises.

Why MDM is Critical

Imagine a hospital where 500 doctors use their personal iPhones to access patient
records. Without MDM: a stolen phone exposes thousands of patient records; a
doctor might install an untrusted app that leaks data; some doctors might run
outdated iOS with known vulnerabilities. MDM solves all of these problems
centrally.

MDM Core Capabilities with Examples

• Remote Wipe: Instantly erase all data on a lost or stolen device. Example:
An employee reports their laptop stolen at Delhi airport at 10pm. IT
remotely wipes all data by 10:05pm — before any attacker can extract data.
• Policy Enforcement: Push mandatory settings to all devices — screen lock
after 5 minutes, minimum 6-digit PIN, full disk encryption required.
Example: New company policy requires all devices to have biometric lock
— MDM enforces it automatically on all 10,000 enrolled devices overnight.
• App Management (MAM): Deploy approved apps, block unauthorized ones,
and remotely remove apps. Example: Company deploys the corporate VPN
app and Office 365 to all devices automatically on enrollment.
• Containerization (for BYOD): Creates a secure encrypted work container on
a personal phone that is completely isolated from personal data. Example:
On a doctor's personal phone, the hospital's container (with patient data) and
the personal phone (Instagram, WhatsApp) are cryptographically isolated —
hospital IT can wipe only the work container, not personal photos.
• Compliance Monitoring: Continuously checks if devices meet security
requirements and alerts IT or restricts access if they don't. Example: A
device becomes non-compliant when the user disables screen lock — MDM
automatically blocks corporate email access until the user re-enables it.
• Geofencing: Restrict device capabilities based on location. Example: A
classified government device can only access secure servers when physically
located within the office building — outside, it blocks all access.

Dept. of CSE | Page 20 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

MDM Tool Provider Best For Key Feature

Microsoft Intune Microsoft Windows + mobile in one Tight Azure AD
platform integration, conditional
access
VMware VMware Enterprise zero-trust Unified endpoint
Workspace ONE deployments management (mobile +
desktop + IoT)
Jamf Pro Jamf Apple-only environments Deep macOS/iOS
(education, creative) management
capabilities
IBM MaaS360 IBM AI-driven threat Watson AI analyzes
management device behavior for
anomalies
Google Endpoint Google Google Workspace Free basic MDM
Mgmt organizations included with Google
Workspace

2.5 Digital Payments Security in India

India has undergone one of the world's fastest digital payment transformations.
Following demonetization in 2016 and the COVID-19 pandemic, digital payment
volumes exploded. UPI alone processes over 10 billion transactions per month. This
scale makes security absolutely critical.

Payment Type How It Works Security Example

Mechanism Platform
Banking Cards Card linked to bank EMV chip, PIN, CVV, HDFC Debit
(Debit/Credit) account; transactions OTP, 3D Secure Card, SBI
authorized by PIN, OTP, or Credit Card
biometric
UPI (Unified Real-time bank-to-bank UPI PIN + Device GPay, PhonePe,
Payments transfer via VPA (Virtual Binding + SIM Paytm, BHIM
Interface) Payment Address) using verification + NPCI
smartphone backend fraud detection
e-Wallets Pre-loaded digital wallet; MPIN, OTP, KYC Paytm Wallet,
funds stored independently verification, Amazon Pay,
of bank account tokenization, RBI- MobiKwik
mandated limits
USSD (*99#) Feature phone-based MPIN required for NUUP —
banking; works on any transactions; operator- National
GSM phone without internet level network security Unified USSD
Platform

Dept. of CSE | Page 21 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

Payment Type How It Works Security Example

Mechanism Platform
Aadhaar Enabled Biometric-authenticated Fingerprint/IRIS CSP (Customer
Payments (AePS) bank transaction using biometric + Aadhaar Service Points)
Aadhaar 12-digit number at OTP; UIDAI backend in rural India
micro-ATM authentication

2.6 Banking Card Security — In Depth

Banking cards — debit and credit — are used for in-person purchases (Point of Sale),
online shopping (Card Not Present), and ATM withdrawals. Each use case has
different vulnerabilities and protections.

Security Features Explained

• EMV Chip (Europay Mastercard Visa): A microprocessor chip embedded in
the card that generates a unique, one-time cryptogram for each transaction.
Unlike the magnetic stripe (which stores static data), the chip data cannot be
simply cloned because the cryptogram changes every time. Example: When
you insert your card in a chip reader, it generates a code like 'A3F7B9C2'
valid only for this exact transaction — even if an attacker captures it, they
cannot reuse it.
• PIN (Personal Identification Number): A 4-6 digit secret code required for
in-person transactions. The PIN is never stored on the card — it is processed
by the bank's PIN verification system. Example: Even if someone steals your
card, they cannot use it at a physical store without your PIN.
• CVV (Card Verification Value): The 3-digit code on the back
(Visa/Mastercard) or 4-digit code on the front (Amex). Used to verify card-
not-present (online) transactions. The CVV is not stored in the magnetic
stripe — so a skimmed card cannot be used online without the CVV.
Example: Online shopping requires card number + expiry + CVV — three
separate pieces of information an attacker needs.
• OTP (One-Time Password): For online transactions, the bank sends a 6-digit
code to your registered mobile number valid for 5-10 minutes. Adds an
additional factor — even if attacker has card details, they need your phone.
Example: After entering card details on Amazon, you receive 'Your OTP is
847291. Valid for 10 minutes. Do not share.'
• 3D Secure (Verified by Visa / Mastercard SecureCode): An additional
authentication protocol for online payments. After entering card details on a
merchant site, you are redirected to your bank's secure page to verify via

Dept. of CSE | Page 22 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

OTP or password. Example: Buying on a new website — after card details,

Axis Bank's page opens asking you to enter your registered mobile OTP.

Card Attack Methods

• ATM Skimming: A physical device installed over the card slot captures
magnetic stripe data, while a tiny camera records the PIN. Example: Police
in Mumbai discovered a skimming device on an ATM that had stolen data
from 500+ cards over two weeks before discovery.
• Card Cloning: Using skimmed magnetic stripe data to create a duplicate
card. Works only where merchants still accept magnetic stripe (chip-less
swipe) or for online fraud (where CVV may also have been stolen).
Example: Cloned cards are commonly used in countries that haven't
migrated to chip-and-PIN.
• Card Not Present (CNP) Fraud: Stolen card number + expiry + CVV are
used for online purchases. No physical card needed. Example: Attacker buys
card data on dark web for $5, makes $2,000 in online purchases before
victim notices.

2.7 UPI Security — Architecture and Fraud

UPI (Unified Payments Interface), launched by NPCI (National Payments
Corporation of India) in 2016, is a revolutionary payment system that enables instant,
24/7 bank-to-bank transfers using just a VPA (Virtual Payment Address) like
name@okaxis. It has become the most popular payment method in India.

How UPI Authentication Works (Step by Step)

[Link] installs a UPI app (GPay, PhonePe, Paytm) and links their bank
account.
[Link] app performs device binding — it registers the combination of App +
Device + SIM card with NPCI. The app only works on this specific device
with this specific SIM.
[Link] sets a UPI PIN (4 or 6 digits) which is linked to the bank account — set
directly in the banking system.
[Link] every transaction: User enters recipient VPA or scans QR code, enters
amount, enters UPI PIN — the PIN is encrypted end-to-end and verified by
the user's bank.
[Link] routes the transaction and both banks confirm in under 3 seconds.

Dept. of CSE | Page 23 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

Critical UPI PIN is used ONLY to send money. You NEVER need to enter
Security your UPI PIN to RECEIVE money. If anyone asks for your PIN to
Point send payment to you, it is 100% fraud.

Common UPI Frauds with Detailed Explanations

• Collect Request Fraud: UPI allows 'payment collect requests' — one party
asks another to approve a payment. Scammers pose as buyers and send a
collect request to sellers, saying 'I've sent the money, please approve the
request.' The victim thinks they are receiving money but are actually
approving a payment FROM their account. Example: A woman selling a
second-hand phone on OLX receives a 'Rs.5000 collect request' from the
'buyer.' She approves it — Rs.5000 is deducted from her account.
• Fake QR Code Fraud: Attacker sends a QR code asking the victim to scan
and 'receive' money. In UPI, scanning any QR code initiates a PAYMENT
(sending), not a receipt. There is no such thing as 'scanning to receive
money.' Example: Attacker sends message: 'I will pay Rs.10,000 for your
item. Scan this QR to receive payment.' Victim scans QR and pays
Rs.10,000 to the attacker.
• Fraudulent UPI Apps: Cloned versions of GPay, PhonePe, or BHIM that
look identical but steal credentials. Example: Searching 'BHIM App
Download' on Google finds sponsored ads for fake APK files that steal UPI
PIN when entered.
• Vishing for UPI PIN: Attacker calls pretending to be bank customer care,
claims there's an issue with the account, and asks for UPI PIN 'to verify.'
Example: 'This is SBI helpdesk. Your UPI is blocked due to suspicious
activity. Please share your UPI PIN to restore access.' Banks NEVER ask for
UPI PIN.

Statistics: According to RBI, UPI-related fraud complaints

increased 59% in 2022-23. The most common fraud type is collect
Real-World
Example
request fraud and social engineering — not technical hacking. This
means educating users is more effective than technical controls
alone.

2.8 e-Wallet Security

E-wallets are digital payment applications that store money for use in transactions.
Unlike UPI (which transfers directly from bank), e-wallets have a stored balance.

Dept. of CSE | Page 24 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

Popular wallets in India include Paytm, Amazon Pay, PhonePe Wallet, and
MobiKwik.

Security Architecture of e-Wallets

• RBI Regulation: All e-wallets in India must be authorized by the RBI under
the Payment and Settlement Systems Act. This means minimum security
standards are mandated.
• KYC Tiers and Limits: Without KYC — maximum balance Rs.10,000,
monthly spending Rs.10,000. With full KYC — maximum balance
Rs.2,00,000. This limits damage from a compromised wallet.
• Tokenization: When you save your credit card in a wallet (like Google Pay),
the actual card number is replaced with a 'token' — a random number that
represents the card. Even if the token is stolen, it is useless without the
payment network's key. Example: Google Pay stores token '4111-0000-
0000-1234' instead of your actual card '4111-1111-1111-1111'. A merchant
data breach exposes only the token, not your real card.
• MPIN Authentication: Most wallets require a 4-6 digit MPIN for
transactions. Some also support biometric (fingerprint/face). Example:
Paytm requires MPIN for any payment above Rs.2,000, and for account
settings changes.
• Fraud Detection AI: Wallets use machine learning models to detect unusual
transaction patterns. Example: If your Paytm account suddenly tries to
transfer Rs.50,000 to an unknown account at 3am, the system flags it and
requires additional verification.

e-Wallet Attack Scenarios

• Account Takeover via OTP Interception: Attacker obtains the victim's phone
number (or performs SIM swap) and intercepts the OTP sent during login.
Example: Attacker performs SIM swap, intercepts Paytm login OTP,
changes MPIN, and drains wallet balance.
• Fake Cashback Fraud: Victim receives message 'You have received Rs.500
cashback. Enter your wallet OTP to credit.' Victim enters OTP — which
actually authorizes a payment FROM their wallet to the attacker. Example:
'Congratulations! You have won Rs.1000 Paytm cashback. Enter OTP
847291 to receive.' The OTP is actually for a Rs.1000 payment request the
attacker has initiated.

2.9 USSD-Based Banking (*99#)

Dept. of CSE | Page 25 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

USSD (Unstructured Supplementary Service Data) is a protocol used by GSM

networks for session-based communication. In India, NPCI launched *99# as the
National Unified USSD Platform for basic banking on feature phones — reaching
citizens without smartphones or internet.

How It Works
[Link] dials *99# on any mobile phone (even a basic feature phone) on any
network.
27.A menu appears on screen (not a web page — a GSM session) offering:
Check balance, Mini statement, Fund transfer, Change MPIN, Generate
OTP.
[Link] navigates the menu using number keys and enters MPIN to authorize
transactions.
[Link] session communicates directly with the bank via NPCI's USSD gateway
— no internet required.

USSD Security Considerations

• MPIN Protection: MPIN is required for all financial transactions. However,
MPIN entry on a feature phone is visible to anyone watching the screen —
shoulder surfing risk.
• Session Security: USSD sessions are short-lived (terminated after 3 minutes
of inactivity). Sessions are encrypted at the GSM network level.
• Network-Level Risk: USSD traffic flows through the telecom operator's
network. In countries with weak telecom security, USSD can theoretically be
intercepted by SS7 (Signaling System 7) attacks. India's *99# uses additional
application-level controls.
• Physical Security Risk: Feature phones are less likely to have screen locks
— a stolen phone with the banking app open poses a risk.
• Best Practice: Never use *99# on a shared phone or in public view. Change
MPIN immediately if you suspect compromise.

2.10 Common Digital Payment Frauds and Prevention

Despite technical security measures, the weakest link in digital payment security is
almost always the human user. Social engineering and psychological manipulation
are used to bypass even strong technical controls.

Dept. of CSE | Page 26 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

Fraud Type How Attackers Real Example Prevention

Execute It
Phishing Mass messages SMS: 'Your SBI account Never click links in
(Email/SMS) impersonating banks, is blocked. Update KYC SMS/email. Always
TRAI, delivery at [Link] type bank URL
companies, asking within 24 hours' directly or use
victims to click links official app.
and enter details on
fake websites
Vishing Attacker calls posing as Call: 'I am from TRAI. Banks/TRAI never
(Phone Call) bank employee, TRAI Your number will be call asking for OTP
officer, or police. disconnected for illegal or PIN. Disconnect
Builds trust and use. Give me your and call the official
urgency, then extracts Aadhaar OTP to verify number.
OTP/PIN/card details your identity.'
SIM Swap Attacker submits fake Mumbai case (2020): Set a SIM lock PIN
documents to telecom Rs.1.86 crore stolen via with carrier. Monitor
carrier to get victim's SIM swap by submitting if your phone loses
number ported to a new fake ID to Airtel network
SIM, intercepting all unexpectedly.
OTPs
Collect Attacker initiates a UPI OLX/Quikr seller scam Understand that
Request Fraud collect request and — 'buyer' sends collect approving any UPI
tricks victim into request for item price; request DEDUCTS
thinking they need to seller approves it losing money. Only approve
approve it to RECEIVE money requests you
money initiated.
Job/Investment Promise of high returns Part-time job: 'Complete Any scheme
Scam or work-from-home tasks, earn Rs.500 each. requiring upfront
jobs; victim pays First pay Rs.2000 payment is almost
registration fee or registration.' Then certainly fraud.
invests in fake scheme disappears. Verify through
official channels.
Remote Attacker convinces Victim installs 'SBI Never install remote
Access Fraud victim to install Remote Support' app access apps
AnyDesk or from unknown caller. suggested by
TeamViewer for 'tech Attacker watches OTP unknown callers. No
support'. Watches entry and approves bank provides
victim's screen during parallel transaction. support this way.
banking.

Golden Rules for Digital Payment Safety

Dept. of CSE | Page 27 | Module 1 & 2 Teaching Notes | 23CSE423

 23CSE423 - Cyber Security Principles and Practices | SJB Institute of Technology

• 1. NEVER share OTP, UPI PIN, CVV, card number, or net banking
password with ANYONE — including people claiming to be bank
employees.
• 2. Receiving money via UPI NEVER requires you to enter your PIN or
approve any request.
• 3. Always download apps from official app stores (Google Play or Apple
App Store) only.
• 4. Check the URL carefully before entering credentials — attackers use
domains like '[Link]' instead of '[Link]'.
• 5. Enable instant transaction alerts (SMS + email) on all accounts — detect
fraud within seconds.
• 6. Report fraud immediately: Call 1930 (National Cyber Crime Helpline) or
visit [Link] — earlier reporting increases chance of money
recovery.
• 7. Use UPI transaction limits wisely — keep daily limits low for regular use,
increase only when needed.
• 8. Never use public Wi-Fi for financial transactions. Use mobile data or
trusted Wi-Fi with VPN.

Module 2 exam expects: L1 — Name types of mobile attacks and

payment systems. L2 — Explain how UPI authentication works;
RBT Levels describe MDM capabilities. L3 — Apply OWASP Mobile Top 10 to
1-4 identify vulnerabilities in a given app scenario. L4 — Analyze a
fraud scenario, identify which attack was used, and recommend
prevention measures.

End of Module 1 & Module 2 Teaching Notes — 23CSE423

SJB Institute of Technology | Dept. of CSE | For Teaching Use Only

Dept. of CSE | Page 28 | Module 1 & 2 Teaching Notes | 23CSE423