Cybersecurity

Unit 1 & Unit 2 — Question Bank

10-Mark University Exam Answers

UNIT – 1

1. Define Cybersecurity. Discuss its different classes with suitable examples.

Introduction
Cybersecurity is the practice of protecting computers, networks, applications, devices, and data from unauthorized access, attacks, damage,
or theft. It involves technologies, processes, and security practices used to maintain the confidentiality, integrity, and availability of
information.

Definition
Cybersecurity can be defined as the protection of digital systems, networks, devices, and information from cyber threats and unauthorized
activities.

Objectives of Cybersecurity
The major objectives are based on the CIA Triad:
1. Confidentiality – Information should be accessible only to authorized users.
Example: Password protection and encryption.

2. Integrity – Information should not be modified without authorization.

Example: Hashing helps detect changes in files.

3. Availability – Systems and information should be available when required.

Example: Backup servers can maintain availability during failures.

Classes of Cybersecurity

1. Network Security
Protects computer networks from unauthorized access and attacks.
Examples: Firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), Network monitoring

2. Application Security
Protects software and web applications from vulnerabilities.
Examples: Secure coding, Input validation, Web Application Firewall, Protection against SQL Injection and XSS

3. Information Security
Protects information from unauthorized access, modification, or destruction.
Examples: Data encryption, Access control, Data classification, Backup

4. Endpoint Security
Protects devices such as laptops, desktops, and mobile phones.
Examples: Antivirus, Endpoint Detection and Response (EDR), Device encryption

5. Cloud Security
Protects cloud-based infrastructure, applications, and data.
Examples: Multi-factor authentication, Cloud access control, Encryption, Security monitoring

6. IoT Security
Protects Internet of Things devices such as smart cameras, sensors, and smart appliances.
Example: Securing a smart CCTV camera using strong authentication and updated firmware.

7. Mobile Security
Protects smartphones and tablets from malicious applications, data theft, and unauthorized access.

Importance
Cybersecurity is important because it:
Protects personal and organizational data.
Prevents financial losses.
Protects critical infrastructure.
Prevents identity theft.
Maintains customer trust.
Supports business continuity.

Conclusion
Cybersecurity is an essential part of modern digital infrastructure. Different classes such as network, application, information, endpoint,
cloud, IoT, and mobile security work together to protect organizations against cyber threats.
 2. Explain the concept of Information Security and its importance in the digital
era.

Introduction
Information has become one of the most valuable assets of modern organizations. Organizations store large amounts of personal, financial,
business, and confidential information digitally. Therefore, protecting information from unauthorized access and misuse is essential.

Definition
Information Security (InfoSec) is the practice of protecting information and information systems from unauthorized access, use,
disclosure, modification, disruption, or destruction.

CIA Triad
The foundation of Information Security is the CIA Triad.

1. Confidentiality
Ensures that information is available only to authorized people.
Example: A bank allows only the account holder and authorized employees to access account information.

2. Integrity
Ensures that information remains accurate and is not improperly changed.
Example: Digital signatures can help verify that a document has not been modified.

3. Availability
Ensures that authorized users can access information when needed.
Example: Backup systems can keep services available after a hardware failure.

Other Principles
Authentication — Verifies the identity of a user. Example: Username, password, OTP, or biometric authentication.
Authorization — Determines what an authenticated user is allowed to access.
Non-repudiation — Ensures that a person cannot easily deny performing an action. Example: Digital signatures.

Importance in the Digital Era

1. Protection of personal information – Protects names, addresses, passwords, and financial details.
2. Prevention of financial loss – Helps prevent fraud and unauthorized transactions.
3. Protection against cyberattacks – Defends against malware, phishing, ransomware, and unauthorized access.
4. Business continuity – Security controls and backups help organizations continue operations.
5. Customer trust – Strong security improves customer confidence.
6. Legal and regulatory compliance – Organizations need to protect sensitive information according to applicable laws and regulations.
7. Protection of intellectual property – Protects source code, designs, research, and business strategies.

Example
Consider an online banking system. It uses:
Passwords for authentication.
OTP/MFA for additional verification.
Encryption for protecting data.
Access controls for authorization.
Backups for availability.
Logging for detecting suspicious activities.

Conclusion
Information Security is essential in the digital era because organizations depend heavily on digital information. Maintaining confidentiality,
integrity, and availability helps protect individuals, businesses, and governments from cyber threats.
 3. Compare the Indian legal framework for cybercrime with the global legal
framework.

Introduction
Cybercrime can cross national borders because attackers can operate from one country while targeting systems in another. Therefore,
countries have developed laws and international frameworks to address cybercrime.

Indian Legal Framework

The primary legislation addressing cyber activities in India is the Information Technology Act, 2000 (IT Act).
It provides legal recognition for:
Electronic records.
Electronic signatures.
Certain cyber offences.
Cyber-related penalties.
Intermediary responsibilities.
Cyber incident investigation and enforcement.

Other Indian laws can also apply to cyber offences, including provisions of general criminal law and data/privacy-related regulations.

Major Cybercrime Areas in India

Examples include: unauthorized access, data theft, identity theft, online cheating, cyberstalking, publishing prohibited content, and attacks
against computer resources.

Global Framework
Different countries have their own cybercrime laws.
United States: Computer Fraud and Abuse Act (CFAA).
European Union: GDPR and other cybersecurity-related regulations.
United Kingdom: Computer Misuse Act 1990.
International cooperation: Budapest Convention on Cybercrime provides a framework for cooperation among participating countries.

Comparison

Aspect India Global Framework

Main cyber law IT Act, 2000 Different laws depending on country

Electronic transactions Legally recognized Generally recognized through national laws

Cyber offences Covered under IT Act and other laws Covered by national cybercrime laws

Data protection Digital personal-data protection framework GDPR and other national/regional laws

International cooperation Uses international cooperation mechanisms Treaties and cross-border cooperation

Enforcement Indian law-enforcement and judicial system Depends on individual country

Jurisdiction Primarily Indian jurisdiction Cross-border jurisdiction can be complex

Major Challenges
1. Cybercrime is borderless.
2. Different countries have different laws.
3. Investigation may require international cooperation.
4. Evidence may be stored in another country.
5. Attackers may hide their identity using different technologies.
6. Cyber laws must continuously adapt to new technologies.

Example
Suppose an attacker located in Country A steals data from a company located in India and stores it on a server in Country B. Investigation
may require cooperation between all three countries.

Conclusion
India has developed a legal framework for dealing with cybercrime, mainly through the IT Act and related legislation. However, because
cybercrime is international, effective enforcement requires cooperation between countries, compatible laws, and efficient digital-evidence
sharing.
 4. Discuss the key provisions and limitations of the Information Technology Act,
2000.

Introduction
The Information Technology Act, 2000 is India’s major legislation dealing with electronic transactions and various cyber-related offences.
It was introduced to provide legal recognition to electronic records and electronic transactions and to address emerging cyber offences.

Key Provisions
1. Legal recognition of electronic records – Electronic records are given legal recognition under the Act.
2. Electronic signatures – The Act provides legal recognition to electronic/digital signatures used for authentication.
3. Cyber offences – The Act addresses several offences involving computer systems and electronic information, including unauthorized
access, damage to computer systems, identity-related offences, online cheating, and certain forms of privacy violations.
4. Intermediary provisions – The Act establishes responsibilities and conditions relating to intermediaries such as online platforms and
service providers.
5. Cyber incident response – India has mechanisms and institutions for responding to cybersecurity incidents, including CERT-In.
6. Extraterritorial application – Under certain circumstances, the Act can apply to offences involving computer resources located in India
even when the person committing the offence is outside India.
7. Penalties – The Act provides penalties and punishments for specified cyber offences.

Limitations
1. Rapid technological development – Technology changes faster than legislation. New technologies may create new forms of
cybercrime.
2. Cross-border cybercrime – Attackers can operate from foreign countries, making investigation and prosecution difficult.
3. Attribution problem – Identifying the actual attacker can be difficult because attackers may use compromised systems and
anonymization technologies.
4. Digital evidence challenges – Digital evidence can be easily modified, deleted, or hidden.
5. Enforcement challenges – Effective cybersecurity requires skilled investigators, forensic experts, and modern infrastructure.
6. Privacy concerns – Cybersecurity enforcement and data collection must be balanced with individual privacy rights.

Example
A cybercriminal may use a compromised computer in another country to attack an Indian organization. Even if the victim is in India,
identifying and prosecuting the actual attacker can be difficult.

Conclusion
The IT Act, 2000 established an important legal foundation for India’s digital environment and cybercrime regulation. However, changing
technology, cross-border attacks, attribution problems, and digital-evidence challenges require continuous development of cybersecurity
laws and enforcement capabilities.
 5. What is the 5P Model for Online Security? Explain each P with an example.

Introduction
The 5P model is a simple approach to understanding important areas of personal and organizational online security. It emphasizes security
awareness, responsible behavior, and protection of digital assets.
The five Ps: People, Processes, Policies, Products/Technology, Protection

1. People
People are one of the most important elements of cybersecurity. Employees and users can either strengthen or weaken security.
Example: An employee who recognizes a phishing email and reports it helps prevent an attack.

2. Processes
Processes are systematic procedures used to maintain security, such as incident response, backup, password-reset, and vulnerability
management procedures.
Example: An organization follows a defined process for reporting and investigating suspicious emails.

3. Policies
Security policies define rules that users and organizations must follow, such as password policy, acceptable-use policy, remote-access policy,
and data protection policy.
Example: A company policy requires employees to use MFA for accessing corporate systems.

4. Products/Technology
Technology provides technical protection against cyber threats, such as firewall, antivirus/EDR, SIEM, encryption, MFA, and IDS/IPS.
Example: A firewall blocks unauthorized network connections.

5. Protection
Protection refers to the overall measures used to reduce security risks and protect digital assets, such as regular backups, encryption,
access control, awareness training, and continuous monitoring.
Example: Regular backups help an organization recover after a ransomware attack.

Importance of the 5P Model

The model demonstrates that cybersecurity cannot depend only on technology. Effective security requires:
People + Processes + Policies + Technology + Protection

Conclusion
The 5P model provides a holistic approach to online security. Organizations can improve their cybersecurity by combining trained people,
proper processes, effective policies, appropriate technologies, and strong protection mechanisms.
UNIT – 2
 6. Explain how criminals plan and execute cyberattacks with a suitable example.

Introduction
Cyberattacks are generally not random activities. Attackers often follow a sequence of activities to identify targets, discover vulnerabilities,
gain access, and achieve their objectives.

Major Stages
1. Target Selection – The attacker selects a target such as an individual, company, government organization, or banking institution.
2. Reconnaissance – The attacker collects information such as domain names, IP addresses, email addresses, technologies used, and
publicly available employee information.
3. Scanning and Enumeration – The attacker identifies systems, services, ports, and potential weaknesses.
4. Initial Access – Common methods include phishing, exploiting vulnerabilities, stolen credentials, and malicious attachments.
5. Execution – After gaining access, malicious code or commands may be executed.
6. Persistence – Attackers may attempt to maintain access to the compromised system.
7. Privilege Escalation – The attacker attempts to obtain higher privileges, for example moving from a normal user account to
administrator-level access.
8. Lateral Movement – The attacker may move from one compromised system to another within the organization.
9. Data Collection – The attacker collects valuable information such as customer data, credentials, financial information, and intellectual
property.
10. Exfiltration or Impact – The attacker may steal data, disrupt systems, encrypt files, or damage infrastructure.

Example: Ransomware Attack

A simplified ransomware attack may occur as follows:
Phishing email → User opens malicious attachment → Malware executes → Attacker gains access → Attacker moves through
network → Files are encrypted → Ransom demand

Prevention
Organizations can reduce risk through MFA, security awareness training, patch management, endpoint security, network segmentation,
backups, SIEM monitoring, and incident response plans.

Conclusion
Cyberattacks generally involve multiple stages from reconnaissance to achieving the attacker’s objective. Understanding these stages helps
security teams detect attacks early and prevent significant damage.
 7. Define Social Engineering. Describe its classification with suitable examples.

Definition
Social engineering is the use of psychological manipulation and deception to convince people to reveal confidential information, perform
an action, or provide unauthorized access. Instead of attacking technology directly, attackers often target the human element.

Classification of Social Engineering

1. Phishing – Attackers send fake emails or messages to trick users. Example: An attacker sends a fake bank email asking the user to verify
their account.
2. Spear Phishing – A targeted phishing attack directed at a specific person or organization. Example: An attacker creates a personalized
email targeting an organization’s finance employee.
3. Whaling – Phishing attacks targeting senior executives or high-value individuals. Example: A fake email is sent to a company’s CEO
requesting an urgent financial transfer.
4. Vishing – Social engineering conducted through voice calls. Example: A caller pretends to be a bank representative and asks for
confidential information.
5. Smishing – Social engineering through SMS or text messages. Example: A message claims a parcel cannot be delivered and asks the
victim to click a fraudulent link.
6. Pretexting – The attacker creates a false story or identity to obtain information. Example: An attacker pretends to be an IT employee and
asks a user to provide account information.
7. Baiting – The attacker offers something attractive to trick the victim. Example: A malicious USB drive is presented as containing free
software.
8. Tailgating – An unauthorized person follows an authorized person into a restricted physical area. Example: An attacker follows an
employee through a secure office door.
9. Quid Pro Quo – The attacker offers a benefit in exchange for information or action. Example: Someone pretends to be technical support
and offers to “fix” a user’s computer in exchange for login information.

Prevention
Security awareness training, verifying unexpected requests, using MFA, avoiding suspicious links and attachments, not sharing passwords
or OTPs, and following organizational security policies.

Conclusion
Social engineering is dangerous because it exploits human trust and behavior. Awareness, verification, and strong authentication are
essential to reduce social-engineering attacks.
 8. How are botnets created in cyberspace? Explain their architecture and risks.

Introduction
A botnet is a network of compromised computers or devices that are controlled by an attacker, commonly called a botmaster. Each
infected device is called a bot or zombie.

How Botnets Are Created

1. Identification of vulnerable devices
2. Initial compromise
3. Installation of malicious software
4. Establishment of communication with the controller
5. Registration of infected devices
6. Remote control of the infected devices
7. Execution of malicious activities

Botnet Architecture
A simplified architecture is: Botmaster → Command and Control (C2) → Infected Devices/Bots
The C2 infrastructure allows the attacker to communicate with compromised devices and coordinate activities.
Centralized Architecture – Bots communicate with a central command-and-control server. Advantage for attacker: Easy management.
Weakness: Taking down the central server can disrupt the botnet.
Peer-to-Peer Architecture – Bots communicate with other bots without depending completely on a single central server. Advantage: More
difficult to disrupt.

Uses of Botnets
DDoS attacks, spam distribution, credential theft, malware distribution, fraud, cryptocurrency-related abuse, and proxying malicious traffic.

Risks
1. DDoS Attacks – Large numbers of compromised devices can overwhelm a target server.
2. Data Theft – Compromised devices may be used to steal sensitive information.
3. Financial Loss – Organizations may suffer downtime and recovery costs.
4. Privacy Loss – Personal information can be collected from infected devices.
5. Network Disruption – Botnet traffic can consume network resources.

Prevention
Regular software updates, strong passwords, MFA, endpoint protection, network monitoring, blocking suspicious connections, and security
awareness.

Conclusion
Botnets transform compromised devices into a remotely controlled network. Their distributed nature makes them a serious cybersecurity
threat, particularly for DDoS attacks, data theft, and malware distribution.
 9. Write a short note on attack vectors and how they affect the cyber state.

Introduction
An attack vector is a method, path, or technique used by an attacker to gain unauthorized access to a system, network, application, or
organization.

Common Attack Vectors

1. Phishing – Deceptive emails or messages used to obtain credentials or deliver malware.
2. Malware – Malicious software such as ransomware, spyware, and trojans.
3. Weak Passwords – Weak or reused passwords can allow unauthorized access.
4. Software Vulnerabilities – Unpatched vulnerabilities can provide an entry point.
5. Insider Threats – Employees or contractors may intentionally or accidentally cause security incidents.
6. Supply Chain Attacks – Attackers compromise a third-party vendor or software component to reach the final target.
7. Web Application Attacks – Vulnerabilities in web applications can expose sensitive information or allow unauthorized actions.
8. Social Engineering – Attackers manipulate users into revealing information or performing unsafe actions.

Impact on Cyber State

The term cyber state refers to a nation’s digital infrastructure, government systems, critical infrastructure, and overall cyberspace. Attack
vectors can affect government services, banking systems, power and energy infrastructure, telecommunications, healthcare, defense
systems, transportation, and national databases.

Major Effects
1. Economic Loss – Cyberattacks can cause financial losses and business disruption.
2. Service Disruption – Critical digital services may become unavailable.
3. Data Theft – Sensitive government or citizen information may be stolen.
4. National Security Risks – Attacks against critical infrastructure can create serious national-security concerns.
5. Loss of Public Trust – Repeated attacks can reduce public confidence in digital services.

Example
A cyberattack against a country’s critical infrastructure could disrupt essential services and create economic and social consequences.

Protection
National cybersecurity strategies, critical infrastructure protection, threat intelligence, security monitoring, incident response, employee
training, and international cooperation.

Conclusion
Attack vectors are the different paths through which cyber threats reach their targets. Protecting national cyberspace requires identifying
these vectors and implementing multiple layers of defense.
 10. Explain how cloud computing has changed the landscape of cybercrimes.

Introduction
Cloud computing provides computing resources such as servers, storage, databases, and applications through networks, often on demand.
Cloud technology has transformed how organizations store and process data, but it has also introduced new cybersecurity risks.

Changes Introduced by Cloud Computing

1. Data Stored in the Cloud – Organizations can store large amounts of data remotely. Risk: Misconfigured storage can expose sensitive
information.
2. Remote Access – Employees can access cloud resources from different locations. Risk: Stolen credentials can provide unauthorized
access.
3. Shared Infrastructure – Cloud providers often use shared infrastructure. Risk: Misconfiguration or weaknesses can affect multiple
resources.
4. Increased Attack Surface – Cloud environments may include APIs, virtual machines, containers, storage services, and identity systems,
each a potential attack surface if improperly secured.
5. Account Takeover – Attackers may target cloud accounts using phishing, stolen passwords, credential stuffing, and session theft.
6. Data Breaches – Poor access controls or configuration errors can expose sensitive information.
7. Denial-of-Service Attacks – Attackers may overwhelm cloud-hosted services, causing service disruption.
8. Insider Threats – Cloud administrators and employees with excessive privileges can potentially misuse access.

Common Cloud Cybercrimes

Data breaches, account hijacking, ransomware, cryptojacking, API attacks, misconfiguration-based exposure, and malware distribution.

Security Measures
1. Multi-factor authentication
2. Strong identity and access management
3. Encryption
4. Regular security monitoring
5. Least-privilege access
6. Secure API configuration
7. Regular backups
8. Cloud security assessments
9. Logging and SIEM monitoring
10. Employee awareness training

Example
Suppose an organization stores customer information in a cloud storage service but accidentally makes the storage publicly accessible.
Attackers could discover and access the exposed information.

Advantages Despite Risks

Cloud computing also provides security benefits such as centralized security management, scalable security controls, automated updates,
security monitoring, and backup and disaster recovery capabilities.

Conclusion
Cloud computing has changed cybercrime by introducing new targets such as cloud accounts, APIs, storage systems, and virtual
infrastructure. However, with proper identity management, encryption, monitoring, access control, and secure configuration, organizations
can significantly reduce cloud-related cyber risks.