Cyber Security

Introduction

Communication between computers is a complex process. To simplify it, the International Organization for Standardization (ISO) developed the OSI (Open Systems Interconnection) reference model, which divides network communication into seven layers. Each layer performs a specific function and provides services to the layer above it.

Diagram:

flowchart LR
    subgraph S["Sender"]
        direction TB
        S7["7 Application"] --- S6["6 Presentation"] --- S5["5 Session"] --- S4["4 Transport"] --- S3["3 Network"] --- S2["2 Data Link"] --- S1["1 Physical"]
    end
    subgraph R["Receiver"]
        direction TB
        R7["7 Application"] --- R6["6 Presentation"] --- R5["5 Session"] --- R4["4 Transport"] --- R3["3 Network"] --- R2["2 Data Link"] --- R1["1 Physical"]
    end
    S7 -. data .- R7
    S4 -. segments .- R4
    S3 -. packets .- R3
    S2 -. frames .- R2
    S1 == "bits over the transmission medium" === R1

Layers of the OSI Model

1. Physical layer: Transmits raw bits over the transmission medium (cables, signals). Devices: hubs, repeaters. Security issue: wiretapping.
2. Data Link layer: Provides physical (MAC) addressing, framing and error detection. Devices: switches, bridges. Security issues: MAC spoofing, ARP poisoning.
3. Network layer: Provides logical (IP) addressing and routing of packets. Device: router. Protocols: IP, ICMP. Security issue: IP spoofing.
4. Transport layer: Provides end-to-end delivery, segmentation, flow control and error control. Protocols: TCP, UDP. Security issue: SYN flood.
5. Session layer: Establishes, manages and terminates sessions between applications. Security issue: session hijacking.
6. Presentation layer: Handles data translation, encryption and compression. Examples: SSL/TLS encryption, JPEG. Security issue: weak encryption.
7. Application layer: Provides the interface for user applications. Protocols: HTTP, FTP, SMTP, DNS. Security issues: phishing, SQL injection.

Summary Table

Advantages of the OSI model:

• Divides a complex process into simple layers.
• Makes troubleshooting and teaching easier.
• Helps locate where security controls are needed.

Memory aid (top to bottom): "All People Seem To Need Data Processing". (Bottom to top: "Please Do Not Throw Sausage Pizza Away".)

Networking basics: A computer network connects devices to share data and resources using protocols. LANs cover a local area; WANs connect larger geographical areas. Understanding layers, addressing, routing and protocols helps locate risks and choose security controls.

Introduction

While the OSI model is a theoretical reference, the TCP/IP model is the practical model used by the Internet. It was developed by the US Department of Defense (DARPA) and has four layers (some books show five, splitting the lowest layer into Data Link and Physical).

Diagram:

Layers of the TCP/IP Model

1. Network Access (Link) layer: Handles physical transmission and MAC addressing (Ethernet, Wi-Fi). Corresponds to the OSI Physical and Data Link layers.
2. Internet layer: Handles IP addressing and routing of packets (IP, ICMP, ARP). Corresponds to the OSI Network layer.
3. Transport layer: Provides end-to-end communication using TCP (reliable, connection-oriented) and UDP (fast, connectionless).
4. Application layer: Provides services to users (HTTP/HTTPS, FTP, SMTP, DNS, SSH). Combines the OSI Application, Presentation and Session layers.

Comparison of OSI and TCP/IP

Example: When a user opens a website, HTTP works at the Application layer, TCP at the Transport layer, IP at the Internet layer and Ethernet or Wi-Fi at the Network Access layer.

TCP versus UDP: TCP is connection-oriented and provides ordered, reliable delivery with flow and congestion control. UDP sends datagrams without these built-in guarantees and has lower protocol overhead. Application requirements determine the choice.

TCP connection establishment: Client → server: SYN; server → client: SYN-ACK; client → server: ACK. The exchange synchronises initial sequence numbers and establishes connection state. It does not itself encrypt traffic or authenticate identities.

Introduction

Data travels between devices through a physical path. Transmission media are the physical paths through which data travels from sender to receiver. The choice of medium affects speed, distance, cost and security.

Diagram:

flowchart TD
    T["Transmission media"] --> G["Guided (wired)"]
    T --> U["Unguided (wireless)"]
    G --> G1["Twisted pair"]
    G --> G2["Coaxial cable"]
    G --> G3["Optical fibre"]
    U --> U1["Radio waves"]
    U --> U2["Microwave<br/>(incl. satellite)"]
    U --> U3["Infrared"]

1. Guided (Wired) Media

1. Twisted pair cable (UTP/STP): Pairs of copper wires twisted together to reduce interference; used in LANs (Cat5e/Cat6). Speed up to 1–10 Gbps over about 100 m. It can be tapped.
2. Coaxial cable: A central copper core with metal shielding; used in cable TV and older LANs. Moderately secure.
3. Optical fibre: Transmits data as light pulses through thin glass fibres. Very high speed and long distance. It is the most secure medium because it is very hard to tap and is not affected by electromagnetic interference.

2. Unguided (Wireless) Media

1. Radio waves: Used in Wi-Fi, Bluetooth and mobile networks. Easily intercepted, so encryption (WPA2/WPA3) is needed.
2. Microwave and satellite: Line-of-sight, long-distance communication. Signals can be intercepted.
3. Infrared: Very short range, line of sight (TV remote). Hard to intercept from a distance.

Comparison Table

Case Study – Choosing Media for a Bank Branch

A bank connects its branch to the head office using optical fibre because it is fast and very hard to tap. Inside the branch, staff PCs use twisted pair cables. Customer Wi-Fi is kept on a separate network with WPA3 encryption, so attackers using the wireless network cannot reach the bank's internal systems.

Introduction

Networks are built using hardware devices that connect computers and control the flow of data. Network devices operate at different OSI layers, and some of them also play an important security role by filtering or isolating traffic.

Network Devices

1. Hub (Layer 1): Broadcasts incoming data to all ports. It is insecure because every connected device can see all traffic (sniffing).
2. Repeater (Layer 1): Regenerates and amplifies weak signals to extend distance. It has no security function.
3. Switch (Layer 2): Sends frames only to the port of the destination MAC address. It reduces sniffing and supports VLANs and port security.
4. Bridge (Layer 2): Connects two LAN segments and filters traffic using MAC addresses.
5. Router (Layer 3): Forwards packets between different networks using IP addresses. It supports access control lists (ACLs) and NAT.
6. Modem (Layer 1): Converts digital signals to analog and back for ISP lines.
7. Gateway (up to Layer 7): Connects networks that use different protocols and can filter traffic.
8. Access point (Layer 2): Connects wireless devices to a wired LAN, with Wi-Fi encryption and authentication.
9. Firewall (Layers 3–7): Filters traffic based on rules and is the main perimeter defence.

Hub vs Switch vs Router

Case Study – College Lab

A college replaced its old hubs with switches after students used sniffing tools to capture others' login data. Each department was placed in a separate VLAN, and a router with ACLs and a firewall controlled access between the student network, the faculty network and the Internet. As a result, sniffing attacks stopped and unauthorised access to faculty systems was blocked.

Given: Network = 192.168.1.0/26 (class C, default /24).

To find: subnet mask, number of subnets, hosts per subnet and address ranges.

Formulae: Subnets = 2ⁿ; Hosts per subnet = 2ʰ − 2; Block size = 256 − last octet of mask.

Solution:

Step 1: Subnet mask. /26 = 26 ones → 11111111.11111111.11111111.11000000 = 255.255.255.192

Step 2: Borrowed bits. n = 26 − 24 = 2.

• Number of subnets = 2² = 4
• Host bits h = 32 − 26 = 6, so hosts per subnet = 2⁶ − 2 = 62
• Block size = 256 − 192 = 64

Step 3: Subnet ranges.

Answer: Mask = 255.255.255.192; 4 subnets; 62 hosts per subnet; ranges as shown in the table.

Second example: Find the network and broadcast address of 192.168.10.75/27.

1. /27 → mask 255.255.255.224; block size = 256 − 224 = 32.
2. Multiples of 32: 0, 32, 64, 96 … 75 lies between 64 and 95.
3. Network address = 192.168.10.64; Broadcast = 192.168.10.95; usable hosts = .65 to .94 (30 hosts).

Case study: A company with 4 departments (HR, Accounts, IT, Sales), each with fewer than 60 PCs, uses the four /26 subnets above. A firewall rule blocks Sales from accessing the Accounts subnet, so a virus in Sales cannot spread directly to financial systems.

Addressing and NAT: An IP address identifies a network interface; a subnet mask or prefix divides network and host portions. The numerical below assumes a /24 parent split into /26 subnets. NAT translates addresses: static NAT uses fixed mappings, dynamic NAT uses a pool, and PAT lets many private addresses share a public address using ports. NAT conserves IPv4 addresses; it is not a substitute for a firewall.

Definition: A protocol is a set of rules for communication, and a port number identifies the specific service on a device.

Example: When you open https://example.com, DNS (port 53) finds the IP address and HTTPS (port 443) loads the page securely.

Memory aid: "22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS" – say it aloud a few times.

Introduction

Every security measure aims to protect information in some way. The CIA triad is the core model of information security. It consists of three principles – Confidentiality, Integrity and Availability – which together define what it means for information to be secure.

Diagram:

flowchart TD
    C["Confidentiality<br/>only authorised access"] --- I["Integrity<br/>accurate, unaltered"]
    I --- A["Availability<br/>accessible when needed"]
    A --- C

1. Confidentiality

Confidentiality means that information is accessible only to authorised people.

Threats: data theft, sniffing, shoulder surfing.

Controls: encryption, passwords, access control, multi-factor authentication.

2. Integrity

Integrity means that information is accurate, complete and not altered without authorisation.

Threats: tampering, man-in-the-middle attacks, malware.

Controls: hashing, digital signatures, checksums, version control.

3. Availability

Availability means that information and systems are accessible to authorised users when needed.

Threats: DoS / DDoS attacks, hardware failure, ransomware.

Controls: backups, redundancy, DDoS protection, UPS.

Summary Table

Case Study – Online Banking

1. Confidentiality: Customer account details are encrypted with HTTPS (TLS), and login requires a password and an OTP.
2. Integrity: Transaction messages are protected with hashes and digital signatures, so an attacker cannot change ₹1,000 to ₹10,000 in transit.
3. Availability: The bank uses redundant servers and DDoS protection, so customers can use the service 24×7.

If any one principle fails – leaked data, altered transactions or the website going down – security is broken.

Memory aid: Can I Access? – Confidentiality, Integrity, Availability.

Definition and need: Cyber security protects systems, networks and data against unauthorised access, disruption or misuse. Its goals include confidentiality, integrity and availability, supported by authentication, accountability and appropriate access control.

Introduction

Attackers usually follow a planned sequence of steps to break into a system. Understanding these phases of hacking helps security professionals and ethical hackers detect and stop attacks at each stage. The five phases are Reconnaissance, Scanning, Gaining Access, Maintaining Access and Covering Tracks.

Diagram:

flowchart TD
    A["1. Reconnaissance<br/>gather information"] --> B["2. Scanning<br/>find open ports, weaknesses"]
    B --> C["3. Gaining Access<br/>exploit a weakness"]
    C --> D["4. Maintaining Access<br/>install backdoor"]
    D --> E["5. Covering Tracks<br/>delete evidence"]

1. Reconnaissance (Footprinting)

The attacker collects information about the target before attacking.

1. Passive reconnaissance: no direct contact – Google search, social media, WHOIS lookup, company website.
2. Active reconnaissance: direct contact – pinging systems, calling employees.

Defence: limit public information and train staff.

2. Scanning

The attacker uses tools to find live hosts, open ports, running services and vulnerabilities. Types include port scanning, network scanning and vulnerability scanning (tools such as Nmap and Nessus).

Defence: close unused ports, use firewalls and IDS.

3. Gaining Access

The attacker exploits a vulnerability to enter the system, using methods such as password cracking, SQL injection, buffer overflow or phishing.

Defence: regular patching, strong passwords, MFA and input validation.

4. Maintaining Access

The attacker keeps access for future use by installing backdoors, rootkits or Trojans, or by creating hidden accounts.

Defence: antivirus / EDR and monitoring for unknown accounts and processes.

5. Covering Tracks

The attacker hides evidence by deleting or modifying log files, hiding files, or using encryption and tunnelling.

Defence: central log servers and file integrity monitoring.

Example: An attacker finds an employee's email on LinkedIn (reconnaissance), scans the company server (scanning), sends a phishing email to steal a password (gaining access), installs a backdoor (maintaining access) and deletes logs (covering tracks).

Memory aid: "Really Smart Geeks Maintain Cover" – Reconnaissance, Scanning, Gaining access, Maintaining access, Covering tracks.

Authorisation and hacker types: Ethical hacking is testing with explicit permission, a defined scope and reporting obligations. White-hat work is authorised; black-hat activity is malicious; grey-hat activity may lack permission even when harm is not intended. The syllabus's phases describe an attack lifecycle. In an authorised assessment, document findings and preserve evidence; do not treat covering tracks as an instruction to erase audit records.

Introduction

Cryptography protects information by converting it into an unreadable form. Depending on how keys are used, cryptography is classified into three main types: Symmetric key cryptography, Asymmetric key cryptography and Hash functions.

1. Symmetric Key Cryptography (Secret Key)

In symmetric cryptography, the same key is used for both encryption and decryption.

flowchart LR
    P1["Plaintext"] --> E["Encrypt with Key K"] --> C["Ciphertext"] --> D["Decrypt with the SAME Key K"] --> P2["Plaintext"]

Features:

1. Fast and suitable for large amounts of data.
2. The key must be shared secretly – the key distribution problem.

Algorithms: DES, 3DES, AES, Blowfish.

Example: Encrypting files on a laptop's hard disk using AES.

2. Asymmetric Key Cryptography (Public Key)

In asymmetric cryptography, a pair of keys is used: a public key (shared with everyone) and a private key (kept secret). Data encrypted with the receiver's public key can only be decrypted with the receiver's private key.

flowchart LR
    subgraph Sender
        P1["Plaintext"] --> E["Encrypt with receiver's PUBLIC key"]
    end
    E --> C["Ciphertext"]
    subgraph Receiver
        D["Decrypt with receiver's PRIVATE key"] --> P2["Plaintext"]
    end
    C --> D

Features:

1. Solves the key distribution problem.
2. Supports digital signatures and non-repudiation.
3. Slower than symmetric cryptography.

Algorithms: RSA, ECC, Diffie–Hellman (key exchange).

Example: HTTPS websites use the server's public key during the TLS handshake.

3. Hash Functions

A hash function is a one-way function that produces a fixed-length digest from any input. It uses no key and cannot be reversed.

Uses: checking data integrity, storing passwords securely, digital signatures.

Algorithms: SHA-256; MD5 (now considered weak).

Example: A downloaded file's SHA-256 hash is compared with the website's published hash to confirm it was not altered.

Comparison Table

Introduction

RSA (named after Rivest, Shamir and Adleman, 1977) is the most widely used asymmetric (public key) encryption algorithm. It uses a public key for encryption and a private key for decryption. Its security depends on the difficulty of factoring a very large number into its two prime factors.

1. Key Generation

1. Choose two large prime numbers, p and q.
2. Compute n = p × q.
3. Compute φ(n) = (p − 1)(q − 1).
4. Choose e such that 1 < e < φ(n) and gcd(e, φ(n)) = 1.
5. Compute d such that (d × e) mod φ(n) = 1 (d is the modular inverse of e).
6. Public key = (e, n); Private key = (d, n).

2. Encryption and Decryption

3. Worked Example 1: p = 3, q = 11, message M = 4.

1. n = 3 × 11 = 33
2. φ(n) = 2 × 10 = 20
3. Choose e = 3 (gcd(3, 20) = 1)
4. Find d: 3 × d mod 20 = 1, so d = 7 (because 3 × 7 = 21 = 1 × 20 + 1)
5. Public key = (3, 33); Private key = (7, 33)
6. Encryption: C = 4³ mod 33 = 64 mod 33 = 31
7. Decryption: M = 31⁷ mod 33 = 4 ✓

Shortcut for the decryption step: 31 ≡ −2 (mod 33). (−2)⁷ = −128. −128 mod 33 = −128 + 132 = 4 ✓

4. Worked Example 2: p = 5, q = 11, M = 9.

1. n = 55, φ(n) = 4 × 10 = 40, e = 3, d = 27 (3 × 27 = 81 = 2 × 40 + 1)
2. C = 9³ mod 55 = 729 mod 55 = 14 (55 × 13 = 715; 729 − 715 = 14)
3. Decryption with d = 27 gives back M = 9.

Applications:

1. Digital signatures.
2. Secure key exchange.
3. SSL/TLS certificates for HTTPS.
4. Secure email.

Advantages:

• Solves the key distribution problem.
• Provides authentication and non-repudiation through digital signatures.
• Very secure when large primes (hundreds of digits) are used.

Limitations:

• Slow for encrypting large amounts of data.
• Requires long keys (2048 bits or more).
• Could be broken by future large quantum computers.

Introduction

Digital content such as images, music and videos can be copied easily. Digital watermarking is the technique of embedding hidden or visible information (a watermark) into digital content to prove ownership or detect tampering. Unlike encryption, the content remains usable.

1. Types of Digital Watermarking

1. Visible watermark: clearly seen, such as a logo on a photo or "SAMPLE" printed across a document.
2. Invisible watermark: hidden in the data and detected only by software.
3. Robust watermark: survives editing, compression and resizing; used for copyright protection.
4. Fragile watermark: breaks when the content is changed; used to detect tampering (integrity).

2. Uses of Digital Watermarking

1. Copyright protection: proving who owns the content.
2. Proof of ownership in legal disputes.
3. Tracking illegal copies (fingerprinting – a unique mark for each buyer).
4. Authentication of documents and certificates.
5. Broadcast monitoring of advertisements and programmes.

3. Comparison with Cryptography

Advantages:

• Protects intellectual property.
• Helps trace the source of leaked content.
• Does not affect normal use of the content.

Limitations:

• Visible watermarks can be cropped or edited out.
• Strong editing may remove weak invisible watermarks.

Example: A photographer embeds an invisible watermark in images sold online; if a copy appears on another website, the watermark proves ownership.

Introduction

Security cannot be achieved by technology alone; it needs a managed, continuous process. An ISMS (Information Security Management System) is a systematic, documented framework of policies, procedures and controls for managing information security risks. The international standard for an ISMS is ISO/IEC 27001, and it works through the PDCA (Plan–Do–Check–Act) cycle.

Diagram – PDCA Cycle:

flowchart LR
    P["1. PLAN<br/>scope, policy, risk assessment,<br/>choose controls"] --> D["2. DO<br/>implement controls,<br/>train staff"]
    D --> C["3. CHECK<br/>monitor, measure, internal audit,<br/>management review"]
    C --> A["4. ACT<br/>correct problems,<br/>improve the ISMS"]
    A -- "continuous improvement" --> P

Working Procedure of an ISMS

1. Plan (Establish the ISMS)

1. Define the scope – which departments and systems are covered.
2. Write the information security policy.
3. Identify assets, threats and vulnerabilities, and perform risk assessment.
4. Select suitable controls (from ISO 27001 Annex A) and prepare a Statement of Applicability.

2. Do (Implement and Operate)

1. Implement the selected controls – access control, encryption, backups, firewalls.
2. Conduct security awareness training for employees.
3. Document procedures.

3. Check (Monitor and Review)

1. Monitor logs and security incidents and measure how well the controls work.
2. Conduct internal audits and management reviews.

4. Act (Maintain and Improve)

1. Take corrective and preventive actions for any problems found.
2. Update policies and controls; the cycle then repeats.

Benefits of an ISMS:

• Systematic and consistent protection of information.
• Compliance with laws and regulations.
• Increased customer trust and ISO 27001 certification.
• Fewer security incidents through continuous improvement.

Example: An IT company gets ISO 27001 certification by defining its ISMS scope, assessing risks, implementing controls, auditing them every six months and improving weak areas.

ISM and ISMS: Information Security Management coordinates people, processes and technology to manage information risk. An ISMS is the organised system of policies, responsibilities, risk assessment, controls, review and continual improvement. It supports confidentiality, integrity, availability, accountability and business continuity.

Introduction

Employees need clear rules about how to use and protect information. A security policy is a formal written document, approved by top management, that states the organisation's rules, responsibilities and expected behaviour for protecting its information assets. It is the foundation of all security measures.

1. Types of Security Policies

1. Acceptable Use Policy (AUP): rules for proper use of computers, the Internet and email by employees.
2. Password policy: rules for password length, complexity, change frequency and not sharing passwords.
3. Access control policy: who can access what, based on least privilege; management of user accounts.
4. Email and Internet policy: rules for attachments, website use and social media.
5. Backup policy: what to back up, how often, where to store it and how to test restoration.
6. Remote access / BYOD policy: rules for VPN use and personal devices at work.
7. Incident response policy: steps to report and handle security incidents.
8. Data classification policy: labels such as public, internal, confidential and secret.

2. Contents of a Security Policy

1. Purpose and scope of the policy.
2. Roles and responsibilities of management, IT staff and employees.
3. Policy statements – the actual rules.
4. Compliance requirements and penalties for violation.
5. Review date and approval signature.

3. Characteristics of a Good Security Policy

1. Clear, simple and easy to understand.
2. Enforceable and practical.
3. Supported by top management.
4. Communicated to all employees.
5. Reviewed and updated regularly.

Example policy statement: "Passwords must be at least 12 characters long, include letters, numbers and symbols, and must never be shared."

Introduction

No organisation can remove every security risk, and resources are limited. Risk management is the process of identifying, assessing and controlling risks to information assets so that they are reduced to an acceptable level, with the most serious risks handled first.

Diagram:

flowchart TD
    A["1. Identify<br/>assets, threats, vulnerabilities"] --> B["2. Analyse<br/>likelihood × impact"]
    B --> C["3. Evaluate<br/>rank and prioritise"]
    C --> D["4. Treat<br/>avoid, reduce, transfer, accept"]
    D --> E["5. Monitor and review"]
    E -. continuous .-> A

Steps of Risk Management

1. Risk identification: List the assets, the threats they face and their vulnerabilities.
2. Risk analysis: Estimate the likelihood and impact of each risk – qualitatively (High / Medium / Low) or quantitatively (expected loss in rupees).
3. Risk evaluation: Rank the risks and decide which need action first.
4. Risk treatment: Choose one of four options:
   • Avoid: stop the risky activity (for example, do not store card numbers).
   • Reduce / Mitigate: apply controls such as firewalls, patching and training.
   • Transfer / Share: move the risk to another party through cyber insurance or outsourcing.
   • Accept: accept low risks when control costs more than the possible loss.
5. Monitoring and review: Risks change over time, so they must be reviewed regularly.

Risk Matrix

Example: An unpatched web server (vulnerability) facing ransomware (threat) has High likelihood and High impact, so the risk is Critical. It is treated by reducing the risk – patching immediately and keeping offline backups.

Memory aid for treatment: "ART-A" – Avoid, Reduce, Transfer, Accept.

Terms: An asset is something valuable; a threat is a potential cause of harm; a vulnerability is a weakness; risk concerns the likelihood and consequences of harm when a threat exploits a weakness.

Introduction

Having security policies and controls is not enough; they must be checked regularly. An information security audit is a systematic, independent evaluation of an organisation's security policies, controls and systems to check whether they are effective and compliant with standards (such as ISO 27001) and laws.

1. Objectives of a Security Audit

1. Identify weaknesses and vulnerabilities.
2. Check compliance with policies, standards and laws.
3. Verify that security controls are working properly.
4. Recommend improvements.

2. Types of Security Audit

1. Internal audit: carried out by the organisation's own audit team.
2. External audit: carried out by an independent third party, such as for ISO 27001 certification (in India, CERT-In empanelled auditors).
3. Compliance audit: checks adherence to laws and standards.
4. Technical audit: includes vulnerability assessment and penetration testing (VAPT) and configuration review.

3. Audit Process

1. Planning: define the scope, objectives, criteria and schedule.
2. Information gathering: review policies, network diagrams and past incidents.
3. Fieldwork / testing: conduct interviews, check configurations, access rights and logs, and run vulnerability scans.
4. Analysis: compare findings with standards and rate the risks.
5. Reporting: prepare an audit report with findings, risk levels and recommendations.
6. Follow-up: check that the reported issues have been fixed.

Case Study – Audit of a College ERP System

1. Scope: student records and fee payment module.
2. Findings: ex-staff accounts still active; the admin password shared by three people; backups never tested; the server missing security patches.
3. Risks: unauthorised changes to marks, data loss and ransomware.
4. Recommendations: remove accounts within 24 hours of staff leaving; individual admin accounts with MFA; monthly backup restore tests; a monthly patch schedule.
5. Follow-up after 3 months: all issues were closed except patching, which was given a new deadline.

Benefits of Auditing:

• Early detection of security weaknesses.
• Proof of compliance for regulators and customers.
• Improved trust and continuous improvement (the "Check" step of PDCA).

Introduction

As more services move online, computer systems face constant attacks. A cyber attack is any deliberate attempt to gain unauthorised access to, damage, disrupt or steal from computer systems, networks or data. Based on how the attacker behaves, attacks are classified as passive attacks and active attacks.

1. Passive Attack

In a passive attack, the attacker only observes or monitors communication without changing it. The aim is to obtain information. It threatens confidentiality.

Types:

1. Eavesdropping / sniffing: capturing network traffic to read data.
2. Traffic analysis: studying communication patterns (who talks to whom and how often), even when data is encrypted.

2. Active Attack

In an active attack, the attacker modifies, disrupts or creates data or system activity. It threatens integrity and availability.

Types:

1. Masquerade (spoofing): pretending to be another user or system.
2. Replay: capturing a valid message and resending it later.
3. Modification of messages: altering data in transit (man-in-the-middle).
4. Denial of Service: making services unavailable to genuine users.

Diagram:

flowchart LR
    subgraph Passive["Passive attack"]
        direction LR
        A1["A"] --> B1["B"]
        X1["Attacker<br/>only listens"] -. copies traffic .- A1
    end
    subgraph Active["Active attack"]
        direction LR
        A2["A"] --> X2["Attacker<br/>changes / blocks / fakes data"] --> B2["B"]
    end

Comparison Table

Example: Capturing passwords on public Wi-Fi with a sniffing tool is a passive attack; changing the amount in an online payment request is an active attack.

Additional examples: Man-in-the-middle attacks intercept or manipulate communications; spoofing impersonates a trusted identity or address; password attacks attempt to obtain or guess credentials. Controls include authenticated encryption, appropriate access controls, strong unique passwords, MFA and monitoring.

Introduction

Many cyber attacks are carried out using harmful programs. Malware (malicious software) is any software intentionally designed to harm, exploit or gain unauthorised access to a computer system. Malware spreads through email attachments, infected downloads, USB drives and malicious websites.

Types of Malware

1. Virus: Attaches itself to a host file or program and runs when the file is opened. It needs user action to spread. Effect: corrupts or deletes files.
2. Worm: A standalone program that replicates itself across networks without user action. Effect: slows networks and spreads rapidly (WannaCry spread as a worm).
3. Trojan horse: Appears to be useful software but hides malicious code. Effect: opens a backdoor for attackers.
4. Ransomware: Encrypts the victim's files and demands payment (often in cryptocurrency) for the decryption key.
5. Spyware: Secretly collects user information such as browsing habits and passwords.
6. Keylogger: Records every keystroke to capture passwords and card details.
7. Adware: Displays unwanted advertisements and slows the system.
8. Rootkit: Hides deep inside the operating system to give hidden administrator control and conceal other malware.
9. Botnet: A network of infected "zombie" computers controlled remotely, used for DDoS attacks and spam.
10. Logic bomb: Malicious code that activates when a condition is met, such as a specific date.

Virus vs Worm vs Trojan

Prevention:

1. Use updated antivirus / EDR software.
2. Apply security patches regularly.
3. Avoid pirated software and unknown attachments.
4. Keep offline backups (especially against ransomware).
5. Use least-privilege (non-admin) accounts.

Example: An employee opens a fake invoice attachment, which installs ransomware and encrypts the company's shared files.

Memory aid: Virus = Visitor that needs a host; Worm = Wanders alone; Trojan = Trick gift.

Introduction

Attackers often find it easier to trick people than to break technology. Phishing is a social engineering attack in which attackers send fake messages (email, SMS or calls) that appear to come from a trusted source in order to trick victims into revealing passwords, OTPs or card details, or into installing malware.

1. Types of Phishing

1. Email phishing: mass fake emails, such as "Your account will be blocked – verify now".
2. Spear phishing: targeted at a specific person or organisation using personal details.
3. Whaling: spear phishing aimed at top executives such as the CEO or CFO.
4. Smishing: phishing through SMS, such as "KYC pending, click this link".
5. Vishing: voice phishing over phone calls, such as a fake bank officer asking for an OTP.
6. Clone phishing: a copy of a genuine email in which the link is replaced with a malicious one.
7. Pharming: redirecting users to a fake website by poisoning DNS.

2. Signs of Phishing

1. Urgent or threatening language.
2. Misspelt or mismatched sender addresses and URLs.
3. Requests for OTP, PIN or password.
4. Unexpected attachments or links.
5. Poor grammar and offers that are too good to be true.

3. Prevention

1. Never share OTPs, PINs or passwords – banks never ask for them.
2. Check the URL and sender carefully, and type website addresses yourself.
3. Use MFA, spam filters and email authentication (SPF, DKIM, DMARC).
4. Provide security awareness training and phishing simulations.
5. Report suspicious messages (in India: cybercrime.gov.in or helpline 1930).

Example: A student receives an SMS saying her electricity will be cut tonight unless she pays through a link; the link leads to a fake payment page that steals card details.

Social engineering and insider threats: Social engineering manipulates people through pretexting, baiting, impersonation, tailgating or phishing. Verify unusual requests through a trusted independent channel, limit access and train users. Insiders may be malicious, negligent or have compromised accounts. Reduce risk with least privilege, separation of duties, access reviews, prompt offboarding and monitored activity.

Introduction

Some attacks aim not to steal data but to stop a service from working. A Denial of Service (DoS) attack tries to make a server, website or network unavailable to genuine users by flooding it with traffic or exploiting a weakness. A Distributed DoS (DDoS) attack uses many compromised computers (a botnet) to attack the target at the same time. Both attack availability.

Diagram:

flowchart TD
    subgraph DoS["DoS – one source"]
        A1["Attacker"] ==> S1["Server"]
    end
    subgraph DDoS["DDoS – many sources"]
        A2["Attacker"] -- commands --> B1["Bot 1"] & B2["Bot 2"] & B3["Bot 3"] & B4["Bot 4"] & B5["Bot 5"]
        B1 & B2 & B3 & B4 & B5 ==> T["Target server<br/>(overloaded)"]
    end

1. Common Types of DoS / DDoS Attacks

1. SYN flood: many SYN requests are sent without completing the TCP three-way handshake.
2. Ping (ICMP) flood / Ping of Death: overwhelming the target with ping packets or oversized packets.
3. UDP flood: sending large numbers of UDP packets to random ports.
4. HTTP flood: sending huge numbers of web requests (application layer attack).
5. Amplification attack (such as DNS amplification): small requests trigger large responses that are directed at the victim.

2. DoS vs DDoS

3. Prevention and Mitigation

1. Firewalls and IPS rules to block malicious traffic.
2. Rate limiting and SYN cookies.
3. Load balancers and extra bandwidth.
4. DDoS protection services and CDNs.
5. Patching IoT devices and changing default passwords so they do not become bots.

Example: During a festival sale, an online shopping site is flooded with fake traffic from thousands of infected devices, making it unavailable to real customers.

Introduction

Most websites store data in databases and use SQL (Structured Query Language) to access it. SQL injection (SQLi) is a web application attack in which an attacker enters malicious SQL code into an input field (login box, search box or URL) so that the database runs unintended commands. It can expose, change or delete data and bypass login.

1. How SQL Injection Works

A vulnerable login page builds its query by joining user input directly:

SELECT * FROM users WHERE username = 'INPUT_USER' AND password = 'INPUT_PASS';

If an attacker types ' OR '1'='1 into both the username and password fields, the query becomes:

SELECT * FROM users WHERE username = '' OR '1'='1' AND password = '' OR '1'='1';

Because '1'='1' is always true, the condition returns rows and the attacker may log in without a valid password.

2. Effects of SQL Injection

1. Authentication bypass (logging in without a password).
2. Theft of data such as customer records and passwords.
3. Modification or deletion of data.
4. Complete compromise of the database.

3. Prevention

1. Parameterised queries / prepared statements (most important) – user input is treated only as data, never as code:

cursor.execute("SELECT * FROM users WHERE username = %s AND password = %s",
               (user, pwd))

2. Input validation – allow only expected characters and length.
3. Careful use of stored procedures and ORM frameworks.
4. Least privilege for the database account (no admin rights for the web application).
5. A Web Application Firewall (WAF).
6. Hide detailed database error messages from users.
7. Store passwords as salted hashes, not plain text.

Example: An attacker enters a crafted string into a college result portal's roll-number box and is able to view the results of all students.

Introduction

Studying real cyber attacks shows how attackers exploit weaknesses and what lessons organisations can learn. The following case studies cover ransomware, DDoS, data breaches and attacks on Indian organisations.

1. WannaCry Ransomware (May 2017)

1. Type: ransomware that spread like a worm.
2. How it happened: it exploited a vulnerability in Microsoft Windows SMBv1 (the "EternalBlue" exploit) on unpatched systems.
3. Impact: hundreds of thousands of computers in about 150 countries were affected; the UK's National Health Service (NHS) had to cancel appointments.
4. Lessons: apply security patches promptly, disable outdated protocols, keep offline backups and segment networks.

2. Mirai Botnet DDoS Attack on Dyn (October 2016)

1. Type: DDoS attack using a botnet of infected IoT devices (cameras, routers).
2. How it happened: Mirai malware logged into IoT devices using default usernames and passwords.
3. Impact: the attack on DNS provider Dyn made major websites such as Twitter, Netflix and Amazon hard to reach for users in parts of the US and Europe.
4. Lessons: change default passwords, update IoT firmware and use DDoS protection.

3. Equifax Data Breach (2017)

1. Type: data breach through a web application vulnerability.
2. How it happened: attackers exploited a known flaw in Apache Struts that had not been patched for months.
3. Impact: personal data (names, Social Security numbers, birth dates) of about 147 million people was exposed.
4. Lessons: timely patch management, vulnerability scanning, network segmentation and encryption of sensitive data.

4. Cosmos Bank Cyber Attack, Pune (August 2018)

1. Type: malware attack on the bank's ATM switch system combined with cloned cards.
2. Impact: about ₹94 crore was withdrawn through ATMs in many countries and transferred abroad within two days.
3. Lessons: real-time monitoring of payment systems, strong network segmentation and incident response planning.

5. AIIMS Delhi Ransomware Attack (November 2022)

1. Type: ransomware attack on hospital servers.
2. Impact: the hospital's digital services were disrupted for about two weeks, and staff had to work manually.
3. Lessons: regular backups, network segmentation, updated systems and stronger cyber security for critical infrastructure such as healthcare.

Summary Table

Exam tip: For a 10-mark answer, explain any two or three cases using the same headings – type, how it happened, impact and lessons.

Introduction

Every network connected to the Internet needs a guard at its entrance. A firewall is a hardware device or software program that monitors and controls incoming and outgoing network traffic according to a set of security rules. It acts as a barrier between a trusted internal network and an untrusted external network such as the Internet.

Diagram:

flowchart LR
    I["Internet<br/>(untrusted)"] --> F{"FIREWALL<br/>checks rules:<br/>allow / deny"} --> L["Internal LAN<br/>(trusted)"]

1. Types of Firewalls

1. Packet filtering firewall: checks each packet's header – source/destination IP address, port and protocol – against rules. It works at the network layer. It is fast but cannot see packet contents.
2. Stateful inspection firewall: keeps track of the state of active connections and allows only packets that belong to a valid connection. More secure than simple packet filtering.
3. Application-level gateway (proxy firewall): works at the application layer; it acts as an intermediary that inspects the actual content of requests (for example HTTP, FTP).
4. Circuit-level gateway: works at the session layer and checks that the TCP handshake is valid, without inspecting the data.
5. Next-Generation Firewall (NGFW): combines stateful inspection with deep packet inspection, application awareness and an intrusion prevention system.

2. DMZ (Demilitarised Zone)

A DMZ is a separate network segment placed between the Internet and the internal network. Public-facing servers (web, mail, DNS) are kept in the DMZ, so that if they are attacked, the internal network stays protected.

flowchart LR
    I["Internet"] --> F1["Firewall 1"] --> D["DMZ<br/>Web / Mail / DNS servers"] --> F2["Firewall 2"] --> L["Internal LAN"]

Advantages:

• Blocks unauthorised access from outside.
• Allows control and logging of traffic.
• Can hide internal IP addresses (NAT).

Limitations:

• Cannot stop insider attacks or attacks through allowed traffic (such as phishing emails).
• Wrong rules can block genuine users or leave gaps.
• Simple firewalls cannot detect malware inside encrypted traffic.

Comparison Table

Example: A college firewall allows students to browse websites (port 443) but blocks incoming connections to the internal exam database.

Introduction

A firewall can block known bad traffic, but some attacks still get through. An Intrusion Detection System (IDS) monitors network or system activity and alerts administrators about suspicious behaviour. An Intrusion Prevention System (IPS) does the same but also automatically blocks the attack.

1. Types of IDS / IPS (based on location)

1. Network-based (NIDS / NIPS): monitors traffic across the whole network segment. Example: Snort, Suricata.
2. Host-based (HIDS / HIPS): installed on an individual computer or server; monitors files, logs and processes on that host.

2. Types of IDS (based on detection method)

1. Signature-based detection: compares activity with a database of known attack patterns (signatures).
   • Advantage: accurate for known attacks, few false alarms.
   • Limitation: cannot detect new (zero-day) attacks.
2. Anomaly-based detection: builds a model of normal behaviour and flags anything unusual.
   • Advantage: can detect new attacks.
   • Limitation: more false positives.

Diagram:

flowchart LR
    subgraph IDS["IDS – passive, out of line"]
        direction LR
        I1["Internet"] --> F1["Firewall"] --> L1["LAN"]
        F1 -. copy of traffic .-> D["IDS"] --> AL["Alert"]
    end
    subgraph IPS["IPS – active, in line"]
        direction LR
        I2["Internet"] --> F2["Firewall"] --> P["IPS<br/>blocks bad packets"] --> L2["LAN"]
    end

Comparison Table

Example: An IPS notices thousands of login attempts per minute from one IP address and blocks that address automatically.

Memory aid: IDS = Smoke alarm (warns); IPS = Sprinkler (acts).

Honeypots: A honeypot is an isolated decoy designed to attract suspicious activity for detection and analysis. Low-interaction versions simulate services; high-interaction versions provide more realistic environments. They supplement monitoring and must be isolated so they cannot become an attack platform.

Honeypot deployment and limits: Place a decoy where its activity can be logged and isolated from production assets. Low-interaction honeypots simulate a limited set of services and are easier to contain; high-interaction honeypots allow deeper observation but require stronger containment and monitoring. They can reveal reconnaissance and attack patterns, but only activity reaching the decoy is observed. They do not replace endpoint protection, patching, IDS/IPS or incident response.

Introduction

When data travels over public networks such as the Internet or café Wi-Fi, it can be intercepted. A Virtual Private Network (VPN) creates a secure, encrypted "tunnel" over a public network, so that data travels privately as if on a private network.

1. Working of a VPN

1. The user's device runs VPN client software and connects to a VPN server.
2. Both sides authenticate each other.
3. Data is encrypted and wrapped inside another packet (tunnelling).
4. The VPN server decrypts the data and forwards it to the destination; the user's real IP address is hidden.

flowchart LR
    U["User"] == "encrypted tunnel over the Internet" ==> V["VPN server"] --> O["Office network / website"]

2. Types of VPN

1. Remote access VPN: connects an individual user (such as an employee working from home) to the organisation's network.
2. Site-to-site VPN: connects two or more office networks over the Internet (for example a head office and a branch).
3. SSL/TLS VPN: works through a web browser using HTTPS; no special client is needed.
4. IPsec VPN: secures traffic at the network layer, commonly used for site-to-site links.

Advantages:

• Confidentiality of data through encryption.
• Secure remote working.
• Hides the user's IP address and location.
• Cheaper than leased private lines for connecting offices.

Limitations:

• Encryption may reduce speed.
• The VPN provider can see traffic, so a trusted provider is required.
• Does not protect against malware or phishing.

Example: A bank employee working from home connects through the company VPN to securely access internal systems.

Multi-factor authentication: MFA combines different factor categories: something known (password), possessed (security key) or inherent (biometric). Two passwords are not two factors. Require suitable MFA for remote access and privileged accounts. Defence in depth combines access controls, patching, segmentation, detection, backups and response; no single tool is sufficient.

MFA example and limitation: A password plus a hardware security key combines knowledge and possession. A password plus a PIN remains one factor category. MFA reduces the risk from a stolen password, but a stolen session, unsafe recovery process or successful phishing may still bypass some implementations. Protect enrolment and recovery as well as login; use independent access controls and monitoring alongside MFA.

Introduction

When we see https:// and a padlock icon in a browser, the connection is protected by TLS. SSL (Secure Sockets Layer) and its modern successor TLS (Transport Layer Security) are protocols that provide secure communication between a client (browser) and a server over the Internet. SSL is now outdated; current websites use TLS 1.2 or TLS 1.3.

1. Services Provided by TLS

1. Confidentiality: data is encrypted (symmetric encryption such as AES).
2. Integrity: message authentication codes detect any change in data.
3. Authentication: the server proves its identity with a digital certificate issued by a Certificate Authority (CA).

2. TLS Handshake (conceptual, not an exact TLS 1.3 message sequence)

1. Client Hello: the browser sends the TLS versions and cipher suites it supports, plus a random number.
2. Server Hello: the server chooses the version and cipher suite and sends its random number.
3. Certificate: the server sends its digital certificate containing its public key.
4. Certificate verification: the browser checks that the certificate is valid and signed by a trusted CA.
5. Key exchange: the key-establishment method depends on the TLS version and chosen suite. A modern certificate-based handshake commonly uses ephemeral Diffie–Hellman; RSA key transport is a legacy option and is not used in TLS 1.3. The parties derive symmetric traffic keys.
6. Finished: both sides confirm the handshake, and all further data is encrypted with the symmetric session key.

Diagram:

sequenceDiagram
    participant C as Client (Browser)
    participant S as Server
    C->>S: 1. Client Hello
    S->>C: 2. Server Hello
    S->>C: 3. Certificate
    Note over C: 4. Verify certificate
    C->>S: 5. Key exchange
    C->>S: 6. Finished
    S->>C: 6. Finished
    Note over C,S: Encrypted data using the session key

Comparison Table

Example: When a student logs in to an online banking site, TLS encrypts the username and password so that no one on the network can read them.

Memory aid: Handshake steps – "Hello, Hello, Certificate, Check, Key, Finish".

SSL, TLS and IPsec: SSL is obsolete; TLS protects application communications such as HTTPS. IPsec protects IP traffic using AH for integrity/authentication and ESP for encryption and/or integrity, depending on configuration. Transport mode protects the payload of an IP packet; tunnel mode encapsulates an entire original IP packet, commonly for VPNs. IKE negotiates security associations and keys. TLS and IPsec operate at different layers.

Protocol reference: TLS 1.3 specification, RFC 8446

Introduction

Emerging technologies are advanced technologies that improve the way computer systems, networks and data are protected from cyber threats. Three important emerging technologies in cyber security are Artificial Intelligence (AI), Blockchain and Quantum Cryptography. These technologies help detect cyberattacks, secure digital transactions, protect sensitive information and strengthen overall network security.

1. Artificial Intelligence (AI) in Cyber Security

Artificial Intelligence refers to the ability of computer systems to perform tasks that normally require human intelligence, such as learning, reasoning and decision-making.

Applications of AI in Cyber Security:

1. Threat Detection: AI analyses large amounts of network data to identify suspicious activities and potential cyberattacks.
2. Malware Detection: AI identifies malicious software by recognising unusual patterns and behaviour.
3. Intrusion Detection: AI monitors network traffic and detects unauthorised access attempts.
4. Phishing Detection: AI identifies suspicious emails, fake websites and fraudulent messages.
5. Automated Response: AI-powered security systems can automatically block malicious IP addresses, isolate infected devices and alert security teams.
6. User Behaviour Analysis: AI detects unusual login locations, abnormal access patterns and suspicious user activities.

Advantages:

• Detects threats quickly and efficiently.
• Can analyse large volumes of data in real time.
• Automates repetitive security tasks.
• Helps identify previously unknown attack patterns.

Limitations:

• Requires high-quality training data and computing resources.
• Attackers can also use AI to create sophisticated cyberattacks.
• Incorrect predictions may produce false alarms or miss threats.

Example: An AI-powered security system detects an unusual login attempt from a foreign location and flags it as suspicious.

2. Blockchain in Cyber Security

Blockchain is a distributed digital ledger that stores information in blocks linked together using cryptographic techniques. Once data is recorded and confirmed, altering it is designed to be difficult without detection or network agreement.

Applications of Blockchain in Cyber Security:

1. Data Integrity: Cryptographic hashes help detect unauthorised changes to stored data.
2. Secure Transactions: Blockchain supports the verification and recording of digital transactions.
3. Decentralised Security: Distributed records reduce dependence on a single central database.
4. Identity Management: Blockchain can support secure digital identity verification and credential management.
5. Supply Chain Security: It helps track the origin and movement of products, software components and digital records.
6. Audit Trails: Blockchain provides a traceable record of transactions and changes, supporting security audits.

Advantages:

• Makes unauthorised data modification easier to detect.
• Provides transparent and traceable records.
• Reduces reliance on a single central authority.
• Uses cryptographic mechanisms to protect records.

Limitations:

• Some blockchain networks consume significant energy.
• Transaction processing may be slow or expensive.
• Private keys must be protected carefully.
• Blockchain does not automatically guarantee that the original data entered was correct.

Example: An organisation uses blockchain to maintain tamper-evident records of important transactions and verify whether records have been altered.

3. Quantum Cryptography in Cyber Security

Quantum cryptography uses principles of quantum physics to secure communication. One of its most important applications is Quantum Key Distribution (QKD), which allows two parties to establish a shared encryption key while detecting certain types of eavesdropping.

Applications of Quantum Cryptography in Cyber Security:

1. Secure Key Distribution: QKD enables two parties to establish shared cryptographic keys securely.
2. Eavesdropping Detection: Measuring quantum states can disturb them, potentially revealing an interception attempt.
3. Protection of Sensitive Data: It can support secure communications for governments, banks and research organisations.
4. Secure Communication Networks: It can be used in specialised communication links where strong key security is required.
5. Future Quantum Threats: Quantum-resistant (post-quantum) cryptographic algorithms are being developed to protect conventional systems against attacks using powerful quantum computers; NIST published its first post-quantum standards in 2024.

Advantages:

• Provides a physics-based approach to detecting interception during key distribution.
• Can strengthen the security of highly sensitive communications.
• Addresses certain risks associated with future quantum computing capabilities.

Limitations:

• Requires specialised equipment and communication infrastructure.
• Can be expensive to deploy and maintain.
• Has practical distance and implementation constraints.
• QKD does not protect against every cyberattack or automatically secure the entire communication system.

Example: A government organisation uses a QKD system to establish encryption keys for a sensitive communication link.

Comparison of the Three Technologies

Definition: NAT (Network Address Translation) is a technique used by a router to translate private IP addresses inside a network into a public IP address for the Internet, and back again.

flowchart LR
    subgraph LAN["Private network"]
        P1["PC1 192.168.1.2"]
        P2["PC2 192.168.1.3"]
        P3["PC3 192.168.1.4"]
    end
    N["NAT router<br/>inside: 192.168.1.1<br/>outside: 203.0.113.5"]
    P1 --> N
    P2 --> N
    P3 --> N
    N --> W["Internet / web server<br/>(sees only 203.0.113.5)"]

Types:

1. Static NAT: one private IP is mapped to one fixed public IP (used for servers).
2. Dynamic NAT: private IPs are mapped to a pool of public IPs.
3. PAT (Port Address Translation) / NAT overload: many private IPs share one public IP using different port numbers (common in home routers).

Private IP ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.

Security limitation: Address translation can conceal internal addressing and changes how inbound connections are mapped, but NAT is not an authentication system or a replacement for firewall policy. Port forwarding and existing mappings affect reachability. Its main practical benefit is conserving public IPv4 addresses.

Example: A home Wi-Fi router lets a phone, laptop and TV share one public IP address provided by the ISP.

Introduction

Even the strongest technical security can be bypassed if a person is tricked. Social engineering is the art of manipulating people – rather than hacking technology – into revealing confidential information or performing actions that compromise security. It exploits human trust, fear, urgency and curiosity.

Techniques of Social Engineering

1. Phishing / Vishing / Smishing: fake emails, phone calls or SMS messages. Example: "Your SIM will be blocked, share the OTP."
2. Pretexting: creating a false story (pretext) to obtain information. Example: a caller pretends to be from the IT help desk.
3. Baiting: leaving infected USB drives or offering free downloads. Example: a USB drive labelled "Salary list 2026" left in the office.
4. Quid pro quo: offering a service in exchange for information. Example: "free tech support" in exchange for login details.
5. Tailgating / Piggybacking: following an authorised person into a restricted area. Example: walking in behind an employee with an ID card.
6. Shoulder surfing: watching someone type a PIN or password. Example: at an ATM or in a café.
7. Dumpster diving: searching rubbish for documents and notes. Example: finding printed passwords in the bin.
8. Impersonation: pretending to be an authority figure. Example: a fake "CEO" email asking for an urgent fund transfer.

Prevention

1. Regular security awareness training.
2. Verify identity through a separate, trusted channel before sharing information.
3. Clear policies: never share passwords or OTPs, use visitor badges, prevent tailgating.
4. Shred sensitive documents and follow a clean desk policy.
5. Encourage employees to report suspicious requests.

Example: An accounts clerk receives an urgent email that appears to be from the CEO asking for a ₹5 lakh transfer; she verifies by phone and discovers it is fake.

Defence principle: Combine usable processes, verification, training and technical controls; do not rely on blaming individual users.

Definition: An insider threat is a security risk that comes from people inside the organisation – employees, former employees, contractors or partners – who have legitimate access to systems and data.

Types:

1. Malicious insider: intentionally steals data or causes damage (for revenge or money).
2. Negligent (careless) insider: causes harm by mistake (clicking phishing links, losing a laptop, using weak passwords).
3. Compromised insider: an employee whose account is taken over by an outside attacker.

Prevention:

1. Least privilege and role-based access control.
2. Separation of duties so no single person controls a whole critical process.
3. Monitoring and logging of user activity; Data Loss Prevention (DLP) tools.
4. Immediate removal of access when employees leave.
5. Background checks, awareness training and a clear reporting culture.

Example: A sales employee copies the customer database to a pen drive before joining a competitor.

IPsec is a suite for protecting IP-layer traffic. The protections depend on the protocol and configuration.

Transport mode: The original IP header remains; ESP protects the carried payload. It is often used between hosts. AH also authenticates selected header fields.

Tunnel mode: An entire original IP packet is encapsulated inside a new packet. With ESP encryption, the inner packet is hidden; the new outer header remains visible so routers can deliver it.

Working sequence: Identify traffic requiring protection → establish security associations → protect outbound packets → verify/decrypt at the receiving endpoint → deliver the original traffic.

Example: Two branch gateways use an ESP tunnel to protect traffic crossing the public network. Endpoints and gateways still need their own access controls.

TLS comparison: TLS secures application communication sessions; IPsec protects selected IP traffic at the network layer.

Technical reference: NIST Guide to IPsec VPNs

Checked against the supplied sem723.pdf theory syllabus on . This maps the listed content topics to answers; it is not a prediction of exam questions or marks for any individual answer.