Introduction to Cyber Security
We use computers, smartphones and the internet for almost everything today, from online banking and shopping to studying and communicating with other people. As more personal and business information moves online, protecting that information has become an important part of using technology.
Cyber Security is the practice of protecting computers, networks, applications, devices and data from unauthorized access, misuse, damage or disruption. It is not limited to installing antivirus software. Good security involves technology, people and proper procedures working together.
Why Is Cyber Security Important?
A security problem can have consequences beyond losing a file or getting a computer infected. For an organization, a successful attack can interrupt services, expose customer information or cause financial loss. For an individual, stolen passwords or personal information can be misused in many ways.
- Protection of sensitive information: Helps prevent unauthorized access to personal, financial and organizational data.
- Business continuity: Security controls can reduce the impact of attacks that interrupt important services.
- Privacy protection: Helps keep personal information accessible only to authorized people and systems.
- Financial protection: Reduces the risk of losses caused by fraud, ransomware and other cyber incidents.
- Maintaining trust: Organizations need reliable security practices to maintain the confidence of customers, employees and partners.
Major Areas of Cyber Security
- Network Security
- Application Security
- Information and Data Security
- Identity and Access Management
- Operational Security
- Security Awareness and Training
- Backup and Recovery
Fundamental Principles of Cyber Security
Cyber security is based on several fundamental ideas. The most widely known model is the CIA Triad. Here, CIA does not refer to an organization; it stands for Confidentiality, Integrity and Availability.
The CIA Triad
- Confidentiality: Information should be available only to people or systems that are authorized to access it.
- Integrity: Data should remain accurate, complete and protected from unauthorized modification.
- Availability: Authorized users should be able to access systems and information when they need them.
Consider an online banking system. Confidentiality protects your account information from unauthorized users. Integrity helps ensure that account balances and transactions are not changed improperly. Availability means that legitimate customers can access the service when required.
Other Important Security Principles
- Authentication: Verifying who a user, device or system really is.
- Authorization: Deciding what an authenticated user is allowed to access or do.
- Accountability: Keeping records that help determine which users or systems performed particular actions.
- Non-repudiation: Providing evidence that can help prevent a party from falsely denying an action or communication.
Cyber Security Threats
A cyber security threat is a potential event or activity that can harm a computer system, network, application or its data. A threat may take advantage of a vulnerability, which is a weakness in software, hardware, configuration or human behavior.
Threats can come from outside an organization or from people who already have some level of access to its systems.
Common Categories of Threats
| Threat Category | Description | Example |
|---|---|---|
| External Threat | Originates outside the organization or system | Phishing campaign or external attacker |
| Internal Threat | Involves a person who has legitimate access to systems or information | Misuse of access or accidental data exposure |
| Human Error | Security problems caused unintentionally by users | Sending confidential information to the wrong recipient |
| Organized Cyber Crime | Planned attacks carried out for financial or other objectives | Ransomware or large-scale fraud |
Common Cyber Attacks
A cyber attack is an intentional attempt to gain unauthorized access, steal information, disrupt a service or otherwise compromise a computer system. Different attacks target different weaknesses.
Common Types of Cyber Attacks
- Phishing: An attacker uses a deceptive email, message or website to persuade a person to reveal information or perform an unsafe action.
- Distributed Denial-of-Service (DDoS): A service is overwhelmed with a large volume of requests or traffic, making it difficult for legitimate users to access it.
- Man-in-the-Middle (MitM): An attacker attempts to intercept communication between two parties.
- SQL Injection: Malicious input is used to interfere with an application's database query. Proper input handling and parameterized queries are important defenses.
- Cross-Site Scripting (XSS): An attacker attempts to make a web application deliver malicious script content to other users.
- Zero-Day Attack: An attack that exploits a vulnerability before a fix or patch is generally available to defend against it.
- Social Engineering: Psychological manipulation is used to persuade people to reveal information or perform an action that benefits the attacker.
Basic Ways to Reduce Risk
- Keep operating systems and applications updated.
- Use strong and unique passwords.
- Enable multi-factor authentication where available.
- Be careful with unexpected links and attachments.
- Back up important information regularly.
- Use appropriate access controls.
- Provide security awareness training to users.
Malware
Malware is short for malicious software. It refers to software intentionally created to damage systems, steal information, disrupt operations, spy on users or perform other unauthorized activities.
Common Types of Malware
| Malware | What It Does | Typical Characteristic |
|---|---|---|
| Virus | Attaches itself to files or programs and can spread when the infected file is executed | Usually requires some form of user or host action to propagate |
| Worm | Can replicate and spread between systems | Can spread automatically across vulnerable systems |
| Trojan | Disguises itself as legitimate or useful software | Relies on users being tricked into running or installing it |
| Ransomware | Can encrypt or otherwise make data unavailable and demand payment | Often causes serious operational disruption |
| Spyware | Secretly collects information about users or their activities | Can compromise privacy and sensitive information |
| Adware | Displays unwanted advertising or performs advertising-related activities | Some forms are merely annoying, while others can create security or privacy concerns |
Cryptography
Cryptography is the study and application of techniques used to protect information and communications. It is widely used in online banking, secure websites, messaging, digital signatures and many other systems.
Basic Cryptography Terms
- Plaintext: The original readable information.
- Ciphertext: The transformed information produced by encryption.
- Encryption: The process of transforming plaintext into ciphertext.
- Decryption: The process of recovering the original information from ciphertext.
- Key: Information used by a cryptographic algorithm to perform encryption, decryption or another cryptographic operation.
- Cryptographic Algorithm: The mathematical procedure used to perform the cryptographic operation.
Symmetric and Asymmetric Cryptography
| Symmetric Cryptography | Asymmetric Cryptography |
|---|---|
| Uses the same secret key for encryption and decryption | Uses a related public key and private key |
| Generally faster for encrypting large amounts of data | Generally involves more computational overhead |
| Secure key sharing is an important consideration | Public keys can be distributed openly while private keys are kept secret |
| Examples include AES | Examples include RSA and ECC |
In practice, modern secure systems often combine both approaches. Asymmetric cryptography can help establish or protect a shared secret, while symmetric cryptography can then be used efficiently for the actual data transfer.
Encryption Algorithms
Encryption algorithms transform readable information into a form that should not be understandable without the required cryptographic key. Different algorithms are designed for different purposes and security requirements.
Symmetric Algorithms
- AES (Advanced Encryption Standard): A widely used symmetric encryption standard that supports 128-bit, 192-bit and 256-bit keys.
- DES (Data Encryption Standard): An older encryption standard with a 56-bit effective key and no longer considered suitable for modern security requirements.
- 3DES: Applies the DES operation multiple times. It is an older technology and has largely been replaced by more modern algorithms.
- Blowfish: An older symmetric block cipher with a variable-length key.
Asymmetric Algorithms and Techniques
- RSA: A public-key cryptographic algorithm historically used for encryption and digital signatures.
- ECC (Elliptic Curve Cryptography): Uses elliptic-curve mathematics to provide strong security with relatively smaller key sizes than some traditional public-key systems.
- Diffie-Hellman: A method for establishing a shared secret between parties over an insecure communication channel.
- DSA (Digital Signature Algorithm): Designed for creating and verifying digital signatures.
Network Security
Network security focuses on protecting network infrastructure, communication, connected devices and the information moving between them. It combines technologies, policies and monitoring practices to reduce security risks.
Important Network Security Components
- Firewall: Controls network traffic according to configured security rules.
- Intrusion Detection System (IDS): Monitors activity and generates alerts when suspicious behavior is detected.
- Intrusion Prevention System (IPS): Can detect suspicious traffic and take action to block or prevent it.
- Virtual Private Network (VPN): Creates an encrypted communication channel over a network for supported use cases.
- Access Control: Determines which users or systems are allowed to access particular resources.
Defense in Depth
Defense in depth means using multiple layers of security rather than depending on a single protection mechanism. If one control fails, another control may still reduce the impact.
- Physical Security
- Network Security
- Application Security
- Identity and Access Controls
- Data Protection
- Security Awareness
- Backup and Recovery
Security Protocols
Security protocols define rules and mechanisms that help protect communication between systems. Different protocols solve different security problems.
TLS (Transport Layer Security)
TLS helps protect data exchanged between applications over a network. HTTPS uses TLS to provide secure communication between a web browser and a web server.
IPsec
Internet Protocol Security is a collection of protocols used to authenticate and protect IP communications. It is commonly associated with secure network connections and VPN technologies.
SSH (Secure Shell)
SSH provides secure remote access and secure communication for supported network services. It is commonly used by administrators to manage remote systems.
PGP and OpenPGP
PGP and related standards such as OpenPGP use cryptographic techniques to provide confidentiality and authentication for supported data and communications.
Firewalls and Intrusion Detection
A firewall controls network traffic according to security rules. It can help separate trusted and untrusted networks and restrict unwanted connections. Different firewall technologies inspect traffic at different levels.
Types of Firewalls
- Packet Filtering Firewall: Makes filtering decisions using information contained in network packets, such as addresses, ports and protocols.
- Stateful Firewall: Keeps track of active network connections when making filtering decisions.
- Application-Level Gateway: Can inspect and control traffic at the application level.
- Next-Generation Firewall: Combines traditional firewall functions with additional security and traffic-inspection capabilities.
IDS vs IPS
| IDS | IPS |
|---|---|
| Detects suspicious or malicious activity | Detects and can actively block or prevent suspicious activity |
| Primarily provides monitoring and alerts | Provides monitoring together with prevention actions |
| Security teams investigate generated alerts | Can automatically respond according to configured rules |
Authentication and Access Control
Authentication is the process of verifying the identity of a user, device or system. After authentication, authorization determines what that identity is allowed to access.
Common Authentication Factors
- Something you know: Password, PIN or another secret.
- Something you have: Security token, smart card or trusted mobile device.
- Something you are: Biometric characteristics such as a fingerprint or facial characteristics.
- Somewhere you are: Information about a user's location can sometimes be used as an additional security signal.
- Something you do: Behavioral characteristics can sometimes be used for authentication or risk assessment.
Multi-Factor Authentication
Multi-factor authentication (MFA) requires two or more different authentication factors. The important point is that the factors should come from different categories rather than simply using two passwords.
Examples
- Password + authenticator application
- Password + security key
- PIN + smart card
- Password + biometric authentication
Cyber Laws and Regulations in India
Cyber security is not only a technical subject. Legal and regulatory frameworks also determine how digital information, electronic records, cyber offences and personal data are handled.
Information Technology Act, 2000
In India, the Information Technology Act, 2000 is an important piece of legislation dealing with electronic records, electronic communication and various computer-related offences. It has also been amended over time to address changes in the digital environment.
Digital Personal Data Protection Act, 2023
India's Digital Personal Data Protection Act, 2023 provides a legal framework concerning the processing of digital personal data and the rights and responsibilities associated with such processing.
Students should be careful when studying cyber-law topics because laws and regulations can change over time. For examination preparation, always check the syllabus and the latest official legal information relevant to the exam.
Common Cyber Security Mistakes
Many security incidents are connected to simple mistakes. Understanding these mistakes is useful both for examinations and for everyday use of technology.
- Using the same password everywhere: If one service is compromised, attackers may try the same credentials elsewhere.
- Ignoring software updates: Updates often include security fixes as well as new features.
- Clicking unknown links: A message that appears to come from a trusted person or company may still be fraudulent.
- Giving excessive permissions: Users and applications should generally receive only the access they actually need.
- Not keeping backups: A reliable backup can be extremely valuable when data is accidentally deleted or affected by an incident.
- Ignoring security awareness: Technology alone cannot eliminate risks created by human behavior.
Cyber Security Quick Revision
Before an examination, try to connect the major concepts instead of memorising each definition separately.
- CIA Triad: Confidentiality, Integrity and Availability.
- Authentication: Verifies identity.
- Authorization: Determines permissions.
- Malware: Malicious software.
- Phishing: Deceptive attempt to obtain information or influence a user.
- Firewall: Controls network traffic according to rules.
- IDS: Detects and reports suspicious activity.
- IPS: Detects and can block suspicious activity.
- Symmetric Cryptography: Uses a shared secret key.
- Asymmetric Cryptography: Uses public and private keys.
- MFA: Uses multiple authentication factors.
- Defense in Depth: Uses multiple layers of security controls.
Practice Questions
Use these questions to test your understanding after studying the chapter. Try answering them in your own words before checking your notes.
- What is cyber security and why is it important?
- Explain the three components of the CIA Triad.
- What is the difference between authentication and authorization?
- What is the difference between a threat and a vulnerability?
- What is phishing? Give a simple example.
- Differentiate between a virus, worm and Trojan.
- What is ransomware?
- What is the difference between symmetric and asymmetric cryptography?
- Why is AES preferred over older algorithms such as DES?
- What is the purpose of a firewall?
- Differentiate between IDS and IPS.
- What is multi-factor authentication?
- What is defense in depth?
- What is the purpose of TLS in web communication?
- What is the role of the Information Technology Act, 2000 in India?
Conclusion
Cyber Security is a broad field that combines technology, processes and human awareness to protect digital systems and information. Concepts such as the CIA Triad, authentication, malware, cyber attacks, cryptography, network security and access control provide the foundation for understanding the subject.
For examination preparation, it is useful to learn the meaning of each concept, understand how related concepts differ, and practise applying them to simple real-world situations. Cyber security is also a practical subject, so the concepts learned here can help students make safer decisions when using computers, mobile devices and online services.