Information Security & Cyber Law: Threats, Safeguards & Legal Rules

TAKEAWAYS:

• Cyber threats (viruses, malware, phishing) can steal data or damage systems—learn how they work and how to stop them.
• Security tools like firewalls, encryption, and strong passwords protect your devices and data from attacks.
• Cyber laws in Nepal (like the Electronic Transactions Act) define rules for online safety, privacy, and legal consequences.
• Ethical computing means using technology responsibly—respecting copyright, avoiding piracy, and reporting cybercrimes.
• NEB exams test definitions, real-world scenarios (e.g., "How would you respond to a phishing email?"), and matching security tools to threats.
• Practical tips (like recognizing fake websites or creating secure passwords) are often asked in short-answer questions.

What is Information Security?

Information security (or cybersecurity) is the practice of protecting data, devices, and networks from unauthorized access, damage, or theft. Think of it like locking your house:

• Physical security = locks, alarms, security guards.
• Cybersecurity = firewalls, passwords, encryption.

Why is it important?

In Nepal, cybercrimes like online fraud, identity theft, and hacking are rising. For example:

• A student’s bank account might be hacked if they reuse passwords.
• A business’s customer data could be leaked if their website isn’t secure.
• Schools might face ransomware attacks, where hackers lock files and demand money.

pie
    title Cyber Threats in Nepal (2023)
    "Phishing" : 35
    "Malware" : 25
    "Hacking" : 20
    "Data Breaches" : 15
    "Other" : 5

Types of Cyber Threats

Cyber threats are like different kinds of burglars. Here’s how they work:

1. Malware (Malicious Software)

Malware is software designed to harm your computer or steal data. Types include:

• Viruses: Attach to clean files (like a disease spreading). Example: A USB drive with a virus infects your PC when plugged in.
• Worms: Spread without user action (e.g., through emails). Example: The ILOVEYOU virus (2000) tricked users into opening an email.
• Trojans: Disguise as legitimate software. Example: A "free game crack" that actually installs spyware.
• Ransomware: Locks your files and demands payment. Example: WannaCry (2017) attacked hospitals worldwide.

sequenceDiagram
    participant User
    participant Malware
    participant System
    User->>Malware: Opens infected file (e.g., USB drive)
    Malware->>System: Executes hidden code (e.g., keylogger)
    System-->>Malware: Steals data (passwords, contacts)
    Malware->>User: Displays fake error (distraction)
    Note right of User: **Example: ILOVEYOU virus (2000)**
    Note left of System: **Impact: 50M+ infected globally**

2. Phishing and Social Engineering

Phishing tricks you into revealing sensitive info (passwords, credit card numbers). Common types:

• Email Phishing: Fake emails from "banks" or "NEB" asking for login details.
• Spear Phishing: Targeted attacks (e.g., an email pretending to be from your school principal).
• Vishing: Phone calls pretending to be tech support ("Your computer has a virus!").

Example: You receive an email:

"From: NEB Exam Office Subject: Your Result is Ready! Click here to download: [suspicious.link] Urgent: Reply within 24 hours!"

Red flags: ✅ No personal greeting (e.g., "Dear Student"). ✅ Urgent language ("Act now!"). ✅ Links to weird websites (hover to check the real URL).

3. Hacking

Hackers exploit weaknesses in systems to:

• Steal data (e.g., passwords, credit cards).
• Disrupt services (e.g., DDoS attacks on government websites).
• Spy on users (e.g., keyloggers recording keystrokes).

Types of hackers:

4. Identity Theft

When someone steals your personal info (name, address, Aadhaar number) to:

• Open bank accounts in your name.
• Take loans or buy things on your credit card.
• File fake tax returns.

How it happens:

• Stolen laptops with unencrypted data.
• Public Wi-Fi attacks (hackers spy on unsecured connections).
• Data breaches (e.g., a company’s database is hacked).

Security Measures to Protect Yourself

Now that you know the threats, here’s how to fight back:

1. Password Security

Weak passwords are like leaving your front door unlocked. Rules for strong passwords:

• Length: At least 12 characters.
• Complexity: Mix uppercase, lowercase, numbers, and symbols (e.g., T@st3r#2024).
• Uniqueness: Never reuse passwords (e.g., don’t use Password123 for Facebook, email, and banking).
• Tools: Use a password manager (like Bitwarden or KeePass) to store passwords securely.

2. Firewalls and Antivirus

• Firewall: Acts like a security guard for your network. Blocks unauthorized access.
  • Types:
    • Hardware firewall: Router or modem.
    • Software firewall: Windows Defender, ZoneAlarm.
• Antivirus: Scans for malware (e.g., Avast, Norton, Windows Defender).

Example: If a hacker tries to connect to your PC, the firewall checks:

1. Is this a known safe program?
2. Is the connection coming from a trusted source?
3. If not, BLOCK IT.

3. Encryption

Encryption scrambles data so only authorized people can read it. Think of it like a secret code:

• Example: HTTPS (the "S" stands for Secure) encrypts data between your browser and a website.
• Tools:
  • BitLocker (Windows): Encrypts your entire hard drive.
  • VeraCrypt: Encrypts files or drives.

4. Two-Factor Authentication (2FA)

2FA adds a second layer of security. Even if a hacker steals your password, they can’t log in without the second factor.

How it works:

1. You enter your password.
2. You get a code on your phone (via SMS or an app like Google Authenticator).
3. Only if you enter the code can you log in.

Example:

• Banking apps often use 2FA.
• Google/Facebook recommend enabling it.

5. Secure Browsing

• Avoid public Wi-Fi for banking: Hackers can spy on unsecured connections.
• Check for HTTPS: Always look for 🔒 in the browser bar.
• Block pop-ups: They can install malware.
• Use ad-blockers: Some ads contain malicious code.

6. Regular Updates

• Operating System: Windows/macOS/Linux updates fix security holes.
• Apps: Keep browsers, antivirus, and apps updated.
• Example: The EternalBlue exploit (used in WannaCry) targeted unpatched Windows systems.

Cyber Laws in Nepal

Nepal has laws to punish cybercrimes and protect users. Key acts:

classDiagram
    class ElectronicTransactionsAct {
        +Digital Signatures
        +Online Contracts
        +Fraud Punishment
    }
    class MulukiAin {
        +Cybercrime Provisions
        +Penalties for Hacking
        +Identity Theft Laws
    }
    class CyberSecurityStrategy2019 {
        +National Framework
        +Awareness Programs
        +Critical Infrastructure Protection
    }
    ElectronicTransactionsAct --> MulukiAin : "Amends"
    MulukiAin --> CyberSecurityStrategy2019 : "Implements"

1. Electronic Transactions Act, 2008

• Defines digital signatures as legally valid.
• Rules for online contracts (e.g., buying something online).
• Punishes fraudulent transactions (e.g., fake online payments).

2. Muluki Ain (Civil Code) – Cybercrime Provisions

• Section 177: Punishes identity theft (up to 3 years in jail).
• Section 178: Punishes hacking (up to 5 years in jail).
• Section 179: Punishes child pornography (severe penalties).

3. Cyber Security Strategy of Nepal (2019)

• Government plan to:
  • Train people on cybersecurity.
  • Set up a National Cyber Security Center.
  • Protect critical infrastructure (banks, hospitals, power grids).

Example Case: In 2021, a Nepali hacker was arrested for phishing attacks that stole Rs. 5 million from bank accounts. He was sentenced under Section 178 of Muluki Ain.

flowchart TD
    A["Cybercrime Committed"] --> B{"Is it Identity Theft?"}
    B -->|"Yes"| C["Section 177: Up to 3 years jail"]
    B -->|"No"| D{"Is it Hacking?"}
    D -->|"Yes"| E["Section 178: Up to 5 years jail"]
    D -->|"No"| F["Other Cyber Laws"]

Ethical Computing and Digital Citizenship

Even if laws aren’t broken, unethical behavior can harm others. Examples:

• Piracy: Downloading movies/games illegally harms creators.
• Cyberbullying: Posting mean comments or fake news.
• Plagiarism: Copying others’ work without credit (common in exams!).

How to be a good digital citizen: ✅ Respect copyright (don’t steal software or music). ✅ Verify sources before sharing news (fake news spreads fast!). ✅ Report cybercrimes to:

• Nepal Police Cyber Crime Unit: cybercrime@police.gov.np
• NEA (Nepal Electricity Authority) for online fraud.

NEB Exam Tips for Unit 12

The NEB exam tests concepts, scenarios, and definitions. Here’s how to score full marks:

1. Short Answer Questions (SAQ)

Example Question: "What is phishing? Give two examples of how phishing emails trick users."

Model Answer:

Phishing is a cyber attack where hackers trick users into revealing sensitive information (like passwords or credit card numbers) by pretending to be a trusted entity.

Two examples:

1. Fake Bank Email: An email from "NMB Bank" asks you to click a link to "verify your account" or face suspension. The link leads to a fake website.
2. NEB Result Scam: An email claims your NEB result is ready and asks you to "download" it by entering personal details.

Key Points to Include:

• Definition of phishing.
• How it tricks users (urgent language, fake logos, spoofed emails).
• Real-world examples.

2. Long Answer Questions (LAQ)

Example Question: "Explain the security measures to protect against malware. How does a firewall differ from an antivirus?"

Model Answer:

Security measures against malware:

1. Antivirus Software: Scans files and programs for malware (e.g., Avast, Windows Defender). Regular updates are crucial.
2. Firewalls: Blocks unauthorized network access (hardware/software-based).
3. Safe Browsing: Avoid downloading from untrusted sites; use HTTPS.
4. Email Security: Never open attachments from unknown senders.
5. Regular Updates: Patch software vulnerabilities (e.g., Windows updates).

Difference between Firewall and Antivirus:

Feature	Firewall	Antivirus
Purpose	Blocks unauthorized network access	Detects and removes malware
Works at	Network level (traffic)	File/system level (scans)
Example	Windows Firewall, pfSense	Norton, McAfee
Prevention	Stops attacks before they enter	Cleans infections after entry

Exam Tip:

• Use tables for comparisons (like above).
• Explain how each measure works (not just names).

3. Scenario-Based Questions

Example Question: "Your friend received a call from someone claiming to be from ‘Nepal Telecom’ saying there’s an issue with their SIM card. The caller asks for the OTP sent to your friend’s phone. What should your friend do? Explain with reasons."

Model Answer:

My friend should:

1. Not share the OTP: OTPs are one-time passwords for security. Sharing them gives hackers access to their account.
2. Verify the caller: Ask for the official helpline number of Nepal Telecom (e.g., 10001) and call back.
3. Report the incident: If the call was fraudulent, report it to Nepal Telecom’s cybercrime cell.

Why?

• Hackers use vishing (voice phishing) to steal OTPs and take over accounts.
• Legitimate companies never ask for OTPs over the phone.

4. Matching Questions

Example Question: Match the following cyber threats with their descriptions:

Correct Answer:

• A → 2
• B → 1
• C → 4
• D → 3

Exam Tip:

• Learn key characteristics of each threat (e.g., ransomware = locks files).
• Practice matching with past NEB papers.

5. True/False Questions

Example Question: "Encryption is used to make data unreadable to unauthorized users. (True/False)"

Answer: True Explanation:

Encryption converts data into ciphertext (unreadable format) using algorithms. Only authorized users with the decryption key can read it. Example: HTTPS encrypts data between your browser and a website.

Practice Questions (NEB Style)

Test your understanding with these questions:

Short Answers

1. Define cybersecurity. Give one example of a cyber threat in Nepal.
2. What is two-factor authentication (2FA)? Why is it important?
3. List two cyber laws in Nepal that punish hacking.

Long Answer

4. Explain the Electronic Transactions Act, 2008. How does it protect online transactions in Nepal?
5. Describe three security measures you would take to protect your laptop from malware. Use diagrams where necessary.

Scenario

6. "You found a USB drive with your name on it. What steps would you take before plugging it into your computer?" Justify your answer.

Summary Table: Threats vs. Solutions

Final Exam Tips

1. Memorize definitions: NEB loves exact terms (e.g., "Phishing is a social engineering attack...").
2. Use diagrams: For processes like encryption or firewall working, draw simple flowcharts.
3. Relate to Nepal: Mention local examples (e.g., "Nepal Police Cyber Crime Unit" or "NMB Bank scams").
4. Practice past papers: NEB repeats question patterns. Solve at least 5 past questions from Unit 12.
5. Write neatly: For long answers, use bullet points and tables to organize information.

Remember:

"Cybersecurity is not just for experts—it’s for everyone. Small habits (like strong passwords) can prevent big problems!"