Info Security & Cyber Law: Threats, Safeguards & Legal Rules

TAKEAWAYS:

• Cyber threats (viruses, malware, phishing) can steal or damage data—learn how they work and how to stop them.
• Security tools like firewalls, encryption, and passwords create layers of protection for computers and networks.
• Ethical hacking helps find security weaknesses legally, but black-hat hacking is a crime.
• Cyber laws in Nepal (like the Electronic Transaction Act) punish hacking, piracy, and online fraud.
• Data privacy (GDPR, Nepal’s rules) means companies must protect your personal information.
• Safe online habits (strong passwords, two-factor authentication) reduce risks of identity theft.

---

What is Information Security?

Information security (or cybersecurity) protects data from unauthorized access, use, disclosure, disruption, modification, or destruction. It ensures confidentiality, integrity, and availability (CIA triad) of information.

Why is it important?

• Personal data (bank details, passwords) can be stolen.
• Businesses lose money if hacked (e.g., ransomware attacks).
• Government systems (voting, healthcare) must stay secure.
• Reputation damage: A hacked company loses customer trust.

---

Common Cyber Threats

Cyber threats are risks that can harm computers or networks. Here are the most dangerous ones:

1. Malware (Malicious Software)

Malware is software designed to damage or gain unauthorized access to a computer. Types of malware:

• Viruses: Attach to clean files and spread (e.g., ILOVEYOU virus in 2000).
• Worms: Self-replicating malware that spreads without user action (e.g., WannaCry).
• Trojans: Disguised as legitimate software (e.g., fake game cracks).
• Ransomware: Locks your files and demands payment (e.g., WannaCry, LockBit).
• Spyware: Secretly monitors your activity (e.g., keyloggers).

How to protect against malware? ✅ Use antivirus software (e.g., Avast, Norton). ✅ Avoid pirated software (often contains malware). ✅ Keep software updated (patches fix vulnerabilities). ✅ Don’t open suspicious emails/attachments.

---

2. Phishing and Social Engineering

Phishing tricks users into revealing sensitive information (passwords, credit card numbers). Types of phishing:

• Email phishing: Fake emails from "banks" or "Amazon" asking for login details.
• Spear phishing: Targets specific people (e.g., CEO fraud).
• Smishing: Phishing via SMS.
• Vishing: Phishing via voice calls (fake tech support).

How to spot phishing? ⚠️ Check the sender’s email (e.g., support@amaz0n.com is fake). ⚠️ Hover over links (don’t click—see if the URL is suspicious). ⚠️ Never share passwords over email or calls. ⚠️ Look for poor grammar/spelling in official-looking emails.

---

3. Hacking and Unauthorized Access

Hackers exploit weaknesses in systems to gain control. Types of hackers:

Common hacking methods:

• Brute force attacks: Trying all possible passwords.
• SQL injection: Inserting malicious SQL code into a website’s database.
• Man-in-the-middle (MITM): Intercepting communication between two parties (e.g., public Wi-Fi hacking).

How to prevent hacking? ✅ Use strong passwords (12+ characters, mix of letters/numbers/symbols). ✅ Enable two-factor authentication (2FA). ✅ Update software regularly. ✅ Use VPNs on public Wi-Fi.

---

Security Measures and Tools

To protect against threats, we use security tools and best practices.

1. Firewalls

A firewall is a barrier between a trusted network (e.g., your PC) and untrusted networks (e.g., the internet). It blocks unauthorized access.

Types of firewalls:

How to configure a firewall?

• Allow only necessary ports (e.g., port 80 for HTTP, 443 for HTTPS).
• Block unknown or suspicious traffic.
• Keep firewall rules updated.

---

2. Encryption

Encryption converts data into unreadable code (ciphertext) to prevent unauthorized access. Types of encryption:

Where is encryption used?

• HTTPS (secure websites, padlock icon in browser).
• VPNs (secure internet connections).
• Email encryption (PGP, S/MIME).
• Password storage (databases store hashed passwords).

---

3. Password Security

Weak passwords are the #1 way hackers break in. How to create a strong password? ✅ Length: 12+ characters. ✅ Complexity: Mix of uppercase, lowercase, numbers, symbols (e.g., Tr0ub4dour&3). ✅ Avoid:

• Common words (password123).
• Personal info (YourName1990).
• Repeating characters (aaaaaa). ✅ Use a password manager (e.g., Bitwarden, LastPass).

Two-Factor Authentication (2FA) 2FA adds an extra layer of security. Even if a hacker steals your password, they need a second code (sent to your phone or email). Types of 2FA:

• SMS codes (less secure, but easy).
• Authenticator apps (Google Authenticator, Authy).
• Hardware tokens (YubiKey, most secure).

---

4. Antivirus and Anti-Malware Software

Antivirus programs detect and remove malware. How they work:

1. Scan files for known malware signatures.
2. Heuristic analysis (detects new, unknown malware).
3. Real-time protection (blocks threats before they harm).

Popular antivirus tools:

• Free: Avast, AVG, Windows Defender.
• Paid: Norton, McAfee, Kaspersky.

How to use antivirus effectively? ✅ Schedule regular scans (weekly/full scan, daily/quick scan). ✅ Update definitions (new malware is discovered daily). ✅ Quarantine suspicious files (don’t delete immediately—review first).

---

Cyber Laws in Nepal

Nepal has laws to punish cybercrimes and protect digital rights.

Key Cyber Laws in Nepal

1. Electronic Transaction Act (2063/2008)

   • Legal recognition of digital signatures.
   • Punishes fraud, hacking, and forgery in electronic transactions.
   • Example: Sending fake invoices via email is illegal.

2. Cyber Security Strategy (2075)

   • Government plan to protect critical infrastructure (banks, hospitals).
   • Promotes cybersecurity awareness in schools and businesses.

3. Penal Code (Amendment) Act (2074)

   • Hacking can lead to 3 months to 5 years in jail.
   • Identity theft is punishable by fine or imprisonment.
   • Child pornography is a serious crime (up to life imprisonment).

4. Data Privacy Laws

   • Companies must protect customer data (e.g., bank details, emails).
   • Unauthorized data collection is illegal (e.g., selling user data without consent).

Cybercrimes and Punishments

---

Ethical Hacking vs. Cybercrime

Ethical hacking (or penetration testing) is legal and helps find security weaknesses before criminals do.

Difference Between Ethical and Unethical Hacking

How ethical hackers work:

1. Get permission from the company/government.
2. Scan for vulnerabilities (weak passwords, unpatched software).
3. Exploit flaws (safely, without causing harm).
4. Report findings and suggest fixes.
5. Get certified (e.g., CEH – Certified Ethical Hacker).

---

Safe Online Practices

Follow these habits to stay safe online:

1. Safe Browsing

• Use HTTPS websites (look for the padlock 🔒 in the browser).
• Avoid downloading pirated software (contains malware).
• Use ad-blockers to reduce tracking.

2. Social Media Security

• Limit personal info (birthdate, address, phone number).
• Check privacy settings (who can see your posts?).
• Avoid accepting friend requests from strangers.

3. Email Security

• Don’t open suspicious emails (even from known contacts—could be hacked).
• Verify sender addresses (e.g., amazon-security@amazon.com is real; amaz0n-support@gmal.com is fake).
• Use email encryption (PGP for sensitive emails).

4. Mobile Security

• Enable device encryption (Android: Settings > Security > Encryption).
• Avoid jailbreaking/rooting (removes security protections).
• Use trusted app stores (Google Play, Apple App Store).

---

NEB Exam-Style Questions and Solutions

Short Answer Questions (2 marks each)

Q1. What is the difference between a virus and a worm? Answer:

---

Q2. Explain two ways to protect against phishing attacks. Answer:

1. Verify the sender’s email address – Check for misspellings (e.g., paypa1.com instead of paypal.com).
2. Never click on suspicious links – Hover over links to see the real URL before clicking.

---

Q3. What is encryption? Give one real-life example. Answer: Encryption is the process of converting plaintext (readable data) into ciphertext (unreadable code) to protect it from unauthorized access. Example: When you visit https://facebook.com, your login details are encrypted using AES or RSA to prevent hackers from stealing them.

---

Long Answer Questions (5-7 marks)

Q4. Describe the CIA triad in cybersecurity. How does a firewall help achieve these goals? Answer: The CIA triad stands for Confidentiality, Integrity, and Availability—the three core goals of cybersecurity.

Example: A company uses a firewall to:

• Block port scanning (confidentiality).
• Prevent malicious traffic from altering databases (integrity).
• Stop DDoS attacks that could take the website down (availability).

---

Q5. Explain the steps an ethical hacker follows to test a company’s security. Why is ethical hacking important? Answer: Ethical hackers follow these steps:

1. Reconnaissance (Info Gathering)

   • Collect information about the target (e.g., website, IP addresses).
   • Use tools like Nmap to scan open ports.

2. Scanning

   • Identify vulnerabilities (weak passwords, unpatched software).
   • Example: Checking if the website uses HTTP (insecure) instead of HTTPS.

3. Gaining Access

   • Exploit weaknesses (e.g., SQL injection, brute force attacks).
   • Note: This is done in a controlled environment with permission.

4. Maintaining Access

   • See if the hacker can stay undetected (e.g., backdoors).

5. Covering Tracks

   • Check if the hacker’s actions can be traced.

6. Reporting

   • Document findings and suggest fixes (e.g., "Update your firewall rules").

Why is ethical hacking important?

• Helps companies find and fix security flaws before criminals exploit them.
• Reduces financial losses from data breaches.
• Builds customer trust (e.g., banks hire ethical hackers to secure transactions).

---

Practical/Application Questions (3-5 marks)

Q6. You received an email claiming to be from your bank, asking you to click a link and verify your account details. What steps will you take to ensure it’s safe? Answer:

1. Check the sender’s email – Is it from the official bank domain (e.g., @bankname.com)?
2. Hover over the link – Does the URL look suspicious (e.g., bank-verification.net instead of bankname.com)?
3. Contact the bank directly – Call the official customer service number (not the one in the email).
4. Never enter passwords on the linked page—open the bank’s website manually.
5. Report the email as phishing to the bank and your email provider.

If in doubt, assume it’s fake!

---

Q7. Explain how encryption works using symmetric and asymmetric keys. Give one advantage and one disadvantage of each. Answer:

Example:

• Symmetric: Encrypting a Word document with AES.
• Asymmetric: Securing email communication (public key encrypts, private key decrypts).

---

Exam Tip: How to Score Full Marks in NEB Exams

1. Understand key terms – Define malware, firewall, encryption, phishing, CIA triad clearly.
2. Compare and contrast – Questions often ask for differences (e.g., virus vs. worm, symmetric vs. asymmetric).
3. Real-life examples – Always give one example when explaining concepts (e.g., WannaCry for ransomware).
4. Diagrams and tables – Draw CIA triad, firewall layers, hacker types to visualize answers.
5. Legal consequences – Mention jail time/fines when discussing cybercrimes in Nepal.
6. Practical steps – For phishing/email safety, list 3-4 clear steps (e.g., verify sender, don’t click links).
7. Ethical hacking process – Remember the 6 steps (reconnaissance, scanning, gaining access, etc.).

Common Mistakes to Avoid: ❌ Vague answers – Instead of "It’s bad," say "Phishing can lead to identity theft and financial loss." ❌ Forgetting Nepal’s laws – Always relate cybercrimes to Electronic Transaction Act or Penal Code. ❌ No examples – If asked about malware, name a type (e.g., Trojan) and give an example (fake game cracks).

---

Final Advice:

• Practice NEB past papers – Focus on short and long questions from previous years.
• Memorize key laws – Know punishments for hacking, fraud, and child pornography.
• Stay updated – Cyber threats evolve; follow CERT Nepal (cert.gov.np) for alerts.

Good luck! 🚀 Secure your digital life and ace your exams!