Chapter 14: Cyber Security
A school office keeps a lot in one computer. Names of students, home addresses, phone numbers of parents, fee records, marks, staff salaries. For years, all of that sat in a steel cupboard, and the only way to reach it was to walk into the room and open a drawer. Now it sits on a hard disk, and the computer is connected to the internet.
That change brings something good and something risky. The good part is that a clerk can find a record in seconds. The risky part is that the drawer is no longer guarded by a wall and a lock. Someone sitting far away, whom nobody in the school has ever met, may try to reach the same file.
Nothing has to be broken open for this to happen. A single click on a convincing email, one pen drive borrowed from a friend, one password written on a sticky note under the keyboard, and the drawer is open.
This chapter is about that new kind of lock, and about the people who try to get past it.
Diagram
Fig. 14.0-1 – a split illustration. Left half: a school office with a steel cupboard, a drawer of paper files, and a clerk holding a key. Right half: the same office with a desktop computer, the files shown as icons on the screen, and a network line running out of the window to a globe, with an unknown figure at a laptop at the far end of the line. Label the left half “Files in a cupboard: one lock, one door” and the right half “Files on a computer: many doors”
The rest of this chapter will answer each of these questions.
14.1 Why Computer Systems Need Protecting
Think about a small shop at the end of your street. At night the owner pulls down the shutter and puts a lock on it. The lock is not there because the shutter is valuable. It is there because of what sits behind the shutter — the stock, the cash box, the record of who owes money.
A computer system is protected for the same reason. What matters is not only the machine. It is what the machine holds and what it can do.
Three things worth protecting
Every computer system has three parts that someone may want to get at, and they are worth naming separately.
The hardware is the physical part you can touch — the computer itself, the screen, the cables, the router on the wall, the pen drive in your pocket. The software is the set of programs that run on it, from the operating system to a billing program written for one particular shop. The data is the information stored and processed by those programs — marks, addresses, photographs, bank balances, sensor readings from a robot.
Losing any one of the three causes a different kind of trouble. If the hardware is taken, the work stops. If the software is damaged, the work stops in a slower and more confusing way. If the data is stolen, the work may carry on perfectly, and nobody notices anything for weeks.
What an attacker can do
Someone who reaches a system they should not have reached can do three broad things with it, shown in Fig. 14.1-1.
Diagram
Fig. 14.1-1 – three side-by-side panels sharing one folder icon labelled “Data”. Panel 1 “Steal”: a copy of the folder being carried away by an unknown figure, the original still in place. Panel 2 “Change”: the folder open with a number being altered from 45 to 95. Panel 3 “Block”: the folder wrapped in a chain and padlock, with the rightful owner locked out
They can steal it, which means copying it and taking the copy away. They can change it, so that the owner keeps using information that is now wrong. Or they can block it, so that the owner cannot reach their own files or their own website at all. The third one is easy to miss. A hospital whose records are locked away is in trouble even if not one line of that data has left the building.
The word for all of this
Protecting hardware, software and data from harm — whether the harm is theft, damage, disturbance or simply someone looking at what they should not — is called cybersecurity.
The word “unauthorized” is doing a lot of work in that sentence. A teacher opening the marks file is normal. The same file opened by someone who was never given permission is a security failure, even if that person changes nothing.
Distance is the new problem
Here is what makes this different from the shop shutter. A thief has to stand in front of a shop to rob it. A person attacking a computer system does not.
If a machine is connected to a network, the attempt can come from another city or another country, from someone who has never seen the building and never will. They can try thousands of times, quietly, at three in the morning, and each failed attempt costs them almost nothing. This is why a lock alone is not enough, and why the rest of this chapter is about many small precautions rather than one big one.
An attacker gets in through a weak point — an old program that was never updated, a password that is easy to guess, a setting left switched on by mistake. Such a weak point is called a vulnerability. Most of the measures you will meet in this chapter are simply ways of leaving fewer of them lying around.
14.2 Cybercrime
Not every problem on a computer is a crime. A file deleted by mistake, a program that crashes, a wrong number typed into a form — these are accidents, and they are fixed rather than reported to the police.
What we are about to look at is different. It is deliberate, it is illegal, and a computer is part of how it is done.
14.2.1 What Cybercrime Is
Any illegal activity in which a computer, a network or a digital system plays a part is called cybercrime. The person who carries it out is called a cybercriminal.
Those three roles are worth separating, because they look quite different from the outside. See Fig. 14.2-1.
Diagram
Fig. 14.2-1 – three labelled panels in a row, each showing a laptop in a different role. Panel 1 “Computer as the tool”: a laptop with an arrow going out to a bank passbook, captioned “used to commit the crime”. Panel 2 “Computer as the target”: an arrow coming in from an unknown figure to a laptop with a cracked screen icon, captioned “the system itself is attacked”. Panel 3 “Computer as the place”: a laptop screen showing a chat window with threatening speech bubbles, captioned “where the harm is done”
The three roles, one at a time
When the computer is the tool, the crime is an old one carried out in a new way. Cheating someone out of money is not a new idea. Doing it through a fake payment page is.
When the computer is the target, the system itself is what the attacker wants — its files, its settings, or simply its ability to keep running. A website pushed offline on the day a company’s results are announced is an attack on the system, not on any one person’s wallet.
When the computer is the place, the harm happens to a person, and the network is merely where it happens. Threatening messages sent to a classmate hurt exactly as much as they would in a corridor.
14.2.2 Whom Cybercrime Affects
It is easy to imagine cybercrime as something that happens to large companies. It reaches much further than that, and it helps to look at the three levels separately.
Individuals
A single person loses money from a bank account, has photographs taken from a phone, or finds an account posting messages they never wrote. The sums involved may be small compared with a company’s losses, but the person affected usually has the least help available and the least idea of what to do next.
Organisations
For a school, a shop, a hospital or a factory, the damage arrives in several forms at once. There is direct financial loss. There is the cost of the work that stops while systems are repaired. There is the loss of information that took years to build up. And there is damage to reputation — once customers learn that their details were taken, they hesitate to hand over any more.
Governments
Here the target is often information rather than money: defence records, tax data, plans that are not meant to be public. Attacks can also be aimed at services that a whole city depends on, such as a power supply or a transport network. When these stop, people who have never touched a computer are affected.
Why the harm spreads
One more thing makes cybercrime hard to contain. Digital harm copies itself easily.
A stolen list of email addresses does not stay with the person who took it. It is sold, copied and used to attack the people on that list, who then face fake messages that look convincing because they contain real details. One break-in at one organisation becomes thousands of separate attempts on individuals, months later and far away.
14.3 Security and Ethical Issues in Computing
Computers raise two kinds of question, and they are not the same question.
The first is a security question: can someone get in who should not? The second is an ethical question: even when nobody breaks a rule, is what is being done fair to the people affected? A pirated copy of a program is a security matter for the company that sold it. A machine that quietly makes a skilled worker’s job dull is not a break-in at all, yet something has been lost.
The nine issues in this section cover both kinds. Some are crimes. Some are matters of responsibility that no lock can solve.
14.3.2 Theft of Software
Software costs a great deal to make and almost nothing to copy. That gap is where this issue lives.
Making, using or passing on a copy of a program without paying for it or being permitted to is theft of software, usually called software piracy. It covers installing one purchased copy on twenty machines, downloading a paid program from a site that has no right to offer it, and sharing a licence key with friends.
Students often feel this is a small matter, because the shop still has its copy and nobody seems poorer. But what was bought was never the file. It was permission to use the program under stated conditions, and that permission is what has been taken.
Pirated software carries a practical risk too. A copy that has been altered to bypass its licence check has also been altered in ways the user cannot see, and such copies are a common way for harmful software to reach a computer.
14.3.3 Disputed Rights to Products
The previous issue was about copying something whose owner is clear. This one is about arguing over who the owner is in the first place.
Digital work — a program, a song, a design, a photograph, a database, the text of a book — can be copied perfectly, edited, combined with other work and published in minutes. So disputes arise constantly. Who owns a program written by an employee at home on a Sunday? Who owns a tune that closely resembles an older one? Who owns a photograph edited by someone else and posted with no name attached?
Rights over creations of the mind are called intellectual property, and taking or using someone’s work without permission is intellectual property theft.
14.3.4 The Use of Computers to Commit Fraud
Fraud means getting money or an advantage by deceiving someone. Computers have not changed what fraud is. They have changed how many people one person can attempt it on.
The most common form you will meet is phishing. An attacker sends a message — an email, an SMS, a chat — that pretends to come from a bank, a delivery company, a government office or a school. It asks the reader to click a link and enter a password, a card number or a one-time code on a page that looks like the real one. Nothing is broken into. The victim hands the details over.
Look at Fig. 14.3-2, which shows the parts of such a message that usually give it away.
Diagram
Fig. 14.3-2 – a mock email on screen with four callout labels pointing at it. Label 1 at the sender line: “address is slightly wrong”. Label 2 at the subject: “creates urgency — ‘account closing today’”. Label 3 at the body: “asks for a password, PIN or OTP”. Label 4 at the link: “link text and real destination do not match”. No real bank name is used anywhere in the figure
The pattern behind all four is the same. A real organisation does not need your password, because it already knows what your account holds. And a real deadline does not arrive as a surprise in a message that pushes you to act before you can check.
Once details are captured, they may be used directly, or used for identity theft — pretending to be that person in order to open accounts, make purchases or claim services in their name. Details such as Aadhaar numbers, PAN numbers and bank account numbers are valuable to an attacker for exactly this reason.
14.3.5 The Phenomenon of Hacking and Data Theft
Hacking means gaining access to a computer system or network without permission. Sometimes it is done through a technical weakness in a program, sometimes through a guessed or stolen password, and sometimes by persuading a person to open the door, as in phishing.
What follows the entry is usually data theft — copying information out of the system. The information taken depends on where the attacker landed: customer lists, medical records, examination papers, design files, login details for other systems.
Two features of data theft make it especially difficult to deal with.
The first is that it is silent. Nothing goes missing, so an organisation may not notice for months. The second is that stolen data is easy to pass on. Much of it ends up being traded on the dark web, a part of the internet reachable only with special software, where stolen records, along with drugs and weapons, are bought and sold.
When the same activity is aimed at a government’s or a company’s secret information — defence plans, research, trade secrets — it is called cyber espionage. The method is the same; the target and the motive are different.
14.3.6 Sabotage in the Form of Viruses
Sabotage means deliberately damaging something so that it stops working properly. On a computer, this is usually done with malware — software written to damage, disturb or take control of a system.
Several kinds are worth telling apart, because they spread differently:
- A virus attaches itself to a file or a program and is carried to another computer when that file is copied or shared.
- A worm needs no file to travel in and no person to help it. It copies itself across a network on its own.
- A trojan arrives disguised as something useful — a game, a free tool, a document — and does its real work once it is run.
- Spyware stays hidden and quietly records what the user types, opens or visits.
- Ransomware locks the owner’s own files by encrypting them, and demands a payment in exchange for unlocking them.
Sabotage does not always need malware at all. In a Distributed Denial-of-Service (DDoS) attack, a website or server is flooded with so much traffic from so many machines at once that it can no longer answer the people who genuinely want to use it. Nothing is stolen and nothing is damaged. The service simply stops, which for an online business is damage enough.
At its most serious, sabotage aimed at services a whole population depends on — power supply, transport, hospitals — with the aim of causing fear or disruption, is called cyberterrorism.
14.3.7 Responsibility for the Reliability of Output
The issues so far involved an attacker. This one needs nobody at all.
A computer produces an answer, the answer is wrong, and it is acted upon. A bill charges twice what it should. A list of eligible students leaves out a name. A robot’s controller reads a faulty sensor and drives into a wall. The machine did exactly what it was told; the output is still wrong.
Output goes wrong for reasons that are all human in origin. The data going in may be wrong or out of date. The program may contain a mistake in its logic. The rules it follows may have been correct once and never updated. Or it may be used for a purpose it was never designed for.
14.3.8 Making False Claims for Computers
Computer systems are also sold with claims about what they can do, and those claims are not always honest.
A system may be advertised as able to spot every fraudulent transaction, mark answer scripts as well as a teacher, predict which student will do well, or catch every piece of malware. Such claims are attractive because they promise to remove an uncertainty that people find uncomfortable. They are also usually beyond what the system was ever tested to do.
The harm is not just a wasted purchase. When people believe a claim, they stop checking. A school that trusts an “always accurate” system stops looking at its output, and a mistake that would once have been caught now goes straight through to a student.
An honest claim is a narrow one. It says what the system was tested on, how well it did on that test, and where it is likely to fail. A claim with no conditions attached is a warning sign in itself.
14.3.9 The Degradation of Work
The last issue is about the people who work alongside these systems.
When a computer takes over part of a job, the part left for the person can become poorer than the job was before. A skilled clerk who once handled a whole case may end up only typing figures into boxes. A driver whose route is chosen and timed by an app has less say over their own day than before. The work is still there, but the judgement, the variety and the control have been taken out of it.
There is a second effect. A skill that is not used regularly fades. When the system fails — and every system eventually does — the people expected to take over may no longer have the practice they once had.
None of this is an argument against automation. It is an argument about how it is introduced. A well designed system takes over the repetitive part and leaves the person the decisions, gives them a way to override it, and keeps them practised enough to work without it when they must.
14.4 Cyberbullying and Cyberstalking
Most of the issues in the previous section were aimed at systems, money or information. Two are aimed straight at a person.
Using digital platforms to harass, insult, threaten or humiliate someone, usually again and again over a period of time, is called cyberbullying. It happens most often between people who already know each other — classmates, teammates, neighbours — which is part of what makes it hard to escape.
Following, watching and repeatedly contacting one particular person through digital means, without their wanting it, is called cyberstalking. Here the attention is fixed on one individual and continues over a long stretch of time. It may involve monitoring what they post, tracking where they are, or contacting them again from new accounts each time they are blocked.
The two overlap, but they are not the same thing, as Table 14.1 sets out.
Why the online form is harder to shake off
Unkindness between people is not new. Three things change when it moves onto a network.
It follows the person home. A corridor can be walked away from; a phone sits on the study table and buzzes at ten at night. There is no point in the day at which it stops.
It has an audience and a memory. A remark made aloud fades. A screenshot does not, and it can be forwarded to hundreds of people the target has never met.
And the person doing it may be hidden. An account can carry any name at all, which makes some people say things they would never say to a face — and makes the target feel there is no one to answer.
Its effect on a person
Being targeted this way is not a small thing, and it is not weakness to be affected by it. People experiencing it often feel anxious and ashamed, lose sleep, find it hard to concentrate on schoolwork, and begin avoiding places and people they used to enjoy. Distress of this kind can become serious, and it is the reason none of it should be carried alone.
What to do about it
If it is happening to you, or to someone you know, the steps in Fig. 14.4-1 are the ones that actually help.
Diagram
Fig. 14.4-1 – five steps drawn as a horizontal chain of boxes with arrows. Box 1 “Do not reply” with a crossed-out speech bubble. Box 2 “Save the evidence” with a screenshot icon showing a saved message and a date. Box 3 “Block and report the account” with a shield and a platform report icon. Box 4 “Tell a trusted adult” with a student talking to a parent and a teacher. Box 5 “Report formally if it continues” with a document going to a cybercrime portal
Do not reply. A reply is what the person is waiting for, and an angry answer can later be used to claim that both sides were at fault.
Save the evidence before anything is deleted. Screenshots that show the message, the account name and the date and time are what any report will rest on.
Block the account and report it to the platform, which can remove content and close accounts.
Tell a trusted adult — a parent, a class teacher, a counsellor. This is the step people skip, usually from embarrassment or from a fear that their phone will be taken away. It is also the step that changes the outcome, because an adult can act in ways a student cannot.
If it continues or involves threats, it can be reported formally. In India, cybercrime complaints can be filed on the National Cyber Crime Reporting Portal at cybercrime.gov.in, and there is a national helpline number, 1930, for reporting cyber financial fraud.
14.5 Measures to Prevent Cybercrimes
There is no single measure that stops cybercrime, and anyone selling one is making the kind of claim you met in section 14.3.8.
What works is layers. If a password is stolen, a second check should still stand in the way. If harmful software gets in, an updated system should give it less to work with. If data is copied, encryption should make the copy useless. Each layer is imperfect on its own, and that is exactly why more than one is used.
The measures fall into four groups: technical, legal, educational, and the newer tools built on artificial intelligence and related technologies.
14.5.1 Strengthening Cybersecurity Infrastructure
This first group is the technical one — the settings, the software and the checks that make a system harder to get into.
Use strong authentication
Authentication is the process of proving that you are who you claim to be. A password does this on its own, badly, because a password can be guessed, copied or handed over by mistake.
Multi-factor authentication (MFA) asks for two or more different kinds of proof before letting anyone in, as shown in Fig. 14.5-1. Typically these are something you know, such as a password; something you have, such as a phone that receives a code; and something you are, such as a fingerprint.
Diagram
Fig. 14.5-1 – three keys in a row, each opening one of three locks on a single door. Key 1 labelled “Something you know — password or PIN”. Key 2 labelled “Something you have — phone receiving a one-time code”. Key 3 labelled “Something you are — fingerprint or face”. Caption line under the door: “the door opens only when more than one lock is opened”
The point of MFA is what it does after a failure. An attacker who has stolen a password still has nothing, because the password alone no longer opens anything.
Passwords still matter underneath it. A password that is long, unusual and different for every account is far harder to work through than a short one reused everywhere. Reuse is the real danger: one leaked password from a small forgotten website becomes a key tried against every other account with the same email address.
Keep systems updated
Software is repaired after it is sold. When a weakness is found in an operating system, a browser or an app, the makers release a security patch — a correction that closes it.
Here is the uncomfortable part. Once a patch is released, the weakness it fixes becomes public knowledge, and attackers know exactly what to look for on machines that have not installed it yet. An old, unpatched system is not merely less protected. It is advertised.
Install firewalls and anti-malware
A network needs a guard at its boundary, deciding which traffic may cross and which may not. That guard is a firewall.
Alongside it sit antivirus and anti-malware programs, which examine files and running programs for known harmful software and for behaviour that resembles it. Their honest limitation is that something entirely new may not be recognised until it has been seen and studied somewhere.
Encrypt data
Encryption turns readable data into a scrambled form that can be turned back only with the correct key. Data is encrypted both at rest — sitting on a disk — and in transit, while travelling across a network.
This is the layer that assumes the others have failed. If a laptop is stolen or a message is intercepted, encrypted contents are of no use to whoever has them.
Watch the network
Large networks are monitored by an intrusion detection system (IDS), which studies traffic and raises an alert when something looks unusual, and by an intrusion prevention system (IPS), which goes one step further and blocks the suspicious traffic itself.
Both work by comparing what is happening now against what normal traffic on that network looks like. A sudden burst of login attempts at four in the morning, or a large volume of data leaving a machine that never sends anything, is the kind of pattern they exist to catch.
Test and audit
Two checks make sure the rest is actually working.
In penetration testing, an organisation employs security specialists to attack its own systems, with written permission, and report every weakness they find. It is the digital version of hiring someone to try the locks on your own building.
A security audit is a regular, planned review of policies, settings and access rights — who can reach what, whether old accounts were closed, whether the rules written two years ago are still being followed.
14.5.2 Legal and Regulatory Measures
Technical measures make an attack harder. The law decides what happens when one succeeds.
Countries define cybercrimes and their penalties in law, and keep updating those laws, because the methods change faster than any statute written a decade ago anticipated. India’s principal law in this area is the Information Technology Act, 2000, which has been amended since.
Cybercrime rarely stays inside one country. An attacker in one place, a server rented in a second, a victim in a third — this is normal rather than unusual. So investigation depends on international cooperation between police forces and governments, which is slow but is often the only route to the people responsible.
Many countries also place incident reporting requirements on organisations, obliging them to report a data breach or an attack to the authorities promptly. This matters for two reasons: quick reporting limits the damage, and it lets others be warned about a method that is being used right now.
Finally, police forces set up specialised cybercrime units, staffed by people trained to handle digital evidence, because a case built on records inside a computer needs skills that ordinary investigation does not teach.
14.5.3 Public Awareness and Education
Look back at how phishing works. No firewall was crossed and no password was cracked; a person was persuaded to hand over a detail. Against that, the defence has to be the person.
Raising awareness means making sure people know what the common threats look like — a message creating false urgency, an unexpected attachment, a page asking for an OTP — before they meet one.
Promoting safe practices turns that knowledge into habits: distinct passwords for different accounts, care before clicking a link, thinking twice about how much personal information goes into a public post, and locking a computer before walking away from it.
Regular training goes further, and in organisations it is the single most effective measure against phishing. Staff are shown current examples, taught what to do when something looks wrong, and — importantly — told whom to inform. A person who reports a suspicious message within minutes turns one mistake into a warning for everybody else.
14.5.4 Use of Advanced Technologies
The last group is the newest, and it is where this chapter meets the rest of your work in artificial intelligence.
Artificial intelligence and machine learning
Security teams face a volume problem. A large network produces more records in an hour than a person could read in a year, and an attack shows up as a small oddity buried in all of it.
This is work that machine learning suits. A model is trained on what ordinary activity on that network looks like, and then flags what does not fit — a login from an unusual place, a file being copied at an unusual hour, traffic to a destination the network has never contacted. The system does not know that an attack is happening. It computes that the current pattern is far from the patterns it was trained on, and passes that to a human analyst to judge.
Its limitations follow directly from how it works. It will flag harmless unusual events, and a genuinely new method that resembles ordinary traffic may not stand out at all. It narrows the search; it does not end it.
Blockchain for security
A blockchain stores records in a chain of blocks, where each block carries a mathematical fingerprint of the one before it, and the whole chain is held on many computers at once rather than in one place.
That structure makes quiet tampering very hard. Changing an old record changes its fingerprint, which breaks every link after it, and the copies held elsewhere no longer agree. It is being used where the question “has this record been altered since it was written?” really matters — financial transactions, supply chain records, and health records.
It is not a general answer to security. A blockchain protects a record after it is written; it cannot tell whether what was written was true in the first place, and it does nothing about stolen passwords or a tricked user.
14.6 Summary
- Every computer system has three things worth protecting: the hardware you can touch, the software that runs on it, and the data it stores and processes.
- Someone who reaches a system without permission can steal data, change it, or block the owner from using it. All three cause harm, even though only one of them takes anything away.
- Cybersecurity is the practice of protecting computer systems, networks and the data they hold from unauthorized access, damage or disruption. A weak point that lets an attacker in is called a vulnerability.
- Because a network carries an attack across any distance, an attacker never has to be near the machine, and can try again and again at almost no cost.
- Cybercrime is illegal activity in which a computer, network or digital system is the tool of the crime, the target of the crime, or the place where it happens.
- What makes an act a cybercrime is permission and intention together — acting without the right to do so, and meaning to do it. An accident or a hardware failure is not a crime.
- Cybercrime harms individuals, organisations and governments, and its effects spread because stolen data is easily copied, sold and used in later attacks.
- Unauthorized use of hardware includes using a machine left logged in, fitting a skimming device to a card reader, and plugging an unknown pen drive into a computer.
- Theft of software, or software piracy, means using or passing on a program without permission. What is bought is the right to use the program, not the file itself.
- Disputed rights to products arise because digital work is easy to copy, edit and republish. Rights over creations of the mind are called intellectual property.
- Computers are used to commit fraud, most commonly through phishing, where a message pretending to come from a trusted organisation asks the reader to give up a password, a card number or an OTP. Details obtained this way are often used for identity theft.
- Hacking means gaining access to a system without permission, and it is usually followed by data theft. Stolen records are frequently traded on the dark web. The same activity aimed at government or corporate secrets is called cyber espionage.
- Sabotage is carried out with malware — viruses, worms, trojans, spyware and ransomware — and also through DDoS attacks, which flood a service with traffic until it can no longer answer real users. Attacks meant to cause fear or widespread disruption are called cyberterrorism.
- Responsibility for the reliability of output rests with people, not machines. Wrong output comes from wrong data, a mistake in the program, outdated rules, or use for a purpose the system was never designed for.
- False claims for computer systems are harmful because people who believe them stop checking. An honest claim states what was tested, how well it worked, and where it is likely to fail.
- Degradation of work happens when automation leaves a person only the dull part of a job, removes their judgement, and lets a skill fade that will be needed when the system fails.
- Cyberbullying is repeated harassment or humiliation through digital platforms. Cyberstalking is persistent, unwanted following and contact aimed at one particular person.
- The steps that help are: do not reply, save evidence, block and report the account, tell a trusted adult, and make a formal report if it continues.
- Technical measures include multi-factor authentication, keeping systems updated with security patches, firewalls and anti-malware, encryption of data at rest and in transit, intrusion detection and prevention, penetration testing and regular security audits.
- No single measure is enough. Security works in layers, so that a failure in one is caught by the next.
- Legal measures include cybercrime laws, international cooperation between countries, incident reporting requirements, and specialised cybercrime units within the police.
- Awareness, safe habits and regular training are the strongest defence against phishing, because a phishing message breaks no technical rule and is stopped only by the person reading it.
- Machine learning is used to flag unusual activity in volumes of network records too large for a person to read, but it raises false alarms and cannot recognise every new method.
- Blockchain links records so that altering an old one breaks the chain, which makes quiet tampering easy to detect. It protects a record after it is written, not the truth of what was written.
14.7 Key Terms
Antivirus — a program that examines files and running software for known harmful software and for behaviour resembling it.
Authentication — the process of proving that a user really is who they claim to be, for example by a password, a code sent to a phone, or a fingerprint.
Blockchain — a way of storing records in a chain of linked blocks, held on many computers at once, so that altering an old record breaks the links after it and becomes visible.
Cyber espionage — spying on individuals, companies or governments through computer systems to steal secret information, usually for political or economic gain.
Cyberbullying — the use of digital platforms to harass, insult, threaten or humiliate someone, usually repeatedly over a period of time.
Cybercrime — illegal activity in which a computer, a network or a digital system is the tool of the crime, its target, or the place where it happens.
Cybercriminal — a person who carries out a cybercrime.
Cybersecurity — the practice of protecting computer systems, networks and the data they hold from unauthorized access, damage or disruption.
Cyberstalking — persistent, unwanted watching, following or contacting of one particular person through digital means.
Cyberterrorism — digital attacks meant to create fear, disrupt services a population depends on, or cause widespread harm, usually for political or ideological reasons.
Dark web — a hidden part of the internet reachable only with special software, often used for trading stolen data and other illegal goods.
Data — the information a computer system stores and processes, such as marks, addresses, bank balances or sensor readings.
Data theft — copying information out of a system without permission, usually after unauthorized access has been gained.
Distributed Denial-of-Service (DDoS) — an attack in which a server, website or network is flooded with traffic from many machines at once until it can no longer serve genuine users.
Encryption — turning readable data into a scrambled form that can be turned back only with the correct key.
Firewall — a barrier in software or hardware that checks traffic entering or leaving a network against a set of rules and stops whatever is not allowed.
Hacking — gaining access to a computer system or network without permission.
Hardware — the physical parts of a computer system, such as the machine itself, its cables, a router or a pen drive.
Identity theft — pretending to be another person, using their stolen personal details, in order to open accounts, make purchases or claim services in their name.
Intellectual property — rights held over creations of the mind, such as a program, a song, a design, a photograph or a piece of writing.
Intrusion detection system (IDS) — a system that studies network traffic and raises an alert when the pattern of activity looks unusual.
Machine learning — a way of building systems that learn patterns from data rather than being given every rule in advance; in security it is used to flag activity that does not fit ordinary patterns.
Malware — software written to damage, disturb or take unauthorized control of a computer system.
Multi-factor authentication (MFA) — a login check that asks for two or more different kinds of proof, so that a stolen password alone opens nothing.
Penetration testing — attacking an organisation’s own systems on purpose, with written permission, in order to find and report weaknesses before an attacker does.
Phishing — a message pretending to come from a trusted organisation, designed to make the reader give up a password, a card number or a one-time code.
Ransomware — malware that encrypts the owner’s files and demands a payment in exchange for unlocking them.
Security audit — a regular, planned review of a system’s policies, settings and access rights to check that its protections are still in place and still followed.
Security patch — a correction released by the makers of a program to close a weakness found in it after release.
Skimming device — an illegal reader fitted over a real card slot on an ATM or payment terminal to capture card details as a card is used.
Software — the programs that run on a computer system, from the operating system to a single application.
Software piracy — using, copying or passing on a program without paying for it or being permitted to.
Spyware — malware that stays hidden and quietly records what a user types, opens or visits.
Trojan — malware disguised as something useful, which does its real work once the user runs it.
Virus — malware that attaches itself to a file or program and travels to another computer when that file is copied or shared.
Vulnerability — a weak point in a system, such as an unpatched program or a guessable password, through which an attacker can get in.
Worm — malware that copies itself across a network on its own, needing neither a file to travel in nor a person to help it.
14.8 Objective Questions
Fill in the blank: A weak point in a system, such as a program that was never updated or a password that is easy to guess, is called a ________.
Expand the following short forms as used in this chapter:
- MFA
- DDoS
- IDS
Choose the correct option: The billing computer in a shop stops working because its power supply has failed. This is best described as:
- Hacking
- A DDoS attack
- Sabotage using malware
- A hardware failure, and not a cybercrime
Choose the correct option: A message says an account will be closed within one hour unless the reader opens a link and enters a one-time code. This is an example of:
- A security audit
- Phishing
- Penetration testing
- Encryption
State whether each statement is true or false:
- A firewall can stop harmful software that arrives on a pen drive.
- In a DDoS attack, the attacker’s aim is to copy data out of a server.
- Software that is given away free by the people who wrote it is the same as pirated software.
Match each kind of malware in the first column with the way it reaches or affects a system in the second column:
| Kind of malware | How it works |
|---|---|
| a. Worm | i. Arrives disguised as something useful and acts when it is run |
| b. Trojan | ii. Encrypts the owner’s files and demands payment to unlock them |
| c. Spyware | iii. Copies itself across a network without needing a file or a person |
| d. Ransomware | iv. Stays hidden and records what the user types and opens |
- Choose the correct option: Which measure still protects an account after its password has been stolen?
- Multi-factor authentication
- A longer password
- An antivirus program
- A regular security audit
14.9 Concept Questions
Define cybercrime. State the three roles a computer can play in one, and give one example of each.
Two students use the same laptop. One opens a file she was given access to; the other opens the same file after guessing a colleague’s password, reads it and changes nothing. Explain which of the two has committed a cybercrime, and why.
State two differences between cyberbullying and cyberstalking.
A pirated copy of a paid program takes nothing away from the shop that sells it. Explain why it is still called theft of software, and state one practical risk of using such a copy.
Using the letter-shift rule from this chapter, in which every letter moves three places forward in the alphabet, work out the scrambled form of the word SENSOR. Show each letter’s change, and state how the original word would be recovered.
A water bill printed by a municipal system charges a household three times its usual amount. Explain who is responsible for the wrong output and why, and give two reasons a correct program can still produce a wrong result.
A company advertises a security system that “detects every attack, with no false alarms”. Explain why such a claim should be treated with caution, and state one honest limitation of using machine learning to spot attacks.
14.10 Case-Based Questions
- A school office keeps its student records — names, addresses, parents’ phone numbers and fee details — on one desktop computer connected to the internet. A visit by a security consultant finds the following practices in the office:
- All three clerks log in with the same username and password.
- The computer is left logged in when a clerk steps out for lunch.
- Software updates are postponed each time they appear, because they slow the machine down.
- A copy of the records is carried home on a pen drive, unencrypted, so that work can continue in the evening.
Answer the following: a. For any three of these practices, state the risk each one creates. b. Suggest one technical measure for each of the three risks you chose. c. If the records were copied by an outsider, name two groups of people affected, and state what the school owes each of them.
- A shopkeeper in a small town takes payments through a card machine and keeps a customer list on the shop laptop. One morning he receives an SMS saying his payment account will be suspended unless he confirms his card details through a link. That afternoon, a customer complains that money was taken from her card after she paid at his shop the previous week.
Answer the following: a. Name the kind of cybercrime the SMS is an attempt at, and give two signs the shopkeeper could check before acting on it. b. Suggest what may have been fitted to the card machine to cause the customer’s loss, and explain how it would work without the customer noticing. c. List three measures the shopkeeper should put in place to protect the customer list on his laptop.