Information Security and Cyber Law
Core concepts
Learn the CIA triad (confidentiality, integrity, availability) plus authentication, authorization, and non-repudiation. Understand threats and attacks: malware (virus, worm, trojan, ransomware), phishing, social engineering, man-in-the-middle, DoS/DDoS, SQL injection, and cross-site scripting. Know cryptographic basics: symmetric vs asymmetric encryption, hashing, digital signatures, and PKI. Study access control (DAC, MAC, RBAC), firewalls, IDS/IPS, VPNs, and security policies. For cyber law, know the categories of offenses (unauthorized access, data interference, identity theft, cyberstalking, child pornography), the role of digital signatures and certifying authorities, and the general framework of national cyber legislation.
Traps to watch
Encryption provides confidentiality; hashing provides integrity; a digital signature provides authentication and non-repudiation - questions mix these. A virus needs a host; a worm self-replicates across networks; a trojan disguises itself. Symmetric encryption is faster but has key distribution problems; asymmetric solves key exchange but is slower. Phishing targets users, not systems. Do not confuse authentication (who you are) with authorization (what you may do).
Worked example / rule of thumb
A user receives an email asking them to click a link and re-enter a password: this is phishing, a social-engineering attack, not a technical exploit. Rule of thumb: match the control to the goal - encryption for confidentiality, hash for integrity, signature for non-repudiation, firewall for perimeter access control.