Cyber Safety, Ethics and Data Privacy
This domain tests whether you can identify an attack, name it correctly, and cite the right law and reporting channel - plus whether you behave ethically with other people's data.
Core rules
- Malware: virus (needs a host file), worm (self-propagates across networks), trojan (disguised as useful), ransomware (encrypts data and demands payment), spyware/keylogger (steals input).
- Attack channels: phishing (email), vishing (voice call), smishing (SMS), pharming (DNS redirection).
- Warning signs: urgency, poor grammar, shortened links, unexpected attachments, requests for OTP or PIN.
- Password hygiene: length over complexity, unique per site, a manager, and two-factor authentication. No genuine bank asks for an OTP.
- UPI fraud patterns: collect requests, scanning a QR code to receive money, remote-access apps during screen sharing.
- Law: IT Act 2000 - s.66C identity theft, s.66D cheating by impersonation, s.66E privacy violation, s.67 obscene material; SPDI Rules 2011; DPDP Act 2023 (consent, purpose limitation, data-principal rights).
- Report at cybercrime.gov.in or helpline 1930 for financial fraud, ideally within the golden hour. Ethics: no plagiarism, respect software licences, no unauthorised access.
Worked example
An SMS says the KYC expires today and asks you to click a shortened link and enter the OTP. Indicators: manufactured urgency, shortened URL, OTP request, wrong sender ID. Correct action: do not click, do not reply, report and delete, and contact the bank on its official number.
Traps that cost marks
- Believing HTTPS makes a link safe.
- Treating 1930 as a general police helpline - it is the financial-fraud line.
- Confusing the DPDP Act 2023 with the IT Act 2000.
- Assuming antivirus removes every threat, including insider data misuse.