Cyber Safety, Ethics and Data Privacy
Cyber Safety, Ethics and Data Privacy tests safe digital behaviour, recognition of social-engineering attacks, protection of personal data and ethical use of information. Expect practical scenarios rather than only definitions.
Core rules and concepts
- Confidentiality, integrity and availability form the CIA triad. Controls include strong unique passwords, multi-factor authentication, updates, antivirus, firewalls and backups.
- Phishing, vishing and smishing use fake messages, calls or SMS to steal credentials or money. Check sender details, links and urgency; verify through an independent channel.
- Personal data includes names, contact details, identifiers, health and financial information. Apply consent, purpose limitation and data minimisation: collect only what is needed and keep it only as long as necessary.
- India's Digital Personal Data Protection Act, 2023 establishes obligations for processing digital personal data. Ethical behaviour also means respecting copyright, not snooping and not sharing another person's information without authority.
- Report suspected incidents promptly; do not investigate by yourself on a production system.
Worked example
An email claims to be from a bank, warns that the account will be blocked in 10 minutes and links to a login page. Cues: unexpected urgency, a link instead of a verified app, and a request to log in. Safer action: do not click; open the bank's official app or type the known website address; contact the bank through an official number. Reasoning: urgency pressures quick action, while independent verification avoids the attacker's channel.
Traps that cost marks
- Believing HTTPS alone proves a site is genuine.
- Sharing an OTP or password with a caller who claims to be support.
- Reusing one password across accounts.
- Posting personal data or client information on social media.