Computer Security and Cyber Law
What this domain tests
Security questions test the CIA triad, cryptographic primitives, common attacks and controls, and the provisions of the Indian IT Act 2000 with its amendments, plus the data protection framework.
Cryptographic building blocks
Confidentiality, integrity and availability form the CIA triad. Symmetric ciphers such as AES are fast but need secure key distribution; asymmetric algorithms such as RSA and ECC are slow but solve key exchange and enable signatures. A hash such as SHA-256 is one-way and fixed-length and provides integrity, not secrecy. A digital signature is the hash encrypted with the sender's private key, giving integrity, authentication and non-repudiation; confidentiality needs separate encryption.
Attacks and controls
Common threats include phishing, malware, SQL injection, cross-site scripting, man-in-the-middle and denial of service. Controls include input validation and parameterised queries, least privilege, patching, firewalls, and IDS or IPS monitoring.
Indian cyber law essentials
IT Act 2000: Section 43 covers damage to computers and data; 65 covers tampering with source documents; 66 covers computer-related offences; 66C identity theft; 66D cheating by impersonation; 66E privacy violation; 66F cyber terrorism; 67 obscene material; 69 interception powers; 72 breach of confidentiality. Section 66A was struck down in Shreya Singhal v. Union of India (2015) and cannot be used. The DPDP Act 2023 governs personal data, and CERT-In is the national nodal agency for incident response.
Worked example
A sender wants to prove a message came from them and was unchanged. Steps: hash the message, encrypt the hash with the sender's private key, attach it, and the receiver decrypts with the sender's public key and recomputes the hash. Matching values prove integrity and origin; the message itself is still readable unless separately encrypted.
Traps that cost marks
- Treating hashing as encryption or as reversible.
- Citing Section 66A as valid law.
- Claiming a digital signature alone gives confidentiality.
- Relying on a firewall to stop insider misuse or malware.