Cyber Safety, Ethics and Data Privacy
What this domain tests
Recognising threats, applying safe practice, and knowing the legal and ethical duties attached to handling other people's data.
Core concepts
- Threats: phishing (fake mail/site harvesting credentials), smishing/vishing (SMS/voice variants), malware (virus, worm, trojan, ransomware), spyware, social engineering, shoulder surfing.
- Controls: strong unique passphrases with multi-factor authentication, updated antivirus, firewall, patched software, encrypted connections (HTTPS, VPN), and regular offline backups.
- Safe habits: verify sender domains, never share OTPs or passwords, lock the screen when leaving, use licensed software, report incidents immediately.
- Legal frame in India: Information Technology Act, 2000 (as amended) - section 66 (computer-related offences), 66C (identity theft), 66D (cheating by impersonation using a computer resource), 67 (obscene material), 72 (breach of confidentiality). Digital Personal Data Protection Act, 2023 governs consent-based processing of personal data.
- Ethics: confidentiality, purpose limitation, consent, minimum necessary data, no personal use of client records, respect for copyright and acknowledgement of sources.
Worked example
An email from '[email protected]' asks you to confirm your card PIN through a link. Reasoning: banks never ask for a PIN; the domain is not the bank's; the message pushes urgency. Do not click - report to the security team and delete. Entering the PIN would be voluntary disclosure, and the bank would still not be liable for your credentials.
Traps that cost marks
- Calling every hacker a criminal; ethical hacking is authorised testing.
- Thinking antivirus alone is enough without patching and backups.
- Quoting the IT Act without the correct section for identity theft.
- Ignoring the confidentiality clause when describing an ITeS workplace.