Password Strength Checker
Straight from the chapter's preventive controls — "use strong passwords: unique, complex passwords, changed regularly." Type a password below (nothing is stored or sent anywhere) to see how it scores.
Enter a Password → Get Strength
● liveIntroduction
Digital technology is an inevitable part of modern life — from alarm clocks and online classes to digital payments, social media, and e-governance. This deep interconnectivity is called cyberspace: the environment of networks, hardware, software, data, and users where online communication and digital interactions take place.
Cyberspace in Kerala
High digital literacy and initiatives like Akshaya centres, e-District, K-FON, and online education platforms have brought technology closer to citizens — but also brought new risks.
Cyber Security defined
The practice of protecting computers, networks, devices, and data from digital attacks, unauthorized access, damage, or theft — using technologies, rules, and safe practices.
Vulnerability in Cyber Space
Vulnerability refers to weaknesses or gaps in computers, networks, software, or user practices that can be exploited by cyber attackers — making digital systems and data more exposed to threats.
7.2.1 Causes of Vulnerability
Software Vulnerabilities
Bugs & coding mistakes can let attackers sneak in. Outdated software has unpatched security holes. Digital footprints — search history, social media activity, cookies, IP address, location — form a data trail attackers can exploit.
Human Factors
Excessive user privileges let a compromised account cause serious damage. Weak passwords are easily guessed. Lack of awareness leads to clicking fake links. Insider threats come from those who already have access.
Network & Infrastructure Issues
Misconfigured firewalls/routers (e.g. default factory passwords) let attackers bypass protection. Poor security settings, untrusted Wi-Fi/devices, and misconfigured cloud storage can all expose data.
Hardware Vulnerabilities
Outdated/unsupported devices no longer receive security patches. Insecure BIOS settings — if not password-protected — let attackers change system settings or install malware before the OS even starts.
Meaning and Scope of Cyber Security
Cyber security involves protecting information and systems from malicious activities in cyberspace. It is not only about computers — it is also about people, data, and safe behaviour online.
The CIA Triad
| Principle | Meaning | KITE portal example |
|---|---|---|
| Confidentiality | Information accessible only to authorized persons | Only the student can access their own account |
| Integrity | Information should not be altered without permission | Textbook content is not tampered with |
| Availability | Information and services available when needed | The portal stays accessible during exam season |
Supporting Security Objectives
Authentication
Verifies the identity of a user or system — "Who are you?" E.g. username/password, OTP, biometrics (fingerprint, face recognition).
Authorization
Determines what an authenticated user is allowed to do — "What are you allowed to do?" E.g. a student can view marks but not edit them.
Access Control Systems
Enforce authentication + authorization rules together — verify identity, then grant permission based on predefined rules (e.g. banking login + OTP → view balance, but blocked from admin functions).
Non-repudiation
Ensures a user cannot deny performing an action after it has occurred — provides proof of origin/action, vital in digital signatures and online transaction records.
Importance & Types of Cyber Security
India's rapidly growing digital economy — UPI payments, Aadhaar-based services, e-Governance — and Kerala-specific services like SPARK, e-Health Kerala, THANAL, FRIENDS, and K-SMART all depend on secure digital systems. A single cyber attack can affect thousands of citizens, making cyber security a shared responsibility.
Protect sensitive data
Aadhaar, PAN, bank account details, and more.
Prevent fraud
Stops online fraud and scams before they cause harm.
Protect databases
Safeguards government databases from attack.
Build trust
Builds trust and reputation in digital services.
7.5 Different Types of Cyber Security
| Type | Focus | Example |
|---|---|---|
| Network Security | Securing networks from intruders using firewalls, IDS, VPNs | A firewall blocking unauthorized access |
| Application Security | Protecting software/devices — secure coding, checking for weaknesses | Regular patching and updates |
| Information Security | Protects data confidentiality, integrity & availability via encryption, access control | Encrypting sensitive files on a corporate network |
| Endpoint Security | Protects PCs, smartphones, tablets from viruses/malware | Antivirus software, EDR tools |
| Operational Security | Processes/decisions for managing data access permissions | Multi-factor authentication for corporate databases |
| Cloud Security | Protects data, apps & infrastructure in cloud computing | Shared responsibility between provider and client |
Common Cyber Security Threats
Understanding common threats is essential to safeguard digital assets.
Phishing Attacks
Attackers pretend to be trusted sources to deceive people into sharing confidential information — deceptive emails prompting entry of data at a fake website.
Malware
Malicious software designed to damage or exploit a device, service, or network — includes viruses, trojans, worms, spyware.
Ransomware
Takes control of a victim's files/systems and demands a ransom to regain access — often by encrypting data until a decryption key is paid for.
Man-in-the-Middle (MitM)
The attacker covertly intercepts and may modify communications between two parties who think they're connecting directly — common on unsecured Wi-Fi.
Denial-of-Service (DoS)
Blocks users from accessing a machine or network by flooding it with requests — typically targets high-profile web servers (banks, media, government).
Zero-Day Exploits
Exploits a vulnerability before developers are aware of it or before a patch exists — extremely dangerous due to little/no time to fix the flaw.
Insider Threats
Sometimes the risk comes from within — disgruntled employees or contractors with inside access can misuse credentials to steal data or disrupt systems.
Cyber Crimes
Cyber crime refers to illegal activities carried out using computers, mobile devices, or the internet — digital technologies may be the target, the tool, or both.
Roles a Computer Can Play
| Role | Example |
|---|---|
| As a target | Hacking a server, spreading viruses, damaging data |
| As a tool | Sending phishing emails, online fraud, spreading malware |
| As a storage device | Storing stolen data, pirated software, illegal content |
| As a communication medium | Planning crimes through emails, chats, or social media |
7.7.1 Against Individuals
Identity theft
Stealing and misusing personal information to commit fraud.
Email spoofing
Forged headers make an email appear to originate from another source.
Phishing & Pharming
Fake websites (spoofing) trick users into entering info; pharming redirects users via DNS manipulation.
Cyber stalking/bullying
Repeated harassing, threatening, or embarrassing someone via digital platforms.
7.7.2 Against Property
Credit card fraud
Fraud using stolen card numbers or details.
Intellectual property crimes
Software piracy, copyright infringement, trademark violations, theft of source code, and internet time theft.
7.7.3 Against Organizations
7.7.4 Against Governments / Society
Forgery
Currency notes, revenue stamps, mark sheets forged using computers and high-quality scanners/printers.
Cyber terrorism
Using computer resources to intimidate or coerce people and carry out terrorist activities.
Web jacking
Hackers gain control of another's website, sometimes to fulfill a political objective.
Cyber Security Controls
Cyber security controls are tools or steps that help keep computers and data safe — grouped into three types.
1. Preventive Controls
Stop problems before they happen: strong passwords, keeping software updated, multilevel (two-factor) authentication, and firewalls.
2. Detective Controls
Identify and alert when something suspicious is happening or already occurred: antivirus software, and login alerts for new devices.
3. Corrective Controls
Fix problems after they happen: reinstalling a clean OS/app after a virus infection, resetting a hacked password, removing unauthorized users.
Cryptography, Hashing & Digital Signatures
Cyber security focuses on prevention rather than cure. These three concepts work together to ensure secure communication, data integrity, authentication, and trust.
| Concept | What it does |
|---|---|
| Cryptography | Converts readable data (plain text) into an unreadable form (cipher text); only someone with the correct key can decrypt it |
| Hashing | Uses a mathematical function to convert data into a fixed-length "hash" — a unique digital fingerprint verifying data hasn't changed |
| Digital Signatures | Use cryptography and hashing to prove sender identity and ensure a message/document cannot be denied later |
Cyber Security Do's and Don'ts
Simple daily habits that keep individuals and organizations safer online.
| Do's | Don'ts |
|---|---|
| Use strong passwords with letters, numbers and symbols | Don't share passwords/OTPs or reuse the same password everywhere |
| Verify links and emails before clicking | Don't click on unknown or suspicious links |
| Download apps/files only from trusted sources, keep updated | Don't download from untrusted sites or ignore updates |
| Lock devices using PIN, password, or biometrics | Don't leave devices unlocked or unattended |
| Use antivirus software and scan regularly | Don't ignore antivirus warnings or alerts |
| Log out after using shared computers | Don't stay logged in on shared/public computers |
| Use secure networks for online transactions | Don't use public Wi-Fi for banking or sensitive activities |
| Report suspicious messages to a trusted adult/authority | Don't respond to online threats or fake prize messages |
| Backup important data regularly | Don't rely on a single copy of important data |
| Use privacy settings on social media | Don't accept friend requests from unknown people |
Legal and Ethical Behaviour in Cyber Space
Using the internet safely means respecting both the law and unwritten ethical standards.
Legal Behaviour
Following the laws and rules related to computers and the internet — not hacking systems, not spreading viruses, not stealing personal/financial information, not sharing illegal or copyrighted content. The Information Technology Act, 2000 gives legal recognition to electronic records and digital signatures, amended by the IT Amendment Bill, 2008 to strengthen cyber security laws.
Ethical Behaviour
Doing what is morally right, even when there is no direct law — respecting others' privacy, not bullying or harassing people online, not spreading fake news, using digital resources honestly, and giving credit to original creators.
Cyber Security Controls — Comparison
Preventive, detective, and corrective controls work together across the lifecycle of a security incident.
| Control Type | When it acts | Goal | Example |
|---|---|---|---|
| Preventive | Before an incident | Stop attacks from happening | Strong passwords, firewalls, 2FA |
| Detective | During / just after an incident | Identify and alert on suspicious activity | Antivirus scans, login alerts |
| Corrective | After an incident | Restore systems and limit damage | Reinstalling OS, resetting passwords |
Quick Recap
Tap a question to reveal the answer.
What are the three principles of the CIA Triad?
Confidentiality, Integrity, and Availability.
What is the difference between authentication and authorization?
Authentication verifies "Who are you?" (e.g. password + OTP); authorization determines "What are you allowed to do?" once logged in.
What is a digital footprint?
The data trail created when a person uses digital devices and the internet — search history, social media activity, cookies, IP address, location data, etc.
Which type of malware needs a host file to spread?
A virus — unlike a worm, which is self-contained and can spread through networks without needing a host.
What is the difference between phishing and pharming?
Phishing is a direct attack — deceptive emails/fake websites trick users into entering data. Pharming is more like a trap door — users are redirected to fake sites via DNS manipulation, often without clicking anything suspicious.
Which cyber security control fixes problems after they happen?
Corrective controls — e.g. reinstalling a clean OS after a virus infection, or resetting a hacked password.
What does non-repudiation ensure?
That a user cannot deny performing an action after it has occurred — it provides proof of origin and action, important for digital signatures and online transactions.
Name the Indian law that gives legal recognition to electronic records and digital signatures.
The Information Technology Act, 2000 — amended by the IT Amendment Bill, 2008 to strengthen cyber security laws.
What is a salami attack?
A cyber crime where a large amount of money or data is stolen by taking very small amounts repeatedly, so each individual theft goes unnoticed — like slicing thin pieces of salami.
Why should you avoid public Wi-Fi for banking transactions?
Untrusted networks can be intercepted by attackers (Man-in-the-Middle attacks), exposing sensitive data like login credentials or card details as it travels over the network.