DIGITAL NOTES
ON
CYBER SECURITY
(R18A0521)
B.TECH III YEAR – II SEM (R18)
(2020-2021)
DEPARTMENT OF INFORMATION TECHNOLOGY
MALLA REDDY COLLEGE OF ENGINEERING & TECHNOLOGY
(Autonomous Institution – UGC, Govt. of India)
Recognized under 2(f) and 12 (B) of UGC ACT 1956
(Affiliated to JNTUH, Hyderabad, Approved by AICTE - Accredited by NBA & NAAC – ‘A’ Grade - ISO 9001:2015 Certified)
Maisammaguda, Dhulapally (Post Via. Hakimpet), Secunderabad – 500100, Telangana State, India
CYBER SECURITY Page 1
MALLA REDDY COLLEGE OF ENGINEERING AND TECHNOLOGY
III Year B.Tech II Sem L T/P/D C
3 -/-/- 3
(RA18A0521) CYBER SECURITY
(Professional Elective 2)
Course objectives:
To understand various types of cyber-attacks and cyber-crimes
To learn threats and risks within context of the cyber security
To have an overview of the cyber laws & concepts of cyber forensics
To study the defensive techniques against these attacks
UNIT -I
Introduction to Cyber Security: Basic Cyber Security Concepts, layers of security,
Vulnerability, threat, Harmful acts, Internet Governance – Challenges and Constraints,
Computer Criminals, CIA Triad, Assets and Threat, motive of attackers, active attacks,
passive attacks, Software attacks, hardware attacks, Cyber Threats-Cyber Warfare, Cyber
Crime, Cyber terrorism, Cyber Espionage, etc., Comprehensive Cyber Security Policy.
UNIT - II
Cyberspace and the Law & Cyber Forensics: Introduction, Cyber Security Regulations,
Roles of International Law. The INDIAN Cyberspace, National Cyber Security Policy.
Introduction, Historical background of Cyber forensics, Digital Forensics Science, The
Need for Computer Forensics, Cyber Forensics and Digital evidence, Forensics Analysis
of Email, Digital Forensics Lifecycle, Forensics Investigation, Challenges in Computer
Forensics
UNIT - III
Cybercrime: Mobile and Wireless Devices: Introduction, Proliferation of Mobile and
Wireless Devices, Trends in Mobility, Credit card Frauds in Mobile and Wireless
Computing Era, Security Challenges Posed by Mobile Devices, Registry Settings for
Mobile Devices, Authentication service Security, Attacks on Mobile/Cell Phones,
Organizational security Policies and Measures in Mobile Computing Era, Laptops.
UNIT- IV
Cyber Security: Organizational Implications: Introduction, cost of cybercrimes and IPR
issues, web threats for organizations, security and privacy implications, social media
marketing: security risks and perils for organizations, social computing and the associated
challenges for organizations.
CYBER SECURITY Page 2
UNIT - V
Privacy Issues: Basic Data Privacy Concepts: Fundamental Concepts, Data Privacy
Attacks, Datalinking and profiling, privacy policies and their specifications, privacy policy
languages, privacy in different domains- medical, financial, etc
Cybercrime: Examples and Mini-Cases
Examples: Official Website of Maharashtra Government Hacked, Indian Banks Lose
Millions of Rupees, Parliament Attack, Pune City Police Bust Nigerian Racket, e-mail
spoofing instances. Mini-Cases: The Indian Case of online Gambling, An Indian Case
of Intellectual Property Crime, Financial Frauds in Cyber Domain.
TEXT BOOKS:
1. Nina Godbole and SunitBelpure, Cyber Security Understanding Cyber
Crimes,Computer Forensics and Legal Perspectives,Wiley
2. B.B.Gupta,D.P.Agrawal,HaoxiangWang,ComputerandCyberSecurity:Principle
s, Algorithm, Applications, and Perspectives, CRC Press, ISBN
9780815371335,2018.
REFERENCES:
1. Cyber Security Essentials, James Graham, Richard Howard and Ryan Otson,
CRCPress.
2. Introduction to Cyber Security, Chwan-Hwa(john) Wu,J. David Irwin, CRC Press
T&FGroup.
Course Outcomes:
The students will be able to:
1. Analyze cyber-attacks, types of cybercrimes, cyber laws and also how to protect
them self and ultimately the entire Internet community from such attacks.
2. Interpret and forensically investigate security incidents
3. Apply policies and procedures to manage Privacy issues
4. Design and develop secure software modules
CYBER SECURITY Page 3
MALLA REDDY COLLEGE OF ENGINEERING & TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY
S. No Topic Page no
Unit
I
1 Cyber security introduction -Basics 5
I
2 Layers of Security 9
I Security vulnerabilities, threats and Attacks
3 11
I
4 Cyber Threats-Cyber-Warfare 16
II
5 Cyberspace and the Law & Cyber Forensics 19
II
6 National Cyber security Policy 22
II
7 Cyber Forensics 23
III
8 Cybercrime-Mobile and wireless devices 30
III
9 Security Challenges proposed by Mobile devices 34
IV
10 Cyber security-Organizational Implications
IV
11 Social Media Marketing
V
12 Privacy Issues-Data Privacy attacks
V
13 Privacy Policy Languages
CYBER SECURITY Page 4
UNIT-I
Introduction to Cyber Security
Cyber Security Introduction - Cyber Security Basics:
Cyber security is the most concerned matter as cyber threats and attacks are overgrowing.
Attackers are now using more sophisticated techniques to target the systems. Individuals,
small-scale businesses or large organization, are all being impacted. So, all these firms
whether IT or non-IT firms have understood the importance of Cyber Security and focusing
on adopting all possible measures to deal with cyber threats.
What is cyber security?
"Cyber security is primarily about people, processes, and technologies working together to
encompass the full range of threat reduction, vulnerability reduction, deterrence, international
engagement, incident response, resiliency, and recovery policies and activities, including
computer network operations, information assurance, law enforcement, etc."
OR
Cyber security is the body of technologies, processes, and practices designed to protect
networks, computers, programs and data from attack, damage or unauthorized access.
The term cyber security refers to techniques and practices designed to protect digital
data.
The data that is stored, transmitted or used on an information system.
OR
Cyber security is the protection of Internet-connected systems, including hardware, software,
and data from cyber attacks.
It is made up of two words one is cyber and other is security.
Cyber is related to the technology which contains systems, network and programs or
data.
Whereas security related to the protection which includes systems security, network
security and application and information security.
Why is cyber security important?
Listed below are the reasons why cyber security is so important in what’s become a
predominant digital world:
Cyber attacks can be extremely expensive for businesses to endure.
In addition to financial damage suffered by the business, a data breach can also inflict
untold reputational damage.
Cyber-attacks these days are becoming progressively destructive. Cybercriminals are
using more sophisticated ways to initiate cyber attacks.
CYBER SECURITY Page 5
Regulations such as GDPR are forcing organizations into taking better care of the
personal data they hold.
Because of the above reasons, cyber security has become an important part of the
business and the focus now is on developing appropriate response plans that minimize
the damage in the event of a cyber attack.
But, an organization or an individual can develop a proper response plan only when
he has a good grip on cyber security fundamentals.
Cyber security Fundamentals – Confidentiality:
Confidentiality is about preventing the disclosure of data to unauthorized parties.
It also means trying to keep the identity of authorized parties involved in sharing and holding
data private and anonymous.
Often confidentiality is compromised by cracking poorly encrypted data, Man-in-the-middle
(MITM) attacks, disclosing sensitive data.
Standard measures to establish confidentiality include:
Data encryption
Two-factor authentication
Biometric verification
Security tokens
Integrity
Integrity refers to protecting information from being modified by unauthorized parties.
Standard measures to guarantee integrity include:
Cryptographic checksums
Using file permissions
Uninterrupted power supplies
Data backups
Availability
Availability is making sure that authorized parties are able to access the information when
needed.
Standard measures to guarantee availability include:
Backing up data to external drives
Implementing firewalls
Having backup power supplies
Data redundancy
CYBER SECURITY Page 6
Types of Cyber Attacks
A cyber-attack is an exploitation of computer systems and networks. It uses malicious code to
alter computer code, logic or data and lead to cybercrimes, such as information and identity
theft.
Cyber-attacks can be classified into the following categories:
1) Web-based attacks
2) System-based attacks
Web-based attacks
These are the attacks which occur on a website or web applications. Some of the important
web-based attacks are as follows-
1. Injection attacks
It is the attack in which some data will be injected into a web application to manipulate the
application and fetch the required information.
Example- SQL Injection, code Injection, log Injection, XML Injection etc.
2. DNS Spoofing
DNS Spoofing is a type of computer security hacking. Whereby a data is introduced into a
DNS resolver's cache causing the name server to return an incorrect IP address, diverting
traffic to the attackers computer or any other computer. The DNS spoofing attacks can go on
for a long period of time without being detected and can cause serious security issues.
3. Session Hijacking
It is a security attack on a user session over a protected network. Web applications create
cookies to store the state and user sessions. By stealing the cookies, an attacker can have
access to all of the user data.
4. Phishing
Phishing is a type of attack which attempts to steal sensitive information like user login
credentials and credit card number. It occurs when an attacker is masquerading as a
trustworthy entity in electronic communication.
5. Brute force
It is a type of attack which uses a trial and error method. This attack generates a large number
of guesses and validates them to obtain actual data like user password and personal
identification number. This attack may be used by criminals to crack encrypted data, or by
security, analysts to test an organization's network security.
CYBER SECURITY Page 7
6. Denial of Service
It is an attack which meant to make a server or network resource unavailable to the users. It
accomplishes this by flooding the target with traffic or sending it information that triggers a
crash. It uses the single system and single internet connection to attack a server. It can be
classified into the following-
Volume-based attacks- Its goal is to saturate the bandwidth of the attacked site, and is
measured in bit per second.
Protocol attacks- It consumes actual server resources, and is measured in a packet.
Application layer attacks- Its goal is to crash the web server and is measured in request per
second.
7. Dictionary attacks
This type of attack stored the list of a commonly used password and validated them to get
original password.
8. URL Interpretation
It is a type of attack where we can change the certain parts of a URL, and one can make a
web server to deliver web pages for which he is not authorized to browse.
9. File Inclusion attacks
It is a type of attack that allows an attacker to access unauthorized or essential files which is
available on the web server or to execute malicious files on the web server by making use of
the include functionality.
10. Man in the middle attacks
It is a type of attack that allows an attacker to intercepts the connection between client and
server and acts as a bridge between them. Due to this, an attacker will be able to read, insert
and modify the data in the intercepted connection.
System-based attacks
These are the attacks which are intended to compromise a computer or a computer network.
Some of the important system-based attacks are as follows-
1. Virus
It is a type of malicious software program that spread throughout the computer files without
the knowledge of a user. It is a self-replicating malicious computer program that replicates by
inserting copies of itself into other computer programs when executed. It can also execute
instructions that cause harm to the system.
CYBER SECURITY Page 8
