IIS CT that the authenticated entity has the proper rights

2 Marks to use certain data, applications, or service.

1. Differentiate between Virus & Worm (any two). Authentication:Authentication is the process of
Virus Worm verifying the identity of a user or information.
A virus is a malicious A worm is a self- User authentication is the process of verifying the
program that attaches replicating malware that identity of a user when that user logs in to a
itself to a host file and spreads automatically computer system.
spreads when the over a network without
infected file is executed. needing a host file. 4. What is access control? List principles of access
Requires human action Spreads automatically control?
(e.g., opening an without human
Access Control is a method of limiting access to a
infected file). intervention.
system or resources. Access control refers to the
Can corrupt or modify Consumes network
process of determining who has access to what
files and slow down the bandwidth and system
system. resources, leading to slow resources within a network and under what
performance. conditions.
Needs a host file or Independent and spreads Principles of access control:
program to spread. on its own.  Principle of Least Privilege
 Separation of Duties
2. Enlist two Active & Passive attack each.  Need to know
Active Attacks:
Man-in-the-Middle (MITM) Attack – The attacker 5. Define following terms
intercepts and alters communication between two (i) Cryptography (ii) Cryptology.
parties. (i) Cryptography: Cryptography is the art and
Denial of Service (DoS) Attack – The attacker floods a science of achieving security by encoding messages
system with traffic to make it unavailable. to make them unreadable. Cryptography is the
practice of securing information by converting it
Passive Attacks: into an unreadable format (encryption) and
Shoulder Surfing – Observing someone's screen or converting it back to its original form (decryption).
keyboard to steal sensitive information like passwords (ii) Cryptology: Cryptology is the combination of
or PINs. cryptography and cryptanalysis. It includes making
Sniffing – The attacker silently listens to network traffic codes to protect information (cryptography) and
without modifying or interrupting data transmission. breaking codes to find hidden messages
(cryptanalysis).
3. Define the terms: Identification, Authorization and
authentication. 6. Define following terms
Identification: Identification is the process used to i) Vulnerability ii) Threat.
recognize individual user.It can be done with the help of i) Vulnerability: A vulnerability is an organizational
username, smart card, ID etc. Security systems use this flaw that can be exploited by a threat to destroy,
identity to grant the access to the user for information. damage or compromise an asset.Vulnerabilities
Authorization: Authorization is the method of figuring include inherent human weaknesses.
out and granting permissions to a demonstrated ii) Threat: A threat is any incident that could
user or system, specifying what assets they can negatively affect an asset – for example, if it’s
access and what actions they’re allowed to carry lost, knocked offline or accessed by an
out.It comes after authentication and guarantees unauthorized party. Threats can be categorized
 as circumstances that compromise the E.g.A person enters their ATM PIN at a cash
confidentiality, integrity or availability of an machine, and someone behind them memorizes it
asset, and can either be intentional or to use later.
accidental.

7. Write any four advantages of Biometrics.

High Security – Biometrics like fingerprints and facial 4 Marks
recognition are unique, making unauthorized access 1. Explain DOS with neat diagram.
difficult. Denial of Service (DoS) is a form of cybersecurity
Convenience – No need to remember passwords; users attack that involves denying the intended users of
can log in with fingerprints, iris scans, or facial recognition. the system or network access by flooding traffic or
Fast Authentication – Biometrics provide quick and requests.
automatic identity verification, reducing login time. In this DoS attack, the attacker floods a target
Difficult to Forge – Unlike passwords or ID cards, biometric system or network with traffic or requests in order
traits (fingerprints, iris, voice) cannot be easily copied or to consume the available resources such as
stolen. bandwidth, CPU cycles, or memory and prevent
Improves Accuracy – Provides more reliable identification legitimate users from accessing them.
than passwords or PINs.
Reduces Fraud – Prevents identity theft since biometric
traits are unique.

8. Explain the term assets.

An asset is any data, device or other component of an
organisation’s systems that is valuable – often because it
contains sensitive data or can be used to access such
information. For example, if a bank website can handle 10
For example, an employee’s desktop computer, laptop or people a second by clicking the Login button, an
company phone would be considered an asset, as would attacker only has to send 10 fake requests per
applications on those devices. second to make it so no legitimate users can log in.
Types of Asset:
i.Tangible Assets
ii.Intangible Assets
iii.Human Assets

9. Explain shoulder surfing attack.

During a shoulder surfing attack, an attacker physically
views someone’s entry of sensitive information, be it
passwords, personal identification numbers, or any other
2. Explain Following terms
such data, over the target’s shoulder.
i) Sniffing ii) Spoofing
Most often, this attack takes place in public or semi-public
i) Sniffing:
environments where an attacker can have a glimpse of
Sniffing is the process of monitoring and capturing
what is on screen or being typed at the keyboard without
all the packets passing through a given network
raising much suspicion.
using sniffing tools. It is a form of “tapping phone
wires” and get to know about the conversation.
 There is so much possibility that if a set of  Data that is highly classified today may not require
enterprise switch ports is open, then one of their the same level of protection in the future as its
employees can sniff the whole traffic of the relevance diminishes.
network. Anyone in the same physical location can  Organizations regularly review aging information
plug into the network using Ethernet cable or to determine whether it still needs strict security
connect wirelessly to that network and sniff the measures.
total traffic.
To prevent sniffing attacks we can do following: iii.Useful Life
 Use Encrypted Connections  The relevance and usability of information
 Use Secure Networks impact its classification level.
 Keep Devices and Software Updated  Data that is actively used and updated
 Use Firewall Protection requires proper security to maintain
 Monitor Your Network integrity and confidentiality.
 Beware of Malicious Emails and Attachments  Once the information is no longer useful
 Use Strong, Unique Passwords or necessary, its classification may be
ii) Spoofing: downgraded or it may be archived or
Spoofing is a sort of fraud in which someone or deleted.
something forges the sender’s identity and poses iv.Personal Association
as a reputable source, business, colleague, or  Information linked to a specific
other trusted contact in order to obtain personal individual, such as personal, financial, or
information, acquire money, spread malware, or health data, requires strict classification.
steal data.  Privacy laws securely stored and
Types of Spoofing: processed data to protect individuals'
 IP Spoofing privacy.
 ARP Spoofing  Organizations must ensure that
 Email Spoofing personally identifiable information (PII) is
 Website Spoofing Attack classified and handled according to legal
 DNS Spoofing standards.

3.Explain criteria for information classification. 4. Describe RBAC and ABAC with diagram.
i. Value i.RBAC:
 This is the most common factor for classifying Role-based access control (RBAC) uses roles
data, especially in private organizations. and user groups to categorize access controls.
 If data is critical to business operations, financial With RBAC, system administrators assign roles
stability, or competitive advantage, it must be to subjects and configure access permissions to
classified and secured. apply at the role level.
 Higher-value information requires stricter security Based on a subject’s role, permission to access
controls to prevent unauthorized access, leaks, or a resource will automatically be granted or
cyber threats. denied.
ii. Age In a static environment that doesn’t have
 The sensitivity of information may decrease over frequent shift changes, RBAC can create an
time, allowing reclassification to a lower security effective access management policy.
level. Example Security analyst: Can configure a
firewall, but can't view customer data
Sales representative: Can view customer accounts, but can't Even if piggybacking isn’t attempted with malicious
change firewall settings. intent, it’s still illegal because the user is taking undue
advantage of a service they haven’t paid for.
Piggybacking Types:
1. Password Sharing
2. Physical Access
3. Remote Access
4. Wi-Fi Piggybacking
5. Social Engineering
Prevention:
 Use access control systems like biometric
authentication, keycards, or PIN-based entry.
 Implement automatic session logout after inactivity.
ii.ABAC:  Enable two-factor authentication (2FA) for added
This sets and enforces policies based on characteristics, such security.
as department, location, manager, and time of day.  Use encrypted connections to prevent unauthorized
Using Boolean logic, ABAC creates access rules with if-then data access.
statements that define the user, request, resource, and action.
For example, if the requester is a salesperson, they are ii.Shoulder Surfing:
granted read-write access to the customer relationship During a shoulder surfing attack, an attacker physically
management (CRM) solution, as opposed to an administrator views someone’s entry of sensitive information, be it
who is only granted view privileges to create a report. passwords, personal identification numbers, or any
other such data, over the target’s shoulder.
Most often, this attack takes place in public or semi-
public environments where an attacker can have a
glimpse of what is on screen or being typed at the
keyboard without raising much suspicion.
Privacy screens, which only allow a small angle of view
to their displays, can also be used by users to defend
against shoulder surfing.
Besides, they need to be aware of the surroundings
while inputting sensitive data and place themselves in
such a way as to block the possible viewers.
On-screen keyboards would also introduce some extra
difficulty for people attempting to capture keystrokes,
5.Describe piggy backing and shoulder surfing. hence offering extra protection from this kind of
i.Piggybacking: attack.
Piggybacking is the process of using a wireless connection to Prevention:
access an internet connection without authorization.  Looking for an area of space free where your back
Its objective is to gain free network access which is often is against a wall.
exploited to attempt malicious activities like data breaching  Never give or share your password or any vital
and dissemination of malware. It can also lead to slower information to anyone.
internet speed for all the systems connected to the network.  Never share such open personal accounts in
public local places.
  Locating a quiet spot away from the crowd. Replace each letter in the plaintext message with
the letter that is three positions to the right in the
6.Explain working of fingerprint mechanism and its limitations. alphabet.
Fingerprint biometrics is a commonly used form of biometric  H becomes K (shift 3 from H)
security that is easy to use, hard to fool, and often a cost-  E becomes H (shift 3 from E)
effective strategy, relying on something a person has.  L becomes O (shift 3 from L)
Fingerprints cannot be forgotten or lost like a password or ID  L becomes O (shift 3 from L)
card, and no two people share fingerprints, guaranteeing that  O becomes R (shift 3 from O)
they are unique to each individual.
Fingerprint biometrics use a scanner that can be small and The encrypted message is now “KHOOR”.
freestanding or contained within a device directly, such as a
smartphone, security system, or computer. Fingerprint 8. Describe encryption and decryption with diagram.
scanners take a digital rendering of the fingerprint and convert i. Encryption:
it to a digital algorithm for storage. Encryption is a form of data security in which
In this way, fingerprint data is safe from reverse engineering. information is converted to ciphertext. Only
Even if a bad actor obtains the fingerprint data through a authorized people who have the key can decipher
breach or theft, it cannot be turned back into the fingerprint the code and access the original plaintext
image and used. information.
A security feature that is convenient, easy to use, and user- It uses encryption algorithms and a secret key to
friendly, fingerprint biometrics is used across a wide range of scramble data into an unreadable format.
applications to both verify and authenticate identities. Encryption is used in secure communication, online
Fingerprint biometrics continue to advance with evolving transactions, and data storage.
technology. More companies and industries are adopting this ii.Decryption:
form of biometric authentication. When coupled with other Decryption is the process of converting an
security protocols, such as strong passwords or tokens, encrypted message back to its original (readable)
fingerprint biometrics are even more secure. format. The original message is called the plaintext
Limitations: message
 False acceptance and rejection can occur, leading to It allows authorized users to access the original data
security and usability issues. securely.
 Dirt, moisture, or sensor damage can affect fingerprint Decryption ensures that only intended recipients
scanning accuracy. can read the encrypted message.
 Skin conditions like cuts, burns, or worn-out fingerprints
may cause recognition failures.
 Spoofing attacks using fake fingerprints can bypass weak
biometric systems.
 Fingerprint data, once compromised, cannot be
changed like passwords, posing privacy risks.

7. Convert the given plain text, encrypt it with the help of Caesar
cipher technique. “Information Security”.
Choose a shift value. In this case, we will use a shift of 3.
9. Explain Man in the middle Attack with example.
A man-in-the-middle (MITM) attack is a cyberattack in
which a hacker steals sensitive information by
 eavesdropping on communications between two online  Account login credentials
targets such as a user and a web application.If an  Business secrets
attacker puts himself between a client and a webpage, a  Marketing secrets
Man-in-the-Middle (MITM) attack occurs. This form of  Information of the employee base
assault comes in many different ways.  Information about the
Phishing attacks are one common means of entry for software/tools/technologies that is being
MITM attackers. By clicking on a malicious link in an used at the company
email, a user can unknowingly launch a man-in-the
browser attack. Preventive Measures:
MITM attacker might also eavesdrop on private  Destroy any CDs/DVDs containing
communications between two people. In this scenario, personal data.
the attacker diverts and relays messages between the  In case you no longer need your PC,
two people, sometimes altering or replacing messages to make sure you have deleted all the data
control the conversation. so that it can’t be recovered.
 Use of firewalls can prevent suspicious
For example, In order to intercept financial login
Internet users from accessing the
credentials, a fraudulent banking website can be used.
discarded data.
Between the user and the real bank webpage, the fake  Paper documents should be
site lies "in the middle." permanently destroyed/shredded.
 Companies should lock waste bins and

should have a safe disposal policy.

11. Enlist substitution techniques & explain any
one.
The symmetric key cryptography method
employs one secret key for the operations of
encryption and decryption.
Substitution techniques provide two significant
10. Describe the dumpster diving with its prevention
approaches, wherein elements (letters,
mechanism.
characters) from the plaintext message are
Dumpster diving is the process of searching trash to
replaced with new elements according to the
obtain useful information about a person/business that rules based on the secret key.
can later be used for the hacking purpose. This attack Substitution Techniques
mostly targets large organizations or business to carry 1. Caesar Cipher
out phishing (mostly) by sending fake emails to the 2. Playfair cipher
victims that appear to have come from a legitimate 3. Vigenere cipher
source. The information obtained by compromising the 4. Vernam cipher (One-time pad)
confidentiality of the victim is used for Identity frauds.
What does a hacker look for? Caesar Cipher:
 Email address/address This was first proposed by Julius Caesar and is
 Phone numbers to carry out Phishing termed as Caesar Cipher.
Caesar Cipher is a special case of substitution
 Passwords and other social security numbers that we
techniques wherein each alphabet in a message
might have written on sticky notes for our convenience
is replaced by an alphabet three places down
 Bank statements/financial statements
the line.
 Medical records For example, with a shift of three, the letter ‘A’
 Important documents becomes ‘D’, ‘B’ becomes ‘E’, and so on.
 Example:
Choose a shift value. In this case, we will use a shift of 3.
Replace each letter in the plaintext message with the letter that
is three positions to the right in the alphabet.
 H becomes K (shift 3 from H)
 E becomes H (shift 3 from E)
 L becomes O (shift 3 from L)
 L becomes O (shift 3 from L)
 O becomes R (shift 3 from O)

The encrypted message is now “KHOOR”.

12. Consider plain text “CERTIFICATE” and convert it into cipher

text using Caesar Cipher with a shift of position 4. Write steps
for encryption.