IS unit 4 notes

Administering Security –

•Administering security means managing and maintaining safety measures to protect computer
systems, networks, and data from threats.

•It involves setting rules, using tools, and watching over systems to make sure everything stays
secure.

Key Areas in Administering Security:

1. User Management

Creating and managing user accounts

Giving proper permissions (who can access what)
Setting up strong passwords and login policies

2. Access Control

Limiting access based on roles or responsibilities

Using authentication (passwords, biometrics)
Enforcing authorization (what users can do)

3. Security Policies

Writing clear rules for data usage, passwords, software, and network access
Making sure everyone follows these policies

4. Monitoring and Auditing

Keeping logs of system activity

Watching for suspicious behavior
Auditing systems regularly to check for issues

5. Software and Patch Management

Updating software to fix security holes

Installing antivirus and firewalls
Blocking unauthorized software

6. Backup and Recovery

Regular data backups

Planning how to recover systems after crashes or attacks
7. Training and Awareness

Teaching users about:

Phishing
Safe browsing
Reporting threats

Goals of Administering Security:

Confidentiality: Keep data private

Integrity: Prevent changes to data
Availability: Keep systems running

Tools Used:

Firewalls
Antivirus
Intrusion Detection Systems (IDS)
Role-Based Access Control (RBAC)
Security Information and Event Management (SIEM)

Security Planning –

Security planning is the process of creating a proper strategy to protect an organization’s

computers, networks, and data from threats.

It helps ensure:

Confidentiality (only the right people see the data)

Integrity (data is not changed by attackers)
Availability (systems work when needed)

Why is Security Planning Important?

Because without a plan, it’s easy to:

Be attacked by hackers or malware

Lose important data
Face financial loss or legal issues
Steps in Security Planning:

1. Identify Assets

Know what needs protection (e.g., data, systems, devices).

2. Identify Threats and Risks

Understand what could go wrong (e.g., hackers, viruses, insider threats).

3. Set Security Goals

Define what you want to protect and how secure it should be.

4. Create Policies

Write rules for:

Passwords
User access
Data sharing
Software usage

5. Choose Security Measures

Examples:

Antivirus, firewalls
Encryption
Backup systems

6. Train Users

Teach employees how to recognize threats (e.g., phishing, weak passwords).

7. Monitor and Review

Regularly check if the plan is working, and update when needed.

Types of Security Plans:

Strategic Plan:- Long-term security goals

Tactical Plan :-Specific projects (e.g., install antivirus)
Operational Plan :-Day-to-day rules (e.g., password change every 30 days)

Example:
A bank creates a security plan to:

Protect customer data with encryption

Use firewalls and antivirus
Limit access to sensitive systems
Backup all data daily
Train employees on safe email habits

What is Risk Analysis?

•Risk analysis means checking what could go wrong, how serious it would be, and how to stop it. It
is a part of security planning.

Imagine you're locking your house. You think:

What if a thief comes in? (Threat)

Is the door strong enough? (Vulnerability)
What will I lose? (Impact)
Should I install a camera or change the lock? (Control)

This is exactly what risk analysis does in the world of computers, data, and networks.

Why is Risk Analysis Important?

It helps:

Prevent attacks or damage

Save money and time
Keep your data safe
Make better security decisions

Steps of Risk Analysis:

1. Identify Assets

Find what is important and needs protections

Example: customer data, emails, servers, websites.

2. Identify Threats

What bad things can happen?

Example: hacking, viruses, data loss, insider attacks.

3. Identify Vulnerabilities
 What weaknesses can be used by attackers?
Example: weak passwords, no antivirus, untrained staff.

4. Determine Likelihood

How likely is it that a threat will happen?

Example: There’s a high chance of phishing emails.

5. Estimate Impact

If the threat happens, how much harm will it cause?

Example: Losing ₹1 lakh worth of data or reputation.

6. Calculate Risk

Risk = Likelihood × Impact

If both are high, risk is high. If one is low, risk is lower.

7. Plan Security Controls

What can you do to reduce risk?

Examples:
Use antivirus
Encrypt data
Train staff
Backup data

Example Scenario:

Situation: A company stores customer info on one computer.

Threat: Malware attack

Vulnerability: No antivirus
Impact: Loss of data and trust
Likelihood: High (since no protection)
Solution: Install antivirus, take regular backups

Types of Risk Analysis:

Qualitative Uses:- ratings like High, Medium, Low (no exact numbers)
Quantitative Uses :-numbers and money to measure risks

What are Organizational Security Policies?

Organizational security policies are rules and guidelines made by a company or organization to
protect its data, systems, and employees from security threats like hacking, misuse, and
accidents.

These policies define:

What users can or cannot do

How systems and data should be used and protected
Who is responsible for what in case of a security issue

Why are They Important?

Security policies:

Help prevent data leaks, cyberattacks, and human errors

Protect the privacy of customers and employees
Make sure everyone in the organization knows the right way to handle data
Ensure legal compliance

Types of Security Policies in an Organization:

1. General Security Policy

Covers the overall goal of protecting the organization's assets.

Example: "Our company is committed to protecting customer data at all levels."

2. Access Control Policy

Defines who can access what information or systems.

Example: "Only HR can view employee salary records."

3. Password Policy

Rules for creating and managing passwords.

Example: "Passwords must be 8+ characters and changed every 60 days."

4. Internet and Email Policy

Rules for safe use of internet and email to avoid malware or phishing.
Example: "Do not open email attachments from unknown sources."

5. Data Backup Policy

How and when data should be backed up and stored safely.

Example: "Daily backups are stored on a secure external server."

6. Bring Your Own Device (BYOD) Policy

 Rules for using personal devices (like phones or laptops) for work.

7. Incident Response Policy

What to do if there is a security breach or cyberattack.

Example: "Report the attack to the IT team immediately."

Key Elements of a Good Security Policy:

Clear goals
Defined roles and responsibilities
Step-by-step guidelines
Training for employees
Monitoring and regular updates

Example:

A school may have a policy like:

> "Teachers and students must not share login passwords. Any data saved on computers must be
backed up weekly."
 IS unit 4 notes

What is Physical Security?

•Physical security means protecting computers, servers, networks, and data from physical threats
such as:

Theft (stealing devices or data)

Fire and flood
Power failures
Unwanted or unauthorized access
Vandalism (someone breaking or damaging things)

It is the first layer of security in any organization—before cybersecurity tools like antivirus or
firewalls.

Why is Physical Security Important?

Even if a computer is protected by strong passwords or encryption, anyone can:

Steal it and break it open

Unplug the power and stop services
Burn or damage it during a fire So, physical protection is very important for keeping data
safe.

Types of Physical Security Controls:

1. Access Control

Only authorized people can enter important areas.

Example: Security guards, ID cards, fingerprint scanners.

2. Surveillance

Monitoring areas with CCTV cameras or alarms.

Example: Watching the server room 24/7.

3. Locks and Barriers

Using strong locks, fences, locked doors, safes.

 Example: Locking laptops to desks or keeping servers in a locked room.

4. Environmental Protection

Protecting against fire, smoke, heat, and water.

Example: Fire extinguishers, smoke detectors, air coolers.

5. Power Backup

Keeping systems running during power failure.

Example: UPS (Uninterruptible Power Supply), generators.

Example:

In a bank:

Doors and cameras protect rooms with cash and computers.

Only staff with ID cards can enter the server room.
Fire alarms and AC protect equipment from heat and fire.

This is all part of physical security.

Legal Issues in Computer Security

•Legal issues in computer security refer to actions related to computers and data that violate the
law.

•These are covered under cyber laws and aim to protect systems, data, and users from misuse or
crime.

Common Legal Issues:

1. Unauthorized Access (Hacking)

Accessing someone’s computer, email, or network without permission is illegal.

2. Data Theft

Stealing or copying confidential data like customer information, passwords, or financial

records.

3. Software Piracy

Using or distributing unlicensed software violates copyright laws.

4. Identity Theft
 Using someone else’s personal information like Aadhaar, PAN, or credit card details without
permission.

5. Cyber Bullying & Harassment

Using computers or the internet to threaten, insult, or harass someone.

6. Phishing & Online Fraud

Creating fake websites or emails to trick people into giving personal or financial information.

7. Spreading Malware or Viruses

Creating and spreading harmful software intentionally is a criminal offense.

Legal Protection in India:

IT Act 2000 (Information Technology Act)

Main cyber law in India

Covers hacking, data theft, cyberstalking, fraud, etc.

Indian Penal Code (IPC)

Some sections also apply to cybercrimes (e.g., cheating, impersonation).

Why Legal Issues Matter:

To protect users’ rights and privacy

To punish cybercriminals
To make the internet a safe place
To build trust in digital systems

Privacy Issues in Computer Security

Privacy issues in computer security refer to the protection of a user’s personal and sensitive
information from being accessed, misused, or shared without permission.

What is Personal or Sensitive Information?

Name, address, phone number

Passwords, Aadhaar or PAN number
Bank account or card details
Medical or health data
 Browsing habits or location

Common Privacy Issues:

1. Data Collection Without Consent

Websites or apps collect personal data without telling the user or asking for permission.

2. Data Sharing

Companies share or sell user data to third parties without informing users.

3. Tracking

Websites track user activity using cookies or trackers to show ads or collect behavior data.

4. Lack of Encryption

If sensitive data is not encrypted, hackers can easily steal it during transfer or storage.

5.Data breaches

Unauthorized people gain access to large databases of private user information.

Why Privacy is Important:

Protects from identity theft

Builds trust between users and services
Ensures legal compliance with data protection laws
Prevents misuse of personal information

How to Protect Privacy:

Use strong passwords

Avoid unknown websites and apps
Read privacy policies before giving personal info
Turn off location and app permissions when not needed
Use secure websites (https)

In India:
 The IT Act 2000 provides some privacy protection.
The Digital Personal Data Protection (DPDP) Act 2023 aims to give users more control over
their data.

Ethical Issues in Computer Security

Ethical issues in computer security deal with what is right or wrong behavior when using
computers, networks, and data. These are not always illegal, but they may still be unfair or
harmful.

Examples of Ethical Issues:

1. Unauthorized Access

Accessing someone’s files or accounts without permission, even if it's easy to do.

2. Monitoring Without Consent

An employer tracking employees’ emails or browsing activity secretly.

3. Misusing Personal Data

Collecting user data for one purpose, then using or selling it for something else.

4. Intellectual Property Theft

Copying someone’s software, photos, or code without credit or permission.

5. Creating Harmful Software

Making or spreading viruses, malware, or spyware, even for “fun” or testing.

6. Fake Identities

Using false names or fake accounts to hide real identity or fool others.

Basic Ethical Principles in Computing:

1. Do not harm others with your actions.

2. Respect privacy of users and systems.

3. Do not steal or copy information or software.

4. Be honest about your identity and work.

5. Report flaws or bugs that can cause harm.

Why Ethical Behavior is Important:

Builds trust in technology

Protects users and their rights
Reduces cybercrime and misuse
Encourages responsible use of computer skills

In Real Life:

Even if something is not illegal, it can still be ethically wrong. For example, spying on someone’s
online activity without telling them may not always break the law—but it breaks trust and privacy.
 IS unit 4 notes

Protecting Programs and Data in Computer Security

Protecting programs and data means using methods to prevent unauthorized access, misuse,
damage, or loss of software and information stored on computers and networks.

Why Protection is Important:

Prevents data loss or theft

Avoids unauthorized changes to programs or files
Ensures privacy, confidentiality, and accuracy
Maintains trust in systems and applications

Methods to Protect Programs and Data:

1. Authentication

Verifies the identity of users (e.g., passwords, biometrics, OTP)

2. Authorization

Gives specific access rights to users (e.g., read-only, edit, admin rights)

3. Access Control

Restricts who can access or modify files or programs using permissions and roles

4. Encryption

Converts data into unreadable form so even if it's stolen, it’s useless without the key

5. Backups

Regularly saving copies of data in case of accidental loss, failure, or attack

6. Antivirus and Anti-malware

Software that detects and removes threats like viruses, worms, and spyware
7. Firewall

Blocks unauthorized access to or from a network

8. Audit Logs

Keeps records of user activities to track any misuse or security breach

9. Software Updates

Fixes security bugs and strengthens protection against new threats

Tips for Better Protection:

Use strong and unique passwords

Do not install unknown or pirated software
Avoid clicking on suspicious links or emails
Keep your OS and apps updated
Regularly scan your system for threats

Information and the Law – Computer Security

"Information and the law" refers to the legal rules and regulations that govern how data and digital
information should be used, stored, protected, and shared in a safe and ethical way.

Why It's Important:

As more personal, financial, and confidential data is stored digitally, laws are needed to:

Protect privacy
Prevent cybercrimes
Ensure responsible use of data
Promote trust in digital systems

Key Legal Concepts:

1. Intellectual Property Rights (IPR)

Protects original software, content, and inventions from copying or misuse. Includes:

Copyright
Patents
 Trademarks

2. Cyber Laws

Laws created to handle online crimes like hacking, phishing, and data theft
In India: The Information Technology (IT) Act, 2000 handles most cyber-related crimes.

3. Data Protection and Privacy Laws

These laws ensure that users’ personal data is collected, stored, and used responsibly
India's recent law: Digital Personal Data Protection Act, 2023 (DPDP).

4. Computer Misuse Laws

Make activities like unauthorized access, malware spreading, and network attacks illegal.

5. Electronic Evidence Laws

Data like emails, messages, and server logs are used as legal evidence in cybercrime cases.

Examples of Illegal Activities Under the Law:

Hacking government or personal systems

Spreading viruses or ransomware
Stealing or selling user data
Sending fake job or bank emails to scam people
Distributing pirated software

Laws for Information Security (India + Global Overview)

Information security laws are created to protect data from theft, misuse, hacking, and privacy
violations. These laws ensure safe and legal use of information, especially in the digital world.

1. Information Technology (IT) Act, 2000 – India

This is the main cyber law in India.

Key Provisions:

1. Section 43 – Penalty for unauthorized access, downloading, introducing viruses, etc.

2. Section 66 – Punishment for hacking and other cybercrimes.
3. Section 66C – Identity theft using someone else's digital signature/password.
4. Section 66D – Cheating by impersonation (e.g., fake job/bank emails).
5. Section 67 – Punishment for sending obscene or offensive content online.
6. Section 72 – Breach of data confidentiality and privacy.
2. Digital Personal Data Protection (DPDP) Act, 2023 – India

New law focused on protecting personal data of individuals.

Key Highlights:

Companies must take user consent before using personal data.

Users have the right to access, correct, or delete their data.
Strict penalties for data breaches or misuse.

3. Copyright Act, 1957 (Amended)

Protects software, content, videos, and images from unauthorized copying or sharing.
Software piracy is a legal offense.

4. Indian Penal Code (IPC) Sections (Along with IT Act)

Section 419 – Punishment for cheating by personation (online fraud).

Section 420 – Cheating and dishonesty for financial gains online.

5. International Laws (Examples)

GDPR (Europe) – General Data Protection Regulation: strict data protection law for citizens
of the EU.
HIPAA (USA) – Protects health-related data.
CCPA (USA) – Protects personal information of California residents.

Why These Laws Are Important:

To punish cybercriminals
To protect users’ privacy and data
To build trust in digital services
To encourage safe use of technology

Rights of Employees and Employers in Computer Security (Digital Workplace

Context)

In any organization that uses computers and digital systems, both employees and employers have
certain rights and responsibilities to maintain privacy, security, and ethical practices.

1. Rights of Employees:
a. Right to Privacy

Employees have the right to expect reasonable privacy in their emails, personal files, and
usage (if not violating policies).
Employers must inform employees if monitoring is being done.

b. Right to a Secure Environment

Employees can expect safe access to systems, free from malware, spyware, or unauthorized
access.

c. Right to Fair Use

Employees should not be blamed for accidental mistakes unless they violated clear security
policies knowingly.

d. Right to Access Information

Employees should have access to relevant tools and data needed for their job within security
limits.

e. Right to Whistleblow

Employees can report security breaches or unethical behavior without fear of punishment.

2. Rights of Employers:

a. Right to Monitor Systems

Employers can monitor usage of company resources (emails, internet) to protect the system,
as long as it’s disclosed.

b. Right to Enforce Security Policies

Employers can set rules about what can or cannot be done on company systems.

c. Right to Protect Data

Employers have the right to encrypt, back up, and restrict access to company data.

d. Right to Take Disciplinary Action

If employees misuse systems, share passwords, or leak data, the employer can take legal or
disciplinary steps.

e. Right to Control Access

Employers decide who can access what level of data, depending on job roles.
 IS unit 4 notes

Software Failures

A software failure happens when a computer program does not work as expected. It may crash,
give wrong results, stop responding, or even create security problems.

Detailed Explanation:

When software is developed, it goes through coding, testing, and deployment. But sometimes, due
to mistakes or weak processes, it may contain bugs or errors. ThesHere’s a clear and exam-ready
explanation of:

Types of Software Failures:

1. Functional Failures:

The software doesn't perform the task it is supposed to do.

Example: A login page not accepting correct passwords.

2. Performance Failures:

The software runs too slow or crashes under load.

Example: An online shopping app crashing during sales.

3. Security Failures:

Hackers can exploit weaknesses in the code.

Example: A website gets hacked because of poor password protection.

4. Compatibility Failures:

The software does not work on all devices or browsers.

Example: A website works on Chrome but not on Firefox.

5. Recovery Failures:

The system cannot recover after an error or crash.

Example: A word file gets corrupted and cannot be restored.

Common Causes of Software Failures:

1. Bugs in Code

Mistakes made by programmers during development.

2. Poor Testing

If software isn’t tested properly, hidden errors remain.

3. Incompatibility

Software may not work properly with certain devices, OS, or browsers.

4. Memory Issues

Like memory leaks or buffer overflows can cause crashes.

5. Incorrect Inputs

If the program doesn’t handle unexpected user inputs properly.

6. Security Vulnerabilities

Exploited by hackers, leading to failure or data leaks.

7. Updates or Patch Problems

New updates might break the existing system if not tested properly.

Causes of Software Failures:

1. Poor coding
2. Lack of testing
3. Ignoring user input validation
4. Weak design
5. Improper handling of memory

Consequences of Software Failures:

1. Loss of customer trust

2. Financial damage
3. Data loss or data theft
4. Legal problems for the company

Example:
In 2015, the British Airways check-in system failed because of a software issue. Flights were
delayed for hours and the company lost millions.

How to Avoid It:

Test software properly (manual and automatic tests)

Use secure coding techniques
Keep updating and patching the software
Take user feedback seriously

Computer Crime –

Computer crime (also called cybercrime) refers to any illegal activity that involves a computer, a
network, or both.
These crimes are committed to steal data, spread viruses, harm systems, or earn money illegally
using digital technology.

Types of Computer Crime:

1. Hacking

Unauthorized access to someone else’s computer or data.

Example: Breaking into a bank’s system to steal account details.

2. Phishing

Tricking users to share personal information through fake websites or emails.

Example: Fake emails asking for your bank login.

3. Virus and Malware Attacks

Spreading harmful programs to damage or take control of other systems.

Example: Ransomware locking files and demanding money.

4. Identity Theft

Stealing personal data to impersonate someone.

Example: Using another person’s ID to apply for loans.

5. Cyberbullying and Harassment

Using the internet to threaten, stalk, or insult others.

6. Data Theft
 Copying or stealing confidential data from companies or individuals.

7. Online Scams and Frauds

Fake shopping websites, lottery scams, job scams, etc.

8. Software Piracy

Copying or using software without proper license or permission.

Effects of Computer Crime:

Financial loss
Identity and privacy loss
Emotional stress for victims
National or corporate security risks

Preventive Measures:

Strong passwords
Updated antivirus software
Don’t click unknown links or attachments
Use firewalls and secure networks
Be aware of online scams

Privacy in Information Security – Explained

Privacy refers to the right of individuals to control how their personal information is collected,
used, and shared.

In information security, privacy is about protecting confidential personal or organizational data

from unauthorized access or disclosure.

Key Concepts in Privacy:

1. Data Confidentiality:

Only authorized users should have access to sensitive data.

2. Data Minimization:
 Only the necessary amount of personal data should be collected.

3. User Consent:

Users should know and approve how their data is used.

4. Right to Access and Erasure:

Users can ask to view or delete their stored personal data (GDPR law supports this in
Europe).

5. Anonymity and Encryption:

Tools to protect identity and data while storing or transferring.

Examples of Privacy in Action:

Social media platforms asking for permission to access your photos.

Websites showing a cookie consent banner.
Hospitals encrypting patient records.
Banks hiding full account numbers.

Threats to Privacy:

Hacking and data breaches

Phishing attacks
Unauthorized surveillance
Poor app permissions

How to Protect Privacy:

Use strong passwords and two-factor authentication

Share data only on trusted websites
Read privacy policies before agreeing
Keep software updated

Ethical Issues in Computer Security

Definition:
Ethical issues in computer security refer to the moral responsibilities and correct behavior related
to the use, protection, and access of computer systems and data.

Key Ethical Issues:

1. Privacy Violation

Accessing or sharing someone's personal data without permission is unethical

Example: Reading someone’s emails without consent.

2. Hacking

Breaking into computer systems or networks, even without causing harm, is unethical
Example: Bypassing passwords to enter a system.

3. Data Theft and Misuse

Stealing or misusing data for personal gain or to harm others

Example: Selling customer data.

4. Software Piracy

Copying or distributing software illegally violates intellectual property rights

Example: Downloading cracked software.

5. Plagiarism

Copying someone’s code or digital content without giving credit

Example: Submitting copied projects in college or work.

6. Spreading Malware

Creating or distributing viruses, spyware, etc., that damage or steal data.

Example: Sending infected files knowingly.

7. Social Engineering

Tricking people into giving their passwords or personal information.

Example: Phishing attacks pretending to be a bank.

8. Lack of Accountability

IT professionals not taking responsibility for security failures or breaches.

Importance of Ethics in Security:

Builds trust between users and organizations

Promotes safe use of technology
Prevents legal trouble and data breaches
Encourages professional responsibility
Case study of corporate security

📚 Case Study: Facebook Data Leak (2019)

🏢 Company: Facebook

📆 Year: 2019

🔍 Type of Incident: Public exposure of user data on cloud servers

👥 Affected Users: Over 540 million Facebook users

🛑 What Happened:

In April 2019, security researchers from UpGuard discovered that user data from Facebook was
exposed publicly on Amazon Web Services (AWS) cloud servers.

The data was not leaked by Facebook directly, but by third-party developers who used Facebook’s
APIs and stored the data without proper protection.

🔓 Exposed Data Included:

Facebook user IDs

Comments, likes, and reactions

Account names and phone numbers

⚠️ Main Causes of the Leak:

1. Poor third-party data handling

– Developers did not secure the user data they collected via Facebook.

2. Lack of strong cloud security controls

– Data was stored on AWS without proper password protection or encryption.

3. Inadequate monitoring of app developers

– Facebook didn’t monitor how external partners were managing users’ data.

🔒 Facebook’s Response:

Took down the exposed data after the issue was reported.
Promised to restrict third-party access to user data.
Launched “Data Abuse Bounty Program” to report misuse by app developers.
Updated its privacy and API access policies.
---

🧠 Security Lessons Learned:

Lesson Explanation

Third-party risk management:- Companies must ensure partners follow strict data
protection rules.
Secure cloud storage:- All data stored on cloud must be encrypted and access-controlled.
Audit and monitoring :-Regular checks on developers and their data handling practices.
User control:- Users should know what data is shared and be able to control it.