Information Security and Cyber Laws: Threats, Controls, Privacy and Ethics (Overview) Questions

Question 1

Write one example of a cyber crime.

Accepted Answer

Example: **identity theft** (using someone’s personal data to commit fraud).

Question 2

Define information security.

Accepted Answer

**Information security** is the protection of information and systems from unauthorized access, modification and disruption.

Question 3

What does CIA stand for in information security?

Accepted Answer

**CIA** = **Confidentiality, Integrity and Availability**.

Question 4

What is phishing?

Accepted Answer

**Phishing** is a fraud technique where attackers use fake messages/websites to steal sensitive information like passwords and OTPs.

Question 5

What is malware?

Accepted Answer

**Malware** is malicious software designed to harm systems, disrupt operations or steal data (e.g., virus, trojan, ransomware).

Question 6

What is a data breach?

Accepted Answer

A **data breach** is unauthorized access/exposure of sensitive data such as customer information or passwords.

Question 7

Explain CIA triad with suitable examples.

Accepted Answer

The **CIA triad** is the foundation of information security:
- **Confidentiality**: only authorized users can access data (e.g., only HR can view payroll).
- **Integrity**: data remains accurate and is not changed without authorization (e.g., invoice edits require approval).
- **Availability**: systems/data are accessible when needed (e.g., backups and DR keep systems running during failures).

Thus, CIA ensures data is private, correct and accessible.

Question 8

Differentiate between virus, worm, trojan and ransomware (any three differences).

Accepted Answer

Virus vs Worm vs Trojan vs Ransomware:
- **Virus**: attaches to a file/program and spreads when executed.
- **Worm**: self-replicates and spreads across networks automatically.
- **Trojan**: appears legitimate but performs hidden malicious actions (may open backdoor).
- **Ransomware**: encrypts/locks data and demands payment to restore access.

Hence, worms spread automatically, trojans hide inside apps, and ransomware extorts money by locking data.

Question 9

Explain phishing and social engineering with prevention measures (any three).

Accepted Answer

**Phishing** uses fake emails/SMS/websites to steal passwords/OTPs. **Social engineering** manipulates people to reveal information or perform actions.

Prevention (any three):
- do not click suspicious links; verify URL and sender
- never share **OTP/password**; banks never ask OTP on calls
- enable **MFA/2FA** and strong passwords
- use updated antivirus and security awareness training

Thus, awareness + verification + MFA reduce phishing risk significantly.

Question 10

Explain preventive, detective and corrective security controls with examples.

Accepted Answer

**Preventive controls** (avoid):
- **MFA**, access control, firewall, patching

**Detective controls** (detect):
- audit logs, IDS/monitoring, alerts

**Corrective controls** (recover):
- backup restore, incident response, rollback, patch after incident

Hence, organizations combine all three to reduce incidents and recover quickly when attacks happen.

Question 11

Explain privacy and ethical issues in IT (any four points).

Accepted Answer

Privacy and ethical issues in IT:
- collecting excessive personal data without necessity (**privacy violation**)
- sharing/selling customer data without consent
- unauthorized access to employee/customer records
- software piracy and plagiarism
- spreading misinformation and misuse of social media

Therefore, organizations must use data responsibly with consent, security and fair practices.

Question 12

Explain the importance of strong authentication and access control in information security (any three points).

Accepted Answer

Importance of **strong authentication** and **access control**:
- prevents unauthorized access by verifying user identity using **MFA/OTP/biometrics**.
- supports **least privilege** so users can access only what they need, reducing data exposure.
- reduces insider misuse by enforcing roles and keeping accountability through permissions.
- protects critical systems and improves confidentiality of sensitive data.

Thus, authentication + access control are core preventive controls for protecting information assets.

Question 13

Explain incident response steps with a simple flowchart (basics).

Accepted Answer

### **Incident Response (Basics)**

An **incident response plan** helps an organization handle attacks quickly and reduce damage.

```text
Detect → Contain → Investigate → Eradicate → Recover → Review/Improve
```

**Exam-style points**:
- **Detect**: identify suspicious activity via logs/alerts.
- **Contain**: isolate affected systems to stop spread.
- **Investigate**: find cause, impacted data, attack path.
- **Eradicate**: remove malware, close vulnerabilities, reset credentials.
- **Recover**: restore services from clean backups and validate.
- **Review**: document lessons and strengthen controls to prevent recurrence.

Thus, incident response ensures quicker recovery and improves future security posture.

Question 14

Explain cyber laws: meaning, objectives and examples of cyber crimes (exam-style table).

Accepted Answer

### **Cyber Laws (Meaning, Objectives, Examples)**

**Cyber laws** are legal rules related to digital activities, online transactions, cyber crimes and electronic evidence.

| Area | What it covers | Examples |
|---|---|---|
| **Cyber crime** | punish misuse of computers/networks | hacking, identity theft, phishing fraud, malware spreading |
| **E-transactions** | recognition of electronic records/signatures | e-contracts, digital signatures |
| **Data & privacy** | protection of sensitive/personal data (where applicable) | unlawful data sharing, breach reporting |

**Objectives**:
- prevent and punish cyber crimes
- protect users and increase trust in online business
- support legal validity of electronic records

Thus, cyber laws create a safer legal environment for digital business and communication.

Question 15

Explain major cyber threats and suitable controls with a table/flowchart (overview).

Accepted Answer

### **Cyber Threats and Controls (Overview)**

Cyber security is about understanding threats and applying the right controls to reduce risk.

| Threat | What happens | Suitable controls |
|---|---|---|
| **Malware/Ransomware** | files corrupted/encrypted | antivirus, patching, backups, least privilege |
| **Phishing** | users tricked to share OTP/password | awareness training, email filters, MFA |
| **Unauthorized access/hacking** | data theft/modification | strong passwords, MFA, RBAC, monitoring |
| **DoS/DDoS** | service becomes unavailable | rate limiting, DDoS protection, redundancy |

```text
Threat → Vulnerability exploited → Incident → Controls (Prevent/Detect/Correct) → Reduced impact
```

**Conclusion**: Using layered controls (people + process + technology) improves confidentiality, integrity and availability.

Information Security and Cyber Laws: Threats, Controls, Privacy and Ethics (Overview)

8 more questions to unlock