Cyber Security & Digital Awareness

1CIA triad — three security goals

Information security is built on three goals called the CIA triad: Confidentiality, Integrity and Availability. Confidentiality means only authorised people see the data. Integrity means the data is not altered by unauthorised users. Availability means authorised users can reach the data and services when they need them.

Stems that ask which goal keeps data secret, unchanged, or reachable map onto C, I and A in that order — the triad itself has no fourth pillar.

Figure. Three equal security goals. Integrity is tinted for the common exam trap: silent data change with secrecy and uptime still intact.

2Virus, worm, Trojan and ransomware

Four malware labels dominate the set. A virus attaches to files and needs a host (and typically human action to spread). A worm self-replicates over networks without needing that host-file attachment. A Trojan hides as legitimate software. Ransomware encrypts or locks data and demands payment to restore access.

The load-bearing contrast is virus versus worm: host-and-action versus self-spreading on the network.

Figure. Virus needs a host file plus user action; worm self-replicates on the network. Trojan is bait software; ransomware locks data for payment.

3Firewall versus antivirus

A firewall monitors and filters incoming and outgoing network traffic against rules, acting as a barrier between a trusted network and an untrusted one. Antivirus software is aimed at preventing, detecting and removing malware on a system.

Do not swap the jobs: antivirus fights malware on the machine; a firewall filters network traffic at the boundary.

Figure. Firewall filters traffic at the trust boundary. Antivirus acts on files and programs inside the system — do not swap the jobs.

4Phishing and credential bait

Phishing tricks users into revealing credentials through fake emails, SMS or websites that imitate a trusted sender. The bait is social engineering, not a clever exploit of the bank's server.

Never share OTP, PIN or passwords with anyone who asks — strong passwords and refusing those requests cut off the usual phishing payoff.

Figure. Phishing is social engineering. Sharing OTP or PIN is the leak path; refusing and verifying on an official channel is the safe path.

5Authentication factors and 2FA

Authentication asks you to prove who you are using factors: something you know (password), something you have (OTP or hardware token), or something you are (biometric). Two-factor authentication (2FA) combines two different factor types — commonly a password plus an OTP.

Repeating the same factor twice (two passwords) is not 2FA; the second factor must come from a different category.

Figure. 2FA pairs two different factor types — usually password plus OTP. Repeating the same type twice is not two-factor.

How 2FA works

1. First factorThe user proves knowledge — typically a password.
2. Second factorA different category is required — often an OTP on a phone or a biometric.
3. Access grantedOnly when both succeed does the account open; stealing the password alone is not enough.

6Symmetric, asymmetric encryption and HTTPS

Encryption protects data in transit or at rest. Symmetric encryption uses one shared key (AES is the usual named example). Asymmetric encryption uses a public and private key pair (RSA is the usual pair named). HTTPS is HTTP carried over SSL/TLS — shown by a padlock and an https:// URL — so the browser session is encrypted on the wire.

AES ↔ one shared key; RSA ↔ public+private pair; HTTPS ↔ HTTP over SSL/TLS.

Figure. Symmetric uses one shared key (AES). Asymmetric uses a public/private pair (RSA). HTTPS is HTTP carried over SSL/TLS.

7Cloud models — IaaS, PaaS, SaaS

Cloud computing delivers on-demand computing resources over the Internet. Three service models appear by increasing abstraction: IaaS (infrastructure), PaaS (platform) and SaaS (software). Moving from IaaS to SaaS, the provider manages more of the stack and the customer manages less.

Order the models by abstraction — Infrastructure, Platform, Software — not by which brand name you remember.

Figure. Abstraction rises from IaaS to SaaS: the provider manages more of the stack; the customer manages less.

8UPI and digital payments in India

UPI (Unified Payments Interface) enables instant bank-to-bank digital payments in India. Move money between bank accounts in real time through a UPI app, without handing cash or a card at a counter.

UPI is a payment rail between banks — not a malware type and not a firewall rule.

Figure. UPI is India's bank-to-bank payment rail via an app — not a malware type and not a traffic firewall.