Chapter at a glance
- Network security protects devices and data from illegitimate access or misuse by exploiting vulnerabilities.
- Malware is malicious software developed to damage hardware, steal data or cause trouble; major types include virus, worm, ransomware, Trojan, spyware, adware and keylogger.
- A virus is a code that inserts itself into executable files, remains dormant until execution and spreads on human-triggered contact; a worm is a standalone program that self-replicates across networks without a host or human trigger.
- Ransomware blocks or encrypts user data and demands payment; Trojan masquerades as legitimate software and spreads through user interaction without self-replication.
- Antivirus software uses signature-based detection (VDF), sandbox detection, heuristics, data mining and real-time protection to identify and remove malware.
- HTTP transmits data in plain text; HTTPS encrypts data and requires an SSL certificate for secure transmission of sensitive information.
- Firewall is a network security system (software, hardware or both) that monitors and filters incoming/outgoing traffic based on predefined rules; types are network firewall and host-based firewall.
- Cookies are small data packets stored by websites on the client computer to remember browsing information; hackers are classified as white-hat (ethical), black-hat (crackers) or grey-hat according to intent.
Key terms and definitions
- Malware: Short for MALicious softWARE; any software developed with the intention to damage hardware, steal data or cause trouble to the user.
- Virus: Piece of software code created to perform malicious activities; it inserts its code into executable files, remains dormant until the infected file is executed and spreads on contact.
- Worm: Standalone malware program that does not need a host; it replicates on its own and spreads to other computers through the network.
- Ransomware: Malware that blocks access to user data or threatens to publish it and demands ransom payment.
- Trojan: Malware that appears as legitimate software; once installed it behaves like a virus or worm but does not self-replicate.
- Spyware: Malware that gathers information about a person or organisation without the user’s knowledge and sends it to an external entity.
- Adware: Malware created to generate revenue by displaying online advertisements via pop-ups or “pay-per-click”.
- Keylogger: Malware or hardware that records keys pressed on the keyboard and may send logs to an external entity.
- On-screen keyboard: Software keyboard using a fixed QWERTY layout.
- Online virtual keyboard: Web-based or standalone keyboard whose key layout is randomised each time it is used.
- Antivirus: Software (also called anti-malware) that prevents, detects and removes a wide range of malware.
- Virus Definition File (VDF): Signature database containing virus signatures, updated continuously.
- Virus Signature: Consecutive sequence of bytes commonly found in a malware sample.
- Spam: Unsolicited bulk emails or messages containing advertisement links or attachments.
- HTTP: Protocol that transmits data over the WWW without encryption.
- HTTPS: Secure variant of HTTP that encrypts data before transmission and requires an SSL digital certificate.
- Firewall: Network security system that protects a trusted private network from unauthorised traffic originating from an untrusted network.
- Network Firewall: Firewall placed between two or more networks.
- Host-based Firewall: Firewall placed on a single computer to monitor traffic to and from that computer.
- Cookie: Small file or data packet stored by a website on the client’s computer to record browsing information.
- Session cookie: Cookie that tracks the current session and terminates it on time-out.
- Authentication cookie: Cookie used to verify whether a user is already logged in.
- Hacker/Cracker: Person with deep knowledge of systems and networks who exploits vulnerabilities to gain unauthorised access.
- White Hat (Ethical Hacker): Hacker who uses knowledge to find and fix security flaws.
- Black Hat (Cracker): Hacker who uses knowledge unethically to break the law and disrupt security.
- Grey Hat: Hacker who exploits vulnerabilities without monetary or political motive, often for challenge.
- Denial of Service (DoS): Attack that floods a resource with illegitimate requests so authorised users cannot access it.
- Distributed Denial of Service (DDoS): DoS attack launched from a bot-net of compromised zombie computers distributed across many locations.
- Zombie/Bot: Compromised computer controlled remotely by an attacker via malicious software (bot).
- Bot-Net: Network of zombie computers used to carry out DDoS attacks.
- Network Intrusion: Any unauthorised activity on a computer network.
- Snooping (Sniffing): Secret capture and analysis of network traffic; packets may be reproduced and re-inserted.
- Eavesdropping: Real-time unauthorised interception of private communication (VoIP, IM, video, etc.).
Syntax and constructs
No programming statements, functions, methods or commands are taught in this chapter.
Algorithms and worked logic
No algorithms, procedures or step sequences involving code or dry-run logic are present in the chapter.
Common errors and exam pitfalls
- Confusing virus with worm (forgetting that a virus needs a host file and human trigger while a worm is standalone and self-replicating).
- Stating that a Trojan self-replicates (NCERT explicitly says it does not).
- Mixing HTTP and HTTPS (HTTP sends plain text; HTTPS encrypts and needs SSL).
- Using “hacker” and “cracker” interchangeably without specifying white-hat/black-hat/grey-hat intent.
- Listing only one or two malware distribution methods instead of the four given (Internet download, spam email, removable media, network propagation).
- Omitting that an outdated VDF makes antivirus ineffective or that polymorphic/encrypted malware evades signature detection.
- Writing “firewall only blocks viruses” instead of stating it filters traffic according to security rules between trusted and untrusted networks.
- Forgetting the distinction between snooping (can be stored and analysed later) and eavesdropping (real-time only).