JAWAHARLAL NEHRU TECHNOLOGICAL UNIVERSITY HYDERABAD B.Tech III CYBER LAWS AND ETHICS Previous Question Paper (August - 2022 - R18)

Computer security mandates and legislation are legal frameworks designed to protect information systems, ensure data privacy, and regulate cyber activities. These laws establish standards for organizational security, define criminal conduct, and provide mechanisms for enforcement.

Key components include:

• Information Technology Act, 2000 (IT Act): The primary legislation governing cybercrime and electronic commerce in India. It provides legal recognition for electronic transactions, defines offenses such as hacking, data theft, and identity theft, and establishes the Cyber Appellate Tribunal.
• Data Protection and Privacy Laws: Regulations like the Digital Personal Data Protection Act (DPDP) mandate that organizations implement reasonable security practices to protect personal data. They define the rights of data principals and the obligations of data fiduciaries regarding consent, storage, and breach notification.
• Critical Information Infrastructure (CII) Protection: Under Section 70 of the IT Act, the government designates specific systems as CII, where any compromise could have a debilitating impact on national security or public health. These entities are subject to stringent security audits and mandatory reporting to the National Critical Information Infrastructure Protection Centre (NCIIPC).
• Sector-Specific Mandates: Financial institutions and banks are governed by RBI guidelines requiring robust cybersecurity frameworks, including multi-factor authentication, incident response plans, and periodic vulnerability assessments. Similarly, healthcare and telecommunications sectors follow specific security standards to ensure service continuity and user safety.
• International Standards and Compliance: Organizations often adopt frameworks like ISO/IEC 27001 to demonstrate compliance with global security mandates. These standards provide a systematic approach to managing sensitive information through risk assessment and continuous monitoring.

These mandates collectively force organizations to move from reactive security measures to proactive governance, ensuring that technical controls are backed by legal accountability and institutional responsibility.

Computer security, often referred to as cybersecurity, is the protection of computer systems, networks, hardware, software, and the data they contain from theft, damage, unauthorized access, or disruption. It encompasses the preservation of the CIA triad: Confidentiality (ensuring data is accessed only by authorized users), Integrity (ensuring data remains accurate and unaltered), and Availability (ensuring systems and data are accessible when needed).

Efforts to obtain and maintain computer security are multi-faceted, involving technical, administrative, and physical measures:

• Technical Controls: Implementation of firewalls, intrusion detection and prevention systems (IDPS), and robust encryption protocols to protect data at rest and in transit. Regular software patching and vulnerability management are critical to closing security gaps.
• Authentication and Access Control: Utilizing multi-factor authentication (MFA) and the principle of least privilege (PoLP) to ensure that users only have the minimum level of access required to perform their job functions.
• Physical Security: Protecting the physical infrastructure, such as data centers and server rooms, through biometric locks, surveillance cameras, and environmental controls to prevent physical tampering or hardware theft.
• Administrative and Policy Frameworks: Developing comprehensive security policies, incident response plans, and disaster recovery strategies. This includes regular security audits and compliance with legal frameworks like the IT Act.
• Human Factors and Awareness: Conducting regular security awareness training to educate users on identifying phishing attempts, social engineering tactics, and safe browsing habits, as human error remains a primary security vulnerability.
• Continuous Monitoring: Employing Security Information and Event Management (SIEM) tools to monitor network traffic and system logs in real-time to detect and respond to anomalous behavior or potential threats proactively.