MAULANA ABUL KALAM AZAD UNIVERSITY OF TECHNOLOGY, WEST BENGAL

(FORMERLY WEST BENGAL UNIVERSITY OF TECHNOLOGY )

NAME : SUBHAJIT KUNDU

REG. NO. : 201580100110011 ROLL NO. 15800120007
PROGRAM: BACHELOR OF TECHNOLOGY IN COMPUTER SCIENCE & ENGINEERING
COLLEGE /INSTITUTION : MALLABHUM INSTITUTE OF TECHNOLOGY-158
FOURTH YEAR SECOND SEMESTER CA1 EXAMINATION 2024, 8 TH SEM- CA1
CRYPTOGRAPHY AND NETWORK SECURITY (PEC-CS 801B)
TITLE SLIDE

• Title: "Attacks on Computers and Computer Security"

• Subtitle: Understanding Threats and Ensuring Protection
INTRODUCTION

 Brief overview of the increasing reliance on computers Computers have become ubiquitous in our daily lives,
revolutionizing the way we work, communicate, and access information. As we navigate the digital age, our
reliance on computers continues to grow exponentially. From personal computing devices to complex systems
driving industries, computers have woven themselves into the fabric of our modern existence.
 This increasing dependence stems from the unparalleled capabilities computers offer — rapid processing of vast
amounts of data, efficient automation of tasks, and seamless connectivity. The digital landscape, once a novel
frontier, has now become an integral part of our societal infrastructure.
 However, this reliance brings forth a critical challenge — the vulnerability of our interconnected systems to
various cyber threats. Understanding these threats and ensuring the protection of our computers is paramount in
safeguarding the integrity, confidentiality, and availability of the information they handle. In this presentation, we
delve into the landscape of attacks on computers and the crucial measures to fortify computer security in the face
of evolving challenges.
INTRODUCTION

 Importance of computer security in the digital age. : In the dynamic landscape of the digital age, where the pulse of global
activities resonates through computer networks, the importance of computer security has never been more paramount.
Computers serve as the backbone of our interconnected world, facilitating communication, commerce, education, and
innovation. As we immerse ourselves in this digital revolution, the significance of safeguarding our digital assets becomes a
cornerstone of our collective progress.
 Computer security is not merely a technical concern; it is an imperative that underpins the trust and reliability we place in
digital systems. The vast repositories of sensitive data, ranging from personal information to critical infrastructure controls,
demand meticulous protection. In an era where cyber threats loom large, a breach in computer security can have far-reaching
consequences, jeopardizing privacy, economic stability, and even national security.
 This presentation seeks to underscore the critical role of computer security in preserving the trustworthiness of our digital
interactions. As we explore the landscape of attacks on computers, we simultaneously embark on a journey to comprehend the
measures necessary to fortify our digital defenses. By understanding and championing the cause of computer security, we
empower ourselves to navigate the digital age with confidence, resilience, and a commitment to the responsible stewardship of
our interconnected world.
 TYPES OF ATTACKS
 Malware (viruses, worms, trojans) Malware, short for malicious software, refers to any software specifically
designed to harm or exploit computer systems.
• Viruses: These are self-replicating programs that attach themselves to legitimate executable files or documents,
spreading when the infected file is executed.
• Worms: Worms are standalone malicious programs that replicate and spread independently, often exploiting
vulnerabilities in network protocols.
• Trojans: Named after the ancient Greek story, trojans disguise themselves as legitimate software but carry hidden
malicious functionalities, misleading users into unintended actions.

 Phishing attacks Phishing attacks involve deceptive tactics to trick individuals into divulging sensitive
information, such as usernames, passwords, or financial details.
 One common technique is "Email Spoofing", where attackers forge emails to appear as if they are from a
trustworthy source, such as a bank or a legitimate service provider. This misleading correspondence often contains
links to fake websites or malicious attachments, aiming to manipulate recipients into revealing confidential
information.
TYPES OF ATTACKS

 Denial-of-Service (DoS) attacks Denial-of-Service (DoS) attacks aim to disrupt the normal functioning of a
computer system or network, rendering it temporarily or indefinitely unavailable to users.
 A key characteristic is the overwhelming of resources, where attackers flood the targeted system with an
excessive volume of traffic or requests, causing it to become overloaded and incapable of handling legitimate user
requests. This results in a denial of service to legitimate users attempting to access the targeted system or network.
 Define Man-in-the-Middle (MitM) attacks and describe a common method used in such attacks.
 A: Man-in-the-Middle (MitM) attacks involve an unauthorized third party intercepting and potentially altering
communication between two parties without their knowledge. A common method in MitM attacks is "Packet
Sniffing", where the attacker secretly captures and analyzes data packets transmitted between the communicating
parties. By eavesdropping on the communication, the attacker can gain sensitive information, such as login
credentials or financial details, leading to potential exploitation.
TYPES OF ATTACKS

 Define ransomware and outline a common strategy employed by attackers in ransomware attacks.
 A: Ransomware is a type of malicious software designed to block access to a computer system or files until a sum
of money, or ransom, is paid to the attacker.
 A common strategy employed by attackers in ransomware attacks is "Encrypting Files". In this method, the
ransomware encrypts the victim's files using a strong encryption algorithm, rendering them inaccessible. The
victim is then presented with a ransom demand, usually in cryptocurrency, in exchange for the decryption key that
can unlock the files. This strategy exploits the urgency and critical nature of accessing one's own data to coerce
the victim into paying the ransom.
•.
MALWARE

 Provide a definition of malware and offer examples of two types.

 A: Malware, short for malicious software, refers to any software intentionally designed to cause harm to a
computer system, network, or user.
 Examples of malware include:

1. Viruses: Self-replicating programs that attach to legitimate files and spread when these files are executed.
2. Trojans: Malicious software disguised as legitimate programs, tricking users into installing and executing them,
often leading to unauthorized access or data theft.
 Briefly explain how malware spreads, highlighting two common methods.
 A: Malware spreads through various means, utilizing vulnerabilities and deceptive tactics.

1. Email Attachments: Malicious software can be distributed through email attachments. Users may unknowingly
download and execute the attached files, allowing malware to infiltrate the system.
2. Drive-by Downloads: Malware can exploit vulnerabilities in web browsers or plugins, leading to automatic
downloads when users visit compromised websites. Without user interaction, the malware infiltrates the system.
MALWARE

 Impact on computer systems and data. Describe the impact of malware on computer systems and data,
highlighting two significant consequences.
 A: Malware inflicts severe consequences on computer systems and data:

1. Data Loss or Corruption: Malware can compromise the integrity of data by either corrupting files or causing
their permanent loss. This impact may result in critical data becoming inaccessible or unusable.
2. System Downtime: The presence of malware can lead to system instability, crashes, or slowdowns, causing
significant downtime. This disruption hampers productivity and can have economic repercussions for businesses
reliant on continuous system operation.
 PHISHING ATTACKS
•Explanation of phishing.
•Phishing is a type of cyber attack that involves deceptive tactics to trick individuals into divulging sensitive information, such as usernames, passwords, or
financial details. Attackers often disguise themselves as trustworthy entities to exploit the target's trust and gain unauthorized access to confidential
information.
1. Common phishing techniques Email Spoofing: Phishers forge emails to appear as if they are from legitimate sources, such as banks or service
providers. These deceptive emails often contain links to fake websites or malicious attachments, aiming to trick recipients into revealing sensitive
information.
2. Spear Phishing: In this targeted approach, attackers tailor phishing attempts for specific individuals or organizations. They gather information about the
target to create personalized and convincing phishing messages, increasing the likelihood of success.

3. How to recognize and avoid phishing attacks Check Email Sender: Verify the authenticity of emails by carefully examining the sender's email address.
Legitimate organizations use official domains, and phishing emails may use variations or misspellings.
4. Scrutinize URLs: Hover over links in emails to preview the actual URL before clicking. Phishing emails often use disguised links that redirect to
malicious websites. Ensure the link matches the expected destination.
5. Be Cautious with Attachments: Avoid opening email attachments from unknown or unexpected sources. Malicious attachments can contain malware or
phishing attempts.
6. Verify Requests for Information: Legitimate organizations rarely request sensitive information via email. Verify the authenticity of any request for
personal or financial details by contacting the organization directly using official contact information.
 By being vigilant and applying these practices, individuals can reduce the risk of falling victim to phishing attacks and protect their sensitive information.
DENIAL-OF-SERVICE (DOS) ATTACKS
• What is a DoS attack? A Denial-of-Service (DoS) attack is a malicious attempt to disrupt the normal functioning
of a computer system, network, or service by overwhelming it with a flood of traffic, requests, or data. The
objective is to make the targeted system or network temporarily or indefinitely unavailable to its intended users.
1. Differentiating between DoS and DDoS attacks DoS Attack (Denial-of-Service): In a DoS attack, a single source
is responsible for generating the excessive traffic or requests that overwhelm the targeted system. The attack is
initiated from one location, often a single computer or a small group of systems.
2. DDoS Attack (Distributed Denial-of-Service): DDoS attacks involve multiple sources working in coordination
to flood the targeted system with traffic. These sources can be a network of compromised computers (botnets),
amplifying the scale and impact of the attack.
3. Impact on service availability Disruption of Normal Operations: DoS attacks disrupt service availability by
saturating the target with traffic or requests, causing the system to become overloaded. This leads to a slowdown
or complete unavailability of services for legitimate users.
4. Financial Consequences: The impact on service availability can result in financial losses for businesses and
organizations. Downtime affects productivity, disrupts customer services, and can lead to reputational damage,
impacting the bottom line.
 Understanding the distinctions between DoS and DDoS attacks is crucial for implementing effective mitigation
 MAN-IN-THE-MIDDLE (MITM) ATTACKS
• Explanation of MitM attacks Man-in-the-Middle (MitM) attacks involve an unauthorized third party intercepting and potentially
altering communication between two parties without their knowledge. The attacker positions themselves between the
communicating entities, allowing them to eavesdrop on, manipulate, or inject malicious content into the communication stream.
1. Examples of MitM scenarios Wi-Fi Eavesdropping: An attacker sets up an unsecured Wi-Fi hotspot, enticing users to connect.
By doing so, the attacker can intercept and analyze the data transmitted between the user and the internet, capturing sensitive
information such as login credentials.
2. DNS Spoofing: In this scenario, an attacker manipulates the Domain Name System (DNS) to redirect a user to a malicious
website instead of the intended destination. The user believes they are accessing a legitimate site, while the attacker can capture
sensitive data.
 Importance of encryption in MitM prevention Encryption plays a crucial role in preventing MitM attacks:

1. Securing Communication: Encryption ensures that the data exchanged between parties is encoded and can only be deciphered
by the intended recipient. This prevents attackers from understanding or manipulating the information even if intercepted.
2. Protecting Data Integrity: Encryption not only secures the confidentiality of data but also verifies its integrity. If an attacker
attempts to alter the encrypted data, the recipient can detect the tampering, thwarting potential manipulation.
 By understanding MitM attack scenarios and implementing encryption, individuals and organizations bolster their defenses
against unauthorized interception and manipulation of their sensitive communications.
RANSOMWARE

• Definition and characteristics of ransomware Ransomware is a type of malicious software designed to block access to a computer system
or files until a sum of money, or ransom, is paid to the attacker. Characteristics of ransomware include the encryption of files, often
accompanied by a ransom demand, and a time-sensitive ultimatum for the victim to pay or risk permanent data loss.
1. How ransomware encrypts files Encryption Algorithm: Ransomware employs robust encryption algorithms to lock files on the victim's
system. Commonly used encryption methods include RSA or AES, making it computationally infeasible to decrypt files without the unique
key held by the attacker.
2. Targeted File Types: Ransomware selectively encrypts specific file types, such as documents, images, or databases, maximizing the
impact on the victim and coercing them into paying the ransom to regain access to vital information.
3. Strategies for preventing and responding to ransomware attacks Regular Backups: Regularly back up critical data to an offline or cloud-
based storage system. In the event of a ransomware attack, having up-to-date backups enables recovery without succumbing to the
attacker's demands.
4. Employee Training: Educate employees about the risks of phishing emails, as these are common vectors for ransomware. Training
programs can empower users to recognize and avoid suspicious emails, reducing the likelihood of infection.
5. Use of Antivirus and Anti-Malware: Employ robust antivirus and anti-malware solutions to detect and neutralize ransomware threats.
Regularly update these security tools to guard against evolving ransomware variants.
6. Security Patching: Keep operating systems and software up to date with the latest security patches. Ransomware often exploits known
vulnerabilities, and patching helps close these security loopholes.
CYBERSECURITY MEASURES
1. Importance of cybersecurity measures Protection Against Threats: Cybersecurity measures are crucial for
safeguarding digital assets against a myriad of cyber threats, including malware, phishing attacks, and unauthorized
access. These measures create a robust defense mechanism to shield systems, networks, and sensitive data from potential
breaches.
2. Maintaining User Trust: In an interconnected digital landscape, user trust is paramount. Cybersecurity measures build
and maintain trust by assuring users that their information is secure, fostering confidence in digital interactions and
transactions.
•Overview of essential security practices:
1. Use of strong, unique passwords. Strength and Complexity: Strong, unique passwords enhance security by making
it challenging for attackers to guess or crack them. A combination of uppercase and lowercase letters, numbers, and
symbols increases password complexity, reducing vulnerability to brute-force attacks.
2. Avoiding Password Reuse: Using unique passwords for each account prevents a security breach on one platform from
compromising multiple accounts. Password reuse magnifies the impact of a security incident, emphasizing the
importance of diversification.
 CYBERSECURITY MEASURES

1. Regular software updates Patch Vulnerabilities: Regular software updates are essential to patch known vulnerabilities in operating systems
and applications. These updates address security flaws that could be exploited by attackers, enhancing the overall resilience of the system.
2. Improved Security Features: Software updates often include enhancements to security features. Staying current ensures that the latest security
protocols and measures are in place, reducing the risk of exploitation by emerging threats.
•
1. Antivirus and anti-malware software Real-time Threat Detection: Antivirus and anti-malware software actively scan files and processes in
real-time, identifying and neutralizing malicious code. This proactive defense helps prevent the installation and execution of malware on the
system.
2. Regular Definition Updates: These security tools rely on regularly updated malware definitions to recognize new threats. Continuous updates
enable antivirus software to effectively identify and combat the latest variants of malicious software.
3. Firewall protection. Network Security: Firewalls act as a barrier between a trusted internal network and untrusted external networks,
monitoring and controlling incoming and outgoing traffic. This enhances overall network security by preventing unauthorized access and
protecting against cyber threats.
4. Application Layer Filtering: Firewalls with application layer filtering capabilities can scrutinize data at a deeper level, inspecting specific
application protocols. This provides an additional layer of protection against sophisticated attacks targeting specific applications or services.
 NETWORK SECURITY

1. Importance of securing networks Protecting Sensitive Data: Securing networks is vital for protecting sensitive data from unauthorized
access and potential breaches. Networks serve as the backbone for information flow, and securing them safeguards critical information
from cyber threats.
2. Ensuring Availability: Network security measures ensure the availability of services and resources by preventing disruptions caused by
cyber attacks. This availability is crucial for maintaining business operations and delivering reliable services to users.
3. Use of firewalls and intrusion detection/prevention systems Firewalls as a Barrier: Firewalls act as a barrier between internal networks
and external threats, controlling incoming and outgoing traffic. They play a crucial role in preventing unauthorized access and protecting
against cyber attacks, enhancing overall network security.
4. Intrusion Detection/Prevention Systems (IDPS): IDPS continuously monitor network and system activities, identifying and responding
to suspicious behavior or potential security incidents. These systems add an extra layer of defense by detecting and mitigating threats in
real-time.
Virtual Private Networks (VPNs) for secure communication. Encrypted Communication: VPNs enable encrypted communication over
untrusted networks, such as the internet. This encryption ensures that sensitive data transmitted between users and corporate networks remains
secure and confidential.
5. Remote Access Security: VPNs provide a secure method for remote access to corporate networks. This is particularly important for
remote employees or users accessing sensitive information from external locations, enhancing overall security posture.
ENCRYPTION

• Definition of encryption Encryption Definition: Encryption is a process of encoding information in a way that
only authorized parties can access and understand it. It involves the use of mathematical algorithms to transform
plaintext into ciphertext, rendering the original data unreadable without the appropriate decryption key.
1. Importance of encrypting sensitive data. Confidentiality Assurance: Encryption plays a pivotal role in ensuring
the confidentiality of sensitive data. By converting information into an unreadable format, it prevents unauthorized
access, protecting sensitive data from being understood or exploited by malicious actors.
2. Data Security Compliance: Encrypting sensitive data is often a requirement for regulatory compliance and data
protection standards. Adhering to encryption practices helps organizations meet legal and industry-specific
mandates, avoiding potential penalties and reputational damage.
3. Examples of encrypted communication Secure Sockets Layer (SSL)/Transport Layer Security (TLS):
SSL/TLS protocols encrypt data transmitted between a user's web browser and a website's server. This ensures
secure online transactions, such as e-commerce purchases or secure logins to online banking platforms.
4. Virtual Private Networks (VPNs): VPNs use encryption to secure communication over untrusted networks. This
is commonly used for remote access to corporate networks or to establish secure connections between
geographically distant locations.
SECURITY AWARENESS TRAINING

1. The role of user education in cybersecurity. Risk Mitigation: User education is crucial in raising awareness about
cybersecurity risks and threats. Educated users are better equipped to identify and mitigate potential risks, reducing the
likelihood of falling victim to cyber attacks.
2. Creating a Security-Conscious Culture: User education fosters a security-conscious culture within an organization.
When users understand the importance of cybersecurity, they become active participants in safeguarding sensitive
information and contribute to a more resilient cybersecurity posture.
 onducting Security Awareness Programs - Two Marks:

1. Training Sessions: Security awareness programs involve regular training sessions that cover various aspects of
cybersecurity, including recognizing phishing attempts, creating strong passwords, and understanding the importance of
software updates. These sessions empower users with the knowledge to make informed security decisions.
2. Simulated Attacks: Some security awareness programs incorporate simulated cyber attacks to provide users with a
realistic experience of potential threats. These simulations help users recognize and respond to actual cyber threats more
effectively.
 Reporting Suspicious Activities - Two Marks:

1. Early Detection: User education encourages individuals to actively report any suspicious activities or potential security
INCIDENT RESPONSE
 Developing an Incident Response Plan -

1. Proactive Preparedness: An incident response plan is a proactive strategy outlining the steps to be taken in the event of a security
incident. It includes identification, containment, eradication, recovery, and lessons learned. Developing this plan ensures a structured
and efficient response when a security incident occurs.
2. Reducing Downtime and Impact: A well-developed incident response plan aids in reducing downtime and minimizing the impact of a
security incident on operations. It provides a systematic approach for the organization to return to normalcy swiftly and efficiently.
 Importance of Quick and Effective Response to Security Incidents -

1. Mitigating Damage: A quick and effective response is crucial in mitigating the potential damage caused by a security incident. Rapid
identification and containment prevent the spread of threats, limiting their impact on systems, data, and the overall organization.
2. Restoring Trust: A swift response instills confidence in stakeholders, including customers and partners. Timely and transparent
communication about the incident and its resolution helps restore trust in the organization's ability to handle security challenges.
 Collaboration with Law Enforcement -

1. Legal Investigation: Collaboration with law enforcement agencies facilitates a legal investigation into the security incident. This is
essential for identifying and apprehending cybercriminals, contributing to the overall cybersecurity ecosystem.
2. Enhanced Expertise: Law enforcement agencies bring specialized expertise and resources to the investigation process. Collaborating
with them enhances the organization's capabilities in tracking down and prosecuting individuals or groups responsible for the security
incident.
FUTURE THREATS AND TRENDS
 Emerging Threats in Cybersecurity -

1. AI-Powered Attacks: The integration of artificial intelligence (AI) in cyber attacks poses an emerging threat. Attackers may leverage AI
to enhance the sophistication and adaptability of malware, making it more challenging to detect and mitigate.
2. 5G Vulnerabilities: With the widespread adoption of 5G technology, new attack vectors may emerge. Exploiting vulnerabilities in 5G
networks could lead to disruptions, data breaches, and attacks on connected devices.
 Future Trends in Cyber Attacks -

1. Ransomware Evolution: Future trends suggest that ransomware attacks will continue to evolve, incorporating advanced techniques such
as double extortion, where attackers steal sensitive data before encrypting files, increasing the pressure on victims to pay ransoms.
2. Supply Chain Attacks: Cybercriminals are increasingly targeting supply chains to compromise organizations indirectly. This trend is
expected to grow as attackers recognize the potential for widespread impact through third-party vulnerabilities.
 The Importance of Staying Vigilant and Adapting to New Challenges -

1. Dynamic Threat Landscape: The cybersecurity landscape is dynamic, with threats evolving rapidly. Staying vigilant allows
organizations to adapt to new challenges, proactively identifying and addressing emerging threats to enhance overall resilience.
2. Protecting Digital Assets: Staying adaptive is crucial to protecting digital assets in the face of evolving cyber threats. By continuously
updating defenses, adopting new technologies, and fostering a cybersecurity-aware culture, organizations can effectively safeguard their
information and systems.
 As cybersecurity threats evolve and future trends in cyber attacks emerge, the importance of staying vigilant cannot be overstated.
Organizations that remain adaptable and proactive in their cybersecurity efforts are better positioned to navigate the complex and ever-
CASE STUDIES

 Real-World Examples of Notable Cyber Attacks -

1. Stuxnet (2010): Stuxnet was a sophisticated worm that specifically targeted Iran's nuclear facilities. It demonstrated the
potential for cyber attacks to disrupt critical infrastructure, emphasizing the need for enhanced security measures in
industrial systems.
2. Equifax Data Breach (2017): The Equifax breach exposed sensitive personal information of millions of people. This
incident underscored the importance of robust data protection practices, including secure storage, encryption, and timely
disclosure of security incidents.
 Lessons Learned from Past Incidents -

1. Importance of Patch Management: The WannaCry ransomware attack (2017) exploited unpatched vulnerabilities in
Windows systems. Organizations learned the critical lesson of maintaining up-to-date patching to prevent exploitation of
known vulnerabilities.
2. Human Element in Security: The phishing attack on Podesta's email during the 2016 U.S. presidential election
highlighted the role of human error in cybersecurity. Training and awareness programs became crucial to mitigate the
risks associated with social engineering attacks.
 CONCLUSION
 Recap of Key Points -

1. Cyber Threats Evolution: The dynamic nature of cyber threats demands continuous adaptation. Threats such as Stuxnet and the
Equifax breach illustrate the diverse and evolving tactics employed by cyber adversaries.
2. Lessons Learned: Incidents like WannaCry and the Podesta email hack emphasize the importance of lessons learned. Proactive
measures, including patch management, human awareness, and robust data protection, are crucial for cybersecurity resilience.
 Emphasis on the Dynamic Nature of Cyber Threats :

1. Rapid Evolution: Cyber threats evolve rapidly, necessitating a proactive and adaptive cybersecurity approach. The landscape is
marked by emerging threats like AI-powered attacks and 5G vulnerabilities, requiring constant vigilance.
2. Supply Chain Vulnerabilities: The increasing focus on supply chain attacks indicates the dynamic nature of threats.
Cybercriminals exploit indirect paths to compromise organizations, underscoring the need for a comprehensive security strategy.
 Encouragement for Continuous Learning and Adaptation -

1. Vigilance and Adaptability: Staying vigilant and adapting to new challenges are key to navigating the dynamic threat landscape.
Continuous learning ensures that organizations remain proactive in identifying and mitigating emerging cyber threats.
2. Cultivating Cybersecurity Awareness: Encouraging a culture of continuous learning and cybersecurity awareness empowers
individuals and organizations to respond effectively to evolving threats. This proactive approach contributes to overall
cybersecurity resilience.
RESOURCES AND REFERENCES

1. Books: Explore textbooks and reference materials on cryptography, network security, and related subjects.
Authors like Bruce Schneier, William Stallings, and Cryptography and Network Security by Behrouz A. Forouzan
are reputable sources.
2. Online Courses: Platforms like Coursera, edX, and Udacity offer courses on cryptography and network security.
Universities often provide high-quality content.
3. Academic Journals: Check reputable academic journals like the IEEE Transactions on Information Theory,
Journal of Cryptology, or ACM Transactions on Information and System Security for in-depth research articles.
4. Official Documentation: Refer to official documentation and standards bodies such as NIST (National Institute
of Standards and Technology) for cryptographic standards.
 For the latest news and trends:

1. Security Blogs: Follow blogs and websites dedicated to cybersecurity and cryptography, such as Schneier on
Security, Krebs on Security, and the EFF (Electronic Frontier Foundation) blog.
2. News Outlets: Stay updated with reputable technology news websites like Ars Technica, Wired, or The Verge,
which often cover developments in cryptography and network security.