The terminology ‘cyber security’ is composed of two words, cyber and security. The word cyber is derived from the Greek word cybernetics. Cyber indicates the relationship with information technology. The word security is derived from the Latin word Securitas meaning condition of being secure. Cyber security, computer security or information technology security is established to safeguard the computer systems and networks from essential disclosure of information, theft, damage or destruction of hardware, software, electronic data, devices connected with systems etc.

Cyber security is the application of various processes, technologies, and controls for protecting the computer systems of the organization. Such security procedures are adopted to shield the information technology systems of the association or corporation from cyber-attacks. The main aim of cyber security is to prevent the data from unauthorized access.[i]

With the advancement in science and technology, the usage of computers is increasing at a fast pace. Everything nowadays is being done online from making reservations to filling form online. Various business transactions, shopping via wallets is very trending nowadays. Increasing use of technology involves both pros and cons. Technology is very fruitful for many. It helps in saving time and is cost efficient. But rapidly rising use of technology has posed threat on the security of the undisclosed data and privacy of the individual.

In the coming years data will be considered as a new oil. The future trades of the countries will depend upon the initiatives they are taking for protecting their data. It is essential to prevent data being misused by criminal mindsets. Many of the biggest and advanced companies in the world are victimized by the ill effects of cyber-attacks. It has caused both monetary and reputational damage to the corporations. To prevent the organization from such loss, the need was to develop cyber security systems for protection of computers and other such devices from cybercrime.

Cyber security and Information security[ii]

Cyber security and information security are regarded as similar by many. But there is a difference between the two. Cyber security is restricted only to the protection of data available digitally. It is a narrow concept. Its role is to secure computer systems and its related facets. It seeks to provide only authorized access to the secured data of the organization. It aims to prevent cyber related criminal activities. On the other hand, Information security is a broader concept. It protects the data stored both in electronic form and physical or paper form. It prevents all the informational assets from being misused.

Terminology related with cyber security[iii]

1. Cloud- cloud or cloud computing is a technology which provides the users a facility to access their files and devices anywhere in the world. It is a server on which software and data bases run, which can be accessible over the internet from any place. Through this technique users and corporations are not required to manage physical servers or to run software applications on their own systems. In cloud, the storage is not on the individual devices but on the servers in a data center. Due to cloud computing we can easily open our same account on a different device with all pictures, videos and chats intact.
2. Docking- it is also called docking station or dock. It is a device that connects laptop to multiple peripherals. Instead of plugging multiple devices, the laptop can be used as a desktop system with the use of this device. Due to docking a laptop can function as both and users usually enjoy benefits of both the desktop and the laptop.
3. Virtual private network (VPN)- VPN or virtual private network is a tool in which data is converted into code over the internet from a device to a network. It helps in preventing unauthorized access over the data. This way of encryption lets transmission of data safely. VPN provides online privacy to the users.
4. Exploit- it is a code which takes advantage of loopholes in the security system. It provides an intruder to access a network and gain advantages over it, it can also be called as a malicious application or script to misuse vulnerability of the security.
5. Breach- it is considered as a next step to exploit. It is the moment when vulnerability of the system is misused, and the bad guy is able to access files and documents. It is an incident that results in unauthorized access to data or devices.
6. Firewall- it is an essential tool in cyber security. It is a device which monitors the incoming and outgoing traffic of network and allows or blocks data packets according to security rules and procedures placed. It can be of three types- hardware, software, and hybrid.

Terms commonly used along with Cyber[iv]

1. Cyber Space- cyber space is defined as the virtual world or is considered as an electronic medium through which online communication takes place. The term cyber space was first coined by William Gibson, in his book Neuromancer. The cyber space allows the users to interact with others, play games, share their thoughts, engage in discussions etc. it can be considered as unreal world where information is exchanged between two or more devices.
2. Cyber Forensics- cyber forensics also known as computer forensics. It is the process of analyzing and detailed investigation of any computing device, to gather evidence can be produced in the court of law. It is the branch of digital forensic science. It is a way in which science and technical skills are applied to investigate a cybercrime. Computer forensics can also be comprehended as a process of investigation is done to find out, the guilty, reason of committing such crime and finding evidence to be presented in the court.
3. Cyber Crime- computer crime or cybercrime is a crime involving a device and a network. It causes financial and reputational damage to the innocent or aggrieved. Such offences are done to cause harm to an individual, want to cause physical and mental damage whether directly or indirectly to the victim. Such crimes have potential to threaten an individual or a country’s security and financial health. When cybercrimes cross the international border and involves at least one nation state, it is sometimes called cyberwarfare.
4. Cyber terrorism- it is the use of internet to conduct offensive acts, with a motive to cause bodily injury to an individual or group of individuals. It is done with an intention to gain political advantage via threat. It can be defined as an intentional usage of computer systems or network which causes harm to group of people with an objective to gain personal benefits.
5. Cyber extortion- It is a type of cybercrime in which the attacker charges something in return to give back access of the systems and data to its users. In cyber extortion, the hacker keeps the systems, network, data at hostage. It charges monetary value in return to release this information. It can also be defined as criminal activity done through force, threats, or blackmail. It is a criminal activity in which individual or group uses internet as a hostile force for demanding money.

Types of Cyber crime[v]

• Hacking- it simply means unauthorized access to a computer system or network. It can also be understood as taking advantage of the loopholes in the security systems and exploiting it. It is done with an aim to cause harm to an individual or organization whether financially or otherwise.
• Phishing- this is a kind of online fraud. This technique is used to obtain card and personal details through a fake mail. They act as a legitimate institution and lure people in.
• Malware- Malware is a short form of malicious software, this kind of software is specially designed to hack a particular device or cause damage to the system, server, network etc.  This method is used by attackers for performing a cyberattack. It can sometimes aim for unauthorized access to the systems or network.
• Trojan horse- this type of cybercrime misleads users of its true intention. They seem to be a legitimate software but can take control of your devices, systems, or software. This software can damage, steal data of the system. It uses deceptive means for cyberattack. On first instance it seems to be harmless but causes destruction at later period.
• Computer virus- it is a type of computer program, which when inserted into the system multiplies itself by altering other programs. Viruses can enter into the system through various methods, but the most common method is via internet. With every click on the internet, the system is under serious risk of virus entering in the system and stealing and causing damage to the data.
• Smishing- it is a kind of digital fraud in which a text message is shared to the users which contains a URL or phone. Clicking it will redirect the users to a site through which hackers perform cybercrime. Like phishing, smishing also seeks immediate attention of the users.
• Pharming- in this technique, the attacker installs a malicious code on the system of the user. When the user opens the internet, the code will redirect it without its permission to a fraudulent website.
• Vishing- the attackers utilize mobile phones to steal or damage personal data of the users in this technique of vishing.
• Bot/botnet- it is a kind of application whose function is to do tasks on command, it allows the hacker to take overall control of the computer system which is being affected. These infected computer systems are called ‘botnet’ and its control is with the hacker called ‘bot-herder’.
• Worm- it is a kind of malware that has got the ability to duplicate itself in order to spread the infection in other connected computers.

Big global cyber attacks[vi]

• Yahoo (2016)- this was the biggest hacking attack faced by an organization ever. It affected over 3000 users. The parent company of yahoo announced that due to breach, every single account was affected. It even includes other accounts like Tumblr, Fantasy, and Flickr accounts.
• WannaCry and Petya ransomware attacks- such ransomware attacks affected many computers and devices globally. India was among the most affected country in the APAC nations.
• Zomato (2017)- Zomato a food delivery application has suffered a major security breach, the user named ‘nclay’ claimed to have hacked data of Zomato application users. The data was intended to sell on darkweb marketplace. Zomato even claimed that the financial information of its users is not leaked or stolen.
• Facebook (2018)- Facebook has faced one of the serious disgraces over the globe. They are accused of sharing private data of their users to a UK based company which was beneficial in USA elections. Facebook has apologized for the data breach. But it had affected many users.
• Dropbox (2016)- Dropbox case was quite similar to the Zomato case, the email accounts and passwords of many users were sold on darknet marketplace. Many users accounts were affected. Dropbox mailed its users to change the passwords of their accounts.

Types of Cyber security[vii]

• Network Security- there are various kinds of computer network, whether public or private. Some companies have a private network, and some are accessible to public network. The network security is composed of procedures, policies, and framework to prevent and detect unauthorized access to data in a network. To safeguard a network from cyber-attack, it must be formed of a unique name and protected via strong password.
• Application Security- it is a type of cybersecuritywhich protects applications from unauthorized access, stealing and misuse of data etc. it is a process of making applications more secure. This is usually inserted at the formation or development stage. The security features can also be implanted after its deployment. The main aim is to safeguard data of its users.
• Information Security- this type of cyber security seeks to prevent unauthorized access, misuse, destruction, or disruption of data in any form whether digital or physical data. In this kind various processes and methodologies are in place to safeguard data in any electronic or print form. It aims to protect data whether in storage or transit.
• Operational Security- it seeks to protect data assets. It is a security process which organization put in place to prevent sensitive information from going into wrong hands. There are five steps in this process-first is to identify sensitive data, identify threats, analyze security threats and loopholes in security systems, evaluate level of threat, form a plan to alleviate the threats.

Legislation adopted in Germany

Cybersecurity is governed by multiple laws in Germany. The main act punishing guilty involved in cybercrimes is the German IT Security Act, 2015. This act is considered most well formulated law of all times in Germany. It seeks to protect IT systems and to safeguard personal data and privacy of users online. It is the most stringent act. After its formulation other acts like telecommunications etc. were amended. The new IT security law focuses on critical infrastructure and has provided a wide definition pertaining to same including IT, energy, telecommunications sector etc. [viii]The new obligations provide for- Implement appropriate organizational and technical safeguards and other measures in accordance with state of law within two years after the entry into force of secondary legislation specifying those safeguards and measures.

• Regularly (but at least every two years) prove that they fulfill the security requirements by means of security audits, ex-animations, or certifications), the operators must provide an overview of such audits etc. to the BSI including information on the security defects discovered.
• Designate a contact point for the BSI. Notify the BSI immediately of any significant disruptions of the availability, integrity, authenticity, confidentiality of their IT systems, components and processes which may have result or have resulted in failure or an impairment of functioning of critical infrastructure operated by them.

For Private companies, the BDSG or federal rule have set up new regulations. Such new guidelines will strengthen the cyber security systems and at the same time prove to be a safeguard to the data and information of organizations or individuals. These regulations are required to be followed by corporations as a measure to protect themselves from cyber-attacks.

They are-

• Video surveillance of public places
• Data processing for other purposes, then initially intended (Section 24 BDSG- new)
• Data processing in context of employment
• Data processing related to consumer credits
• Limitations of rights of data subject
• Designation of DPO
• Administrative fines, criminal proceedings
• Procedural rules for private and public law suites

Cybercrime encompasses a variety of different criminal offences such as:[ix]

• Violation of privacy of the words spoken (section 201 of the criminal code)
• Data espionage (section 202a of the criminal code).
• Phishing (section 202b of the criminal code).
• Data manipulation (section 303a of the criminal code) and
• Computer sabotage (section 303b of the criminal code)

Cybercrime that causes a monetary loss to the aggrieved (e.g.: phishing) can constitute a fraud (section 263 of the criminal code). The criminal code provides punishment for computer systems related fraud (section263a of the criminal code), which occurs when the attacker damages the (financial) property of another person by manipulating the result of data processing operation through[x]–

• The incorrect configuration of the computer program.
• The use of incomplete or incorrect data
• The unauthorized usage of data; or
• The exercise of other unauthorized influence on the processing operation

Depending upon the individual offence, the criminal penalties leviable ranges from fines to imprisonment for up to three years. Where government entities are targeted, there could be charges of treason (section 94 of the criminal code) or the disclosure of government secrets (section 95 of the criminal code), which can lead to a sentence of imprisonment up to 5 years or more. In the case of (computer) fraud, the penalties range from fines to imprisonment for up to 5 years or in severe cases up to 10 years[xi].

The data protection authorities have both[xii]:-

• The investigative powers (the power to order provision of documents or to obtain information)
• The corrective powers (the power to issue warnings and impose fines)

These measures can be taken against-

• The data controller (the person that determines the purpose and means of data processing)
• The data processor (the person who process personal data on behalf of the controller)

Companies can always appeal against government enforcement actions. The remedies may be divided into administrative and juridical remedies.

Safety tips for prevention from Cyber crime[xiii]

• Software and operating system should be up to date
• Anti-virus software must be used
• Strong passwords must be in place
• End to end encryption must be in place
• Internal controls must be properly framed and checked continuously
• Staff involved in security systems their work must be properly monitored.
• Email attachments and links from unknown senders should not be opened.
• Unsecured Wi-Fi networks in public places should not be used.

Frequently Asked Questions

Define cyber security?

Cyber security, computer security or information technology security is established safeguard the computer systems and networks from essential disclosure of information, theft, damage or destruction of hardware, software, electronic data, devices connected with systems etc. Cyber security is the application of various processes, technologies, and controls for protecting the computer systems of the organization. Such security procedures are adopted to shield the information technology systems of the association or corporation from cyber-attacks.

What is the importance of cyber security?

If Good Cyber security procedures are in place, the organization or individuals can be protected from cyber-attacks. The private, secret, or essential data would be prevented from being stolen, disclosed or damaged etc. Many of the biggest and advanced companies in the world are victimized by the ill effects of cyber-attacks. It has caused both monetary and reputational damage to the corporations. To prevent the organization from such loss, the need was to develop cyber security systems for protection of computers and other such devices from cybercrime.

Reference

[i] www.itgovernance.co.uk

[ii] Ibid

[iii] www.cybintsolutions.com

[iv] En.m.wikipedia.org

[v] The institute of company secretaries of India, Secretarial audit, compliance management and due diligence, June 2019

[vi] Cakamalgarg, Forensic Audit, May 2019

[vii] En.m.wikipedia.org

[viii] Insideprivacy.com

[ix] www.mondaq.com

[x] Ibid

[xi] Ibid

[xii] Ibid

[xiii] www.kaspersky.co.in