Internet and Ethical Practices - Course Syllabus

Course Objectives and Foundational Principles

• Exploration of Internet Services: The primary objective involves developing a comprehensive technical understanding of modern Internet services, networking utilities, web architectures, and collaborative communication tools.

• Security and Ethical Inquiry: The secondary objective requires analyzing the security vulnerabilities, threat vectors, cryptographic remedies, legal statutes, and ethical responsibilities inherent in digital computing environments and global network usage.

Learning Outcomes

• Mastery of Internet and World Wide Web Architectures: Comprehensive proficiency in the underlying protocols, networking structures, addressing conventions, and application-layer mechanisms that operate the Internet and the World Wide Web.

• Application of Cryptographic Methods for Network Security: Ability to identify, evaluate, and employ cryptographic algorithms, data integrity techniques, and defense strategies to protect sensitive information from adversarial attacks.

• Assessment of E-Commerce Security Challenges: Deep understanding of electronic commerce architectures, electronic fund transfer protocols, payment processing risks, and systemic vulnerabilities across diverse commercial transaction models.

• Navigating Cyberspace Security Concerns and Cyber Law: Thorough knowledge of contemporary cyber threats, attack methodologies, social engineering tactics, organizational cybersecurity defenses, and the statutory legal frameworks (notably The Information Technology Act, 2000) that enforce cyber ethics and regulatory compliance.

Unit 1: Data Communication over Internet and Online Services

• Data Communication over the Internet:

  • Data communication is the exchange of digital data between two or more networked devices via transmission media, governed by standardized protocols.

  • Relies primarily on packet-switching architectures operating over the Transmission Control Protocol / Internet Protocol ($\text{TCP/IP}$) suite.

  • Data is broken down into discrete packets containing payload data, source addresses, destination addresses, sequence numbers, and error-checking checksums before transmission across heterogeneous routing nodes.

• Internet Connectivity Paradigms:

  • Connecting to the Internet: Establishing physical and data-link connections between local customer premises equipment (CPE) and Internet Service Providers (ISPs).

  • Broadband: High-bandwidth data transmission technique that simultaneously transports multiple signals and traffic types across wide frequency bands (such as DSL, coaxial cable broadband, fiber-to-the-home [FTTH], and fixed wireless). Broadband connections operate as asymmetric or symmetric shared media with high data transmission capacities.

  • Leased Connection (Leased Line): A dedicated, private, bidirectional, symmetrical telecommunication line connecting two geographic locations directly (such as an enterprise office directly to an ISP point of presence). Leased lines guarantee a $1:1$ contention ratio, high throughput, low latency, and strict Service Level Agreements (SLAs), distinguishing them from shared broadband.

• Core Web Architecture and Addressing:

  • World Wide Web (WWW): An information system where documents and web resources are identified by uniform identifiers, interlinked by hypertext links, and accessible over the Internet via client-server architecture.

  • Web Browsers: Client-side software applications designed to retrieve, parse, render, and execute web-based content, including HyperText Markup Language (HTML), Cascading Style Sheets (CSS), and JavaScript scripts (examples include Google Chrome, Mozilla Firefox, Apple Safari, and Microsoft Edge).

  • Uniform Resource Locator (URL): A standardized structural string used to reference resources on a network, formalized under the general syntax: protocol://hostname:port/path?query#fragment.

  • Hypertext Transfer Protocol (HTTP): A stateless, application-layer communication protocol functioning on a client-request/server-response paradigm. Standard communication relies on plaintext transmission over TCP port $80$, whereas HTTPS secures transmissions using Transport Layer Security (TLS) or Secure Sockets Layer (SSL) encryption over TCP port $443$.

• Online Communication, Publishing, and Retrieval Systems:

  • Blogs (Weblogs): Regularly updated, chronological or reverse-chronological online journals and publication systems managed by Content Management Systems (CMS), enabling single-author or multi-author digital discourse and reader engagement.

  • Search Engines: Software algorithms and systems designed to search information on the World Wide Web. Operation consists of three core phases: web crawling (discovering content via bots/spiders), indexing (categorizing and parsing tokens and keywords into massive databases), and query processing/ranking (evaluating relevance and authority through algorithmic weights such as PageRank).

  • E-Mail Services: Store-and-forward electronic mail exchange services using client-server paradigms governed by standard networking protocols: Simple Mail Transfer Protocol (SMTP) for outbound email dispatch over TCP ports $25$, $465$, or $587$; Post Office Protocol version 3 (POP3) for downloading and local storing over port $110$ or $995$; and Internet Message Access Protocol (IMAP) for synchronized, multi-client server-side message management over port $143$ or $993$.

  • Teleconferencing: Interactive real-time audio and video sessions conducted across communication networks utilizing Voice over Internet Protocol (VoIP), Real-Time Transport Protocol (RTP), Session Initiation Protocol (SIP), and WebRTC standards.

  • Social Networks: Interactive platforms facilitating personal and professional relationship-building, information dissemination, community management, and profile exchanges across distributed user bases.

  • Online Services: Centralized and decentralized digital utilities delivered via web interfaces, including cloud hosting, Software-as-a-Service (SaaS), online banking, collaborative productivity suites, and streaming media platforms.

Unit 2: Network Security and Cryptography

• Cryptography Terminologies and Foundations:

  • Cryptography: The mathematical and algorithmic science of securing information by transforming intelligible messages into unintelligible representations to ensure privacy, integrity, and authenticity.

  • Plaintext ($P$): The original, legible message, unencrypted data stream, or file input into an encryption algorithm.

  • Ciphertext ($C$): The unintelligible, enciphered output generated by executing an encryption algorithm on plaintext using a cryptographic key.

  • Cipher: The underlying mathematical function, algorithm, or operational procedure used to perform encryption and decryption.

  • Key ($K$): A specific alphanumeric sequence, bit string, or mathematical parameter that parameterizes the cipher to yield unique transformations.

  • Encryption ($E$): The transformation process represented functionally as: $C = E(K, P)$.

  • Decryption ($D$): The reverse transformation process recovering the original plaintext: $P = D(K, C)$.

• The CIA Triad and Core Security Goals:

  • Confidentiality: Ensuring that sensitive information remains entirely inaccessible to unauthorized users, processes, or devices through access controls, isolation, and data encryption.

  • Integrity: Guaranteeing that data has not been modified, altered, forged, deleted, or inserted during transit or storage. Integrity is maintained via cryptographic hash functions (such as SHA-256) and message authentication codes (MACs).

  • Availability: Guaranteeing continuous, timely, and uninterrupted authorized access to systems, operational data, network bandwidth, and computing infrastructure, mitigating disruptions like hardware crashes or Denial of Service attacks.

  • Supplementary Security Goals:

    • Authenticity: The verification and validation of claimed identities before access or transmission is granted.

    • Non-Repudiation: The guarantee that an entity cannot deny having sent or received a message or performed a specific action, typically enforced using asymmetric digital signatures.

    • Accountability: The tracing of actions to specific system entities via logging and auditing procedures.

• Security Attacks and Vulnerabilities:

  • Passive Attacks: Adversarial actions that monitor, inspect, or intercept data without tampering with content or system operations.

    • Eavesdropping/Snooping: Intercepting and reading unencrypted messages on a transmission medium.

    • Traffic Analysis: Monitoring data packet frequencies, volumes, source-destination patterns, and network bursts to deduce confidential intelligence.

  • Active Attacks: Malicious actions that actively alter data streams, compromise system states, or disrupt network infrastructure.

    • Masquerading/Spoofing: Pretending to be an authorized entity.

    • Replay Attacks: Intercepting legitimate data transmissions and retransmitting them at a later time to produce an unauthorized effect.

    • Modification of Messages: Changing portions of a transmitted message or delaying its reception.

    • Denial of Service (DoS): Depleting system resources or bandwidth to prevent legitimate usage.

• Cryptographic Security Services:

  • Authentication Service: Proves the true identity of communicants or processes.

  • Access Control Service: Enforces access control matrices to restrict unauthorized resource utilization.

  • Data Confidentiality Service: Shields message content and traffic patterns from unauthorized observation.

  • Data Integrity Service: Identifies any modification, insertion, deletion, or replay within a data unit.

  • Non-Repudiation Service: Provides mathematical proof of message origin and message delivery.

• Types of Cryptography:

  • Symmetric Key Cryptography (Secret-Key / Single-Key Cryptography):

    • Uses an identical secret key for both encryption and decryption operations: $K_{enc} = K_{dec} = K$.

    • Computational processing speed is exceptionally fast, making it ideal for bulk data encryption.

    • Primary limitation is the key distribution problem: securely exchanging the shared secret key between communicating parties over an untrusted channel.

    • Key count formula for $n$ communicating entities requiring pairwise security: $\frac{n(n - 1)}{2}$.

    • Representative ciphers: Data Encryption Standard (DES), Triple DES (3DES), Advanced Encryption Standard (AES), and Blowfish.

  • Asymmetric Key Cryptography (Public-Key Cryptography):

    • Uses a mathematically linked key pair: a public key ($K_{pub}$), which is openly disseminated, and a private key ($K_{priv}$), which is kept strictly confidential by the owner.

    • Encryption transformation performed with the recipient's public key: $C = E(K_{pub}, P)$.

    • Decryption transformation performed exclusively with the recipient's private key: $P = D(K_{priv}, C)$.

    • Digital signature creation performed with the sender's private key: $S = E(K_{priv}, H(P))$, where $H(P)$ represents the message digest; verified by anyone using the sender's public key: $H(P) = D(K_{pub}, S)$.

    • Key count formula for $n$ entities: $2n$.

    • Computationally heavier and slower than symmetric ciphers; predominantly used for key exchange, digital certificates, and digital signatures.

    • Representative algorithms: RSA (Rivest-Shamir-Adleman), Elliptic Curve Cryptography (ECC), and Diffie-Hellman Key Exchange.

• Cryptanalysis and Steganography:

  • Cryptanalysis: The science, mathematical analysis, and practice of decoding ciphers, breaking cryptographic systems, and retrieving plaintexts or keys without initial knowledge of the secret key.

    • Ciphertext-Only Attack: The analyst possesses only an intercept of ciphertexts.

    • Known-Plaintext Attack: The analyst possesses matching pairs of plaintext and ciphertext.

    • Chosen-Plaintext Attack: The analyst selects arbitrary plaintexts and receives their corresponding ciphertexts.

    • Chosen-Ciphertext Attack: The analyst selects arbitrary ciphertexts and receives their decrypted plaintexts.

  • Steganography: The technique of concealing a secret message, file, or image inside an ordinary, non-suspicious host carrier (such as the least significant bits of an image, audio file, or video stream). Unlike cryptography, which renders message content unintelligible, steganography hides the very existence of the communication channel.

Unit 3: Security Issues in E-Commerce and Cyber Law

• E-Commerce Business Models:

  • Business-to-Business (B2B): Commercial electronic transactions between enterprises, such as manufacturers, wholesale distributors, and suppliers. Characterized by high transaction values, bulk ordering, electronic supply chain integration, Electronic Data Interchange (EDI), and enterprise resource planning (ERP) interfaces.

  • Business-to-Consumer (B2C): Direct online retail sales from businesses to end-user consumers (for example, online storefronts, retail booking sites, digital streaming subscriptions). Focuses on user interface design, shopping cart architectures, rapid checkout, customer relationship management, and microtransactions.

  • Consumer-to-Business (C2B): Commercial model in which individuals or freelance consumers offer products, creative assets, freelance labor, or custom services to business entities (such as freelance marketplaces, stock photography platforms, and reverse auction mechanisms).

  • Consumer-to-Consumer (C2C): Digital platforms facilitating transactions directly between private individual consumers, where the platform serves as an intermediary escrow, verification, and messaging layer (such as online auction platforms, peer-to-peer marketplaces, and classified advertisement portals).

• Electronic Fund Transfer (EFT) Architectures:

  • Definition: The digital movement of financial funds from one bank account directly to another across an interconnected payment network, eliminating physical paper checks or currency handling.

  • Modes of EFT:

    • National Electronic Funds Transfer (NEFT): An electronic payment system facilitating one-to-one funds transfers; settles transactions in deferred hourly batches throughout operational cycles.

    • Real Time Gross Settlement (RTGS): A gross, continuous, and non-batched settlement system where transactions are cleared instantly and individually in real time, typically utilized for high-value financial transfers.

    • Immediate Payment Service (IMPS): An instant, 24/7/365 interbank electronic fund transfer service accessible via mobile banking, ATM terminals, and internet banking channels.

    • Unified Payments Interface (UPI): A real-time payments platform developed to merge multiple banking services and features under a single mobile architecture, using Virtual Payment Addresses (VPAs) without disclosing underlying bank account details.

    • Automated Clearing House (ACH): An electronic network used for financial institutions to process high volumes of credit and debit transactions in recurring batches (e.g., payroll direct deposits and automatic utility bill debits).

• Online Payment Security Mechanisms and Infrastructure:

  • Payment Gateways: Application service software that encrypts, validates, and routes payment card data between the merchant website, acquirer banks, payment card networks, and customer issuing banks.

  • Tokenization: Replacing sensitive Primary Account Numbers (PANs) with cryptographically generated non-sensitive substitute tokens to eliminate stored payment vulnerabilities.

  • Payment Card Industry Data Security Standard (PCI-DSS): A mandatory international information security standard governing the handling, processing, and storage of branded credit cards to curb financial data breaches.

  • Multi-Factor Authentication (MFA / 2FA): Requiring two or more independent factors (knowledge: passwords/PINs; possession: one-time passwords [OTPs]/smart cards; inherence: biometrics) to authenticate and validate financial transactions.

• The Information Technology Act, 2000 (The IT Act 2000):

  • The foundational statute in India establishing a formal legal framework for electronic commerce, digital documentation, electronic transactions, and electronic governance.

  • Legal Recognition of Electronic Records: Grants legal validity, admissibility, and recognition to digital data, digital signatures, and electronic communications equivalent to physical written documents.

  • Digital Signatures and Public Key Infrastructure (PKI): Prescribes standards for asymmetric cryptosystems, establishing legal procedures for Certifying Authorities (CAs) and the Controller of Certifying Authorities (CCA).

  • Contraventions, Offenses, and Penalties: Formalizes statutory offenses and prescribes civil liability and criminal penalties for unauthorized computer access, data damage, hacking, transmission of illicit materials, and system tampering.

  • Establishment of Adjudicating Bodies: Established the Cyber Appellate Tribunal (now merged with TDSAT) to handle legal disputes, appeals, and enforcement under digital jurisprudence.

• Intellectual Property Rights (IPR) in Cyberspace:

  • Copyright in the Digital Era: Protection of software code, website layouts, digital art, written electronic works, and multimedia databases; enforcement of Digital Rights Management (DRM) technologies to curb digital piracy.

  • Trademarks and Cybersquatting: Protection of distinctive brand marks online; addressing cybersquatting (registering domain names matching established brand marks in bad faith to sell them for profit) and typosquatting (registering common misspellings of popular domains).

  • Patents in Cyberspace: Legal patentability questions concerning proprietary software algorithms, computer-implemented inventions, and e-commerce business process methods.

  • Trade Secrets: Protecting confidential business algorithms, customer analytics databases, internal proprietary code, and strategic data models against corporate espionage and unauthorized leakages.

Unit 4: Security Challenges in Cyberspace

• Primary Cybercrimes and Threat Methodologies:

  • Hacking: Unauthorized access, penetration, exploration, or tampering with computing systems, servers, or networks.

    • Ethical/White-Hat Hacking: Authorized penetration testing and security assessment aimed at hardening systems.

    • Malicious/Black-Hat Hacking: Exploiting system vulnerabilities for unauthorized data exfiltration, system destruction, or financial gain.

    • Grey-Hat Hacking: Unauthorized system penetration without explicitly destructive intent, often disclosing flaws publicly or requesting bounties.

  • Denial of Service (DoS) and Distributed Denial of Service (DDoS):

    • DoS Attack: Saturating the bandwidth, process tables, or computational capacity of a targeted host system with malicious request traffic to render it unavailable to legitimate users.

    • DDoS Attack: Orchestrating millions of malicious traffic flows concurrently from a globally distributed network of compromised systems (a botnet).

    • Mechanisms: SYN Flooding, UDP Flooding, Ping of Death, and Application Layer HTTP GET/POST Flooding.

  • Malware (Malicious Software):

    • Viruses: Code snippets that attach to host executable files and replicate across storage media upon execution.

    • Worms: Standalone malicious software that self-replicates across computer networks automatically by exploiting unpatched protocol vulnerabilities without human activation.

    • Trojans (Trojan Horses): Malicious programs disguised as legitimate utilities that establish hidden backdoors within systems upon installation.

    • Ransomware: Cryptographic malware that silently encrypts critical system files and directories, demanding payment for decryption keys.

    • Spyware/Keyloggers: Covert monitoring software that intercepts user keystrokes, browsing histories, and access credentials.

  • Phishing Attacks:

    • Deceptive social engineering attacks that impersonate legitimate organizations (such as banks or administrative IT departments) via forged emails or spoofed websites to harvest credentials, identity numbers, and credit card details.

    • Spear Phishing: Tailored, highly researched phishing attacks directed at specific individuals.

    • Whaling: Targeted spear-phishing aimed specifically at executive leadership (CEOs, CFOs).

    • Vishing/Smishing: Phishing executed over voice telephony (voice phishing) or Short Message Service (SMS phishing).

  • Cyber Stalking:

    • The continuous, systematic use of the Internet, social media, email, or digital messaging platforms to harass, intimidate, pursue, track, or threaten a victim, inducing reasonable fear of harm or mental anguish.

  • Child Pornography (Child Sexual Abuse Material - CSAM):

    • The production, generation, electronic distribution, dissemination, downloading, hosting, or possession of explicit visual and digital depictions of minors.

    • Categorized as a severe felony across international and domestic jurisdictions, triggering zero-tolerance statutory interdictions, automated hashing matching (e.g., PhotoDNA), and mandatory legal reporting.

• Classification and Domains of Cybercrimes:

  • Cybercrime Targeting Computers and Mobile Devices:

    • Attacks directed squarely at the confidentiality, integrity, and availability of computing devices.

    • Includes rootkit installations, firmware modifications, mobile app repackaging with trojans, zero-day kernel exploits, unauthorized SIM card swapping, and Bluetooth hijacking (bluebugging/bluesnarfing).

  • Cybercrime Against Women and Children:

    • Targeted offenses including non-consensual sharing of intimate images (cyber voyeurism/revenge pornography), online grooming, cyberbullying, morphing, trolling, morphing imagery, and identity-doxing to cause public humiliation.

  • Financial Frauds:

    • Digital identity theft, fraudulent credit/debit card carding operations, ATM skimming, account takeover (ATO), advanced-fee loan scams, and investment pyramid schemes operated over electronic channels.

  • Social Engineering Attacks:

    • Exploiting human psychology, behavioral tendencies, trust, and cognitive biases rather than technical vulnerabilities to bypass physical or digital access controls.

    • Pretexting: Fabricating a fictitious scenario to manipulate a target into divulging sensitive enterprise data.

    • Baiting: Enticing victims with a physical or digital promise (such as leaving infected USB drives labeled "Confidential Payroll" in public lobbies).

    • Watering Hole Attacks: Identifying websites frequently visited by targeted organizations and infecting those specific sites with malware.

• Legal Perspectives on Cybercrime:

  • Jurisdictional complexities stemming from the borderless and transnational nature of the Internet.

  • Evidentiary challenges in digital forensics, including the collection, volatile memory capture, digital chain of custody preservation, and mathematical validation of forensic data under Indian Evidence Act guidelines ($\text{Section 65B}$ certifications).

  • Extraterritorial application of domestic cyber laws when cross-border computer networks or servers located within sovereign territories are compromised.

• Organizations Dealing with Cybercrime and Cybersecurity in India:

  • CERT-In (Indian Computer Emergency Response Team): The national nodal agency under the Ministry of Electronics and Information Technology (MeitY) responsible for monitoring incident logs, predicting cyber threats, handling incident response, and issuing security advisories across India's cyberspace.

  • NCIIPC (National Critical Information Infrastructure Protection Centre): An agency created under $\text{Section 70A}$ of the IT Act 2000, designated to secure national critical information infrastructures across sectors like banking, defense, energy, telecommunications, and transportation.

  • I4C (Indian Cyber Crime Coordination Centre): An initiative under the Ministry of Home Affairs (MHA) designed to provide a comprehensive, coordinated framework for law enforcement agencies to combat cybercrimes across all states and union territories.

  • National Cyber Crime Reporting Portal (cybercrime.gov.in): A centralized online interface managed by I4C enabling citizens to report cybercrimes digitally, with specialized focus on financial frauds and offenses against women and children.

  • State Cyber Police Stations and Forensic Laboratories: Dedicated state-level law enforcement divisions equipped with dedicated cyber forensics wings to investigate cyber offenses, analyze hard drives and mobile devices, and support prosecution under Indian law.

Prescribed Literature and References

• Textbooks:

  • Arora, Ashok. Computer Fundamentals and Applications. Vikas Publishing House.

  • Forouzan, Behrouz A., and Debdeep Mukhopadhyay. Cryptography and Network Security. McGraw Hill Education.

• Reference Books:

  • Chan, Henry, Raymond Lee, Tharam Dillon, and Elizabeth Chang. E-Commerce: Fundamentals and Applications. John Wiley & Sons.

  • Pfleeger, Charles P., and Shari Lawrence Pfleeger. Security in Computing. Prentice Hall of India.