Unit 8: Information Security and Cyber Law

This note is made for NEB Grade 11 Computer Science. This post contains the complete notes for Unit 8 in a simple and easy-to-understand way, based on the syllabus of CDC, along with sample board exam questions based on the official 2077 Specification Grid.

8.1 Digital Society and Computer Ethics

Digital Society: a community in which computers, the internet, and digital devices have become a central part of everyday communication, work, education, and commerce, rather than an optional convenience.

Banking, government services, education, shopping, and even social relationships now run partly or entirely through digital channels. This shift brings real benefits (speed, convenience, wider access) but also creates new responsibilities and risks that didn’t exist in a purely paper-based society, such as privacy, digital security, and appropriate online behavior.

Computer ethics: It guides people to use computers and digital technology responsibly by following moral principles, legal requirements, and what is ethically right.

• Respecting others’ privacy and not accessing their data, accounts, or devices without permission
• Not using a computer to harm others, spread false information, or harass someone online
• Giving proper credit for others’ work and not plagiarizing content
• Not using pirated software or violating copyright and licensing terms
• Using computer resources responsibly, without wasting shared resources such as network bandwidth

8.2 Concept of Information Security

Information security is the practice of protecting digital data and systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

Information security focuses on three core goals, commonly known as the CIA Triad:

Principle	What It Means
Confidentiality	Only authorized people can access or view the data
Integrity	Data stays accurate and unaltered unless changed by an authorized person
Availability	Data and systems are accessible to authorized users whenever needed

A bank data breach, for instance, threatens confidentiality when attackers leak account details, compromises integrity when attackers tamper with transaction records, and disrupts availability when attackers force the bank’s servers offline.

8.3 Concept of Cybercrime

Cybercriminals commit criminal activities using computers, networks, or the internet, either targeting these technologies or using them as tools to commit crimes.

Type of Cybercrime	What It Involves
Hacking	Gaining unauthorized access to a computer system or network
Phishing	Tricking a user into revealing sensitive information (passwords, card details) through fake emails or websites
Identity Theft	Stealing someone’s personal information to impersonate them, often for financial gain
Cyberbullying / Online Harassment	Using digital platforms to threaten, harass, or humiliate another person
Software Piracy	Illegally copying, distributing, or using licensed software without authorization
Financial Fraud	Unauthorized use of banking details, cards, or digital wallets for theft

8.4 Malicious Software and Spam

It refers to any software specifically designed to damage, disrupt, or gain unauthorized access to a computer system, usually without the user’s knowledge or consent.

Type	How It Behaves
Virus	Attaches itself to a legitimate file or program and spreads when that file is shared or run
Worm	Spreads on its own across a network, without needing to attach to another file
Trojan Horse	Disguises itself as legitimate software while carrying out harmful actions in the background
Spyware	Secretly monitors a user’s activity and sends the collected data to a third party
Ransomware	Locks or encrypts a victim’s files and demands payment to restore access
Adware	Automatically displays unwanted advertisements, often bundled with free software

Spam: unsolicited, often irrelevant or repetitive messages, typically sent in bulk over email or messaging platforms, usually for advertising or, in more harmful cases, to spread malware or phishing links.

8.5 Protection from Cybercrime

Most protective measures come down to a handful of consistent habits:

• Use strong, unique passwords for different accounts, and change them periodically
• Enable two-factor authentication (2FA) wherever it’s available, adding a second layer of verification beyond just a password
• Keep software and operating systems updated, since updates frequently patch known security vulnerabilities
• Install and update antivirus software to detect and remove known malware
• Avoid clicking suspicious links or attachments, especially in unexpected emails asking for personal or financial information
• Use a firewall to monitor and control incoming and outgoing network traffic
• Back up important data regularly, so it can be recovered even after an attack like ransomware
• Be cautious about what personal information is shared on social media and public platforms

8.6 Intellectual Property Rights

Intellectual Property Rights (IPR) are the legal right that gives a creator control over the use of their own original creation, such as an invention, piece of writing, design, or software.

IPR exists so that creators can benefit from their own work and are protected against others copying or profiting from it without permission.

Type of IPR	What It Protects
Copyright	Original creative works, such as software, books, music, and films
Patent	New inventions or technical processes
Trademark	Brand names, logos, and symbols that identify a business or product
Trade Secret	Confidential business information, such as a formula or process, kept secret rather than publicly registered

Using pirated software or copying someone else’s code, images, or written work without permission or credit is a direct violation of intellectual property rights, even if no money changes hands.

8.7 Concept of Digital Signature

A digital signature uses an electronic cryptographic method to verify the authenticity and integrity of a digital document or message, confirming the sender’s identity and ensuring that no one has altered the document or message since signing.

A digital signature is not simply a scanned image of a handwritten signature. Cryptography mathematically generates a digital signature and links it to a unique digital certificate issued by a licensed certifying authority, giving the signature legal recognition. In Nepal, the Electronic Transaction Act 2063 establishes this recognition and the certifying authority system, which the next section covers.

• Authentication: confirms the identity of the sender
• Integrity: confirms the document hasn’t been changed after signing
• Non-repudiation: prevents the signer from later denying that they signed the document

8.8 Concept of Cyber Law in Nepal

Cyber law refers to the legal rules that govern activities carried out through computers, networks, and the internet, including electronic transactions, digital signatures, data protection, and cybercrime.

Nepal’s primary cyber law is the Electronic Transaction Act, 2063 (2006), commonly referred to as the ETA. It was Nepal’s first law to formally recognize electronic activity, and it remains the country’s foundational cyber legislation.

• Legal recognition: gives electronic records and digital signatures the same legal standing as paper documents and handwritten signatures
• Certifying Authorities: establishes a licensing and regulatory system (the Office of the Controller of Certification) for authorities that issue digital signature certificates
• Cybercrime provisions: defines offences such as unauthorized access (hacking), computer-related fraud, and the publication of illegal electronic material, along with penalties that can include fines and imprisonment
• Dispute resolution: establishes an Information Technology Tribunal to hear and resolve cases related to electronic transactions and cybercrime

8.9 ICT Policy in Nepal

An ICT Policy is a government framework that sets out the vision, goals, and strategies for developing and using information and communication technology across a country.

Nepal’s current framework is the ICT Policy, 2072 (2015), built around the vision of transforming Nepal into an information and knowledge-based society and economy.

• Expanding access to reliable, affordable internet and ICT infrastructure across the country, including rural areas
• Promoting e-governance, so government services can be delivered in a more transparent and efficient way
• Encouraging the growth of the IT industry as a contributor to Nepal’s economy
• Improving digital literacy among the general population
• Supporting the use of ICT in education, healthcare, and other public sectors

Where the Electronic Transaction Act sets the legal rules for digital activity, the ICT Policy sets the broader national direction and goals for how technology should grow and be used across the country.

Sample Board Exam Questions

Based on the official NEB Computer Science Specification Grid 2077, Unit 8 (Information Security and Cyber Law) carries 6 marks out of the theory paper, spread across the Remembering, Understanding, and Applying levels. It’s commonly tested through a mix of MCQs and a short or long answer question on cybercrime, IPR, or cyber law in Nepal.

Group A: Multiple Choice Questions 1 × 3 = 3

1. Which of the following best describes a computer worm?

a) It needs a host file to spread

b) It spreads on its own across a network

c) It disguises itself as legitimate software

d) It only affects mobile devices

2. Which type of Intellectual Property Right protects a company’s brand name and logo?

a) Copyright

b) Patent

c) Trademark

d) Trade Secret

3. What is Nepal’s primary cyber law called?

a) ICT Policy 2072

b) Electronic Transaction Act 2063

c) Right to Information Act

d) Telecommunications Act

Group B: Short Answer Questions

What is cybercrime? Explain any four types of cybercrime with examples, and mention two measures to protect against them.

Important Questions

1. What is a digital society? How has it changed the way people live and work? 
2. What is computer ethics? List any four ethical practices to follow while using a computer. 
3. What is information security? Explain the CIA Triad. 
4. Define cybercrime. List any four types of cybercrime with brief explanations. 
5. What is malware? Differentiate between a virus, a worm, and a Trojan horse. 
6. What is spam? Why is it considered a security concern beyond being just annoying? 
7. List any five measures to protect a computer system from cybercrime. 
8. What is Intellectual Property Rights? Explain copyright, patent, and trademark with examples. 
9. What is a digital signature? Explain how it ensures authentication, integrity, and non-repudiation. 
10. What is cyber law? Explain the main provisions of the Electronic Transaction Act 2063 of Nepal. 
11. What is the ICT Policy of Nepal? Mention any four of its objectives. 
12. Differentiate between the Electronic Transaction Act and the ICT Policy of Nepal. 

Frequently Asked Questions