Cyber Security: Threats and institutions

Pairs 1, 2 and 3 are correct. Phishing is deceptive electronic communication used to trick people into revealing passwords, OTPs or card details, or into installing malware. Its variants are named after the channel or the target: smishing uses SMS, vishing uses voice calls (for example a fake bank official asking for an OTP), and whaling targets 'big fish' such as CEOs or senior officials (NIST glossary). Pair 4 is wrong: spear phishing is the opposite of bulk mail. It is carefully tailored to a particular person or organisation, often using personal details gathered from social media to look convincing. Untargeted bulk e-mail is ordinary or 'mass' phishing.

A zero-day is a vulnerability that is unknown to the software maker, or known but not yet patched, at the time attackers begin to exploit it; the vendor has had 'zero days' to release a fix. NIST describes a zero-day attack as one that exploits a previously unknown hardware, firmware or software vulnerability. Because signature-based antivirus has no pattern for it, such exploits are prized by criminal and state actors and sold at high prices. Stuxnet used several Windows zero-days, and spyware such as Pegasus has used 'zero-click' exploits that need no action by the phone's owner. The name refers to the defender's time to respond, not the product's release date.

Statements 1 and 2 are correct. Ransomware is malware that denies access to data, usually by encrypting it, and demands a ransom for the key. CISA's StopRansomware Guide describes double extortion: actors first exfiltrate data, then encrypt systems, and threaten to leak or sell the stolen data, so even a victim with good backups is pressured to pay. Statement 3 is wrong. Phishing e-mail is only one entry route; others include exposed remote- desktop services, unpatched software and stolen credentials. WannaCry (May 2017) was a ransomware worm that spread across networks by itself using the EternalBlue exploit of the Windows SMBv1 flaw (MS17-010).

Statement (d) is the incorrect one. A rootkit is designed to hide: it gives an attacker privileged ('root' or administrator) control and conceals itself and other malware, sometimes by modifying the operating system kernel or firmware, so it often survives ordinary removal and may need a full reinstall. Openly showing advertisements is the behaviour of adware. The other three are accurate: spyware gathers data covertly (Pegasus is an extreme, state-grade example), keyloggers capture keystrokes, and cryptojacking steals processing power and electricity to mine coins such as Monero. CERT-In's 2022 directions list cryptominers along with viruses, worms, Trojans, bots, spyware and ransomware as malicious code to be reported.

Three of them, 1, 2 and 3, are social engineering. Social engineering attacks exploit human trust, curiosity, fear or helpfulness rather than a technical flaw. Pretexting invents a believable story (a bank official, a police officer, IT support) to extract information; this underlies most OTP and 'KYC update' frauds. Baiting relies on curiosity, such as a USB drive labelled 'salary details'. Tailgating, or piggybacking, defeats physical access control by simply walking in behind an authorised person. SQL injection is different: it is a technical web- application attack that exploits poor input validation so that the database executes the attacker's commands, and it needs no manipulation of a person at all.

Statements 1 and 2 are correct. A botnet is a collection of infected machines ('bots' or 'zombies') that follow commands from the attacker's command-and-control infrastructure; it can be used to send spam, spread malware or flood a target. CISA's alert of October 2016 described how Mirai scanned the internet for IoT devices reachable over Telnet with default credentials, enslaved them and used them for record-breaking DDoS attacks, including the one that disrupted the DNS provider Dyn. Statement 3 is wrong: a DDoS attack floods a server or network with traffic from many sources so that legitimate users cannot reach it. Its target is availability, not the theft of data, although it is sometimes used as a smokescreen for other attacks.

Statements 1 and 2 are correct. NIST defines an advanced persistent threat as a sophisticated adversary with significant resources that uses multiple attack vectors to establish footholds inside an organisation, exfiltrate information or undermine critical operations, and pursues its objectives repeatedly over an extended period. Many APT groups are linked to states. Stuxnet, analysed by Symantec and the US ICS-CERT in 2010, spread through Windows machines (including via USB drives), looked for Siemens Step 7 software and reprogrammed PLCs; later analysis linked it to centrifuges at Iran's Natanz enrichment plant. Statement 3 describes the opposite of an APT: stealth and patience, not speed and noise, are its hallmarks.

Statements 1 and 2 are correct. A supply-chain attack compromises a trusted supplier so that the malicious code reaches many downstream victims through normal channels. In the SolarWinds case, CISA's advisory AA20-352A described a trojanised Orion component that was digitally signed and delivered as a routine update to thousands of organisations, including US government agencies. Statement 3 is therefore wrong: a valid signature proves only that the file came from the signer and was not altered afterwards, so it actually helped the malware look legitimate. Log4Shell (CVE-2021-44228) affected Apache Log4j 2 and let attackers run code by making a server log a crafted text string; because the library is buried inside countless products, it showed the risk of open-source dependencies.

All three must report cyber incidents (d). Under Section 70B of the IT Act, 2000 and the CERT-In Rules, 2013, service providers (1), data centres (2), body corporates (3) and intermediaries must report cyber security incidents to CERT-In (the Indian Computer Emergency Response Team, under MeitY). CERT-In's April 2022 directions set a six-hour reporting deadline. They also require logs to be kept for 180 days, and VPN providers must store user details for five years.

Critical sectors are protected by NCIIPC under Section 70A. Notice the related laws: the Digital Personal Data Protection Act, 2023 and its 2025 Rules, which add a duty to report data breaches to the Data Protection Board.

Answer as per the official UPSC answer key.

Open this question's page →