Cyber Safety

Cyber safety (also called online safety) means using the Internet in a way that keeps your device, your data and your identity safe from theft, damage and misuse. It is not one setting you switch on; it is a set of daily habits. The first of those habits is safe browsing — being careful about which websites you open, what you download and what you type into a page.

Every page you visit has an address called a URL (Uniform Resource Locator), for example https://www.irctc.co.in. Read a URL from the left: first the protocol, then the domain name, then the path. The protocol http stands for HyperText Transfer Protocol. Plain HTTP sends your data as ordinary readable text, so anyone monitoring the network in between can read what you type. https stands for HyperText Transfer Protocol Secure: the data is encrypted (converted into an unreadable form) before it travels, using a security certificate issued to that site. Most browsers show a small padlock beside such an address; some recent browser versions have replaced the padlock with a different site-information icon, so the dependable rule is that a secure page never carries a Not secure warning.

A common question asks for two or three checks that a site is safe. Give these: the address begins with https:// and the browser shows a padlock or site-information icon rather than a Not secure warning; the domain name is spelled exactly right, because fake sites use lookalike spellings such as 1rctc.co.in or irctc-tickets.example; the site carries a proper contact address, privacy policy and refund policy; and the browser shows no certificate warning. Then state the limit, which completes the answer: a padlock proves only that the connection is encrypted, it does not prove that the owner is honest. A criminal can also obtain a certificate for a fake site, so the domain name must still be read character by character.

Other safe-browsing habits are worth listing in a long answer. Download software only from the official website or an official app store. Never install pirated or cracked software, which is one of the commonest carriers of malware. Keep the browser and the OS (Operating System) updated, because updates close known security holes. Do not click pop-ups that claim your device is infected or that you have won a prize. Avoid banking or shopping on free public Wi-Fi. Log out of accounts on shared or school computers instead of simply closing the tab.

A cookie is a small text file that a website asks your browser to store on your computer, holding information such as a login token, your language choice or the items in your shopping cart. A session cookie is deleted the moment you close the browser; a persistent cookie stays on the disk for a fixed period. A first-party cookie belongs to the site you are actually visiting; a third-party cookie belongs to some other company — usually an advertising network — whose content is embedded inside that page.

Cookies are genuinely useful: they keep you signed in, remember your settings and let a shopping cart survive while you browse. The risk is tracking. Third-party cookies and similar techniques let advertisers build a profile of the sites you visit, which is why a product you looked at once follows you around as an advertisement for days. You can control this. Clear cookies from the browser's settings, block third-party cookies, refuse non-essential cookies on the consent banner, and use private browsing (incognito) mode when you must. Be accurate about incognito mode in an answer: it stops the browser on that device from saving history, cookies and form data; it does not hide your activity from the website itself, from your school or office network, or from your Internet Service Provider.

Authentication is the process of proving that you are the person you claim to be. On most websites the only proof offered is a password, so the strength of that one string decides the safety of everything inside the account — e-mail, marks, photographs and money.

A strong password is long, mixed, meaningless and unique. Long: at least 8 characters for a school answer, and 12 or more in practice, because every extra character multiplies the number of combinations an attacker must try. Mixed: it should combine uppercase letters, lowercase letters, digits and special characters such as @ # $ %. Meaningless: it must not be a dictionary word or a personal detail — not your name, your school name, your date of birth, your admission or roll number, your mobile number, and certainly not 123456 or password. Unique: a different password for every important account, so that one leaked site does not open all the others.

A convenient method is a passphrase. Take a sentence only you would remember — My uncle bought 3 mangoes in Delhi! — and keep the first letters with the digits and punctuation, giving Mub3miD!. It is easy for you to rebuild and hard for a machine to guess. Learn the method, not this example — a password printed in a book, in notes or on a website has already been published, so always build your own sentence. A password manager is an application that generates and stores a different strong password for every site, all locked behind one master password.

Name these attacks when a question asks why weak passwords are dangerous:

• Brute-force attack — software tries every possible combination of characters until one works; length is the best defence.
• Dictionary attack — the software first tries lists of common words, names and previously leaked passwords.
• Shoulder surfing — someone simply watches you type, in a lab, a cyber cafe or a bus.
• Keylogger — spyware that silently records every key you press and sends it to an attacker.
• Social engineering — the attacker talks you into revealing the password, for example by claiming to call from the school IT department.

Because passwords do leak, serious sites add two-factor authentication (2FA), also called two-step verification. Logging in then needs two different kinds of proof drawn from three categories: something you know (password, PIN), something you have (a mobile phone that receives a code, an authenticator app, a hardware security key) and something you are (fingerprint, face or iris — collectively called biometrics). The familiar Indian example is the OTP (One-Time Password) sent to the registered mobile number after you enter your password, valid only for a few minutes and only once.

State the benefit precisely: even if a thief steals or correctly guesses your password, he still cannot log in, because he does not have your phone or your fingerprint. Codes from an authenticator app or a hardware key are considered stronger than SMS OTPs, since a SIM can be cloned or a number fraudulently transferred.

Everyday password discipline: never write passwords at the back of a notebook or on a slip near the computer; never share them with friends, not even for a minute; do not tick Remember password on a shared or school machine; log out fully; lock your phone with a PIN, pattern or biometric and set a short auto-lock time; and change a password at once if a site announces a data breach or if you have typed it on a page you now suspect. Above all, remember the rule that prevents most frauds in India: no bank, wallet, UPI app, telecom company or government office ever asks for your password, PIN, CVV or OTP — not by call, not by SMS, not by message. Anyone who asks is a fraudster.

Personal information is any data that can identify you: your full name, photograph, home address, school name, mobile number, e-mail address, date of birth, and identity numbers such as an Aadhaar number, a PAN or a bank account number. A part of it is treated as sensitive personal information — passwords, financial details, health records and biometrics — and needs the strongest protection of all.

Identity theft is the crime of stealing someone's personal information and using it to pretend to be that person. In India the usual patterns are easy to describe in an answer: a photograph or photocopy of an identity document being misused to obtain a SIM card or a loan; card and bank details used to make purchases; or a fake social-media profile created in a student's name and used to insult classmates. The victim often does not find out for months, and undoing the damage takes far longer than preventing it would have.

A related term is digital footprint — the trail of data you leave behind online. It is active when you deliberately post something (a comment, a photograph, a review) and passive when it is collected without any action by you (your IP address, the pages you visit, your location). The footprint is close to permanent: a post you delete may already have been screenshotted, downloaded or archived by someone else. Before posting, apply a simple test — would you be comfortable if this were read by your parents, your principal and a future employer?

What should never be shared online, especially with people you have not met in person:

• Passwords, PINs, OTPs, card CVV numbers and UPI PINs — with anyone at all, including friends.
• Photographs of identity cards, mark sheets, bank passbooks, cheques, tickets or boarding passes, which carry numbers and barcodes.
• Your home address, your school name with class and section, and your daily timings together — combined, they tell a stranger exactly where to find you.
• Your live location, or holiday plans that announce the house is empty.
• Photographs of other people, especially classmates, without asking them first.

Privacy settings are the controls a platform gives you to decide who sees what. A complete answer lists them: set the account to private so that only approved contacts see your posts; restrict who may send friend or follow requests; restrict who can comment on or tag you, and switch on tag review; turn off location tagging in photographs; hide your date of birth, phone number and e-mail from the public profile; and review the list of connected apps and logged-in devices, removing anything you no longer use. Add this important point: default settings differ from platform to platform and are often more open than a student expects (a few platforms now make new teenage accounts private by default), so privacy must never be assumed — it has to be checked and set deliberately by the user.

App permissions deserve the same care. When an application asks for access to the camera, microphone, contacts, photographs, SMS or location, grant only what it genuinely needs to work — a torch app has no reason to read your contacts, and a game has no reason to read your messages. Prefer only while using the app over always, check permissions again after updates, install only from the official store, and read the ratings and the permission list before installing.

Two legal points are worth a line in a long answer. India's Information Technology Act, 2000 makes offences such as identity theft, cheating by impersonation and violation of privacy punishable by law. The Digital Personal Data Protection Act, 2023 requires organisations to take your consent before collecting and using your personal data and gives you the right to know what is held about you and to have it corrected or erased; for a child, that consent must come from a parent or guardian.

Malware — short for malicious software — is any program written to damage a computer, steal data or take control of a system without the owner's permission. Questions almost always ask you to name the types and say how each behaves or spreads, so learn them as a table in your head.

Virus: a piece of code that attaches itself to a file or program (its host) and runs only when that file is opened, then copies itself into other files. It cannot spread on its own — a user must open the infected file. Viruses travel through infected e-mail attachments, pen drives and downloaded software, and can corrupt or delete data.

Worm: a standalone program that copies itself and spreads by itself across a network, without needing a host file and without any action by the user. Worms exploit weaknesses in software and can slow an entire network by consuming bandwidth and memory. The virus-versus-worm distinction — host needed and user action needed, or not — is a very common short-answer question.

Trojan horse: a program that pretends to be something useful — a free game, a cracked application, a PDF converter — but performs a harmful action once installed. A Trojan does not replicate itself; it relies entirely on the user being tricked into installing it, and it often opens a backdoor that lets an attacker control the machine remotely.

Ransomware: malware that encrypts the victim's files, or locks the whole system, and then displays a message demanding a ransom in exchange for the key. It usually arrives through a phishing attachment or link, or through software that has not been updated. Paying does not guarantee that the files come back, so the real defence is regular backups kept on a separate drive or in cloud storage that is not permanently connected.

Spyware: software that hides on the system and secretly collects information — browsing history, files, screenshots — and sends it to an attacker. A keylogger is a type of spyware that records every keystroke, which is how passwords and card numbers are stolen. Spyware is frequently bundled with free downloads.

Adware: software that displays unwanted advertisements, opens pop-up windows or changes the browser home page and default search engine. It is usually more irritating than destructive, but it slows the machine and some adware also tracks the user.

Signs of infection worth listing: the computer becomes unusually slow; programs crash or start on their own; unknown files or icons appear; files go missing or refuse to open; the browser home page changes by itself; advertisement windows keep opening; or the hard disk stays busy when nothing is running.

Antivirus software is a program that detects, prevents and removes malware. It compares files against a database of known malware patterns called virus definitions (signature-based detection) and also watches for suspicious behaviour. It offers on-demand scans (quick or full), real-time or on-access scanning as files are opened, and it moves suspected files to quarantine — an isolated area — before repairing or deleting them. State the rule the examiner wants: antivirus software is of little use unless its definitions are updated regularly, because new malware appears every day.

A firewall is hardware, software, or a combination of both, placed between a computer or network and the outside world, which filters incoming and outgoing traffic according to a set of rules and blocks unauthorised access. Keep the difference sharp: a firewall controls traffic and stops intruders and unauthorised programs from communicating; antivirus software detects and removes malicious files that are already on the system. Neither one replaces the other.

Complete protection therefore means installing antivirus software and keeping it updated, leaving the firewall switched on, installing operating-system and application updates promptly, scanning pen drives before opening them and disabling autorun, refusing pirated software, never opening unexpected attachments, and taking regular backups.

Phishing is an attempt to obtain personal information — usernames, passwords, OTPs, card or account details — by sending a message that pretends to come from a trustworthy organisation such as a bank, a delivery company, a school or a government department. The name comes from fishing: the attacker puts out bait and waits for someone to bite. Phishing carried out by telephone call is called vishing (voice phishing) and by SMS it is called smishing. When a message is customised for one particular person using details picked up from social media, it is called spear phishing.

Learn the warning signs as a list, because How will you recognise a phishing message? is a standard long-answer question:

• Urgency or threat — your account will be blocked within 24 hours, immediate KYC update required, your parcel could not be delivered.
• A reward that is too good to be true — a lottery you never entered, a free recharge, a job offer that first asks for a registration fee.
• Generic greeting — Dear Customer or Dear User instead of your name.
• Wrong sender address or lookalike link — a bank message sent from a free e-mail address, or a link whose real destination (seen by hovering over it on a computer, or long-pressing on a phone) does not match the text displayed.
• Spelling and grammar mistakes, poor formatting, or a stretched and outdated logo.
• It asks for secrets — password, PIN, CVV or OTP — or asks you to install a screen-sharing or remote-support application.
• An unexpected attachment or a shortened link that hides the real address.

What to do: do not click, do not reply, and do not download the attachment. If you think the message might be genuine, verify it independently — type the official website address yourself, or open the official app, or ring the number printed on your passbook or on the back of your card, never the number given in the message itself. Then mark the message as spam or phishing and delete it. If money has already gone, report immediately on the national cybercrime reporting portal cybercrime.gov.in or on the helpline number 1930 and inform the bank at once, because early reporting improves the chance of the transaction being held.

Safe online transactions. Buy from well-known sellers, and read the return, refund and delivery policies before paying. Confirm that the payment page uses https and that the domain is spelled correctly. Pay through a trusted route — a UPI (Unified Payments Interface) application, net banking or a card — and enter your UPI PIN only inside the UPI application itself, never on a web page and never to a person on a call.

One rule prevents most UPI frauds in India, and it is worth stating in bold in an answer: a UPI PIN is needed only to send money, never to receive it. If a so-called buyer sends you a collect request or a QR code and tells you to enter your PIN in order to receive payment, it is a fraud — scanning that code and entering the PIN takes money out of your account. In the same way, never share an OTP that arrives for a payment you did not start; the OTP is the bank asking you to confirm, not a code to be read out to anyone.

Other sensible habits: do not save card details on unfamiliar sites; for a first purchase from a new site prefer cash on delivery, or a card with a low limit; avoid making payments on public Wi-Fi; switch on SMS and e-mail alerts for your account and actually read them; keep the order confirmation and the transaction reference number until the item arrives; log out after paying; and check your bank statement regularly. A public or shared computer should not be used for banking at all — and if it must be, log out completely and clear the browsing data afterwards.

Social media is where most students meet the risks of the Internet, so the safe-use rules are worth memorising. Keep the account private. Accept requests only from people you actually know, because a friendly stranger may be an adult using a borrowed photograph. Keep personal details out of your bio and out of your username. Do not post your school timetable, your live location or your travel plans. Ask a friend before posting a photograph of them. Never agree to meet an online-only contact alone — tell a parent, and meet in a public place if at all. Be equally careful about forwarding: an unverified message on a messaging app spreads misinformation, and forwarding it makes you part of the problem, so check a claim on a reliable news site before passing it on.

Cyberbullying is the use of digital technology — messages, calls, social media, gaming platforms — to repeatedly harass, threaten, humiliate or target another person. Unlike bullying in a school corridor, it follows the victim home, it can be anonymous, and the material can be copied endlessly. Its common forms are:

• Harassment — repeated abusive or threatening messages.
• Trolling and flaming — deliberately insulting comments meant to provoke an angry public argument.
• Impersonation — creating a fake profile in someone's name and posting as that person.
• Outing and doxxing — publishing someone's private information, photographs or address without consent.
• Exclusion — deliberately leaving a person out of a group chat or an online game to make them feel isolated.
• Cyberstalking — persistent monitoring and contact that makes the victim fear for their safety.
• Morphing — editing someone's photograph and circulating it to embarrass them.

The effects are real and should be mentioned in a long answer: fear, anxiety, loss of sleep and appetite, falling marks, avoiding school, and withdrawal from friends. A student who suddenly stops using a phone, or who becomes upset after using it, may well be a victim.

What to do if you are cyberbullied — learn it as five clear steps. Do not reply and do not retaliate, because a reaction is exactly what the bully wants and an angry reply can make you look equally guilty. Save the evidence: take screenshots showing the message, the profile name, the date and the time, and note the link. Block and report the account using the platform's own report option. Tell a trusted adult — a parent, your class teacher or the school counsellor; schools are expected to act on such complaints. Report to the authorities when it involves threats, obscene content, morphed images or a fake profile: a complaint can be filed on cybercrime.gov.in or on helpline 1930, and the Information Technology Act, 2000 makes such offences punishable.

If you are a witness rather than a victim, do not be a silent bystander. Do not like, share or forward the content — forwarding multiplies the harm and may itself be an offence. Message the victim privately to support them, report the post, and tell a teacher.

Netiquette (network etiquette) is the set of good manners expected of everyone online: be respectful and use polite language; do not type in capital letters, which reads as shouting; do not spam groups with forwards; respect other people's privacy and their time; give credit and never copy someone's work, images or code without permission, because plagiarism is a serious academic and ethical wrong and copying protected material is a violation of copyright law; and re-read a message before sending it, since tone is easily misread in plain text. Together with a sensible limit on screen time and regular breaks, these habits are what make a responsible digital citizen — the term used for a person who uses technology safely, ethically and respectfully.