Maarg Manthan · Topic 14.10

Computer Security Tools: Firewalls, Hackers, VPN

Science & Technology › IT, Telecommunications and Computers · Topic 14.10

Computer security protects systems, networks and data from attack, theft and damage. A firewall is a barrier between a trusted network and an untrusted one, such as the internet, that allows or blocks traffic according to rules; types include packet filtering, stateful inspection, application layer and next generation firewalls. A virtual private network, VPN, creates an encrypted tunnel over the internet so that data cannot be read on the way and the user's address is hidden. Hackers are people who break into systems: white hat hackers do it with permission to find weaknesses, black hat hackers do it for crime or harm, and grey hat hackers act without permission but without bad intent. Other tools include antivirus software, intrusion detection systems, two-factor authentication and software updates.

5 min read · UPSC Prelims · Science & Technology · IT, Telecommunications and Computers

At a Glance

Firewall Filters network traffic
VPN Encrypted tunnel
White hat Ethical hacker
Black hat Criminal hacker
Common threats Malware and phishing
Exam link UPSC Prelims, Science & Technology: IT, Telecommunications and Computers

Where Does It Fit?

This topic follows the account of the Internet of Things. As more devices connect, security tools become essential, and the topic sets out the basic defences and the kinds of attackers that appear in later topics on encryption and ransomware. Previous topic: Internet of Things (IoT). Next topic: Digital India Initiative and E-Governance Programmes (MeghRaj, e-Kranti, BharatNet, Bharat QR).

What Are the Main Security Tools?

Tool	Function
Firewall	Software or hardware that filters traffic by rules. Packet filtering checks addresses and ports, stateful inspection tracks connections, application firewalls inspect content, and next generation firewalls add intrusion prevention
Antivirus and anti-malware	Scan files and programs for known and suspicious malicious code and remove them
Intrusion detection and prevention systems	Monitor networks for attacks and alert or block them
VPN	Tunnels traffic through an encrypted link to a VPN server, using protocols such as IPsec or SSL/TLS. Protects data on public Wi-Fi and lets staff reach office networks safely
Encryption	Scrambles data so that only holders of a key can read it, as in Encryption and Cybersecurity (Cyber Swachhta Kendra)
Authentication	Passwords, one-time passwords, biometrics and two-factor authentication
Patching and backup	Install updates to fix vulnerabilities and keep offline backups

Who Are the Hackers and What Are the Threats?

White hat hackers: ethical hackers or penetration testers hired to find weaknesses and report them
Black hat hackers: criminals who steal data, money or cause damage
Grey hat hackers: act without permission but disclose faults and do not seek harm
Hacktivists: attack for a political or social cause
Script kiddies: inexperienced people using ready-made tools
Virus: malicious code that attaches to files and spreads when they are run
Worm: malware that spreads by itself across networks
Trojan: malware disguised as a useful program

What Else Should You Remember?

Spyware and adware: programs that collect information or show unwanted ads
Ransomware: locks data and demands payment, as in Ransomware Threats (Locky, Petya, WannaCry)
Phishing: fake emails or messages that trick people into giving passwords or money
Social engineering: manipulating people instead of breaking technology
Denial of service: flooding a system with traffic to make it unavailable
Zero-day: an attack on a flaw that the maker does not yet know
Botnet: network of infected devices controlled by an attacker
Two-factor authentication: needs two proofs, such as a password and a one-time code
VPN rules in India: CERT-In directions of 2022 asked VPN providers to keep user logs for five years, which caused some providers to remove servers from India. Check the latest position
Safe practices: strong unique passwords, no clicking on unknown links, regular updates and backups
Law: unauthorised access is an offence under the Information Technology Act, as in Cyber Law in India
Reporting: incidents can be reported to CERT-In and cybercrime.gov.in
Zero trust: a model in which no user or device is trusted by default, and every access request is checked
Data backup rule: the 3-2-1 practice keeps three copies of data on two types of media with one stored offsite
Digital hygiene: updating software, using password managers and checking links before clicking reduce most common attacks
Honeypot: a decoy system that attracts attackers so defenders can study their methods
SIEM and security operations centre: tools and teams that collect logs from all systems and spot signs of attack
Insider threat: employees with access can cause leaks by mistake or on purpose, so access should be limited to what is needed

Why Does It Matter for the Exam?

Hacker types: white, black and grey hat
Firewall types: packet filter, stateful, application
Malware: virus, worm, trojan, ransomware
Current affairs link: VPN rules and phishing cases
Common errors: calling all hackers criminals or saying that a VPN makes a user fully anonymous

As an analytical point, security needs several layers, because no single tool can stop all attacks. Users are often the weakest link, so awareness matters as much as software.

Why Is This Topic Important?

Tools Firewall, VPN
Hackers Hat colours
Malware Names

What Came Next?

The next topic covers the Digital India initiative and e-governance programmes. Next topic: Digital India Initiative and E-Governance Programmes (MeghRaj, e-Kranti, BharatNet, Bharat QR).

Key People and Terms

Firewall Traffic filter
VPN Virtual private network
Malware Malicious software
Phishing Fake message scam
Penetration test Authorised attack test
2FA Two-factor authentication

Exam Corner

Points to Remember

Firewall filters traffic; VPN encrypts a tunnel.
White hat = ethical hacker.
Worm spreads by itself; virus needs a host file.
Phishing tricks users.
CERT-In asked VPN logs for five years (2022).

Do Not Confuse With

Virus and worm Needs a host file versus self-spreading
Firewall and antivirus Network filter versus file scanner
VPN and encryption Secure tunnel versus scrambling data

Memory Hook

White helps, black harms, grey roams; wall the network, tunnel the traffic, patch the holes.

Mains Angle

Questions ask for tool functions and hacker types. These points help.

Layers Many tools
Threats Malware, phishing
Policy VPN rules

A Question You May Face

An original practice question, not a past paper question.

“Explain the role of firewalls and VPNs in cyber security and distinguish between different types of hackers and malware.”

How to Answer

Tools Firewall, VPN.
Hackers Types.
Malware Names.
Way Layers and awareness.

GS Relevance

Prelims: types of firewall, VPN, hacker types, malware names. GS Paper 3: cyber security, science and technology.

Frequently Asked Questions

What is a firewall?

A firewall is a security system that sits between a trusted network and an untrusted one, such as the internet, and decides which traffic may pass according to set rules. It can be hardware or software and may filter packets, track connections or inspect application data. Its aim is to block unauthorised access while allowing legitimate communication.

What is a VPN and how does it work?

A virtual private network creates an encrypted connection, or tunnel, between a user's device and a VPN server over the internet. Data passing through the tunnel cannot be read by others on the way, and websites see the VPN server's address instead of the user's, so it protects privacy on public networks and lets staff reach office systems securely.

What is the difference between white hat, black hat and grey hat hackers?

A white hat hacker breaks into systems with permission to find and fix weaknesses. A black hat hacker does so without permission for crime, profit or damage. A grey hat hacker acts without permission but usually without harmful intent, and may report faults to the owner, though the act is still unauthorised.

What is the difference between a virus and a worm?

A virus is malicious code that attaches itself to a legitimate file or program and spreads when that file is run by a user. A worm is a stand-alone malware that copies itself and spreads automatically across networks without any user action, so it can infect many machines very quickly.

What is phishing?

Phishing is a cyber crime in which attackers send fake emails, messages or websites that look genuine to trick people into revealing passwords, card numbers or other sensitive information, or into installing malware. It is a form of social engineering, and awareness and two-factor authentication reduce its success.

PYQ Practice — Statement Analysis

1 A white hat hacker is an ethical hacker who tests security with permission.

True

Also called a penetration tester.

2 A firewall encrypts data between two networks.

False

It filters traffic; VPNs encrypt.

3 A worm needs a host file to spread.