COURSE DESCRIPTION

Introduction to Cybersecurity introduces students to the basic ideas, principles, technologies and professional practices used to protect computers, networks, applications, information and people from cyber threats. The course explains cybersecurity in simple language and uses examples that are familiar to Nigerian university students.

Students will study information assets, security threats, vulnerabilities, malware, social engineering, passwords, access control, cryptography, network security, web security, cloud security, risk management, incident response, cyber ethics, data privacy and Nigerian cyber law.

CHAPTER ONE

INTRODUCTION TO CYBERSECURITY

1.1 Learning Objectives

At the end of this chapter, students should be able to:

• Define cybersecurity.
• Explain the meaning of cyberspace.
• Describe the importance of cybersecurity.
• Identify areas in which cybersecurity is applied.
• Distinguish cybersecurity from related security concepts.

1.2 Meaning of Cybersecurity

The word cyber refers to computers, digital devices, communication networks and the virtual environment created through the use of these technologies. The word security means protection from danger, damage, loss or unauthorised interference.

Cybersecurity is the protection of computers, mobile devices, networks, software, digital services and information from unauthorised access, attack, damage, disruption, theft or misuse.

Cybersecurity involves the people, technologies, policies, procedures and practices used to protect digital systems and information.

1.3 Meaning of Cyberspace

Cyberspace is the digital environment created by computers, mobile devices, networks, software applications, websites, cloud systems and internet-connected services.

Examples of activities performed in cyberspace include:

• Sending emails.
• Using social media.
• Making online payments.
• Registering university courses.
• Checking examination results.
• Attending online classes.
• Storing files in cloud services.
• Using banking applications.
• Communicating through messaging platforms.

1.4 Why Cybersecurity Is Important

Modern society depends heavily on digital technology. Universities, banks, hospitals, government agencies, businesses and individuals store large amounts of information electronically. If these systems are not properly protected, criminals or other unauthorised persons may steal, alter, destroy or misuse the information.

Cybersecurity is important because it helps to:

1. Protect personal information: It prevents the unauthorised disclosure of names, addresses, passwords, photographs, identity numbers and financial information.
2. Protect money and financial services: It reduces online fraud, account theft and unauthorised financial transactions.
3. Protect organisations: It prevents disruption to business operations, loss of customer trust and damage to organisational reputation.
4. Protect national security: It helps to secure military systems, government networks, energy facilities, transportation systems and communication infrastructure.
5. Support privacy: It helps individuals maintain control over their personal information.
6. Ensure service availability: It helps websites, networks and applications remain accessible to authorised users.
7. Promote trust: People are more willing to use digital services when they believe their information is secure.

1.5 Everyday Examples of Cybersecurity

Cybersecurity is practised when a person:

• Uses a strong password.
• Enables multifactor authentication.
• Updates a mobile phone or computer.
• Avoids suspicious email links.
• Backs up important files.
• Locks a computer before leaving it unattended.
• Uses an antivirus program.
• Connects only to trusted wireless networks.
• Checks a website address before entering payment information.
• Reports a suspicious message to the appropriate authority.

1.6 Areas of Cybersecurity

1.6.1 Network Security

Network security protects communication networks and the data that moves through them. It uses technologies such as firewalls, intrusion detection systems, secure wireless settings and network monitoring.

1.6.2 Application Security

Application security protects software programs from weaknesses that attackers may exploit. It begins during software design and continues through development, testing, deployment and maintenance.

1.6.3 Information Security

Information security protects information in every form, including electronic files, printed documents and spoken information.

1.6.4 Cloud Security

Cloud security protects information, applications and services stored or operated through cloud computing platforms.

1.6.5 Mobile Security

Mobile security protects smartphones, tablets, mobile applications and information stored on mobile devices.

1.6.6 Internet of Things Security

Internet of Things security protects devices that connect to the internet, such as smart cameras, sensors, smart televisions, health-monitoring devices and industrial equipment.

1.6.7 Operational Technology Security

Operational technology security protects computer-controlled physical processes such as electricity generation, water treatment, manufacturing and transportation systems.

1.7 Cybersecurity and Related Concepts

Concept	Meaning
Cybersecurity	Protection of digital systems, networks, devices, applications and information from cyber threats.
Information Security	Protection of information in electronic, printed, verbal or other forms.
Computer Security	Protection of individual computers and their resources.
Network Security	Protection of networks, connected devices and transmitted information.
Data Privacy	Proper and lawful handling of personal information.
Physical Security	Protection of buildings, equipment and people from physical threats.

1.8 Cybersecurity Challenges in Nigeria

Common cybersecurity challenges in Nigeria include:

• Online financial fraud.
• Phishing and fake payment messages.
• Identity theft.
• Social media account hijacking.
• Business email compromise.
• Weak passwords.
• Use of outdated software.
• Low cybersecurity awareness.
• Unlicensed or modified software.
• Unsafe use of public Wi-Fi.
• Insider misuse.
• Inadequate protection of personal data.
• Shortage of trained cybersecurity professionals.

1.9 Ethical Warning

Knowledge of cybersecurity must be used responsibly. Students must not attempt to access another person’s account, device, network or information without clear permission. Curiosity does not provide legal authorisation.

1.10 Chapter Summary

Cybersecurity protects computers, networks, applications, devices and information from unauthorised access, damage, disruption, theft and misuse. It is important to individuals, organisations and governments. Cybersecurity includes network security, application security, cloud security, mobile security and several other specialised areas.

1.11 Review Questions

1. Define cybersecurity.
2. What is cyberspace?
3. State five reasons why cybersecurity is important.
4. Differentiate between cybersecurity and information security.
5. Mention five cybersecurity challenges affecting Nigeria.
6. Give four examples of cybersecurity practices used in everyday life.

---

CHAPTER TWO

BASIC COMPUTING AND INTERNET CONCEPTS

2.1 Learning Objectives

At the end of this chapter, students should be able to:

• Identify the major components of a computer system.
• Explain the difference between hardware and software.
• Describe the basic operation of computer networks.
• Explain common internet concepts.
• Identify the digital environment that cybersecurity protects.

2.2 The Computer System

A computer is an electronic device that accepts data, processes the data according to instructions, stores information and produces output.

A computer system consists mainly of:

• Hardware.
• Software.
• Data.
• People.
• Procedures.
• Communication networks.

2.3 Computer Hardware

Hardware refers to the physical parts of a computer system that can be seen or touched.

Examples include:

• Keyboard.
• Mouse.
• Monitor.
• Processor.
• Memory.
• Hard disk drive.
• Solid-state drive.
• Printer.
• Network interface card.
• Router.
• Flash drive.

2.4 Computer Software

Software refers to the programs and instructions that tell a computer what to do.

2.4.1 System Software

System software controls the computer and provides a platform for other programs. The operating system is the most important example.

Examples of operating systems include:

• Microsoft Windows.
• Linux.
• macOS.
• Android.
• iOS.

2.4.2 Application Software

Application software helps users perform specific tasks.

Examples include:

• Word-processing programs.
• Web browsers.
• Banking applications.
• University portal applications.
• Media players.
• Graphic design programs.
• Database systems.

2.5 Data and Information

Data refers to raw facts, figures or symbols. Information is data that has been processed into a meaningful form.

For example, a list of examination scores is data. After calculating the average, ranking students and assigning grades, the results become meaningful information.

2.6 Computer Networks

A computer network is a group of computers and other devices connected so that they can communicate and share resources.

2.6.1 Local Area Network

A Local Area Network, commonly called a LAN, connects devices within a limited area such as a computer laboratory, office, home or university department.

2.6.2 Wide Area Network

A Wide Area Network, commonly called a WAN, connects devices across large geographical locations. The internet is the largest example of a wide area network.

2.6.3 Wireless Network

A wireless network allows devices to communicate through radio signals instead of network cables. Wi-Fi is a common wireless networking technology.

2.7 Important Network Devices

Device	Function
Router	Directs data between different networks.
Switch	Connects devices within a local network.
Modem	Connects a network to an internet service.
Wireless Access Point	Allows wireless devices to connect to a network.
Firewall	Controls network traffic according to security rules.
Server	Provides services or resources to other computers.

2.8 Client and Server

A client is a device or program that requests a service. A server is a computer or program that provides the service.

When a student opens a university portal, the student’s browser acts as the client. The university web server receives the request and sends the requested page or information.

2.9 The Internet and the World Wide Web

The internet is a global network of interconnected computer networks. The World Wide Web is a collection of websites and web pages accessed through the internet.

The internet and the web are related, but they are not exactly the same. The internet is the communication infrastructure, while the web is one of the services that operates through it.

2.10 Internet Protocol Address

An Internet Protocol address, known as an IP address, is a numerical identifier assigned to a device on a network. It helps network devices locate one another and exchange information.

2.11 Domain Name

A domain name is a human-readable name used to identify an internet resource. It is easier for people to remember a domain name than a numerical IP address.

2.12 Domain Name System

The Domain Name System translates domain names into IP addresses. It performs a function similar to a contact list that connects a person’s name with a telephone number.

2.13 Web Browser

A web browser is an application used to access websites. Users should keep browsers updated because outdated browsers may contain security weaknesses.

2.14 Uniform Resource Locator

A Uniform Resource Locator, known as a URL, is the address of a resource on the web.

A URL may contain:

• The communication protocol.
• The domain name.
• The location of a page or file.
• Additional parameters.

2.15 HTTP and HTTPS

HTTP is a protocol used to transfer web content. HTTPS is the protected form of HTTP. It uses encryption to protect information exchanged between a browser and a website.

The presence of HTTPS does not automatically prove that a website is honest. A fraudulent website can also use HTTPS. Users must still check the domain name and the purpose of the website.

2.16 Email

Electronic mail is used to send messages and files through digital networks. Email is useful, but it is also commonly abused for phishing, fraud and malware distribution.

2.17 Cloud Computing

Cloud computing allows users to access computing resources through a network instead of owning and operating every resource locally.

Cloud services may provide:

• Online storage.
• Email services.
• Virtual computers.
• Database services.
• Software applications.
• Website hosting.

2.18 The Internet of Things

The Internet of Things refers to physical devices containing sensors, software and network connections that allow them to collect and exchange information.

Examples include:

• Smart cameras.
• Smart televisions.
• Fitness trackers.
• Industrial sensors.
• Smart electricity meters.
• Vehicle tracking devices.

2.19 Chapter Summary

Cybersecurity protects an environment made up of hardware, software, data, users, networks, internet services, cloud platforms and connected devices. Understanding these basic technologies helps students understand where cyber threats occur and how protection can be applied.

2.20 Review Questions

1. Differentiate between hardware and software.
2. What is a computer network?
3. Explain the functions of a router and a switch.
4. Differentiate between the internet and the World Wide Web.
5. What is the function of the Domain Name System?
6. Explain the difference between HTTP and HTTPS.

---

CHAPTER THREE

FUNDAMENTAL PRINCIPLES OF CYBERSECURITY

3.1 Learning Objectives

At the end of this chapter, students should be able to:

• Explain the confidentiality, integrity and availability principles.
• Define authentication, authorisation and accountability.
• Explain non-repudiation and privacy.
• Describe defence in depth and least privilege.
• Apply security principles to practical situations.

3.2 The CIA Triad

The three most widely recognised objectives of information security are confidentiality, integrity and availability. Together, they are called the CIA triad.

3.3 Confidentiality

Confidentiality means ensuring that information is accessible only to authorised persons, systems or processes.

Examples of confidentiality controls include:

• Passwords.
• Encryption.
• Access control.
• Locked filing cabinets.
• Security classifications.
• Privacy screens.

For example, only authorised lecturers and examination officers should have access to students’ examination scores before the results are officially released.

3.4 Integrity

Integrity means protecting information from unauthorised or accidental alteration, deletion or destruction. Information has integrity when it is accurate, complete and trustworthy.

Examples of integrity controls include:

• Hashing.
• Digital signatures.
• File permissions.
• Version control.
• Audit logs.
• Input validation.

If an unauthorised person changes a student’s score from 45 to 85, the integrity of the result has been violated.

3.5 Availability

Availability means ensuring that systems, services and information are accessible to authorised users when needed.

Examples of availability controls include:

• Backups.
• Alternative power supply.
• Redundant systems.
• Reliable internet connections.
• Disaster recovery plans.
• System maintenance.
• Protection against denial-of-service attacks.

If a university registration portal becomes unavailable throughout the registration period, availability has been affected.

3.6 Balancing the CIA Triad

Security decisions should consider confidentiality, integrity and availability together. Excessive security may make a system difficult to use, while insufficient security may expose it to attack.

For example, permanently disconnecting a university database from every network may improve confidentiality but make the database unavailable to authorised users.

3.7 Identification

Identification is the process by which a user claims an identity. A username, registration number or email address may serve as an identifier.

3.8 Authentication

Authentication is the process of verifying that a person or system is truly who or what it claims to be.

Authentication may use:

• Something the user knows, such as a password.
• Something the user has, such as a smart card or security token.
• Something the user is, such as a fingerprint.
• Something the user does, such as a typing pattern.
• Somewhere the user is, based on location information.

3.9 Authorisation

Authorisation determines what an authenticated user is permitted to do.

A student may be authorised to view personal results but not to change them. A lecturer may be authorised to upload scores for assigned courses but not for every course in the university.

3.10 Accountability

Accountability means that actions can be traced to the person or system that performed them. User accounts, logs and audit records support accountability.

3.11 Non-Repudiation

Non-repudiation provides evidence that a person performed an action, making it difficult for the person to deny the action later. Digital signatures and reliable audit records can support non-repudiation.

3.12 Privacy

Privacy is the right and ability of individuals to control how information about them is collected, used, stored, shared and deleted.

Cybersecurity supports privacy by protecting personal data from unauthorised access. However, privacy also involves legal, ethical and organisational responsibilities.

3.13 Principle of Least Privilege

The principle of least privilege states that a user, program or system should receive only the minimum access required to perform an assigned duty.

For example, a student assistant helping to arrange books in a library should not automatically receive permission to change students’ academic records.

3.14 Need-to-Know Principle

The need-to-know principle means that a person should access sensitive information only when that information is necessary for an authorised task.

3.15 Separation of Duties

Separation of duties divides important activities among two or more persons. This reduces fraud, error and misuse.

For example, one officer may prepare a payment, while another officer reviews and approves it.

3.16 Defence in Depth

Defence in depth means using several layers of security instead of depending on only one control.

A university system may use:

• A firewall.
• Strong passwords.
• Multifactor authentication.
• Antivirus software.
• Encryption.
• Backups.
• Security monitoring.
• User awareness training.

If one control fails, another control may still prevent or reduce the attack.

3.17 Security by Design

Security by design means considering security from the beginning of a system or application project rather than adding it only after problems occur.

3.18 Default Deny

Default deny means access should be refused unless it has been specifically permitted. This approach is safer than allowing every action and attempting to block only known dangers.

3.19 Chapter Summary

The CIA triad consists of confidentiality, integrity and availability. Other important cybersecurity principles include identification, authentication, authorisation, accountability, non-repudiation, privacy, least privilege, separation of duties, defence in depth and security by design.

3.20 Review Questions

1. Explain confidentiality, integrity and availability.
2. Differentiate between authentication and authorisation.
3. What is the principle of least privilege?
4. Explain defence in depth.
5. What is non-repudiation?
6. Give one university-related example of a confidentiality violation, an integrity violation and an availability problem.

---

CHAPTER FOUR

ASSETS, THREATS, VULNERABILITIES AND RISKS

4.1 Learning Objectives

At the end of this chapter, students should be able to:

• Define an information asset.
• Explain threats and vulnerabilities.
• Differentiate between threats, vulnerabilities and attacks.
• Explain likelihood, impact and risk.
• Perform a basic qualitative risk assessment.

4.2 Information Assets

An asset is anything that has value to an individual or organisation and therefore requires protection.

Examples of assets include:

• Student records.
• Examination results.
• Research data.
• Computers.
• Servers.
• Network equipment.
• Software.
• Passwords.
• Financial information.
• Staff knowledge.
• Organisational reputation.
• Buildings and power systems.

4.3 Asset Classification

Asset classification groups information according to its sensitivity and importance.

A simple classification system may include:

• Public: Information intended for everyone.
• Internal: Information intended mainly for members of the organisation.
• Confidential: Sensitive information restricted to authorised persons.
• Highly confidential: Information that could cause serious harm if disclosed.

4.4 Threat

A threat is anything capable of causing harm to an asset.

Threats may be:

• Human.
• Technical.
• Environmental.
• Intentional.
• Accidental.
• Internal.
• External.

Examples include:

• Cybercriminals.
• Dishonest employees.
• Malware.
• Power failure.
• Fire.
• Flood.
• Hardware failure.
• Human error.
• Theft.

4.5 Vulnerability

A vulnerability is a weakness that may be exploited by a threat.

Examples include:

• A weak password.
• Outdated software.
• An unlocked server room.
• Incorrect file permissions.
• Untrained users.
• Unencrypted information.
• Poorly configured Wi-Fi.
• Lack of backups.

4.6 Exploit

An exploit is a method, action or piece of code used to take advantage of a vulnerability.

4.7 Attack

An attack is a deliberate attempt to compromise the confidentiality, integrity or availability of a system or its information.

4.8 Attack Vector

An attack vector is the path or method used to reach and attack a target.

Examples include:

• Email attachments.
• Malicious links.
• Weak remote-access passwords.
• Infected flash drives.
• Unsafe mobile applications.
• Compromised websites.

4.9 Attack Surface

The attack surface is the total collection of points through which an attacker may attempt to enter, influence or extract information from a system.

A large number of unnecessary applications, accounts and network services increases the attack surface.

4.10 Risk

Risk is the possibility that a threat will exploit a vulnerability and cause harm to an asset.

Risk is commonly considered by examining:

• The likelihood that an event will occur.
• The impact if the event occurs.

A simple risk expression is:

Risk = Likelihood × Impact

4.11 Likelihood

Likelihood describes how probable it is that a threat will exploit a vulnerability.

Likelihood may be rated as:

• Low.
• Medium.
• High.

4.12 Impact

Impact is the level of harm that may result from an incident.

Possible impacts include:

• Financial loss.
• Loss of privacy.
• Service interruption.
• Legal penalties.
• Damage to reputation.
• Loss of academic records.
• Physical injury.
• Loss of public confidence.

4.13 Example of Risk Calculation

Suppose a university stores students’ records on a computer with no backup. The likelihood of hardware failure is rated 3, while the impact of losing all records is rated 5.

Risk Score = 3 × 5 = 15

If the organisation uses the following scale:

• 1 to 5: Low risk.
• 6 to 12: Medium risk.
• 13 to 25: High risk.

A score of 15 is a high risk and requires urgent treatment.

4.14 Security Control

A security control is a measure used to prevent, detect, reduce or correct security problems.

For the risk of losing student records, possible controls include:

• Regular backups.
• Alternative storage.
• Equipment maintenance.
• Restricted access.
• Power protection.

4.15 Residual Risk

Residual risk is the risk that remains after security controls have been applied. It is usually impossible to remove every risk completely.

4.16 Risk Register

A risk register is a document used to record identified risks, affected assets, likelihood, impact, controls, responsible persons and treatment decisions.

Asset	Threat	Vulnerability	Possible Impact	Control
Student records	Hardware failure	No backup	Permanent data loss	Daily backup and recovery testing
University portal	Account takeover	Weak passwords	Unauthorised access	Strong passwords and multifactor authentication
Computer laboratory	Theft	Weak physical security	Loss of equipment	Locks, guards and asset tracking

4.17 Chapter Summary

Assets are valuable resources that require protection. Threats are potential causes of harm, while vulnerabilities are weaknesses that threats may exploit. Risk depends mainly on likelihood and impact. Security controls reduce risk, but some residual risk usually remains.

4.18 Review Questions

1. Define an asset, threat and vulnerability.
2. Differentiate between an attack vector and an attack surface.
3. What is cybersecurity risk?
4. Explain likelihood and impact.
5. What is residual risk?
6. Prepare a basic risk register for a university computer laboratory.

---

CHAPTER FIVE

CYBER THREAT ACTORS AND THEIR MOTIVES

5.1 Learning Objectives

At the end of this chapter, students should be able to:

• Define a threat actor.
• Identify major categories of threat actors.
• Explain the motives of cyber attackers.
• Distinguish ethical hackers from malicious attackers.
• Describe internal and external threats.

5.2 Meaning of a Threat Actor

A threat actor is a person, group or organisation that intentionally or accidentally causes a cybersecurity incident.

5.3 Cybercriminals

Cybercriminals use computers and networks to commit crimes, usually for financial gain.

Their activities may include:

• Online fraud.
• Identity theft.
• Ransomware.
• Account takeover.
• Payment card theft.
• Sale of stolen information.

5.4 Insiders

An insider is a person who has legitimate access to an organisation’s systems or information.

Insider threats may be:

• Malicious insiders: Persons who deliberately misuse access.
• Negligent insiders: Persons who cause harm through carelessness.
• Compromised insiders: Persons whose accounts or devices have been taken over.

5.5 Hacktivists

Hacktivists use hacking activities to support political, social or ideological causes. Their actions may include website defacement, information leaks or service disruption.

5.6 Nation-State Actors

Nation-state actors are groups supported or directed by governments. Their objectives may include intelligence gathering, political influence, military advantage or disruption of another country’s infrastructure.

5.7 Cyberterrorists

Cyberterrorists use or threaten cyberattacks to create fear, cause serious disruption or advance extremist objectives.

5.8 Organised Criminal Groups

Organised criminal groups conduct coordinated cybercrime for profit. They may divide responsibilities among malware developers, fraud operators, money handlers and sellers of stolen information.

5.9 Competitors

A dishonest competitor may attempt to steal business secrets, customer information, research findings or strategic plans.

5.10 Script Kiddies

A script kiddie is an inexperienced person who uses tools or instructions developed by others without fully understanding how they work.

Limited technical knowledge does not make the activity harmless or legal.

5.11 Security Researchers

Security researchers study systems to identify weaknesses and improve security. Their work must be performed with proper authorisation and responsible disclosure.

5.12 Ethical Hackers

An ethical hacker is a security professional who is authorised to test systems for weaknesses. Ethical hacking is controlled by written permission, an agreed scope, professional standards and legal requirements.

5.13 Hacker Descriptions

Description	Meaning
White Hat	An authorised security professional who tests systems to improve security.
Black Hat	A person who accesses or attacks systems for illegal or harmful purposes.
Grey Hat	A person who may test a system without proper permission, even when claiming a helpful purpose.

The absence of malicious intention does not create permission. Testing a system without authorisation can still be unethical or unlawful.

5.14 Motives of Threat Actors

Common motives include:

• Financial gain.
• Revenge.
• Political objectives.
• Ideological beliefs.
• Espionage.
• Competition.
• Recognition or fame.
• Curiosity.
• Entertainment.
• Disruption.
• Extortion.
• Personal grievance.

5.15 Internal and External Threats

An internal threat originates from within an organisation, while an external threat originates outside it.

Insiders may be particularly dangerous because they may already understand the organisation’s systems and possess legitimate access.

5.16 The Cyberattack Process

A cyberattack may involve the following general stages:

1. Gathering information about a target.
2. Identifying possible weaknesses.
3. Attempting to gain access.
4. Expanding control or privileges.
5. Accessing, altering or stealing information.
6. Maintaining access.
7. Attempting to hide evidence.

This general description is provided for defensive understanding. Students must not apply it against unauthorised targets.

5.17 Chapter Summary

Threat actors include cybercriminals, insiders, hacktivists, organised criminal groups, nation-state actors, cyberterrorists and inexperienced attackers. Their motives may include money, revenge, ideology, espionage, recognition or disruption. Ethical security work requires clear authorisation.

5.18 Review Questions

1. Who is a threat actor?
2. Differentiate between malicious, negligent and compromised insiders.
3. Explain four motives of cyber attackers.
4. Differentiate between a white-hat and black-hat hacker.
5. Why can insider threats be difficult to detect?
6. Why is authorisation important in ethical hacking?

---

CHAPTER SIX

MALWARE AND MALICIOUS SOFTWARE

6.1 Learning Objectives

At the end of this chapter, students should be able to:

• Define malware.
• Identify common types of malware.
• Explain how malware spreads.
• Recognise signs of malware infection.
• Recommend malware prevention measures.

6.2 Meaning of Malware

Malware is software or code intentionally designed to damage systems, disrupt operations, steal information, spy on users or provide unauthorised access.

6.3 Computer Virus

A computer virus is malicious code that attaches itself to a legitimate file or program. It normally spreads when the infected file is opened or executed.

6.4 Worm

A worm is malware that can copy and spread itself across networks without attaching itself to another file. Worms may spread quickly and consume network or system resources.

6.5 Trojan Horse

A Trojan horse is malware disguised as a useful or legitimate program. A user may install it believing it is a game, document, utility or application.

6.6 Ransomware

Ransomware is malware that blocks access to systems or encrypts files and demands payment for restoration.

Paying a ransom does not guarantee that files will be restored. Organisations should focus on prevention, secure backups and incident response.

6.7 Spyware

Spyware secretly observes user activities or collects information without proper consent.

It may collect:

• Browsing activities.
• Login details.
• Personal information.
• Application usage.
• Device information.

6.8 Keylogger

A keylogger records keys typed on a keyboard. It may capture usernames, passwords, messages and financial details.

6.9 Adware

Adware displays unwanted advertisements. Some adware also tracks user activity or changes browser settings.

6.10 Rootkit

A rootkit is designed to hide malicious activities and maintain privileged access to a system.

6.11 Backdoor

A backdoor is a hidden or undocumented method of bypassing normal authentication or security controls.

6.12 Bot and Botnet

A bot is an infected device controlled remotely by an attacker. A botnet is a group of compromised devices controlled together.

Botnets may be used for:

• Sending spam.
• Distributing malware.
• Conducting denial-of-service attacks.
• Stealing information.
• Performing fraudulent online activities.

6.13 Logic Bomb

A logic bomb is malicious code designed to activate when a particular condition is met, such as a date, time or system event.

6.14 Fileless Malware

Fileless malware operates mainly through legitimate system tools or computer memory rather than relying on a normal malicious file stored on the disk.

6.15 How Malware Spreads

Malware may spread through:

• Malicious email attachments.
• Fraudulent links.
• Infected flash drives.
• Unlicensed software.
• Fake mobile applications.
• Compromised websites.
• Software vulnerabilities.
• Unsafe downloads.
• Shared network resources.
• Weak remote-access credentials.

6.16 Signs of Malware Infection

Possible signs include:

• Unusual system slowness.
• Frequent crashes.
• Unexpected pop-up messages.
• Unknown applications.
• Changes to browser settings.
• Files becoming unavailable or renamed.
• Unusual network activity.
• Security software becoming disabled.
• Messages sent from an account without the owner’s knowledge.
• Rapid battery or data consumption.

These signs do not always prove that malware is present. Proper investigation is necessary.

6.17 Malware Prevention

Users and organisations should:

1. Keep operating systems and applications updated.
2. Use trusted security software.
3. Download software only from trusted sources.
4. Avoid unknown email attachments.
5. Scan removable storage devices.
6. Use strong passwords and multifactor authentication.
7. Disable unnecessary services.
8. Limit administrator privileges.
9. Back up important files regularly.
10. Train users to recognise suspicious activities.

6.18 Responding to Suspected Malware

A user who suspects malware should:

1. Stop sensitive activities on the device.
2. Disconnect the device from the network when appropriate.
3. Report the incident to the responsible technical officer.
4. Avoid deleting evidence or experimenting carelessly.
5. Use approved security tools to examine the device.
6. Change passwords using a trusted device if account theft is suspected.
7. Restore information only from a verified clean backup.

6.19 Chapter Summary

Malware includes viruses, worms, Trojan horses, ransomware, spyware, keyloggers, rootkits, bots and other malicious programs. Malware may spread through email, unsafe downloads, infected devices and software weaknesses. Prevention depends on updates, secure configuration, backups, security software and user awareness.

6.20 Review Questions

1. Define malware.
2. Differentiate between a virus and a worm.
3. What is ransomware?
4. Explain the meaning of a botnet.
5. State six ways malware can enter a computer.
6. Describe five measures for preventing malware infection.

---

CHAPTER SEVEN

SOCIAL ENGINEERING AND HUMAN-BASED ATTACKS

7.1 Learning Objectives

At the end of this chapter, students should be able to:

• Define social engineering.
• Identify common social engineering methods.
• Recognise warning signs of phishing.
• Explain why attackers target human behaviour.
• Recommend measures for preventing social engineering attacks.

7.2 Meaning of Social Engineering

Social engineering is the manipulation of people into revealing information, granting access or performing actions that weaken security.

Instead of attacking technology directly, a social engineer may exploit fear, trust, greed, curiosity, respect for authority or urgency.

7.3 Phishing

Phishing is a fraudulent attempt to obtain information or persuade a person to perform an unsafe action through a deceptive message.

A phishing message may ask the victim to:

• Enter a password on a fake website.
• Open a malicious attachment.
• Send money.
• Reveal a one-time password.
• Install a harmful application.
• Provide bank or identity information.

7.4 Spear Phishing

Spear phishing is a targeted phishing attack directed at a specific person, department or organisation. The attacker may use personal information to make the message appear convincing.

7.5 Whaling

Whaling is phishing directed at senior officials, executives or other high-value individuals.

7.6 Smishing

Smishing is phishing carried out through text messages or messaging applications.

7.7 Vishing

Vishing is phishing carried out through telephone or voice communication.

7.8 Pretexting

Pretexting involves creating a false story or identity to persuade a victim to provide information or access.

An attacker may pretend to be a lecturer, bank official, technical support worker, delivery agent or government officer.

7.9 Baiting

Baiting offers something attractive in order to persuade a victim to perform an unsafe action.

Examples include free software, free internet access, false scholarship forms or a flash drive left where someone is likely to pick it up.

7.10 Tailgating

Tailgating occurs when an unauthorised person follows an authorised person into a restricted area.

7.11 Shoulder Surfing

Shoulder surfing involves observing a person’s screen, keyboard or documents to obtain sensitive information.

7.12 Impersonation

Impersonation occurs when an attacker pretends to be another person in order to gain trust, information or access.

7.13 Scareware

Scareware uses frightening messages to pressure a person into downloading software, paying money or contacting a fraudulent support service.

7.14 Business Email Compromise

Business email compromise is a form of fraud in which an attacker impersonates or compromises a trusted business email account to request payment, confidential information or changes to payment details.

7.15 Common Warning Signs of Phishing

• Unexpected requests for passwords or one-time codes.
• Urgent threats or pressure.
• Requests for secrecy.
• Unusual payment instructions.
• Misspelled or misleading domain names.
• Unexpected attachments.
• Messages that appear too good to be true.
• Poor grammar or unusual formatting.
• A greeting that does not match the normal relationship.
• A link whose actual destination differs from its visible text.

7.16 Safe Response to Suspicious Messages

1. Do not click the link immediately.
2. Do not open unexpected attachments.
3. Do not reveal passwords or one-time codes.
4. Verify the request through a separate trusted method.
5. Check the sender’s complete address.
6. Report the message to the responsible authority.
7. Delete or quarantine the message after reporting.

7.17 Example

A student receives a message claiming that the student’s university account will be closed within thirty minutes unless the student enters a password through a provided link.

Warning signs include:

• Artificial urgency.
• A threat of immediate account closure.
• A request for a password.
• An unfamiliar link.
• Lack of normal university communication procedures.

7.18 Preventing Social Engineering

Organisations should:

• Provide regular awareness training.
• Use clear verification procedures.
• Apply multifactor authentication.
• Limit public exposure of sensitive information.
• Encourage prompt reporting.
• Test employee awareness with authorised simulations.
• Use email filtering and security tools.
• Require additional approval for sensitive payments.

7.19 Chapter Summary

Social engineering attacks human judgement rather than depending only on technical weaknesses. Common methods include phishing, vishing, smishing, pretexting, baiting, impersonation, tailgating and shoulder surfing. Verification, awareness and caution are essential defences.

7.20 Review Questions

1. Define social engineering.
2. Differentiate between phishing, smishing and vishing.
3. What is spear phishing?
4. State six warning signs of a phishing message.
5. Explain tailgating and shoulder surfing.
6. Describe how a student should respond to a suspicious scholarship message.

---

CHAPTER EIGHT

IDENTITY AND ACCESS MANAGEMENT

8.1 Learning Objectives

At the end of this chapter, students should be able to:

• Explain identity and access management.
• Differentiate identification, authentication and authorisation.
• Describe authentication factors.
• Explain multifactor authentication.
• Apply safe password practices.
• Identify common access-control models.

8.2 Meaning of Identity and Access Management

Identity and Access Management refers to the policies, processes and technologies used to identify users, authenticate them and control their access to systems and information.

8.3 The IAAA Process

Access management commonly involves:

1. Identification: The user claims an identity.
2. Authentication: The identity is verified.
3. Authorisation: Approved permissions are applied.
4. Accounting: User actions are recorded and reviewed.

8.4 Authentication Factors

8.4.1 Something You Know

Examples include:

• Password.
• Personal identification number.
• Passphrase.
• Answer to a security question.

8.4.2 Something You Have

Examples include:

• Smart card.
• Mobile phone.
• Security token.
• Hardware key.

8.4.3 Something You Are

Examples include:

• Fingerprint.
• Face.
• Iris.
• Voice pattern.

8.5 Multifactor Authentication

Multifactor authentication requires evidence from two or more different authentication-factor categories.

A password and a one-time code sent to a registered device may provide two factors because the password is something the user knows and the device is something the user has.

Two passwords are not true multifactor authentication because both belong to the same factor category.

8.6 Password Security

A secure password should:

• Be sufficiently long.
• Be difficult to guess.
• Be unique for each important account.
• Avoid personal information.
• Avoid common words and predictable patterns.
• Not be shared with another person.

8.7 Passphrases

A passphrase is a long combination of words or characters used as a password. A well-constructed passphrase is often easier to remember and harder to guess than a short password.

8.8 Password Managers

A password manager is an application designed to generate, store and organise passwords securely. The user protects the password manager with a strong master password and, where possible, multifactor authentication.

8.9 Unsafe Password Practices

• Using the same password for several accounts.
• Writing a password where others can easily see it.
• Sharing a password.
• Using names, dates of birth or telephone numbers.
• Using simple sequences such as 123456.
• Entering passwords through links in unexpected messages.
• Saving passwords on untrusted public computers.

8.10 Biometrics

Biometric authentication uses measurable physical or behavioural characteristics.

Advantages include:

• Convenience.
• Difficulty of casual sharing.
• Connection to the individual.

Limitations include:

• False acceptance or rejection.
• Privacy concerns.
• Special equipment requirements.
• Difficulty replacing compromised biometric information.

8.11 One-Time Password

A one-time password is a code valid for only one login or transaction, or for a limited period. It should never be revealed to another person.

8.12 Access-Control Models

8.12.1 Discretionary Access Control

In discretionary access control, the owner of a resource may decide who receives access.

8.12.2 Mandatory Access Control

Mandatory access control uses centrally defined security classifications and rules. Individual users cannot freely change the rules.

8.12.3 Role-Based Access Control

Role-based access control assigns permissions according to job roles.

For example, students, lecturers, examination officers and system administrators may receive different permissions.

8.12.4 Attribute-Based Access Control

Attribute-based access control makes decisions using characteristics such as department, location, device, time, security status or type of information.

8.13 Account Lifecycle

The lifecycle of a user account includes:

1. Account request.
2. Identity verification.
3. Account creation.
4. Permission assignment.
5. Usage monitoring.
6. Permission review.
7. Modification when duties change.
8. Account suspension or removal when no longer required.

8.14 Privileged Accounts

Privileged accounts have powerful permissions, such as the ability to install software, create users or change security settings. These accounts require stronger protection, monitoring and restricted use.

8.15 Account Lockout and Rate Limiting

Account lockout and rate limiting reduce repeated login attempts. They help protect accounts from automated password guessing.

8.16 Chapter Summary

Identity and access management ensures that the right people receive the right access for the right purpose. It includes identification, authentication, authorisation and accounting. Strong passwords, multifactor authentication, secure account management and least privilege reduce unauthorised access.

8.17 Review Questions

1. What is identity and access management?
2. Differentiate between identification, authentication and authorisation.
3. List the major authentication factors.
4. What is multifactor authentication?
5. State six safe password practices.
6. Explain role-based access control with a university example.

---

CHAPTER NINE

INTRODUCTION TO CRYPTOGRAPHY

9.1 Learning Objectives

At the end of this chapter, students should be able to:

• Define cryptography.
• Explain plaintext, ciphertext, encryption and decryption.
• Differentiate symmetric and asymmetric encryption.
• Explain hashing and digital signatures.
• Describe digital certificates and public-key infrastructure.

9.2 Meaning of Cryptography

Cryptography is the science and practice of protecting information by transforming it into a form that unauthorised persons cannot easily understand or alter.

9.3 Important Terms

• Plaintext: Original readable information.
• Ciphertext: Information transformed into an unreadable form.
• Encryption: Conversion of plaintext into ciphertext.
• Decryption: Conversion of ciphertext back into plaintext.
• Key: A value used by a cryptographic algorithm.
• Algorithm: A defined procedure used to perform a cryptographic operation.

9.4 Objectives of Cryptography

Cryptography can support:

• Confidentiality.
• Integrity.
• Authentication.
• Non-repudiation.

9.5 Classical Cryptography

Classical ciphers are older techniques used to introduce cryptographic ideas. They are generally not secure enough for modern sensitive information.

9.6 Caesar Cipher

The Caesar cipher replaces each letter with another letter located a fixed number of positions away in the alphabet.

Using a shift of three:

• A becomes D.
• B becomes E.
• C becomes F.

The word DATA becomes GDWD.

The Caesar cipher is useful for teaching, but it is not suitable for protecting modern information.

9.7 Symmetric Encryption

Symmetric encryption uses the same secret key, or closely related keys, for encryption and decryption.

Advantages include:

• High speed.
• Suitability for large amounts of data.
• Efficient use of computing resources.

Its major challenge is securely sharing the secret key.

9.8 Asymmetric Encryption

Asymmetric encryption uses a pair of mathematically related keys:

• A public key that may be shared.
• A private key that must remain secret.

Information encrypted with the appropriate public key can be decrypted with the corresponding private key.

9.9 Comparison of Symmetric and Asymmetric Encryption

Feature	Symmetric Encryption	Asymmetric Encryption
Number of keys	Normally one shared secret key	Public and private key pair
Speed	Generally faster	Generally slower
Key distribution	Secret key must be shared securely	Public key may be distributed openly
Common use	Protecting large amounts of data	Key exchange, authentication and digital signatures

9.10 Hashing

Hashing transforms data into a fixed-length output called a hash value or message digest.

A good cryptographic hash function should:

• Produce the same output for the same input.
• Produce a very different output when the input changes.
• Make it difficult to calculate the original input from the hash.
• Make it difficult to find two different inputs with the same output.

9.11 Encryption and Hashing

Encryption is designed to be reversed by an authorised person with the correct key. Hashing is normally designed as a one-way operation.

9.12 Password Hashing and Salting

Secure systems should not normally store users’ passwords as readable text. They store protected password representations produced through appropriate password-hashing methods.

A salt is a unique random value added before hashing. Salting reduces the usefulness of precomputed password-guessing tables and prevents identical passwords from producing identical stored values.

9.13 Digital Signature

A digital signature is a cryptographic mechanism used to support message integrity, authentication and non-repudiation.

A digital signature does not hide the message. Encryption may be used separately when confidentiality is required.

9.14 Digital Certificate

A digital certificate is an electronic document that links a public key to an identified person, organisation or system.

A certificate may contain:

• The owner’s identity.
• The public key.
• The issuing authority.
• The validity period.
• The issuer’s digital signature.

9.15 Certificate Authority

A certificate authority is a trusted organisation that issues and manages digital certificates.

9.16 Public-Key Infrastructure

Public-Key Infrastructure is the combination of technologies, policies, certificates, authorities and procedures used to manage public-key cryptography.

9.17 Cryptography in Everyday Life

Cryptography is used in:

• Secure websites.
• Mobile banking.
• Encrypted messaging.
• Virtual private networks.
• Device storage encryption.
• Digital certificates.
• Software update verification.
• Electronic payment systems.

9.18 Limitations of Cryptography

Cryptography cannot solve every security problem. It may fail when:

• Keys are stolen.
• Passwords are weak.
• Users are deceived.
• Devices are already compromised.
• Algorithms are implemented incorrectly.
• Keys are poorly managed.

9.19 Chapter Summary

Cryptography protects information through encryption, hashing, digital signatures and certificate systems. Symmetric encryption uses a shared secret key, while asymmetric encryption uses public and private keys. Hashing supports integrity and password protection, while digital signatures support authenticity and non-repudiation.

9.20 Review Questions

1. Define cryptography.
2. Differentiate between plaintext and ciphertext.
3. Compare symmetric and asymmetric encryption.
4. Differentiate between hashing and encryption.
5. What is a digital signature?
6. Explain the purpose of a digital certificate.

---

CHAPTER TEN

COMPUTER AND NETWORK SECURITY

10.1 Learning Objectives

At the end of this chapter, students should be able to:

• Describe basic computer security controls.
• Explain system hardening and patch management.
• Describe firewalls and intrusion detection systems.
• Explain secure wireless networking.
• Identify common threats to networks.

10.2 Endpoint Security

An endpoint is a device connected to a network, such as a desktop computer, laptop, smartphone, tablet or server.

Endpoint security is the protection of these devices from unauthorised access, malware and misuse.

10.3 System Hardening

System hardening is the process of reducing a system’s weaknesses and attack surface.

Hardening activities include:

• Removing unnecessary applications.
• Disabling unused services.
• Changing default passwords.
• Applying secure settings.
• Restricting administrator access.
• Enabling logging.
• Installing updates.
• Encrypting sensitive storage.

10.4 Patch Management

A patch is a software update used to correct errors, improve performance or repair security vulnerabilities.

Patch management involves:

1. Identifying systems and software.
2. Monitoring available updates.
3. Assessing the importance of each update.
4. Testing updates where necessary.
5. Installing approved updates.
6. Confirming successful installation.

10.5 Antivirus and Endpoint Protection

Antivirus software detects, blocks and removes known or suspicious malicious software. Modern endpoint protection may also monitor behaviour, network activity and unusual changes.

Security software must be updated and properly configured. No antivirus product provides complete protection.

10.6 Firewall

A firewall monitors and controls network traffic according to security rules.

Firewalls may be:

• Installed on individual computers.
• Placed between networks.
• Included in routers.
• Provided as cloud services.

10.7 Intrusion Detection System

An Intrusion Detection System monitors activities and alerts responsible personnel when suspicious behaviour is detected.

10.8 Intrusion Prevention System

An Intrusion Prevention System can detect suspicious activity and automatically block or limit it according to configured rules.

10.9 Network Segmentation

Network segmentation divides a large network into smaller sections. This can limit the movement of attackers and reduce the effect of an incident.

For example, a university may separate student Wi-Fi, staff systems, financial systems, laboratory devices and public services.

10.10 Virtual Private Network

A Virtual Private Network creates a protected communication connection across an untrusted network.

A VPN protects information in transit, but it does not automatically make every website safe or remove malware from a device.

10.11 Wireless Network Security

Wireless networks should be protected by:

• Modern wireless encryption.
• Strong administrator passwords.
• Changing default settings.
• Regular firmware updates.
• Separate guest networks.
• Disabling unnecessary remote management.
• Monitoring connected devices.

10.12 Public Wi-Fi Risks

Public Wi-Fi may expose users to fake access points, traffic interception, account theft or malicious devices.

When using public Wi-Fi:

• Avoid sensitive transactions when possible.
• Confirm the correct network name.
• Use secure websites.
• Disable automatic connection.
• Keep file sharing disabled.
• Use an approved VPN when required.
• Forget the network after use.

10.13 Denial-of-Service Attack

A denial-of-service attack attempts to make a system or service unavailable by overwhelming or disrupting it.

A distributed denial-of-service attack uses many devices, often from a botnet, to attack a target at the same time.

10.14 Eavesdropping

Eavesdropping is the unauthorised interception of communication. Encryption helps protect information against interception.

10.15 Spoofing

Spoofing involves falsifying identity or communication information to appear as a trusted system, user or source.

10.16 Man-in-the-Middle Attack

A man-in-the-middle attack occurs when an attacker secretly positions themselves between communicating parties to observe or alter information.

10.17 Backup Security

A secure backup should be:

• Performed regularly.
• Protected from unauthorised access.
• Stored separately from the original system.
• Tested for successful restoration.
• Protected against malware and physical damage.

10.18 Physical Security

Digital systems also require physical protection. Controls may include:

• Locks.
• Access cards.
• Security guards.
• Surveillance cameras.
• Equipment tracking.
• Fire detection.
• Alternative power supply.
• Environmental monitoring.

10.19 Chapter Summary

Computer and network security includes system hardening, software updates, endpoint protection, firewalls, intrusion detection, segmentation, secure wireless networking, backups and physical controls. Several layers should be combined to provide defence in depth.

10.20 Review Questions

1. What is system hardening?
2. Explain patch management.
3. Differentiate between an intrusion detection system and an intrusion prevention system.
4. What is network segmentation?
5. State five precautions for using public Wi-Fi.
6. Differentiate between denial-of-service and distributed denial-of-service attacks.

---

CHAPTER ELEVEN

WEB, APPLICATION, DATABASE, MOBILE AND CLOUD SECURITY

11.1 Learning Objectives

At the end of this chapter, students should be able to:

• Explain common web and application security concerns.
• Describe basic database security.
• Explain cloud computing service models.
• Describe the shared-responsibility concept.
• Identify mobile and Internet of Things security practices.

11.2 Application Security

Application security is the protection of software throughout its design, development, testing, deployment, operation and maintenance.

11.3 Secure Software Development

Secure software development includes:

• Defining security requirements.
• Designing secure architecture.
• Writing secure code.
• Reviewing source code.
• Testing for weaknesses.
• Protecting development tools.
• Applying updates after release.

11.4 Input Validation

Input validation checks information supplied by users or other systems before it is processed.

Applications should not automatically trust information entered through forms, uploaded files, addresses or external systems.

11.5 Broken Access Control

Broken access control occurs when an application fails to properly restrict what users are allowed to access or perform.

For example, a student should not gain access to another student’s academic record by changing a number in a web address.

11.6 Weak Authentication

Weak authentication may result from simple passwords, insecure password recovery, unlimited login attempts or poor session management.

11.7 Session Security

A session represents a user’s active interaction with an application after login.

Secure session management includes:

• Protecting session identifiers.
• Ending sessions after inactivity.
• Providing secure logout.
• Requiring authentication again for sensitive activities.

11.8 Database Security

A database is an organised collection of information. Database security protects stored data from unauthorised access, alteration, disclosure and destruction.

Database controls include:

• Strong authentication.
• Role-based permissions.
• Encryption.
• Backups.
• Audit logs.
• Secure configuration.
• Software updates.
• Input validation.
• Restricted network access.

11.9 Data Minimisation

Data minimisation means collecting and keeping only the information necessary for a legitimate purpose.

An organisation should not collect sensitive personal information simply because storage is available.

11.10 Cloud Computing

Cloud computing provides computing resources through a network on demand.

11.11 Cloud Service Models

11.11.1 Infrastructure as a Service

Infrastructure as a Service provides virtual computing resources such as servers, storage and networking.

11.11.2 Platform as a Service

Platform as a Service provides an environment in which developers can build and deploy applications.

11.11.3 Software as a Service

Software as a Service provides complete applications accessed through a browser or application interface.

11.12 Cloud Deployment Models

• Public cloud: Services provided through shared cloud infrastructure.
• Private cloud: Cloud infrastructure dedicated to one organisation.
• Hybrid cloud: Combination of public and private cloud resources.
• Community cloud: Infrastructure shared by organisations with similar requirements.

11.13 Shared Responsibility

Cloud security is a shared responsibility between the cloud provider and the customer. The exact responsibilities depend on the service model.

The provider may secure the physical infrastructure, while the customer remains responsible for user accounts, passwords, permissions, information classification and secure application configuration.

11.14 Common Cloud Security Risks

• Incorrect permissions.
• Weak administrator accounts.
• Exposed storage.
• Failure to back up information.
• Unmonitored cloud resources.
• Insecure application interfaces.
• Lack of understanding of provider and customer responsibilities.

11.15 Mobile Device Security

Mobile users should:

• Use a screen lock.
• Install applications only from trusted sources.
• Review application permissions.
• Keep the device updated.
• Enable device-location and remote-wipe features where appropriate.
• Back up important information.
• Avoid rooting or unauthorised modification.
• Protect the device from theft.

11.16 Application Permissions

Mobile applications may request access to the camera, microphone, contacts, messages, location or storage. Users should grant only permissions that are reasonably required.

11.17 Internet of Things Security

Connected devices should be protected by:

• Changing default passwords.
• Installing firmware updates.
• Disabling unnecessary features.
• Separating them from sensitive networks.
• Buying devices from trusted manufacturers.
• Reviewing privacy settings.

11.18 Chapter Summary

Application security begins during design and continues throughout the software lifecycle. Important concerns include input validation, access control, authentication, sessions, database protection and secure configuration. Cloud security is shared between providers and customers. Mobile and connected devices also require updates, strong authentication and careful permission management.

11.19 Review Questions

1. What is application security?
2. Explain broken access control.
3. State six database security controls.
4. Differentiate between Infrastructure as a Service, Platform as a Service and Software as a Service.
5. Explain the cloud shared-responsibility concept.
6. State five measures for protecting a mobile device.

---

CHAPTER TWELVE

CYBERSECURITY RISK MANAGEMENT AND SECURITY CONTROLS

12.1 Learning Objectives

At the end of this chapter, students should be able to:

• Explain cybersecurity risk management.
• Describe risk identification, assessment and treatment.
• Classify security controls.
• Explain policies, standards, procedures and guidelines.
• Describe the main functions of a cybersecurity framework.

12.2 Meaning of Risk Management

Cybersecurity risk management is the organised process of identifying, assessing, treating, monitoring and communicating risks that may affect information and digital systems.

12.3 Risk Management Process

A basic risk management process includes:

1. Establishing the context.
2. Identifying assets.
3. Identifying threats and vulnerabilities.
4. Assessing likelihood and impact.
5. Prioritising risks.
6. Selecting risk-treatment options.
7. Implementing controls.
8. Monitoring and reviewing risks.
9. Communicating results.

12.4 Risk Treatment Options

12.4.1 Risk Avoidance

Risk avoidance means stopping or not beginning the activity that creates the risk.

12.4.2 Risk Mitigation

Risk mitigation means applying controls to reduce the likelihood or impact of the risk.

12.4.3 Risk Transfer

Risk transfer shifts part of the financial or operational responsibility to another party, such as through insurance or a service agreement.

Transfer does not always remove legal or reputational responsibility.

12.4.4 Risk Acceptance

Risk acceptance means knowingly deciding to tolerate a risk because it is within approved limits or because treatment costs more than the expected harm.

12.5 Types of Security Controls by Nature

12.5.1 Administrative Controls

Administrative controls include:

• Policies.
• Training.
• Background checks.
• Risk assessments.
• Incident-response plans.
• Separation of duties.

12.5.2 Technical Controls

Technical controls include:

• Firewalls.
• Encryption.
• Antivirus software.
• Multifactor authentication.
• Access-control systems.
• Security monitoring.

12.5.3 Physical Controls

Physical controls include:

• Locks.
• Security guards.
• Fences.
• Cameras.
• Fire suppression.
• Access badges.

12.6 Types of Controls by Function

Control Type	Purpose	Example
Preventive	Attempts to stop an incident before it occurs.	Firewall or access control
Detective	Identifies an incident or suspicious activity.	Audit log or intrusion detection
Corrective	Corrects the effect of an incident.	Removing malware
Recovery	Restores normal operations.	Restoring from backup
Deterrent	Discourages unacceptable behaviour.	Warning notice or visible camera
Compensating	Provides an alternative when the preferred control cannot be used.	Additional monitoring

12.7 Security Policy

A security policy is a high-level statement of management’s expectations and rules for protecting an organisation’s assets.

Examples include:

• Acceptable-use policy.
• Password policy.
• Data-classification policy.
• Remote-access policy.
• Backup policy.
• Incident-response policy.

12.8 Standard

A standard is a mandatory requirement that supports a policy.

A password policy may state that strong passwords must be used, while a password standard specifies the minimum approved requirements.

12.9 Procedure

A procedure provides step-by-step instructions for performing a task.

For example, a password-reset procedure may describe how identity must be verified before a password is changed.

12.10 Guideline

A guideline provides recommended practices. It normally allows more flexibility than a policy, standard or procedure.

12.11 Cybersecurity Framework Functions

A modern cybersecurity framework may organise cybersecurity activities into six broad functions:

1. Govern: Establish direction, responsibility, policy and oversight.
2. Identify: Understand assets, risks, systems and business requirements.
3. Protect: Apply safeguards to reduce cybersecurity risk.
4. Detect: Discover and analyse suspicious events.
5. Respond: Take action when an incident occurs.
6. Recover: Restore systems and improve after an incident.

12.12 Security Awareness and Training

Security awareness helps users recognise threats and understand their responsibilities.

Training should cover:

• Phishing.
• Password security.
• Reporting procedures.
• Safe internet use.
• Protection of personal information.
• Use of removable devices.
• Physical security.
• Remote working.

12.13 Continuous Monitoring

Cybersecurity risk changes over time. New systems, new users, new threats and new vulnerabilities may appear. Organisations should continuously monitor important systems and regularly review risks and controls.

12.14 Example Risk Treatment

A university identifies the risk of unauthorised access to student records because staff members use shared accounts.

Possible treatment measures include:

• Providing individual user accounts.
• Applying role-based permissions.
• Enabling multifactor authentication.
• Recording user activities.
• Reviewing access regularly.
• Disabling accounts when staff members leave.

12.15 Chapter Summary

Cybersecurity risk management identifies, assesses, treats and monitors risks. Treatment options include avoidance, mitigation, transfer and acceptance. Controls may be administrative, technical or physical, and may perform preventive, detective, corrective or recovery functions. Policies, standards, procedures and guidelines help organisations apply security consistently.

12.16 Review Questions

1. Define cybersecurity risk management.
2. Explain the four major risk-treatment options.
3. Differentiate between administrative, technical and physical controls.
4. Differentiate between a policy, standard, procedure and guideline.
5. State and explain the six cybersecurity framework functions.
6. Why must cybersecurity risks be continuously monitored?

---

CHAPTER THIRTEEN

CYBERSECURITY INCIDENTS AND INCIDENT RESPONSE

13.1 Learning Objectives

At the end of this chapter, students should be able to:

• Differentiate between an event and an incident.
• Describe the stages of incident response.
• Explain containment, eradication and recovery.
• Describe the importance of reporting and documentation.
• Explain business continuity, disaster recovery and digital evidence.

13.2 Security Event

A security event is an observable occurrence in a system or network. An event may be normal, suspicious or harmful.

Examples include a successful login, failed login, file download, system restart or firewall alert.

13.3 Security Incident

A security incident is an event or group of events that threatens or violates security policies, business operations or the confidentiality, integrity or availability of information.

Examples include:

• Malware infection.
• Unauthorised account access.
• Loss of a device containing sensitive information.
• Data leakage.
• Website defacement.
• Denial-of-service attack.
• Accidental deletion of important information.

13.4 Data Breach

A personal data breach is a security failure that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data.

13.5 Incident Response

Incident response is the organised process of preparing for, detecting, analysing, containing, removing and recovering from cybersecurity incidents.

13.6 Preparation

Preparation includes:

• Creating an incident-response policy.
• Assigning roles.
• Providing communication methods.
• Maintaining contact information.
• Preparing tools.
• Training staff.
• Maintaining backups.
• Conducting exercises.

13.7 Identification and Analysis

During identification, the organisation determines whether an incident has occurred.

Analysis may examine:

• Affected systems.
• Time of the incident.
• Type of attack.
• Information involved.
• Possible source.
• Evidence available.
• Potential business impact.

13.8 Containment

Containment limits the spread and effect of an incident.

Containment actions may include:

• Disconnecting an infected device.
• Disabling a compromised account.
• Blocking malicious communication.
• Temporarily isolating a network section.
• Preserving evidence.

Containment decisions should consider both security and operational consequences.

13.9 Eradication

Eradication removes the cause of the incident.

Activities may include:

• Removing malware.
• Closing exploited vulnerabilities.
• Deleting unauthorised accounts.
• Changing compromised credentials.
• Reinstalling affected systems.
• Correcting insecure configurations.

13.10 Recovery

Recovery restores systems and services to normal operation.

Recovery includes:

• Restoring clean backups.
• Testing systems.
• Monitoring for repeated activity.
• Returning services gradually.
• Informing authorised stakeholders.

13.11 Lessons Learned

After the incident, the organisation should review:

• What happened.
• How it was detected.
• What worked well.
• What failed.
• The total impact.
• Which controls require improvement.
• How similar incidents can be prevented.

13.12 Incident Reporting

Users should report incidents promptly through approved channels. Delay may allow the incident to spread or destroy valuable evidence.

An incident report may contain:

• Date and time.
• Person reporting.
• Affected system.
• Description of the event.
• Observed signs.
• Actions already taken.
• People notified.

13.13 Incident Response Team

An incident response team may include:

• Cybersecurity personnel.
• Information technology staff.
• Management.
• Legal officers.
• Public relations personnel.
• Human resources personnel.
• Data-protection personnel.
• External specialists.

13.14 Business Continuity

Business continuity is the ability of an organisation to continue essential activities during and after disruption.

13.15 Disaster Recovery

Disaster recovery focuses on restoring information technology systems, applications and information after a major disruption.

13.16 Backup and Restoration

A backup is useful only when it can be successfully restored. Organisations must test backups and ensure they are protected from the same incident affecting the main system.

13.17 Digital Forensics

Digital forensics is the identification, collection, preservation, examination and presentation of digital evidence.

Students should not alter a suspected device carelessly because doing so may change or destroy evidence.

13.18 Chain of Custody

Chain of custody is the documented record of who collected, handled, transferred, examined and stored evidence.

13.19 Example Incident

A lecturer’s laptop containing examination scores is stolen.

Possible response actions include:

1. Report the theft immediately.
2. Determine the type of information on the laptop.
3. Disable active accounts or sessions.
4. Change exposed credentials.
5. Attempt approved remote lock or deletion if available.
6. Assess whether personal data was exposed.
7. Restore necessary files from backup.
8. Document the incident.
9. Review laptop encryption and handling procedures.

13.20 Chapter Summary

Incident response includes preparation, identification, analysis, containment, eradication, recovery and lessons learned. Timely reporting, documentation, backups and trained personnel reduce the impact of incidents. Business continuity keeps essential operations running, while disaster recovery restores technology.

13.21 Review Questions

1. Differentiate between a security event and a security incident.
2. What is a data breach?
3. Explain the stages of incident response.
4. Differentiate between containment and eradication.
5. Differentiate between business continuity and disaster recovery.
6. What is chain of custody?

---

CHAPTER FOURTEEN

CYBER ETHICS, PRIVACY AND NIGERIAN CYBER LAW

14.1 Learning Objectives

At the end of this chapter, students should be able to:

• Explain cyber ethics.
• Describe responsible use of cybersecurity knowledge.
• Explain privacy and personal data protection.
• Identify major Nigerian legal instruments relevant to cybersecurity.
• Explain the importance of authorisation and responsible disclosure.

14.2 Meaning of Ethics

Ethics refers to principles of right and wrong that guide behaviour. Cyber ethics applies ethical principles to the use of computers, networks, information and digital services.

14.3 Ethical Responsibilities of Cybersecurity Students

A cybersecurity student should:

• Respect privacy.
• Obtain permission before testing systems.
• Protect confidential information.
• Avoid causing harm.
• Report vulnerabilities responsibly.
• Use professional knowledge honestly.
• Respect intellectual property.
• Follow laws and institutional rules.
• Avoid conflicts of interest.
• Maintain professional competence.

14.4 Authorisation

Authorisation is clear permission to perform an activity. Cybersecurity testing should be supported by written approval that defines:

• The systems that may be tested.
• The testing period.
• Permitted techniques.
• Prohibited activities.
• Reporting requirements.
• Responsible persons.

A publicly accessible website is not automatically available for security testing.

14.5 Responsible Disclosure

Responsible disclosure is the process of privately reporting a discovered vulnerability to the system owner and allowing a reasonable opportunity for correction before wider publication.

A student who accidentally discovers a weakness should avoid exploiting it further, preserve relevant details and report it through an approved channel.

14.6 Intellectual Property

Intellectual property protects creations such as software, books, designs, music, research and inventions.

Unethical or unlawful activities may include:

• Software piracy.
• Plagiarism.
• Unauthorised copying.
• Removing ownership information.
• Distributing protected materials without permission.

14.7 Meaning of Privacy

Privacy concerns an individual’s control over personal life and personal information.

Data privacy focuses on the lawful, fair and responsible collection, use, storage, sharing and deletion of personal data.

14.8 Personal Data

Personal data is information relating to an identified or identifiable individual.

Examples include:

• Name.
• Address.
• Telephone number.
• Email address.
• Student registration number.
• Identification number.
• Location information.
• Photograph.
• Online identifier.
• Academic record.

14.9 Sensitive Personal Data

Some personal information requires stronger protection because misuse may cause serious harm or discrimination.

Examples may include:

• Health information.
• Biometric information.
• Genetic information.
• Religious or philosophical information.
• Political opinions.
• Information about a person’s private life.

14.10 Data Controller and Data Processor

A data controller determines the purposes and methods of processing personal data.

A data processor processes personal data on behalf of a data controller.

14.11 Basic Data-Protection Principles

Personal data should generally be:

• Processed lawfully, fairly and transparently.
• Collected for clear and legitimate purposes.
• Limited to what is necessary.
• Accurate and kept up to date.
• Retained only as long as necessary.
• Protected with appropriate security.
• Processed with accountability.

14.12 Rights of Data Subjects

Depending on the applicable law and circumstances, individuals may have rights concerning:

• Information about data processing.
• Access to personal data.
• Correction of inaccurate information.
• Objection to certain processing.
• Withdrawal of consent.
• Data portability.
• Complaints and legal remedies.
• Certain automated decisions.

14.13 Nigeria Data Protection Act 2023

The Nigeria Data Protection Act 2023 provides a national legal framework for protecting personal information and regulating the processing of personal data. It also establishes the Nigeria Data Protection Commission.

The Act addresses matters including:

• Principles of personal data processing.
• Lawful bases for processing.
• Consent.
• Data-subject rights.
• Security of personal data.
• Personal data breaches.
• Cross-border transfer of personal data.
• Responsibilities of controllers and processors.
• Complaints, enforcement and remedies.

14.14 Cybercrimes Legislation in Nigeria

Nigeria’s Cybercrimes legislation provides a legal framework for preventing, investigating and prosecuting various offences involving computers, electronic communications, networks and critical information systems.

The Cybercrimes (Prohibition, Prevention, etc.) Act 2015 was amended in 2024. Students and institutions should consult the current official text when detailed legal interpretation is required.

Cyber-related offences may involve:

• Unauthorised access.
• Unauthorised interception.
• System interference.
• Data interference.
• Identity-related offences.
• Electronic fraud.
• Malicious communications.
• Misuse of computer systems.
• Offences affecting critical infrastructure.

14.15 Cyberbullying

Cyberbullying is the use of digital communication to harass, threaten, humiliate or repeatedly harm another person.

14.16 Identity Theft

Identity theft occurs when a person unlawfully obtains or uses another person’s identifying information, usually for fraud or impersonation.

14.17 Online Fraud

Online fraud involves deception through digital systems for financial or other unlawful gain.

Examples include:

• Fake payment alerts.
• Fraudulent investment schemes.
• Fake online stores.
• Account takeover.
• Impersonation.
• False scholarship or employment offers.

14.18 Legal and Ethical Differences

An action may be legal but still unethical, or unethical conduct may later become the subject of legal action. Cybersecurity professionals should satisfy both legal requirements and professional ethical standards.

14.19 Classroom Scenario

A student discovers that changing a number in a university portal address displays another student’s personal information.

The student should:

1. Stop accessing additional records.
2. Do not download or share the information.
3. Record only the minimum details needed for reporting.
4. Report the weakness through an authorised university channel.
5. Allow responsible personnel to investigate.

14.20 Chapter Summary

Cyber ethics guides responsible behaviour in digital environments. Cybersecurity activities require authorisation, respect for privacy and responsible disclosure. The Nigeria Data Protection Act 2023 regulates personal-data processing, while Nigeria’s Cybercrimes legislation addresses several computer-related offences.

14.21 Review Questions

1. Define cyber ethics.
2. Why is written authorisation important in security testing?
3. Explain responsible disclosure.
4. What is personal data?
5. State five principles of data protection.
6. Name the two principal Nigerian legal instruments discussed in this chapter.
7. Differentiate between a data controller and a data processor.

---

CHAPTER FIFTEEN

CYBERSECURITY CAREERS AND EMERGING TECHNOLOGIES

15.1 Learning Objectives

At the end of this chapter, students should be able to:

• Identify major cybersecurity careers.
• Describe the duties of cybersecurity professionals.
• Explain the importance of professional development.
• Discuss emerging cybersecurity technologies and risks.
• Prepare a basic cybersecurity career plan.

15.2 Cybersecurity as a Profession

Cybersecurity is a multidisciplinary profession involving computing, networking, law, management, risk, human behaviour, communication and investigation.

15.3 Security Operations Centre Analyst

A Security Operations Centre analyst monitors systems, investigates alerts, identifies suspicious activity and supports incident response.

15.4 Cybersecurity Analyst

A cybersecurity analyst assesses threats, reviews security controls, monitors systems and recommends improvements.

15.5 Security Engineer

A security engineer designs, implements and maintains security technologies and secure system architecture.

15.6 Penetration Tester

A penetration tester performs authorised security testing to identify weaknesses before malicious attackers exploit them.

Penetration testing requires written permission, an agreed scope and careful reporting.

15.7 Incident Responder

An incident responder investigates and manages cybersecurity incidents, limits damage and supports recovery.

15.8 Digital Forensics Analyst

A digital forensics analyst collects, preserves and examines digital evidence.

15.9 Security Auditor

A security auditor examines whether security controls, policies and practices meet established requirements.

15.10 Governance, Risk and Compliance Professional

A governance, risk and compliance professional helps an organisation manage security responsibilities, assess risks and comply with laws, standards and policies.

15.11 Security Architect

A security architect develops the overall structure and long-term design of an organisation’s security systems.

15.12 Cloud Security Specialist

A cloud security specialist protects cloud applications, information, identities and infrastructure.

15.13 Application Security Specialist

An application security specialist helps software developers design, test and maintain secure applications.

15.14 Data Protection Officer

A data protection officer supports an organisation’s compliance with data-protection obligations and promotes responsible handling of personal information.

15.15 Cybersecurity Researcher

A cybersecurity researcher studies threats, vulnerabilities, defence methods, human behaviour and emerging technologies.

15.16 Important Cybersecurity Skills

Technical Skills

• Computer fundamentals.
• Networking.
• Operating systems.
• Programming and scripting.
• Database fundamentals.
• Cloud computing.
• Security monitoring.
• Risk assessment.

Professional Skills

• Critical thinking.
• Communication.
• Report writing.
• Problem-solving.
• Teamwork.
• Ethical judgement.
• Attention to detail.
• Time management.
• Continuous learning.

15.17 Building a Cybersecurity Career

A student may:

1. Develop strong computing foundations.
2. Study networking and operating systems.
3. Learn basic programming.
4. Use legal practice laboratories.
5. Participate in authorised competitions.
6. Build simple defensive projects.
7. Read security reports and standards.
8. Develop report-writing skills.
9. Join professional communities.
10. Pursue recognised certifications when appropriate.
11. Seek internships and mentorship.

15.18 Artificial Intelligence and Cybersecurity

Artificial intelligence may assist with threat detection, fraud analysis, malware classification and security automation.

Attackers may also use artificial intelligence to create convincing fraudulent messages, automate attacks or generate misleading content. Human oversight remains important.

15.19 Cloud Computing

The growth of cloud services creates demand for professionals who understand cloud identity, configuration, data protection and shared responsibility.

15.20 Internet of Things

The increasing number of connected devices creates security challenges because many devices have limited processing power, weak default settings or long update cycles.

15.21 Operational Technology

Operational technology controls physical processes. A security incident in such an environment may affect equipment, safety, production or public services.

15.22 Blockchain Technology

Blockchain systems use distributed records and cryptographic techniques. They may provide useful capabilities, but applications built on them can still contain programming errors, stolen credentials, fraud or governance weaknesses.

15.23 Quantum Computing

Future large-scale quantum computers may affect some public-key cryptographic methods. Researchers are developing cryptographic methods intended to remain secure against quantum attacks.

15.24 Deepfakes

Deepfakes are artificial or manipulated audio, images or video that may convincingly imitate real people or events. They may be used for fraud, impersonation and misinformation.

15.25 Zero Trust

Zero trust is a security approach that avoids automatically trusting a user or device merely because it is inside an organisation’s network. Access decisions consider identity, device condition, context and least privilege.

15.26 Continuous Learning

Cybersecurity changes rapidly. Professionals must continually update their knowledge, practise responsibly and study new technologies, threats, standards and legal requirements.

15.27 Chapter Summary

Cybersecurity offers careers in monitoring, engineering, incident response, digital forensics, auditing, risk management, privacy, research and secure software development. Success requires technical knowledge, ethical conduct, communication and continuous learning. Emerging areas include artificial intelligence, cloud computing, connected devices, operational technology, blockchain, quantum-resistant cryptography and deepfake detection.

15.28 Review Questions

1. Mention eight cybersecurity careers.
2. What does a Security Operations Centre analyst do?
3. Differentiate between a penetration tester and a malicious hacker.
4. State five technical and five professional cybersecurity skills.
5. Discuss three ways artificial intelligence affects cybersecurity.
6. Why is continuous learning important in cybersecurity?

---

GENERAL COURSE SUMMARY

Cybersecurity protects computers, networks, applications, information and people from unauthorised access, attack, damage and disruption. Effective cybersecurity combines technology, people, policies, procedures, physical protection and responsible management.

The major security objectives are confidentiality, integrity and availability. Organisations must identify their assets, threats, vulnerabilities and risks before selecting appropriate security controls.

Common cyber threats include malware, phishing, account takeover, insider misuse, denial-of-service attacks and exploitation of poorly configured systems. Users can reduce their exposure through strong authentication, software updates, backups, careful internet use and prompt reporting.

Cybersecurity professionals must obey legal and ethical requirements. No system should be tested without proper authorisation. Nigerian students should understand the Nigeria Data Protection Act 2023 and the Cybercrimes Act 2015 as amended in 2024.

---

BASIC CYBERSECURITY TERMS

Access Control: A method of restricting access to authorised users or systems.

Asset: Anything valuable that requires protection.

Attack: An attempt to compromise a system or information.

Authentication: The process of verifying an identity.

Authorisation: The process of determining permitted actions.

Availability: Ensuring authorised users can access resources when needed.

Backup: A separate copy of information used for restoration.

Botnet: A group of compromised devices controlled by an attacker.

Cloud Computing: Provision of computing resources through a network.

Confidentiality: Protection of information from unauthorised disclosure.

Cryptography: The use of mathematical methods to protect information.

Cybersecurity: Protection of digital systems, networks, devices and information.

Data Breach: A security failure resulting in loss, alteration or unauthorised access to protected data.

Digital Signature: A cryptographic mechanism supporting authenticity, integrity and non-repudiation.

Encryption: Conversion of readable information into protected ciphertext.

Firewall: A system that controls network traffic according to security rules.

Hashing: A one-way transformation of data into a fixed-length value.

Incident: An event that threatens or violates security.

Integrity: Protection of information from unauthorised alteration or destruction.

Malware: Software intentionally created to cause harm or unauthorised access.

Multifactor Authentication: Authentication using two or more different categories of evidence.

Phishing: A deceptive message intended to steal information or cause unsafe action.

Privacy: The ability and right to control personal information and private life.

Ransomware: Malware that blocks access or encrypts information and demands payment.

Risk: The possibility that a threat will exploit a vulnerability and cause harm.

Social Engineering: Manipulation of people to reveal information or weaken security.

Threat: Anything capable of causing harm to an asset.

Threat Actor: A person or group responsible for a cybersecurity threat or incident.

Vulnerability: A weakness that may be exploited by a threat.

---

SUGGESTED PRACTICAL ACTIVITIES

1. Identify the information assets in a university computer laboratory.
2. Prepare a simple cybersecurity risk register.
3. Examine sample phishing messages and identify their warning signs.
4. Create a model password and account-management policy.
5. Demonstrate a Caesar cipher using paper and pencil.
6. Inspect basic security settings on an authorised computer.
7. Prepare a checklist for securing a wireless router.
8. Develop an incident-response plan for a stolen university laptop.
9. Classify sample security controls as administrative, technical or physical.
10. Conduct a classroom debate on ethical hacking and authorisation.

Practical Safety Rule

All practical activities must be performed on authorised systems, instructor-provided simulations, virtual machines or isolated laboratory networks. Students must not scan, intercept, access, modify or test real systems without written permission.

---

REFERENCES AND FURTHER READING

1. National Universities Commission. Core Curriculum and Minimum Academic Standards for Computing Programmes in Nigerian Universities.
2. National Institute of Standards and Technology. The NIST Cybersecurity Framework 2.0.
3. Federal Republic of Nigeria. Nigeria Data Protection Act, 2023.
4. Federal Republic of Nigeria. Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, as amended in 2024.
5. Nigeria Data Protection Commission. Official data-protection guidance and awareness materials.
6. Whitman, M. E. and Mattord, H. J. Principles of Information Security.
7. Stallings, W. and Brown, L. Computer Security: Principles and Practice.
8. Andress, J. The Basics of Information Security.
9. Pfleeger, C. P., Pfleeger, S. L. and Margulies, J. Security in Computing.
10. International Organization for Standardization. Information-security management standards and guidance.

---

END OF CYB 101: INTRODUCTION TO CYBERSECURITY