Cyber Security and the Electronic Transactions Act, 2063

Security basics

Security protects the CIA triad: confidentiality, integrity and availability of information.

Malware

Phishing and social engineering

Social engineering tricks people rather than breaking technology. Phishing uses authentic-looking but fake emails or websites to obtain passwords, PINs or card details. Variants are vishing (voice calls) and smishing (SMS). A bank never asks for a PIN or OTP.

Authentication

Three kinds of factor:

1. Something you know: password, PIN
2. Something you have: card, phone receiving an OTP, token
3. Something you are: fingerprint, face (biometrics)

Two-factor authentication combines two different kinds.

Encryption and digital signatures

• Symmetric encryption: the same secret key encrypts and decrypts.
• Asymmetric encryption: a key pair is used, a private key kept secret and a public key shared with everyone.
• A hash function produces a fixed digest of a message; any change to the message changes the digest.
• A digital signature is created with the signer's private key and verified with the signer's public key.

Backups

A full backup copies everything; an incremental backup copies changes since the last backup of any kind; a differential backup copies changes since the last full backup. Keep one copy off-site.

Electronic Transactions Act, 2063

Authenticated on 22 Mangsir 2063 and deemed to have commenced on 24 Bhadra 2063 (Section 1). It applies throughout Nepal and to any person anywhere who commits an offence against it.

Key provisions

• Section 2: an asymmetric crypto system creates a secure key pair; the private key creates a digital signature and the public key verifies it.
• Section 3: a subscriber may authenticate an electronic record by digital signature, using an asymmetric crypto system and a hash function.
• Sections 4 and 5: legal recognition of electronic records and of digital signatures.
• Sections 13 and 14: the Government of Nepal appoints or designates the Controller, who licenses and supervises Certifying Authorities.
• Section 15: nobody may act as a Certifying Authority without a licence. Only a Certifying Authority issues digital signature certificates (Section 30).

Offences relating to computer (Chapter 9)

A repeat offence under Section 47 draws one and a half times the previous punishment. Section 55 covers acts done outside Nepal when the computer or network concerned is in Nepal.

Tribunal: Section 60 provides for a three-member Information Technology Tribunal with a law member, an information technology member and a commerce member; the law member is the chairperson. An appeal lies to the Appellate Tribunal within 35 days. Until the Tribunal is formed, the District Court concerned hears these cases.

Exam pointers

• A worm spreads by itself; a virus needs a host file; ransomware encrypts and demands payment.
• Private key signs, public key verifies.
• The Controller licenses Certifying Authorities; Certifying Authorities issue certificates to subscribers.
• Sections 44, 45 and 46 share the 3 years and Rs 2 lakh ceiling; Section 47 is Rs 1 lakh and 5 years.
• An accomplice gets half the punishment (Section 54).
• IT Tribunal: three members, law member chairs, appeal within 35 days.