1
Seat No.: Enrolment
GUJARAT TECHNOLOGICAL UNIVERSITY
MBA SEMESTER 3 EXAMINATION WINTER 2018
Subject Code: 3539254 Date:12/12/2018
Subject Name: Cyber Security and IT Governance (CSITG)
Time:10:30 AM To 01:30 PM Total Marks: 70
Instructions:
1. Attempt all questions.
2. Make suitable assumptions wherever necessary.
3. Figures to the right indicate full marks.
Q.1

Define the following term briefly:
14
Forgery Social Engineering Salami Attack (d)Backdoors Identify Theft Email Spoofing Password Sniffing
Q.2

Explain the possible attacks on cell phones with examples
07

How are cyber crimes classified? Explain with example.
07
OR

What is cyber stalking? How stalking works?
07
Q.3

Define phishing. Explain spam emails and hoax emails.
07

State the salient features of the Indian IT Act .
07
OR
Q.3

Describe the specific challenges that exist in India with regard to the law and cyber crime scenario in India.
07

Discuss how criminals plan the attack?
07
Q.4

Who are the stakeholders in IT Governance and what are their requirements?
07

What is Botnet? How do viruses get disseminated? Explain with diagram.
07
OR
Q.4

What is IT Governance? Why is IT Governance important?
07

Discuss digital signatures and Indian IT Act.
07
2
Q.5
SONY.SAMBANDH.COM
India saw its first cyber crime conviction recently. It all began after a complaint was filed by Sony India Private Ltd, which runs a website called www.sony-sambandh.com, targeting Non Resident Indians. The website enables NRIs to send Sony products to their friends and relatives in India after they pay for it online. The company undertakes to deliver the products to the concerned recipients. In May 2002, someone logged onto the website under the identity of Barbara Campa and ordered a Sony Colour Television set and a cordless head phone. She gave her credit card number for payment and requested that the products be delivered to Arif Azim in Noida. The payment was duly cleared by the credit card agency and the transaction processed. After following the relevant procedures of due diligence and checking, the company delivered the items to Arif Azim.
At the time of delivery, the company took digital photographs showing the delivery being accepted by Arif Azim. The transaction closed at that, but after one and a half months the credit card agency informed the company that this was an unauthorized transaction as the real owner had denied having made the purchase. The company lodged a complaint for online cheating at the Central Bureau of Investigation which registered a case under Section 418, 419 and 420 of the Indian Penal Code. The matter was investigated into and Arif Azim was arrested. Investigations revealed that Arif Azim, while working at a call centre in Noida gained access to the credit card number of an American national which he misused on the company's site.
The CBI recovered the colour television and the cordless head phone. In this matter, the CBI had evidence to prove their case and so the accused admitted his guilt. The court convicted Arif Azim under Section 418, 419 and 420 of the Indian Penal Code this being the first time that a cybercrime has been convicted. The court, however, felt that as the accused was a young boy of 24 years and a first-time convict, a lenient view needed to be taken. The court therefore released the accused on probation for one year. The judgment is of immense significance for the entire nation. Besides being the first conviction in a cybercrime matter, it has shown that the Indian Penal Code can be effectively applied to certain categories of cyber crimes which are not covered under the Information Technology Act 2000. Secondly, a judgment of this sort sends out a clear message to all that the law cannot be taken for a ride.

How the cyber crime can lead to defamation for country and what measures can be sought out to stop it?
07

What needs to be amended in IT Governance? How it can be done?
07
3
OR
Q-5.

Based on case discriminate between traditional and modern techniques of credit card fraud.
07

Under the Indian IT Act, is there a legal protection available for "personal data" or "sensitive personal data"? Explain how.
07