Ravindra BagaleCourses & study guides मराठी Track your progress

34. Indian Cyber Law and Cyber Crime Awareness

By Last updated:

Chala mitrano, Chapter 18 madhe aapan IT Act che mukhya sections (43, 66, 66B–66F) ani permission cha niyam baghitla. Ata he chapter tyachya pudhe jata: company sathi kayde (CERT-In che 6 taas, DPDP Act), samanya lokansathi cyber crime (UPI fraud, "digital arrest", sextortion, job scam), ani fasavnuk zali tar step-by-step kay karaycha. Trainer, SOC analyst kiwa samanya nagrik – sagalyansathi he upyogi aahe. Ek mahatvachi soochna: kayde badaltat, mhanun pratyek number ani section official source varun tapasa. Samjla ka? Chala!

What you will learn in this chapter

  • More IT Act sections: obscenity, privacy breach, interception, intermediaries
  • New criminal laws (BNS, BNSS, BSA) and electronic evidence
  • CERT-In 2022 directions: 6-hour reporting and log retention for organisations
  • The Digital Personal Data Protection Act, 2023 in simple terms
  • Common cyber frauds in India and how to spot them
  • What a victim should do, step by step, and how to file a complaint

Legal information, not legal advice

This chapter explains the law for learning. Section numbers, penalties and rules change. Always check the current official text on indiacode.gov.in, meity.gov.in, cert-in.org.in and cybercrime.gov.in, and consult a lawyer for a real case.

Concepts in this chapter

  1. 34.1More IT Act Sections You Should Know
  2. 34.2New Criminal Laws and Electronic Evidence
  3. 34.3CERT-In Directions for Organisations
  4. 34.4The Digital Personal Data Protection Act, 2023
  5. 34.5Common Cyber Frauds in India and How to Spot Them
  6. 34.6What to Do If You Are a Victim
  7. 34.7Red vs Blue, Project and Real Incidents
  8. 34.8ISO 27001

The chapter recap is at the end of the last concept page.

Chapter 34: Indian cyber law and awareness — practice tasks

Open chapter lessons · Full guided lab: cyber crime reporting checklist 1930 (not repeated here)

34.1 Know where to report

EasyIT

Why: Speed matters after fraud.

What: Write the main India reporting channels.

How:

  1. National Cyber Crime Portal: cybercrime.gov.in
  2. Helpline 1930 for financial fraud.
  3. Local police cyber cell.

Expected output: All three written with one example each.

Hint

Save a screenshot of the portal home page.

Answer / how to check
  1. You can name 1930 without looking it up.

34.2 IT Act section match (paper)

MediumBanking

Why: Interviews ask basic law.

What: Match section to meaning.

Data file: law.csv

SectionMeaning (fill)
66CIdentity theft
66DCheating by personation
43Unauthorised access / damage

About this file: Awareness table. Each row is one IT Act section. Columns: Section; Meaning to fill.

How:

  1. Read each row.

Expected output: 66C identity theft; 66D cheating by personation; 43 damage/unauthorised access.

Hint

This is awareness, not legal advice.

Answer / how to check
  1. All three matched.

34.3 Evidence pack for a UPI fraud drill

EasyRetail

Why: Good evidence helps the bank and police.

What: List what you would save in a drill.

How:

  1. Fake SMS, UPI reference, bank SMS, call recording note, timeline.
  2. Hash screenshots with sha256sum.

Expected output: A folder with ≥4 items + hashes.txt.

Hint

Do not use real victim data.

Answer / how to check
  1. hashes.txt has one line per file.

Extended teaching notes

Why this lesson matters

Part 11 turns tool skills into professional defensive practice: web risks, cloud, SOC work, hardening, cryptography, Indian law and careers. Every example below stays inside systems you own or public teaching material.

Indian company (sample data)

Suppose we are a junior security engineer at an Infosys or TCS client project. You take this lesson's checklist, map it to three production services (for example a Spring Boot API, a Node.js portal and a Python job), and open tickets with evidence and owners.

Global practice

Follow public guidance from OWASP, CERT-In, CISA and cloud provider Well-Architected / security pillars. Cite them in reports.

Everyday analogy

A cricket team that only practises hitting but never fielding loses matches. Offence skills in a lab exist to improve fielding in real systems.

Apply across stacks

Wherever code appears, ask the same questions.

Java / Spring Boot

Parameterise queries, encode output, limit Actuator, patch dependencies.

.NET

EF Core parameters, HTTPS, Data Protection API, patch NuGet.

Node.js

helmet, parameterized SQL, npm audit, lockfiles.

Python

ORM, autoescape, pip-audit, Bandit.

Go / PHP / Ruby

Safe templates, prepared statements, govulncheck / composer audit / Brakeman.

nginx / Apache / Tomcat

Hide versions, TLS, least-open ports.

MySQL / PostgreSQL / MongoDB / Redis

No public ports, auth on, least-privilege users.

AWS / Azure / GCP

Roles not keys, private data stores, cloud logs on.

Defender worksheet

  1. Write a 5-line summary.
  2. Name one related public breach or advisory.
  3. Practise one safe command on a lab you own.
  4. Write the fix for a teammate.

Recap

  • Permission first.
  • Fix over spectacle.
  • Evidence in notes.

Defender's worksheet (do this today)

  1. Write the lesson title and date.
  2. List three owned systems where it applies.
  3. Run one safe lab check and paste evidence.
  4. Write a two-sentence fix for a teammate.
  5. Note one CERT-In or CISA advisory that relates (title + date).

Indian workplace (sample)

At a Wipro or LTIMindtree client SOC, turn this lesson into one playbook step with an owner and a due date.

Global practice

Compare your notes with OWASP, CIS Benchmarks or a cloud Well-Architected security question. Write the overlap in five lines.

Family test

Explain the risk and the fix without jargon. If a parent or sibling can repeat the warning, you are ready to teach juniors.

Common mistakes

  • Skipping permission.
  • Tool collecting without fixing.
  • Publishing lab screenshots that contain secrets.
  • Treating encoding as encryption.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.

Key terms for this page

  • Control: a safeguard (patch, config, process).
  • Finding: a weakness with evidence.
  • Remediation: the fix and how you verified it.
  • Scope: systems you are allowed to touch.
  • Least privilege: only the access required for the task.
  • Defence in depth: several controls in layers.

Mini case study

Suppose we are a junior engineer at Zoho or Freshworks (sample data). A weekly review asks each person to present one control from their area. You pick a control from this lesson, show a before/after screenshot from a lab, and list the production ticket you would open. That habit builds both skill and credibility.