Security Aspects Class 12 Notes: Malware, Firewall and Network Threats

Revising Security Aspects (Class 12 Computer Science, Chapter 12)? This page condenses the whole chapter into one place: every malware type, the five antivirus methods, the firewall, cookies, hackers and the network threats — with comparisons, original practice scenarios and the answer structure each exercise needs.

These notes follow the 2026-27 session. Page references point to the rationalised NCERT Class XII Computer Science textbook (pp. 223–240), which you can verify or download from the official NCERT textbook portal. Reference: NCERT Class 12 Computer Science textbook, chapter Security Aspects.

Security Aspects at a Glance: What Chapter 12 Covers

Chapter 12 opens with one observation: a computer with no link to an external device or computer faces no network threats — but total isolation is not practical in a connected world.

Network security is therefore the protection of your device and your data from illegitimate access or misuse (NCERT, p. 223), and the whole chapter is a catalogue of threats and the defences against them.

The nine topic blocks below are the chapter’s full scope; jump to any weak spot from the table of contents above.

Running through every block is one idea: each connection is a possible doorway for attack, so every defence controls what crosses the boundary between your device and the outside. This page sits in the CBSE notes library — browse it alongside the other Class 12 notes or directly from the Class 12 Computer Science notes hub.

Core Malware: Viruses, Worms, Ransomware and Trojans

Malware (MALicious softWARE) is any software written with the intention to damage hardware, steal data, or cause trouble to the user (NCERT, p. 224). Four families form the chapter’s core.

Virus: code that inserts itself into an executable file. It stays dormant until the infected file is opened, so replication needs human triggering. Fred Cohen coined the term in 1985, borrowing the behaviour of a biological virus — it spreads on contact with another system (NCERT, p. 224). Famous examples: ILOVEYOU, MyDoom and Stuxnet.

Worm: a standalone program. It needs no host file and no human trigger — it replicates on its own and spreads from computer to computer over the network (NCERT, p. 225). Examples include Code Red and the Morris Worm.

Ransomware: malware that targets user data. It either blocks access to the data or encrypts it, then demands a ransom payment. In May 2017, WannaCry infected almost 200,000 computers across 150 countries, encrypting data and demanding payment in Bitcoin (NCERT, p. 225). Figure 12.1 shows a ransomware attack, in which data access is blocked or encrypted and a ransom is demanded.

Trojan: named after the wooden horse of Troy. The ancient Greeks could not enter Troy by force, so they offered the king a big wooden horse with soldiers hidden inside.

A trojan does the same digitally: it looks like legitimate software, tricks the user into installing it, and then acts much like a virus or worm — it can even open backdoors for attackers. Crucially, a trojan does not self-replicate; it spreads through user interaction such as opening an email attachment (NCERT, p. 226).

Figure 12.2 pictures that wooden horse, and the parallel is the whole point: just as soldiers hid inside the “gift”, hidden malicious code hides inside software that looks trustworthy.

The next section completes the seven-member malware family and compares all seven in one table.

More Malware: Spyware, Adware, Keyloggers and the Keyboard Defence

Spyware gathers information about a person or organisation without the user’s knowledge and sends it to an external entity. It typically tracks internet usage, and it can also capture bank account details, login IDs and passwords (NCERT, p. 226).

Adware exists to generate revenue for its developer. It shows advertisements through pop-ups, web pages or installation screens, earning money by displaying ads or through pay-per-click charges. It is usually annoying but harmless — yet it often paves the way for other malware by displaying unsafe links as advertisements (NCERT, pp. 226–227).

Keylogger is malware (or even hardware) whose whole job is to record the keys a user presses. It logs daily keyboard use and can send the logs to an external entity, revealing passwords, emails and private conversations. The hardware form is a thin transparent keyboard overlay placed on top of the real keyboard (NCERT, p. 227).

The chapter’s defence against keyloggers is the online virtual keyboard. The on-screen keyboard of an operating system uses a fixed QWERTY layout, which sophisticated keylogger software can predict; an online virtual keyboard randomises the key layout every time it is used, so even if keystrokes are recorded, it is very difficult to tell which key was pressed (NCERT, pp. 227–228).

Figure 12.3 shows the fixed QWERTY arrangement of the on-screen keyboard — predictable and therefore exploitable. Figure 12.4 shows the online virtual keyboard with its scrambled layout, reshuffled at each use.

That is why the online virtual keyboard is the safer choice when signing in from an unknown computer. Here is the whole malware family side by side — the fastest way to revise all seven:

To recall the seven names in the chapter’s order, remember: “Vicious Worms Really Try Stealing All Keys” — Virus, Worm, Ransomware, Trojan, Spyware, Adware, Keylogger.

How Malware Spreads, Warning Signs and Prevention

Malware reaches a computer through four distribution channels (NCERT, p. 228):

• Downloaded from the Internet — often disguised as “free stuff”; the user installs it unintentionally.
• Spam email — unsolicited messages carrying hyperlinks or attachments that contain malware.
• Removable storage devices — pen drives, SSDs, music players and phones carry malware to the next machine they are plugged into.
• Network propagation — how worms travel from one computer to another through a network connection.

Signs of an infection (NCERT, pp. 228–229):

• frequent pop-up windows prompting you to visit a site or install software;
• your browser’s default homepage has changed;
• mass emails are being sent from your email account;
• the computer is unusually slow and crashes often;
• unknown programs start when you turn the computer on;
• programs open and close by themselves;
• storage space suddenly disappears; random messages, sounds or music appear;
• files or programs appear or disappear without your knowledge.

Prevention — four hygiene buckets. The chapter’s original prevention list (NCERT, pp. 229–230) is easier to memorise regrouped this way:

If you want the textbook’s original wording of the list, it appears in full on pp. 229–230.

How Antivirus Software Detects Malware: Five Methods

Antivirus software began as a virus remover (hence the name) and evolved into anti-malware that prevents, detects and removes a wide range of threats (NCERT, p. 230). It identifies malware in five ways.

The update warning students often miss: because the VDF must be updated continuously, a skipped update leaves the system effectively unprotected (NCERT, p. 230).

Spam, HTTP vs HTTPS, and the Firewall

Spam is unwanted bulk content sent on digital platforms — messaging, forums, chat and especially email. Organisations build mailing lists and repeatedly send advertisement or invitation emails, cluttering inboxes and sometimes tricking users into buying something or downloading malware.

Email services filter spam automatically, and a user can mark an undetected unsolicited mail as spam so similar mail stays out of the inbox (NCERT, p. 231).

HTTP vs HTTPS. Both are protocols — sets of rules — that govern how data travels between a client web browser and servers over the World Wide Web (NCERT, p. 231). The difference is encryption.

• HTTP sends information as it is, with no scrambling, so any attacker on the path can read it. It is fine for public information such as news portals and blogs, but risky for personal or banking data (NCERT, pp. 231–232).
• HTTPS encrypts the data before transmission and decrypts it at the receiver. HTTPS websites require an SSL digital certificate (NCERT, p. 232).

Think of HTTP as a postcard: anyone who handles it on the way can read the message. HTTPS is a sealed envelope: the message is encrypted, and only the receiver can open and read it.

The habit the chapter wants you to form is to look for the https:// prefix at the start of the address before entering banking, personal or other sensitive information (NCERT, p. 231).

Extra caution: HTTPS encrypts the channel, but it does not prove the website itself is honest. The lock icon only shows that the connection to that address is protected — still verify the address you are sending data to.

Firewall. A firewall is a network security system that protects a trusted private network from unauthorised traffic coming from an untrusted outside network (NCERT, p. 232). It works on predefined security rules, continuously monitoring and controlling incoming and outgoing traffic, and it acts as the first barrier against worms moving across networks.

One working example: a school LAN can be configured so students cannot access the finance server, while the accountant can (NCERT, pp. 232–233). Figure 12.5 shows the firewall’s position — a barrier between a trusted private network and an untrusted outside network, checking every packet that tries to cross. It can be implemented in software, hardware, or both.

There are two firewall types (NCERT, p. 233):

• Network firewall — placed between two or more networks; monitors inter-network traffic.
• Host-based firewall — installed on a single computer; monitors traffic to and from that computer.

The chapter’s Think and Reflect box asks whether a firewall could keep students focused on a project instead of surfing the Internet — a planning question the Project Based Learning notes build on. Firewalls and HTTPS police the same traffic you model in the Computer Networks notes, so keep that chapter’s vocabulary handy.

Cookies: Storage, Types and the Threats They Bring

A cookie is a small file or data packet that a website stores on the client’s computer; only the website that created it can edit it. The name comes from the Unix programmers’ term “magic cookie” — a packet of data a program receives and later sends back unchanged (NCERT, p. 233).

What sites use cookies for: keeping shopping-cart items, storing login credentials and language preferences, remembering search queries and recently viewed pages, and auto-filling your name, address and date of birth in online forms (NCERT, p. 233).

Two main types (NCERT, p. 233):

• Session cookies — track the current session and terminate it on a time-out. If you leave an e-banking page open, it closes automatically after the time-out.
• Authentication cookies — let a website know you are already logged in, so you need not sign in again on every page of the same site.

Threats (NCERT, p. 234). Cookies are usually safe and improve browsing, but:

• some malware disguises itself as a cookie — for example supercookies;
• zombie cookies get recreated even after the user deletes them;
• third-party cookies can share user data without consent — search for an item and the same item starts appearing as advertisements on other sites.

So be careful about which websites you allow to create and store cookies on your machine (NCERT, p. 234).

Hackers and Crackers: White, Black and Grey Hats

Hackers and crackers have deep knowledge of computer systems, operating systems, networks and programming, and both search for loopholes and vulnerabilities to reach unauthorised information (NCERT, p. 234). What separates them is intent.

• White hats (ethical hackers) use their skills to find and fix security flaws. Organisations hire them to check systems, and technically they work against black hats (NCERT, p. 234).
• Black hats (crackers) use their knowledge unethically, break the law and disrupt security by exploiting the same flaws (NCERT, p. 234).
• Grey hats sit in the neutral middle: they hack systems as a challenge or for fun, without monetary or political gain (NCERT, pp. 234–235).

A hacktivist is a hacker whose aim is political or social change (NCERT, p. 234).

Network Security Threats: DoS, DDoS, Intrusion, Snooping and Eavesdropping

Denial of Service (DoS). An attacker overloads a resource — a website, an email server, network storage — with illegitimate requests, so authorised users can no longer reach it. The flood of traffic makes the resource appear busy (NCERT, p. 235). Three recovery facts matter:

• A DoS attack that crashes a server can be recovered by restarting it.
• A flooding attack is hard to recover from, because genuine legitimate requests are mixed into the flood.
• Simple DoS can be countered by blocking packets from the single attacking source.

Distributed Denial of Service (DDoS). Now the flood comes from compromised computers (zombies) spread over the globe or a large area. The attacker installs malicious software called a Bot on each zombie to control it, and the activated network of zombies is a bot-net. Because the attack arrives from many distributed locations, DDoS is very difficult to resolve (NCERT, p. 235).

Intrusion problems. Network intrusion is any unauthorised activity on a computer network (NCERT, p. 236). Three problems beyond DoS:

• Asymmetric routing — the attacker sends intrusion packets through multiple paths to bypass the network’s intrusion sensors.
• Buffer overflow attacks — the attacker overwrites memory areas of network computers with code that executes later, when the programming-error overflow occurs; the executed code can launch a DoS or open network access.
• Traffic flooding — the intrusion detection system itself is flooded with packets until it can no longer monitor properly; in the congestion, the hacker enters undetected.

Snooping (also called sniffing) means secretly listening to a conversation; in networking it is the secret capture and analysis of network traffic. The snooping tool taps the channel, analyses the packets, reproduces exactly the same traffic and places it back, so nothing looks wrong — unencrypted data is therefore vulnerable (NCERT, p. 236).

Snooping is not always an attack: network administrators use it for troubleshooting, and some switches include a SPAN (sniffer port analyser) port function for it (NCERT, p. 237). A related utility, URL snooping, downloads and stores a web stream as a file for later viewing — the technique online video downloaders use.

The packets a snooper analyses are the same traffic concepts you study in the Data Communication notes.

Eavesdropping. Unlike snooping, eavesdropping is the unauthorised real-time interception or monitoring of private communication between two entities. The targets are private channels such as VoIP phone calls, instant messages, video conferences and fax transmissions. The old telephone-line version was wiretapping, and today rootkit malware can turn a laptop’s microphone or camera into an eavesdropping device (NCERT, p. 237).

The chapter’s own analogy: eavesdropping is hearing a live conversation through a hidden microphone, while snooping is copying a letter, keeping the copy, and sending the original on to its address (NCERT, pp. 237–238).

Figure 12.6 draws the eavesdropping situation: a third party sits between the two communicating ends and captures the data stream as it flows, in real time. Unencrypted traffic makes both snooping and eavesdropping easier — which is exactly why the chapter pushes HTTPS for anything sensitive.

Key Terms Table: Quick Definitions for Revision

One lookup table for a final scan — every row is exam-dense, so nothing here repeats the longer explanations above.

The Chapter’s Comparison Box (No Formulas Here)

Honest note first: this chapter contains no mathematical formulas and no numerical problems. What play the role of formulas are definition and comparison pairs — the rows below are worth memorising exactly because they can be asked in that form.

1. HTTP vs HTTPS (NCERT, pp. 231–232):

2. DoS vs DDoS (NCERT, p. 235):

3. Snooping vs Eavesdropping (NCERT, pp. 236–238):

Worked Scenarios: Identify the Malware or Attack

These three original scenarios practise exactly what the chapter’s exercises ask for: recognise the symptom, name the threat, choose the defence. Concept first, then numbered steps.

Scenario A — Identify the malware (signs and distribution)

Scenario B — DoS or DDoS? (original numbers)

Scenario C — Captured login packets (snooping and the HTTPS defence)

Common Mistakes Students Make in Security Aspects

Each row below is a strict error-to-correction pair: what students commonly write, the correct rule, and a quick way to check your own answer.

How to Write Complete Answers to the Chapter Exercise

The chapter’s seventeen exercises (NCERT, p. 240) are all concept questions — definitions, differentiations, lists and short notes; none is a numerical. The table below maps each question to the structure a complete written answer needs. This is structure guidance only, not a worked solution set.

General rule for all seventeen: answer in your own words, reuse the exact terms the question uses (host file, self-replicate, bot-net, real-time), and in itemised answers give about one line of explanation per point. A definition question needs a definition plus an example; a differentiation needs named criteria, not just two separate descriptions.

One-Page Revision Recap: The Night Before

If you have only minutes left, this is the revision layer of the page — short notes that compress the whole chapter into one scan.

• Malware family (7): virus (host file + human trigger), worm (standalone, self-replicates), ransomware (locks or encrypts data, demands payment), trojan (disguised software, no self-replication, backdoors), spyware (secret data theft), adware (ad revenue; gateway to other malware), keylogger (records keys; software or hardware overlay).
• Antivirus methods (5): signature-based (VDF), sandbox, data mining, heuristics, real-time protection. An outdated VDF equals no protection.
• Web security: spam is unwanted bulk content; HTTP is plain (postcard), HTTPS is encrypted (sealed envelope) and needs an SSL certificate; the firewall protects a trusted private network, can be software, hardware or both — network firewall vs host-based firewall.
• Cookies: site-stored data files (cart, login, preferences, auto-fill); session cookies time out, authentication cookies remember logins; watch out for supercookies, zombie cookies and third-party sharing.
• Hackers: white hats fix flaws (hired), black hats break the law, grey hats hack for fun; a hacktivist wants political or social change.
• Network threats: DoS from one source (blockable); DDoS from a bot-net of zombies (very difficult); intrusion problems — asymmetric routing, buffer overflow, traffic flooding; snooping stores traffic for analysis, eavesdropping intercepts in real time.

The four must-know lists:

• the seven malware names and their one-line behaviour;
• the five antivirus methods;
• the two firewall types;
• the three comparison pairs — HTTP vs HTTPS, DoS vs DDoS, snooping vs eavesdropping.

Security Aspects: Frequently Asked Questions

What is the main difference between a virus, a worm and a trojan?

A virus needs an executable host file and a human trigger (opening the file) to replicate; a worm is a standalone program that replicates on its own and spreads over the network; a trojan looks like legitimate software, does not self-replicate, and spreads only through user interaction such as email attachments (NCERT, pp. 224–226).

Why is an online virtual keyboard safer than the on-screen keyboard?

Because the online virtual keyboard randomises the key layout every time it is used, while the operating system’s on-screen keyboard uses a fixed QWERTY layout that sophisticated keylogger software can exploit (NCERT, pp. 227–228).

How is a DDoS attack different from a DoS attack?

A DoS attack floods a resource from a single source and can be countered by blocking that source; a DDoS attack floods from many distributed compromised computers (zombies) controlled through bots, so there is no single source to block and it is very difficult to resolve (NCERT, p. 235).

Are cookies always dangerous?

No. Cookies are small files a website stores on your computer to improve browsing (cart items, login state, preferences) and usually do not infect the machine; the dangers are specific — supercookies disguised as malware, zombie cookies that return after deletion, and third-party cookies sharing data without consent (NCERT, pp. 233–234).

Does HTTPS make a website completely safe?

No. HTTPS encrypts the channel so data cannot be read in transit, but it does not prove the website itself is honest; always verify the address you are entering sensitive information into (NCERT, pp. 231–232).

What is the difference between snooping and eavesdropping?

Snooping (sniffing) is the secret capture and analysis of network traffic and can be stored for later analysis; eavesdropping is the unauthorised real-time interception of a private communication such as a VoIP call or video conference (NCERT, pp. 236–238).

Reference: NCERT Class 12 Computer Science textbook, chapter Security Aspects.