BIT303 Information Security: Unit-Wise Notes and Important Questions for the TU BIT Exam

Information Security (BIT303) sits in the 5th semester of the TU BIT program, and it is the BIT paper that students most often search for by code alone. That is because it is a mixed paper: half of it is cryptography with numericals (modular arithmetic, DES rounds, RSA key pairs, hash computations), and half of it is descriptive security (access control, malware, trust frameworks, risk management and cyber law). Students who prepare it as a theory paper lose the numerical marks; students who prepare only the cryptography lose the descriptive ones.

This guide goes through the ten units, names the questions that have repeated across the 2079 to 2082 papers, and gives a revision order. The full unit notes, solved past questions and flashcards are on the BIT303 subject page, with the official unit tree on the BIT303 syllabus page.

The ten units at a glance

Unit 1: fundamentals

Security concepts and terminology, threats, attacks and assets, risk assessment, security policy, the security auditing architecture, and attack trees. Three questions keep returning: explain threats, attacks and assets; describe the security auditing architecture (asked in 2080 and 2082 and in the undated collection); and define an attack tree, in 2082 paired with password-based authentication and in another paper with constructing an attack tree for internet banking login. Prepare the auditing architecture as a labelled diagram with a short description of each block, because it is the one that is drawn.

Unit 2: cryptographic foundations

This is the numerical unit. The syllabus covers number theory basics, the Euler totient function, the extended Euclidean algorithm, primality testing, finite fields and polynomial arithmetic, and the classical substitution and transposition ciphers. The papers have asked: define the Euler totient function with an example and find a GCD with extended Euclid (2080, 10 marks); write the Miller-Rabin algorithm and test 341 (2081) or 37 (2079); illustrate extended Euclid for 84 and 320; and add, subtract and multiply two polynomials over GF(7) (2082). Work each of these by hand until the table layout is automatic. For the ciphers, be able to distinguish substitution from transposition with one example each.

Unit 3: symmetric encryption

DES is the centre of the unit: its round operation, sub-key generation, S-box operation, and the encryption and decryption process. "Discuss how encryption and decryption is done in the DES algorithm" was a 10-mark question in 2081, the round operation and sub-key generation together were 10 marks in 2079, and the S-box with an example was 5 marks in 2081. The Hill cipher appears as a decryption numerical with a 2x2 key matrix (2079). For the Hill cipher you need the matrix inverse modulo 26, so revise modular inverses from unit 2 alongside it.

Unit 4: asymmetric encryption

RSA key generation, encryption and decryption with a worked example, and the Diffie-Hellman key exchange. RSA numericals have used p = 11 and q = 7 (2081), and the algorithm alone was asked for 5 marks in 2080 and inside a 10-mark question in 2079. Diffie-Hellman with a prime and a primitive root (2080 used 23 and 9; 2079 asked the protocol with an example) is the other regular. Both are easy marks if you have done five examples; both are lost entirely if you have done none.

Unit 5: hash functions and message authentication

Hash function properties, MD5, SHA-1 with its padding scheme, SHA-2, the purposes of message authentication, and digital signatures. This unit has produced a 10-mark question in every paper from 2079 to 2082: how MD5 produces a 128-bit digest (2079), the role of hash functions and the SHA-1 process (2080), how SHA-2 generates a value (2081, 5 marks) and the purposes of message authentication with the MD5 mechanism (2082). Learn one algorithm's structure in full (MD5 or SHA-1), the padding rule, and the four purposes of message authentication, and prepare the digital signature question as a diagram.

Unit 6: authentication and access control

The most heavily examined descriptive unit. Topics: authentication systems and their components, challenge-response, password-based authentication and dictionary attacks, biometrics, two-factor authentication, access control principles, subjects, objects and access rights, and role-based versus attribute-based access control. Two-factor authentication was asked in 2079, 2080 and 2082. Access control models were asked every year, including the difference between role-based and attribute-based control (2082), subjects, objects and access rights with examples (2081, 10 marks), and the access control principles (2080). Online versus offline dictionary attacks (2081) and biometric authentication (2079) complete the set. One past question gives a set of users and files and asks for the access matrix, so practise drawing one.

Unit 7: malware and cyber threats

Definition and types of malicious software, viruses, worms and Trojan horses, zombies, bots and rootkits, phishing, countermeasures and audit trail analysis. Every paper has a malware types question: differentiate virus, worm and Trojan (2079), describe any two types (2080), define zombies, rootkits and Trojans (2081), and define malware and explain its types for 10 marks (2082). Countermeasures with audit trail analysis was 5 marks in 2080. A comparison table of virus, worm and Trojan by propagation, host dependence and payload is the fastest way to score here.

Unit 8: trust frameworks and identity management

Trust frameworks, identity providers, relying parties and attribute providers, the Open Identity Trust Framework, and the three failures interception, repudiation and incapacitation. The roles of the three parties in the Open Identity Trust Framework (2081) and the definitions of interception, repudiation and incapacitation with examples (2081) are the two questions to prepare, plus "what is a trust framework" as a short part (2080).

Unit 9: security risk management

Risk definition and analysis, the aspects of a successful risk assessment, risk treatment methods, and logging. Asked as "what is security risk assessment and what are the aspects of a successful one" (2079), "discuss the methods of risk treatment" (2081) and "how is security risk analysis done" (undated). The four treatment options, avoid, reduce, transfer and accept, with one example each, is the standard answer.

Unit 10: legal and ethical issues

Cybercrime versus computer crime, intellectual property, copyright and patents, ethical issues in computing, and the status of cyber law in Nepal. The cybercrime versus computer crime distinction was asked in 2080 and 2082, ethical issues in 2079 and 2082, copyright versus patent in the undated collection, and the status of cyber law in Nepal in 2081. For the Nepal question, describe the legal position in general terms (the governing act and the kinds of offence it covers) without quoting figures you cannot verify.

A revision order that follows the marks

1. Units 2, 3 and 4 together, as a numerical block: Euler totient, extended Euclid, Miller-Rabin, GF(7) polynomials, DES structure, Hill cipher, RSA and Diffie-Hellman. Two days of worked examples.
2. Unit 5: one hash algorithm in full, padding, purposes of authentication, digital signature diagram. One day.
3. Units 6 and 7: access control models, 2FA, dictionary attacks, biometrics, malware table, countermeasures. One day.
4. Units 1, 8, 9 and 10: the short descriptive questions listed above. One day.

The important questions view ranks these by frequency across the papers on the site. Students who also study the CSIT program will find the cryptography units overlap heavily with Cryptography (CSC327), whose worked ciphers and RSA examples are useful extra practice. For the rest of the semester, the BIT syllabus guide lists every subject with what its paper asks.