1. Generations of Computers and their Characteristics (6 marks)

The development of computers is divided into five generations, each marked by a major change in the hardware technology used.

First Generation (1940–1956) — Vacuum Tubes

• Main electronic component: vacuum tubes; examples: ENIAC, EDVAC, UNIVAC-I.
• Very large in size, consumed huge electric power and produced a lot of heat.
• Very slow, unreliable and extremely expensive; used machine language and punched cards for input.

Second Generation (1956–1963) — Transistors

• Transistors replaced vacuum tubes; examples: IBM 1401, IBM 7094, CDC 1604.
• Smaller, faster, cheaper and more reliable than the first generation; less heat and less power consumption.
• Used assembly language and high-level languages such as FORTRAN and COBOL; magnetic core memory and magnetic tape/disk were introduced.

Third Generation (1964–1971) — Integrated Circuits (IC)

• Many transistors packed on a single IC chip (SSI/MSI); examples: IBM System/360, ICL 1900.
• Much smaller, faster and more reliable; keyboard and monitor used for input/output.
• Operating systems introduced, supporting multiprogramming and time-sharing; high-level languages became common.

Fourth Generation (1971–1980) — Microprocessors (LSI/VLSI)

• Thousands of components on a single chip; examples: Intel 4004, Apple-II, IBM PC.
• Microcomputers became cheap, portable and available to the general public; GUI and mouse introduced.
• Large storage (hard disk, floppy, optical disk), computer networks and the internet began to develop.

Fifth Generation (1980–present) — Artificial Intelligence

• Based on ULSI, parallel processing and superconductors; examples: IBM Watson, modern laptops and smartphones.
• Focus on artificial intelligence, natural language processing, voice recognition, robotics and expert systems.
• Very high speed, huge memory, multimedia capability and wide use of wireless networks and cloud computing.

2. Difference between System Software and Application Software (4 marks)

Conclusion: System software is the base on which application software runs; both are complementary — one manages the machine, the other serves the user's task.

CIA Triad in Computer Security

Introduction

The CIA triad — Confidentiality, Integrity and Availability — is the fundamental model that guides information security in any organization. It states that the security of information and information systems rests on three core principles. A weakness in any one of them weakens the overall security posture.

---

1. Core Principles of the CIA Triad (6 marks)

(a) Confidentiality

Meaning: Confidentiality ensures that information is accessible only to those who are authorised to view it. It protects data from unauthorized disclosure, whether during storage, transmission or processing.

Example: In the Employees Provident Fund (EPF), a member's contribution ledger, KYC details and bank account number must be visible only to the member and authorized EPF staff. If this data is leaked to an outsider or posted publicly, confidentiality is breached.

Mechanisms used: Encryption (AES, TLS/HTTPS), passwords and multi-factor authentication, role-based access control (RBAC), data classification and labelling, secure disposal of media, and non-disclosure agreements.

(b) Integrity

Meaning: Integrity ensures that data is accurate, complete and unaltered unless changed by an authorized person through an authorized process. It protects against accidental modification, corruption and malicious tampering.

Example: When an EPF member's monthly contribution of Rs 10,000 is posted to the ledger, it must remain exactly Rs 10,000. If a hacker or a faulty program changes it to Rs 1,000, integrity is breached. Similarly, a bank cheque whose amount is altered is an integrity violation.

Mechanisms used: Hashing (SHA-256) and checksums, digital signatures and PKI, audit trails and logging, version control, database constraints and validation rules, and segregation of duties so that no single person can both enter and approve a transaction.

(c) Availability

Meaning: Availability ensures that information and the systems that deliver it are accessible to authorized users whenever required. It protects against denial of service, hardware failure, power outage and natural disaster.

Example: EPF members must be able to check their balance, download statements or apply for loans/withdrawals through the online portal 24×7. If the server crashes or is hit by a DDoS attack during the payment window, availability is breached. Similarly, a hospital's patient-record system must never go down in an emergency.

Mechanisms used: Redundant servers and clustering, load balancing, regular backups with tested restoration, Uninterruptible Power Supply (UPS) and generators, Disaster Recovery (DR) and Business Continuity Plan (BCP), failover sites, and DDoS protection.

Summary Table

---

2. How to Implement CIA in an Organization (4 marks)

Implementation requires a combination of administrative, technical and physical controls, supported by top-management commitment.

1. Policy and governance framework

• Formulate an Information Security Policy approved by top management, aligned with ISO/IEC 27001 and Nepal's Electronic Transactions Act, 2063 and Cyber Security Policy.
• Appoint a Chief Information Security Officer (CISO) and form an IT Security Committee.
• Classify information (Public, Internal, Confidential, Secret) and define handling rules for each level.

2. Administrative / people controls

• Conduct background verification before hiring and obtain signed confidentiality agreements.
• Provide regular security awareness training on phishing, password hygiene and social engineering.
• Enforce segregation of duties and principle of least privilege; ensure mandatory leave and job rotation for sensitive posts.
• Maintain a documented DR/BCP and conduct periodic mock drills.

3. Technical controls

• Confidentiality: Encryption of data at rest and in transit, VPN for remote access, MFA, RBAC/least privilege, Data Loss Prevention (DLP) tools.
• Integrity: Digital signatures, file integrity monitoring, checksums, database audit logs, strict change-management procedures, antivirus and patch management.
• Availability: Server clustering and load balancing, RAID storage, automated off-site/cloud backup with periodic restore testing, UPS and standby generator, DDoS mitigation, Service Level Agreements (SLA) with uptime guarantees.

4. Physical and environmental controls

• Restricted-entry server rooms with biometric/CCTV access, fire suppression, temperature control, and secure disposal of hard disks and documents.

5. Continuous monitoring, audit and improvement

• Deploy SIEM/log monitoring and Intrusion Detection Systems; conduct vulnerability assessment and penetration testing.
• Perform internal and external IS audits; run Business Impact Analysis (BIA) and Risk Assessment.
• Apply the PDCA (Plan–Do–Check–Act) cycle for continual improvement and keep an incident response team ready.

---

Conclusion

Confidentiality, Integrity and Availability together form the backbone of information security. An organization such as the EPF, which handles large volumes of sensitive financial and personal data, must implement CIA through a balanced mix of policy, people, technology and physical safeguards, backed by continuous monitoring and management support.

Electronic Commerce

Electronic commerce (e-commerce) is the buying and selling of goods, services, and information, and the conduct of business transactions, through electronic networks — primarily the internet. It covers the whole commercial cycle: advertising and product search, ordering, payment (electronic funds transfer, cards, digital wallets), and delivery of goods or digital content. It may take place between businesses, between a business and a consumer, between consumers, or between the government and citizens. Its defining feature is that the transaction is carried out electronically, without the buyer and seller necessarily meeting face to face.

Two Examples of E-commerce Applications

1. Online retail (B2C): Daraz Nepal — a consumer browses products, places an order, and pays by card, mobile wallet, or cash on delivery.
2. Online ticketing and booking (B2C): Nepal Airlines' online booking system or eSewa/Khalti based bill payment — a customer books a seat or pays a utility bill electronically.

Characteristics of the Various E-commerce Service Models

(a) Business-to-Consumer (B2C) Here a business sells directly to the final consumer. Characteristics: large number of individual buyers, small-value transactions, strong emphasis on attractive product display, easy search and comparison, and convenient payment and home delivery. The seller must handle customer service and returns at scale. Example: Daraz Nepal selling electronics and clothing to individual customers; an airline selling tickets through its website.

(b) Business-to-Business (B2B) Transactions take place between two business firms — raw materials, components, or wholesale goods. Characteristics: fewer but larger buyers, high transaction value, negotiated prices and long-term contracts, bulk ordering, and integration of the buyers' and sellers' systems (EDI, e-procurement). Relationship and credit terms matter more than display. Example: A cement factory buying coal or machinery from a supplier through an e-procurement portal; a wholesaler supplying goods to retailers online.

(c) Consumer-to-Consumer (C2C) Consumers sell to other consumers, usually through a marketplace that provides the platform. Characteristics: the platform owner only facilitates and earns commission; individual sellers with used or surplus goods; trust and rating systems are essential; payment is often held in escrow until delivery. Example: Hamrobazar or Facebook Marketplace, where one individual sells a used mobile phone to another.

(d) Consumer-to-Business (C2B) Individuals supply products, services, or ideas to businesses. Characteristics: the individual sets or bids the price; the business buys the service; commonly used for freelance work, content, and crowdsourcing. Example: A freelancer offering graphic design on Upwork or Fiverr to a company; a customer giving product feedback for which the firm pays.

(e) Government-to-Citizen (G2C) and Government-to-Business (G2B) The government delivers services or makes purchases electronically. Characteristics: statutory or monopoly services, high volume of users, emphasis on transparency and reduced paperwork, and payment of taxes, fees, and licences online. Example: Paying income tax or vehicle tax through the Inland Revenue Department's online portal (G2C); a government department inviting and awarding tenders through an e-procurement portal (G2B).

In short, e-commerce is electronic business transaction over networks, and its service models are distinguished by who transacts with whom — B2C, B2B, C2C, C2B, and government models — each with its own pattern of buyer, transaction size, and trust requirement.

1. Software and its Types (2+3)

Software is a set of programs, instructions, procedures and associated documentation that tells the computer hardware what to do and how to do it. It is the non-physical, logical component of a computer system — it cannot be touched, but without it the hardware is useless. Examples: Windows 11, MS Word, Tally, a payroll program.

Types of Software

(a) System Software Software designed to operate, control and manage the computer hardware and to provide a platform for running application programs. It includes:

• Operating system — Windows, Linux, macOS (resource and file management, process scheduling).
• Utility programs — antivirus, disk defragmenter, backup, compression tools.
• Device drivers — translate OS commands into signals the device understands.
• Language translators — compiler, interpreter, assembler.

(b) Application Software Software developed to perform a specific user task or set of tasks. It includes:

• General-purpose (packaged) software — MS Office, Photoshop, browsers.
• Tailored/customised software — payroll, accounting or inventory systems built for one organisation (relevant to EPF's own contribution and pension systems).
• Utility/enterprise applications — ERP, HRMS, banking and PF management systems.

(c) Other classifications

• Firmware — programs permanently stored in ROM (BIOS/UEFI).
• Middleware — connects and mediates between different applications or databases.
• Open-source vs proprietary — source code freely available (Linux) vs licensed (MS Windows).

2. Hardware Components of a Desktop Computer and their Functions (5)

Hardware means the physical, tangible parts of a computer. The main components of a desktop computer are:

Together these components perform the input → process → storage → output cycle of a computer system.