1. Generations of Computer and their Characteristics (6 marks)

The development of computers is divided into five generations, each marked by a major change in the hardware technology used.

First Generation (1940–1956) — Vacuum Tubes

• Main electronic component: vacuum tubes; examples: ENIAC, EDVAC, UNIVAC-I, IBM 701.
• Characteristics: very large in size, extremely high power consumption and heat generation, very slow speed, small storage capacity, very costly and unreliable.
• Programming was done in machine language; input through punched cards and paper tape; output through printouts.

Second Generation (1956–1963) — Transistors

• Transistors replaced vacuum tubes; examples: IBM 1401, IBM 7094, CDC 1604.
• Characteristics: smaller, cheaper, faster and more reliable than the first generation; less heat and lower power consumption; magnetic core memory and magnetic tape/disk used for storage.
• Assembly language and early high-level languages (COBOL, FORTRAN) came into use.

Third Generation (1964–1971) — Integrated Circuits (ICs)

• Many transistors placed on a single silicon chip (SSI/MSI); examples: IBM System/360, ICL 1900.
• Characteristics: much smaller size, higher speed and reliability, lower cost and power consumption; keyboards and monitors used for input/output; large magnetic disk storage.
• Operating systems and high-level languages (BASIC, PASCAL, C) became common; multiprogramming was introduced.

Fourth Generation (1971–1980) — Microprocessors (VLSI)

• Thousands of ICs packed on one chip (LSI/VLSI); examples: Intel 4004, IBM PC, Apple II, CRAY-1.
• Characteristics: very small size (desktop and portable), very fast, highly reliable, cheap and easily available to common users; large main memory and secondary storage.
• GUI, computer networks, internet, and user-friendly application packages developed; parallel processing and supercomputers appeared.

Fifth Generation (1980–present) — Artificial Intelligence (ULSI)

• Main focus on artificial intelligence and parallel processing; examples: IBM Watson, laptops, smartphones, quantum computers.
• Characteristics: extremely fast (teraflops and above), very large storage, portable and energy-efficient, voice and touch input, natural-language and image recognition.
• Used in robotics, expert systems, machine learning, cloud computing and the Internet of Things.

Note: Each generation brought smaller size, greater speed, larger storage, lower cost and higher reliability than the previous one.

---

2. Difference between System Software and Application Software (4 marks)

Conclusion: System software acts as the bridge between hardware and the user, while application software works on top of it to do the user's actual work.

CIA Triad in Computer Security

Information security rests on three core principles — Confidentiality, Integrity and Availability, collectively called the CIA triad. Every security policy, control and technology is ultimately aimed at protecting one or more of these three attributes of information assets.

1. The Three Core Principles

(a) Confidentiality

Meaning: Confidentiality ensures that information is accessible only to those persons who are authorized to access it. It prevents unauthorized disclosure of data, whether during storage, processing or transmission.

How it is achieved: Encryption (AES, RSA), access control lists (ACL), user authentication (password, OTP, biometric), data classification, steganography, and physical protection of media.

Example: In a bank, a customer's account balance and transaction history must be visible only to that customer and authorized bank staff. If the bank's database is encrypted with AES-256 and only authenticated users with the proper role can query it, confidentiality is maintained. If a hacker steals the database file but cannot decrypt it, confidentiality is still preserved. Similarly, an employee's salary details in a payroll system should not be visible to other employees.

(b) Integrity

Meaning: Integrity ensures that data is accurate, complete and unaltered, and that it has not been modified in an unauthorized or accidental manner. It also means that the source of the data is genuine (authenticity) and the sender cannot later deny sending it (non-repudiation).

How it is achieved: Hashing (SHA-256, MD5), digital signatures, checksums, message authentication codes (MAC), version control, audit logs, and write-protection.

Example: When a customer transfers Rs 50,000 through mobile banking, the amount must not be changed to Rs 5,00,000 in transit. The bank uses a digital signature and hash of the transaction message; if even one digit is altered, the hash changes and the transaction is rejected. Similarly, in an e-governance system storing land ownership records, a hash of each record detects any unauthorized tampering by an insider.

(c) Availability

Meaning: Availability ensures that information systems, data and services are accessible to authorized users whenever required, without interruption. It protects against denial of service, hardware failure, natural disaster and power outage.

How it is achieved: Redundant hardware (RAID, clustering), backup and disaster recovery plans, UPS and generators, DDoS protection, load balancing, regular maintenance, and fault-tolerant design.

Example: A government portal for online tax filing must remain accessible 24×7, especially near the filing deadline. If the primary server fails, a mirrored server in another data centre takes over automatically (high availability clustering), and daily backups allow restoration of data. Similarly, a hospital's patient record system must be available at all times in the emergency ward; a UPS and RAID-1 disk mirroring ensure this.

Summary Table

2. How to Implement CIA in an Organization

Implementation requires a combination of administrative, technical and physical controls, guided by a written security policy.

1. Frame an information security policy and assign responsibility. Top management should approve a security policy based on ISO/IEC 27001, classify data by sensitivity, and appoint a Chief Information Security Officer (CISO) with a security team. Roles and access rights should follow the principle of least privilege.

2. Implement technical controls.

   • For confidentiality: encryption of data at rest and in transit (AES, TLS/HTTPS), firewalls, VPN, strong authentication (MFA), role-based access control (RBAC).
   • For integrity: hashing and digital signatures, database constraints and checksums, file integrity monitoring, tamper-proof audit logs, and segregation of duties so that no single employee can both enter and approve a transaction.
   • For availability: RAID storage, server clustering and load balancing, UPS and standby generator, automated daily backup stored off-site, anti-DDoS protection, and a tested disaster recovery (DR) plan with defined RTO/RPO.

3. Apply physical and personnel controls. Locked server rooms with biometric entry, CCTV, fire suppression, restricted media handling; and for people — background verification, confidentiality agreements (NDA), and regular security awareness training to prevent phishing and social-engineering attacks.

4. Monitor, audit and improve continuously. Conduct vulnerability assessment and penetration testing, monitor logs through a SIEM, perform periodic internal and external audits, run backup-restoration and DR drills, and update the policy and patches regularly. Any incident should be handled through a documented incident-response procedure, and lessons learned should feed back into the policy — making security a continuous PDCA (Plan–Do–Check–Act) cycle.

Conclusion: Confidentiality, integrity and availability are interdependent — encryption without key management harms availability, and availability without integrity makes data worthless. A balanced, defence-in-depth implementation of all three, supported by policy, technology, people and continuous monitoring, is what actually protects an organization's information assets.

Electronic Commerce

Electronic commerce (e-commerce) is the buying and selling of goods, services, and information, and the conduct of commercial transactions, over electronic networks — primarily the internet. It covers the whole chain of a commercial activity carried out electronically: online advertising and product search, ordering and payment, delivery of digital or physical goods, and after-sales service. In e-commerce the physical marketplace is replaced by a virtual (electronic) marketplace, so buyers and sellers need not be at the same place or time. It is broader than "online shopping" because it also includes electronic banking, electronic funds transfer, electronic data interchange (EDI), online ticketing, supply-chain management and electronic stock trading.

Two Examples of E-commerce Applications

1. Online retail (B2C) — e.g., Daraz Nepal: a customer browses products on the website/app, places an order, pays by eSewa, Khalti, card or cash-on-delivery, and the goods are delivered to the home.
2. Online banking / digital wallet (B2C) — e.g., eSewa or Khalti: a user pays utility bills, mobile recharge, insurance premiums and merchant payments electronically without visiting a bank or counter.

(Other valid examples: Amazon, Alibaba, IRCTC/online bus ticketing, eBay C2C auctions, Nepal Airlines online booking.)

Characteristics of the Various E-commerce Service Models

E-commerce service models are classified by who transacts with whom. The main models are B2C, B2B, C2C, C2B, G2C/G2B and m-commerce.

1. Business-to-Consumer (B2C)

• The business sells directly to the final consumer; the largest and most familiar model.
• Characteristics: large number of small-value transactions, strong emphasis on attractive websites, product catalogues, shopping carts, secure online payment and home delivery; demand is created by advertising and discounts.
• Example: Daraz, Amazon — a customer buys a mobile phone online.

2. Business-to-Business (B2B)

• One business sells goods, raw materials or services to another business.
• Characteristics: fewer but very high-value transactions, long-term contracts and negotiated prices, bulk/wholesale supply, integration through EDI or supplier portals, and lower transaction and procurement cost.
• Example: Alibaba.com; a garment factory buying cloth from a mill through an online portal.

3. Consumer-to-Consumer (C2C)

• Consumers sell to other consumers, the website only providing the platform.
• Characteristics: the intermediary earns commission or listing fees, no inventory of its own, price is settled between the parties, and trust/reputation ratings and escrow payment matter greatly.
• Example: eBay, Hamrobazar — a person selling a used motorcycle to another person.

4. Consumer-to-Business (C2B)

• Individuals supply products, services or ideas to businesses.
• Characteristics: the consumer sets or quotes the price, businesses bid for or buy the consumer's service; used for freelancing, crowdsourcing and reviews.
• Example: Upwork/Fiverr — a freelancer offers graphic design to a company; a customer's review influencing a firm's product.

5. Government-to-Consumer / Government-to-Business (G2C / G2B)

• Government delivers services to citizens or firms electronically.
• Characteristics: non-commercial or fee-based public service, round-the-clock availability, transparency and reduced paperwork; payment of taxes, fees and licence renewal online.
• Example: Nepal's eSewa/Connect IPS tax payment, IRD's online VAT filing, passport or driving licence application portals.

6. Mobile Commerce (m-commerce)

• E-commerce conducted through mobile phones and wireless networks.
• Characteristics: anytime–anywhere access, small screen and location-based services, use of apps, QR codes and digital wallets; very high penetration in developing countries.
• Example: paying a shop by scanning a QR code in a mobile banking app.

Common features of all models: they are electronic and paperless, available 24×7 across geographical boundaries, reduce transaction and search cost, allow direct interaction between parties, and depend on secure payment systems, data protection and reliable telecommunications.

In short, e-commerce is the electronic conduct of business transactions, and its service models — B2C, B2B, C2C, C2B, G2C/G2B and m-commerce — differ mainly in who the trading partners are, the size and value of transactions, and the role of the intermediary.

1. Software and Its Types (2 + 3 = 5 marks)

Definition of Software (2 marks)

Software is a set of organised programs, instructions, procedures and associated data that tells the computer hardware what to do and how to do it. Unlike hardware, it is intangible (cannot be touched), logical in nature, and is stored on storage media in binary form. It acts as the bridge between the user and the hardware — the hardware provides the physical capability while the software provides the intelligence. Examples: Windows 11, MS Word, Photoshop, Tally.

Types of Software (3 marks)

In short: system software runs the computer, application software works for the user, and utility software maintains the computer.

2. Hardware Components of a Desktop Computer and Their Functions (5 marks)

Hardware means the physical, tangible parts of a computer that can be seen and touched. The main components of a desktop computer are:

All these units are housed in the system unit (cabinet) and work together under the control of the operating system to convert input data into useful output information.