Chapter 6.1: Data Security

9618 AS Computer Science

📚 Learning Objectives

Explain the difference between the terms security, privacy and integrity of data
Show appreciation of the need for both the security of data and the security of the computer system
Describe security measures designed to protect computer systems, ranging from the stand-alone PC to a network of computers
Show understanding of the threats to computer and data security posed by networks and the internet
Describe methods that can be used to restrict the risks posed by threats
Describe security methods designed to protect the security of data

🌟 Did You Know?

Data security is a prerequisite for ensuring data integrity and data privacy. Without proper security measures, data cannot be guaranteed to remain accurate, complete, and private. Organizations must implement comprehensive security strategies to protect their digital assets!

1. Data Security, Privacy, and Integrity

Understanding the fundamental differences between data security, data privacy, and data integrity is essential for protecting digital information systems.

Term	Definition	Key Focus	Example
Data Security	Protecting data from unauthorized access, theft, or attacks	Preventing breaches or leaks	Using encryption, firewalls, and passwords
Data Privacy	Ensuring data is collected, stored, and shared respecting user rights	Controlling who can access and use personal data	Asking for user consent before collecting personal information
Data Integrity	Ensuring data is accurate, complete, and unaltered during storage or transfer	Maintaining correctness and reliability	Using checksums or validation rules to detect changes

📖 Key Definitions

Data Security: Data can be said to be 'secure' if it is available for use when needed and the data made available is the data that was stored originally
Data Privacy: The process of ensuring that those with authenticated access to systems and data only view data they should be allowed to view
Data Integrity: Refers to accuracy, consistency, and reliability of data; ensures data remains unchanged and retains its intended meaning

1.1 Threats to Security of System

⚠️ Major Threats

Internal mismanagement - Poor security policies or negligent employees
Natural disasters - Fire, flood, earthquakes damaging infrastructure
Unauthorized intrusion - Individuals gaining access without permission
Malicious software - Malware entering the system

💡 Exam Tip

Remember: Security = keeping data safe from threats (e.g., hackers), Privacy = making sure data is used fairly and with consent, Integrity = making sure data stays accurate and unchanged.

2. User Accounts and Passwords

2.1 User Accounts

A user account is an identity created for a person in a computer or computing system. User accounts are used to authenticate a user (prove a user is who they say they are) and control access rights.

📖 Purpose of User Accounts

Authenticate users - Verify identity before granting access
Control access rights - Determine what users can see and do
Track user activity - Log actions for auditing purposes
Personalize experience - Customize settings per user

Example: In a hospital system, nurses and doctors should only have access to medical information regarding the patients they are treating. Receptionists only have access to limited patient information such as name, address, and ward number.

2.2 Passwords

Passwords provide the first line of defense against unauthorized access. The stronger your password, the more protected your computer will be from hackers and malicious software.

📝 Characteristics of Strong Passwords

Combination of uppercase and lowercase letters
Contains numbers (0-9)
Contains special symbols (!@#$%^&*)
Minimum 8-12 characters in length
Example of a strong password: X5j13$#eCM1cG@Kdc

Way to Protect Passwords	Description
Run Anti-Spyware	Make sure passwords are not being sent to whoever put spyware on your computer
Regularly change passwords	In case they have been seen by someone else, illegally or accidentally
Make passwords difficult	Ensure passwords are hard to crack or guess
Use different passwords	Don't reuse the same password across multiple accounts

❌ Common Password Mistakes

Using personal information (birthdays, pet names)
Using simple words found in dictionaries
Reusing the same password across multiple sites
Writing passwords on sticky notes near the computer

3. Authentication Techniques

Authentication is the process of ensuring that a system is secure by asking the user to complete tasks to prove they are an authorised user.

3.1 Digital Signatures

A digital signature securely associates a signer with a document. It provides evidence of origin, identity and status of electronic documents.

📖 What Digital Signatures Confirm

Who sent the data (authentication)
That the data hasn't been changed (integrity)
Non-repudiation - sender cannot deny sending

3.2 Biometrics

Biometrics is the most suitable means of identifying and authenticating individuals through unique biological characteristics.

Biometric Type	How It Works	Application
Fingerprint Scan	Compares fingerprint patterns against stored templates	Smartphones, laptops
Retina/Iris Scan	Uses pattern of blood capillary structure in the eye	High-security facilities
Face Recognition	Maps facial features using distance between points	Mobile devices, airports
Voice Recognition	Analyses voice patterns and speech characteristics	Phone banking

💡 Exam Tip

Biometrics provide the highest level of security because they are based on unique physical characteristics that cannot be easily replicated, lost, or stolen.

4. Firewalls

A firewall is a barrier between a network and the internet. It prevents unwanted traffic from entering a network by filtering requests to ensure they are legitimate.

📖 Types of Firewalls

Hardware Firewalls: Protect the whole network and prevent unauthorised traffic at the network perimeter
Software Firewalls: Protect individual devices on the network, monitoring data going to and from each computer

4.1 Tasks Carried Out by Firewall

📝 Firewall Functions

Examining traffic between user's computer and public network
Checking whether incoming or outgoing data meets a given set of criteria
Logging all incoming and outgoing traffic for later interrogation
Preventing access to certain undesirable sites
Helping prevent viruses or hackers entering user's computer
Warning user if software is trying to access an external data source

💡 Remember

Firewalls are the primary defence against hacking, malware, phishing, and pharming. However, they cannot protect against threats from inside the network!

5. Antivirus and Encryption

5.1 Antivirus Software

Antivirus software is a computer program that detects and gets rid of computer malware and viruses.

📝 How Antivirus Works

Checks files before they are run or loaded on a computer
Compares possible viruses against a database of known viruses
Quarantines files or programs which are possibly infected
Regularly updates virus definitions

5.2 Anti-Spyware

Anti-spyware detects and removes spyware programs. It works by:

Rule-based: Looks for typical features associated with spyware behavior
File structure based: Identifies common spyware programs by their known file structures

5.3 Encryption

Encryption converts data into a secret code so that only authorised users can read it.

Type	Description	Characteristics
Symmetric	Same key encrypts and decrypts	Fast but key must be shared securely
Asymmetric	Public key encrypts, private key decrypts	More secure for sending data

6. Threats: Hacking and Malware

6.1 Hacking

Hacking is the illegal access to a computer system without the owner's permission.

Type	Description	Legal Status
Malicious Hacking	Illegal access without permission; intention to delete, alter, or corrupt files	Illegal
Ethical Hacking	Authorized by companies to check security measures	Legal (with permission)

⚠️ How Hackers Gain Access

Unpatched software - Missing security updates
Out-of-date anti-malware - Cannot detect new threats
Weak passwords - Easy to guess or crack

6.2 Malware Types

Malware Type	What It Does	Key Characteristics
Virus	Replicates itself and causes unwanted events	Needs an active host program
Worm	Stand-alone virus that spreads over networks	Replicates without host
Trojan Horse	Disguised as legitimate software	Contains malicious code
Spyware	Monitors user activity and gathers information	Records keystrokes (keylogger)
Logic Bomb	Code activated when conditions met	Triggers on specific date/event

7. Phishing and Pharming

7.1 Phishing

Phishing is the act of attempting to acquire sensitive information by representing as a trustworthy source via emails.

📝 How Phishing Works

Attacker sends fraudulent emails to many addresses
Email claims to be from reputable company
User clicks on scam link
User is directed to bogus website
User enters personal information
Information is sent to attacker

⚠️ Preventing Phishing

Do NOT click on links unless certain it is safe
Look for https and green padlock symbol
Run anti-phishing toolbars
Keep browsers up-to-date

7.2 Pharming

Pharming redirects users to fake websites through DNS manipulation, even when typing the correct URL.

📖 Phishing vs Pharming

Phishing: User must CLICK a link in fraudulent email
Pharming: User is redirected even when typing CORRECT URL
Pharming is more dangerous - no user error required!

8. Access Rights and Data Protection

Access rights control what users can see or do on a network, ensuring appropriate permissions.

Access Right	What It Means
Full Access	User can open, create, edit, and delete files
Read-Only Access	User can view but cannot edit or delete
No Access	User cannot see or interact with the file at all

Example: School Network
• Administrators: Unrestricted access to all files and settings
• Teaching Staff: Can access student data but not other staff files
• Students: Can only access their own files and folders

8.1 Data Recovery

Causes of Data Loss	Prevention Method
Hard drive crashes	Regular backups, RAID systems
Viruses & Malware	Antivirus software, firewalls
Human error	Training, confirmation prompts
Power outages	UPS (Uninterruptible Power Supply)
Hackers	Access controls, monitoring

9. Key Takeaways

📌 Summary Points

Security, Privacy, and Integrity

Security: Protecting data from unauthorized access, theft, or attacks
Privacy: Ensuring data is used fairly with proper consent
Integrity: Ensuring data remains accurate, complete, and unchanged

Security Measures

User Accounts: Authenticate users and control access rights
Passwords: First line of defense - use strong, unique passwords
Digital Signatures: Verify sender identity and data integrity
Biometrics: Use unique physical characteristics for authentication
Firewalls: Filter network traffic between computer and internet
Antivirus: Detect, quarantine, and remove malware
Encryption: Convert data to unreadable code for protection

Threats to Security

Hacking: Unauthorized access to computer systems
Malware: Viruses, worms, trojans, spyware, logic bombs
Phishing: Fraudulent emails to steal sensitive information
Pharming: DNS redirection to fake websites

10. Glossary

Term	Definition
Antivirus Software	Program that detects and removes computer malware and viruses
Authentication	Process of verifying a user's identity before granting access
Biometrics	Using unique physical characteristics (fingerprint, retina, voice) for identification
Cipher Text	Encrypted, unreadable form of data
Data Integrity	Ensuring data is accurate, complete, and unaltered
Data Privacy	Ensuring data is only accessible to authorized users with consent
Data Security	Protecting data from unauthorized access, corruption, or theft
Digital Signature	Secure method to verify sender identity and document integrity
Encryption	Converting plaintext data into ciphertext for protection
Firewall	Hardware/software that filters network traffic
Hacking	Unauthorized access to computer systems or networks
Malware	Malicious software designed to harm computer systems
Pharming	Redirecting users to fake websites through DNS manipulation
Phishing	Fraudulent attempt to obtain sensitive information via deceptive emails
Spyware	Software that secretly monitors user activity and gathers information
Trojan Horse	Malware disguised as legitimate software
Virus	Self-replicating malware that attaches to host programs
Worm	Self-replicating malware that spreads across networks without a host

11. Exam-Style Questions

1. Describe the difference between data security and data privacy. [2 marks]

Answer:

Data security protects data against loss or corruption through measures like encryption and firewalls
Data privacy protects data against unauthorized access by controlling who can view and use the data

2. Explain three ways in which a firewall can protect a computer system. [3 marks]

Answer:

Examines traffic between user's computer and public network
Prevents access to undesirable sites by maintaining a list of blocked IP addresses
Logs all traffic for security auditing

3. Describe two characteristics of a strong password. [2 marks]

Answer:

Contains a combination of uppercase and lowercase letters
Includes numbers and special symbols

4. Describe the difference between a virus and a worm. [4 marks]

Answer:

A virus needs an active host program to run
A worm is a stand-alone program that can replicate itself without needing a host
Viruses attach themselves to files or programs
Worms spread automatically across networks

5. Explain how encryption can protect data during transmission. [4 marks]

Answer:

Encryption converts plaintext data into ciphertext using an encryption key
Even if data is intercepted, it cannot be understood without the decryption key
The receiver uses the same or matching key to decrypt the data
This ensures only authorised parties can read the transmitted data

11. Exam-Style Questions (continued)

6. Describe what is meant by phishing and explain two ways to protect against it. [4 marks]

Answer:

Phishing is sending fraudulent emails that appear to be from reputable sources to trick users into revealing sensitive information.

Protection methods:

Do not click on links in emails unless certain they are safe
Look for https and the green padlock symbol in the browser

7. Explain the difference between malicious hacking and ethical hacking. [4 marks]

Answer:

Malicious hacking is illegal access without permission, usually to steal data or cause harm
Ethical hacking is authorized by companies to test security measures
Malicious hacking is illegal; ethical hacking is legal with written permission
Ethical hackers are paid for their services; malicious hackers face criminal charges

8. A school network uses access rights. Explain the purpose of access rights. [3 marks]

Answer:

Access rights control what users can see or do on a network
They ensure users can access files they need but cannot access restricted information
Example: Students have read-only access to course materials, while teachers have full access

9. Describe two ways in which antivirus software protects a computer system. [2 marks]

Answer:

Compares files against a database of known viruses
Quarantines or removes infected files to prevent spread

10. Explain what is meant by data integrity and describe one method to ensure it. [3 marks]

Answer:

Data integrity means ensuring data is accurate, complete, and unaltered
It prevents errors, corruption, or unauthorized alterations
One method: Using checksums to verify data hasn't been changed during transmission

12. Exam Success Tips

💡 Security vs Privacy vs Integrity

Security = Protection: Keeps data safe from hackers, malware, and threats
Privacy = Permission: Controls who can access and use personal data
Integrity = Accuracy: Ensures data stays correct and unchanged

🧠 Memory Trick: Malware Types

Virus = Needs a host (like a biological virus needs a cell)
Worm = Crawls alone (stand-alone, spreads by itself)
Trojan = Disguised gift (looks legitimate but hides danger)
Spyware = Secret agent (watches and reports your activities)

💡 Phishing vs Pharming

Phishing: User must CLICK a link in a fraudulent email
Pharming: User is redirected even when typing the CORRECT URL
Pharming is more dangerous because it doesn't require user error!

❌ Common Mistakes to Avoid

Don't say "firewall removes viruses" - it only BLOCKS them, antivirus REMOVES them
Don't confuse authentication with authorization
Don't say encryption prevents data deletion - it only prevents reading stolen data
Don't forget that worms DON'T need a host program

12. Exam Success Tips (continued)

💡 Answer Structure Tips

For "describe" questions: Give step-by-step details
For "explain" questions: Give reasons WHY something happens
For "compare" questions: Mention BOTH items for each point
Mark allocations give hints: [4 marks] = 4 distinct points

🌟 Quick Reference Table

Topic	Key Point
User Accounts	Authenticate users and control access rights
Passwords	Strong = upper/lower + numbers + symbols
Firewall	Barrier between network and internet
Antivirus	Detects and removes malware
Encryption	Converts plaintext to ciphertext
Biometrics	Fingerprint, retina, face, voice

📌 Final Exam Reminders

Read questions carefully - note the command word
Check mark allocations - they tell you how many points to make
Use technical terms: authentication, encryption, quarantine
Give examples where possible
Review your answers if time permits