Cambridge AS & A Level9608

Security

Computer Science 9608 Chapter Notes

What this chapter covers

Security
ShareWhatsAppPost
Security notes

Unable to load PDF

The notes viewer could not load. Please refresh the page.

Read online free. Download a watermarked copy with a free account.

Read the notes

The full Security notes as text: skim, search, and jump between subtopics.

~12 min read

In this chapter

  1. 1Security, Privacy, and Integrity Explained
  2. 2Authentication: Proving You Are You
  3. 3Encryption and Secure Communication
  4. 4Malware Threats and Defences
  5. 5Ensuring Data Integrity

1. Security, Privacy, and Integrity Explained

These three terms are the pillars of data protection, but they mean different things. Data Security is about protecting data from unauthorised access. Think of it as the lock on the door. Data Privacy is about an individual's right to control how their personal data is collected, used, and shared. It's about who has the right to open the door and look inside. Data Integrity is about ensuring data is accurate, complete, and trustworthy over its entire lifecycle. It means the information inside hasn't been secretly changed or corrupted.

Key term

Data Security: The practice of protecting digital information from unauthorised access, corruption, or theft throughout its entire lifecycle.

Examiner insight

Examiners award marks for clear distinctions, so use comparative words like 'whereas' or 'in contrast' when explaining these three terms in an exam.

Common pitfall

Confusing security and privacy. Security is the technical protection (the fence), while privacy is the policy and right to control personal information (who is allowed through the gate).

Worked example 16 marks

A hospital stores patient records. Explain how data security, privacy, and integrity apply to these records.

  1. 1
    1. Security: The hospital must implement measures like firewalls, encrypted databases, and user accounts with strong passwords to prevent hackers or unauthorised staff from accessing the patient records.
  2. 2
    1. Privacy: The hospital must have a clear policy on who can view patient data (e.g., only the patient's doctor and specialist nurses) and for what purpose. Sharing this data without the patient's consent would be a breach of privacy.
  3. 3
    1. Integrity: The system must ensure that patient data, such as blood type or allergies, is entered correctly (validation) and is not accidentally or maliciously altered. A checksum could be used to ensure the record hasn't been corrupted.

Recap

  • Security prevents unauthorised access.
  • Privacy controls who has authorised access and why.
  • Integrity ensures data is accurate and has not been altered.
  • A system can be secure but still violate privacy if authorised users misuse data.
  • All three concepts are essential for trustworthy computer systems.

Quick check

  1. Which of the three concepts (security, privacy, integrity) is most concerned with the accuracy of data?1 mark

2. Authentication: Proving You Are You

Authentication is the process of verifying that someone (or something) is who they claim to be. It's the first line of defence in securing a system. There are three main factors used for authentication: something you know (like a password or PIN), something you have (like a security token, key card, or your phone), and something you are (biometrics like a fingerprint, face scan, or iris scan). Using more than one of these factors is called Multi-Factor Authentication (MFA) or Two-Factor Authentication (2FA), which provides much stronger security than a password alone.

Key term

Authentication: The process of verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in a system.

Common pitfall

Stating that a long password is secure without also mentioning the need for complexity (using a mix of upper-case, lower-case, numbers, and symbols).

Fun fact

Some advanced authentication systems analyse 'behavioural biometrics', like the rhythm of your typing or the way you move your mouse, to continuously verify your identity while you use a system.

Worked example 14 marks

A bank is improving its online login system. It currently uses a username and password. Suggest and describe two other authentication methods it could add to create a multi-factor authentication system.

  1. 1
    1. Method 1 (Something you have): The bank could implement a system where after entering the correct password, a one-time code is sent via SMS to the user's registered mobile phone. The user must then enter this code to log in.
  2. 2
    1. Method 2 (Something you are): The bank's mobile app could require the user to verify their identity using the phone's built-in fingerprint scanner or facial recognition before granting access to the account, in addition to the password.
  3. 3
    1. Justification: Combining the original password ('something you know') with either the phone code ('something you have') or the fingerprint scan ('something you are') creates a multi-factor system. This is much more secure because a criminal would need to steal both the password and the user's physical phone or fingerprint.

Recap

  • Authentication verifies a user's identity.
  • Authentication factors are: something you know, something you have, something you are.
  • A strong password should be long and complex, using a mix of character types.
  • Biometric authentication uses unique physical or behavioural traits.
  • Multi-Factor Authentication (MFA) combines two or more different factor types for enhanced security.

Quick check

  1. Classify a 'fingerprint scan' as an authentication factor.1 mark
  2. Why is 'Password123' a weak password?1 mark

3. Encryption and Secure Communication

Encryption is the process of converting data (plain text) into a coded format (cipher text) to prevent unauthorised access. Asymmetric key cryptography is a powerful method that uses a pair of keys: a public key and a private key. The public key can be shared with anyone, but the private key must be kept secret. This allows for two key functions: sending a private message and verifying a message's origin.

To send a private message TO Bob, you encrypt it with Bob's PUBLIC key. Only Bob can decrypt it with his matching PRIVATE key.

To create a verified message FROM you (a digital signature), you encrypt a summary of the message (a hash) with your own PRIVATE key. Anyone can decrypt it with your PUBLIC key to confirm it came from you and hasn't been altered.

Secure Socket Layer (SSL) and its successor, Transport Layer Security (TLS), are protocols that use these principles to secure communication over the internet, like when you see 'https://' in your browser.

Key term

Asymmetric Key Cryptography: An encryption system that uses a pair of keys for encryption and decryption: a public key that is shared openly, and a private key that is kept secret.

Examiner insight

Marks are often awarded for correctly and explicitly stating which key (e.g. 'Bob's Public Key') is used for each step of encryption and decryption.

Common pitfall

Mixing up the roles of the public and private keys. A simple rule is: Public keys lock (encrypt for privacy) or verify (check a signature). Private keys unlock (decrypt for privacy) or sign (create a signature).

Worked example 14 marks

Alice wants to send a confidential message to Bob using asymmetric encryption. Explain the steps involved, stating which keys are used for encryption and decryption.

  1. 1
    1. Alice obtains Bob's public key. This key is publicly available.
  2. 2
    1. Alice writes her message (plain text).
  3. 3
    1. She encrypts the message using Bob's public key. The message is now cipher text.
  4. 4
    1. Alice sends the cipher text to Bob.
  5. 5
    1. Bob receives the cipher text and uses his own private key to decrypt it back into the original plain text message.
  6. 6
    1. Since only Bob has his private key, no one else who might intercept the message can read it.

Worked example 23 marks

How does a digital signature prove the origin of a message from Bob?

  1. 1
    1. Bob creates a summary of his message, called a hash.
  2. 2
    1. Bob encrypts this hash using his own private key. This encrypted hash is the digital signature.
  3. 3
    1. Bob sends the plain text message along with the digital signature.
  4. 4
    1. A recipient uses Bob's public key to decrypt the signature, revealing the original hash.
  5. 5
    1. The recipient then calculates a new hash from the message they received. If this new hash matches the decrypted hash from the signature, it proves the message is genuinely from Bob and has not been changed.

Recap

  • Encryption turns plain text into unreadable cipher text.
  • Asymmetric encryption uses a public key and a private key pair.
  • To send a private message, encrypt with the recipient's public key.
  • To decrypt a private message, the recipient uses their own private key.
  • To create a digital signature, encrypt with your own private key.
  • SSL/TLS uses encryption to secure internet connections (HTTPS).

Quick check

  1. If you want to send a secret message to a company, which key do you use to encrypt it?1 mark
  2. What does the 'S' in HTTPS stand for?1 mark

4. Malware Threats and Defences

Malware, short for malicious software, is any software intentionally designed to cause damage to a computer, server, client, or computer network. Key types include:

  • Virus: Attaches itself to legitimate programs or files. It requires human action (like running the program) to spread.
  • Worm: Similar to a virus, but it can self-replicate and spread across networks without any human help, exploiting vulnerabilities.
  • Phishing: A social engineering attack, usually via email, that tricks users into revealing sensitive information (like passwords or credit card numbers) by pretending to be a trustworthy entity.
  • Pharming: A more technical attack that redirects a user from a legitimate website to a fraudulent one without their knowledge, with the aim of stealing credentials.

Defences against malware include installing and updating anti-virus software, using a firewall, being cautious of suspicious emails and links, and keeping all software and operating systems up to date to patch vulnerabilities.

Key term

Malware: Software that is specifically designed to disrupt, damage, or gain unauthorized access to a computer system.

Fun fact

The first computer worm, the Morris Worm (1988), was created by a student to gauge the size of the internet. A bug in its code caused it to replicate too aggressively, crashing thousands of computers and leading to the first-ever conviction under the US Computer Fraud and Abuse Act.

Worked example 13 marks

An employee receives an email that appears to be from their bank, asking them to click a link and confirm their account details due to a 'security alert'. Identify this type of threat and describe one technical and one non-technical measure to prevent it.

  1. 1
    1. Identification: This is a phishing attack. It uses social engineering (creating a sense of urgency) to trick the user.
  2. 2
    1. Technical measure: Use an email spam filter. These filters can often detect and block common phishing emails before they reach the user's inbox by checking for suspicious links and sender addresses.
  3. 3
    1. Non-technical measure: User training. Educate employees to be suspicious of unsolicited emails requesting personal information, to check the sender's email address carefully, and to never click links directly but instead navigate to the official website by typing the address manually.

Recap

  • A virus needs a host program to spread, while a worm can spread on its own.
  • Phishing is an attempt to trick you into giving away information.
  • Pharming redirects you to a fake website without you knowing.
  • Anti-virus software scans for and removes known malware.
  • Keeping software updated is crucial to patch security holes that malware exploits.

Quick check

  1. What is the main difference between a virus and a worm?2 marks

5. Ensuring Data Integrity

Data integrity ensures that data is accurate and consistent throughout its lifecycle. This is achieved using two main techniques: validation and verification.

Data Validation is an automatic check performed by the computer during data entry to ensure the data is sensible, reasonable, and in the correct format. Examples include:

  • Range Check: Checks if a number is within an allowed range (e.g., age is between 0 and 120).
  • Format Check: Checks if data matches a specific pattern (e.g., a postcode is LLN NLL).
  • Presence Check: Ensures a field is not left empty.

Data Verification is a process to check that data has been transcribed correctly from one medium to another. It does not check if the data is correct, only that it has been copied accurately.

  • Double Entry: Data is entered twice by two different people. The computer compares the two entries and flags any discrepancies.
  • Visual Check: The user manually compares the entered data with the original source document.

Key term

Data Validation: An automatic computer check performed during data input to ensure that the data is sensible, reasonable and allowable.

Examiner insight

To score highly, provide specific examples of validation checks (e.g., 'a range check between 1 and 10') rather than just naming the type of check.

Common pitfall

Using the terms 'validation' and 'verification' interchangeably. Validation is an automatic check for sensibility, while verification is a check for transcription errors.

Worked example 14 marks

A website has a sign-up form that asks for a user's email address and age. Describe one validation check that could be applied to each field.

  1. 1
    1. Email Address Field: A format check could be used. The system would check that the entered text contains an '@' symbol and a '.' (dot), and that characters appear before and after the '@', to ensure it resembles a valid email format.
  2. 2
    1. Age Field: A range check could be used. The system would check that the age entered is a number between, for example, 13 and 120, to ensure the user is old enough to use the service and the age is realistic.

Worked example 23 marks

Explain how data verification by double entry works when a clerk is entering customer orders from paper forms into a computer system.

  1. 1
    1. The clerk enters a batch of orders into the computer system.
  2. 2
    1. A different clerk, or the same clerk later, re-enters the same batch of orders into the system (without seeing the first entry).
  3. 3
    1. The computer system compares the two sets of entries field by field for each order.
  4. 4
    1. If there are any differences, the system flags the discrepancy and prompts the user to check the original paper form and correct the entry.

Recap

  • Integrity is about the correctness and accuracy of data.
  • Validation checks if input data is sensible and reasonable.
  • Verification checks if data has been copied correctly.
  • A range check, format check, and presence check are all types of validation.
  • Double entry and visual checks are types of verification.
  • You can have valid data that is incorrect (e.g., typing age 34 instead of 43 passes a range check but is wrong).

Quick check

  1. Is checking that a password field is not left blank an example of validation or verification?1 mark
  2. Give an example of a format check.1 mark

End-of-chapter exercise

Test yourself on the whole chapter. Work through these before moving on.

  1. Explain the difference between data security and data privacy, using the example of a social media company.4 marks
  2. Describe two different types of malware and for each one, state a method that can be used to restrict its effect.4 marks
  3. A new online banking service is being designed. Describe three distinct authentication methods, from different categories, that could be combined to provide high security.6 marks
  4. A school registration form includes fields for 'Student Name' and 'Date of Entry' (which must be in the current year). Describe a suitable validation check for each field.4 marks
  5. Sam wants to send a digitally signed, confidential message to Maria. Explain the roles of Sam's private key, Sam's public key, Maria's private key and Maria's public key in this process.6 marks
  6. What is a firewall and how does it help to protect a computer network?3 marks
  7. Compare and contrast data validation and data verification. Give one example of each.4 marks
  8. What is the purpose of SSL/TLS in client-server communication? Describe a situation where its use is appropriate.3 marks
  9. An 8-bit binary value is transmitted with an even parity bit. If the 8 bits of data are 10110101, what will be the value of the parity bit? Explain your answer.2 marks
  10. Distinguish between phishing and pharming.2 marks

Go deeper

Practise and revise with member-only material for this chapter.

Workbook

Exam-style practice questions with full worked solutions.

Unlock with a plan

Chapter at a Glance

A single-page summary of every key idea for fast revision.

Unlock with a plan

Free notes are just the start.

Unlock every Workbook and Chapter at a Glance, and generate your own worksheets and predicted papers.

Explore plans

Related chapters

Data representation (1.1)Communication and Internet technologiesHardwareProcessor fundamentalsSystem software (1.5)Security, privacy and data integrity