Data and the computers that hold it need protecting. This chapter separates three ideas that students often confuse, describes the main threats and the defences against them, and covers the ways data is checked when it is entered and transferred.
6.1 Data security
Security, privacy and integrity
Example: a hospital database. Security stops a hacker stealing records. Privacy means patients' details are shown only to the staff who need them, and are not sold. Integrity means that the record has the correct blood group (not corrupted, mistyped or accidentally changed).
Why both data security and system security matter
Data security protects the information itself (for example by encrypting it and controlling who can open files). System security protects the computer and network (for example from malware or from someone physically stealing a machine). Both are needed: a stolen laptop exposes unencrypted data even if the files had good access rights, and a virus can corrupt or delete data even when the files themselves are well protected.
Threats to computers and data
| Threat | What it is |
|---|---|
| Malware | Malicious software. Types include viruses (attach to files and spread when they are run), worms (spread through networks on their own), Trojan horses (disguised as useful software), spyware (records keystrokes and activity, a keylogger captures passwords), adware, ransomware (encrypts data and demands payment) and bots |
| Hacking | Gaining unauthorised access to a computer or network, to steal, change or destroy data |
| Brute-force attack | Trying every possible password or key until the right one is found |
| Phishing | Fake emails or messages that look genuine and trick the user into giving away personal details or clicking a link to a fake website |
| Pharming | Malicious code on a computer or server redirects the user from a genuine website to a fake one, even when the correct address is typed |
| Social engineering | Tricking people into giving up information or access, for example by pretending to be IT support |
| Denial of service (DoS) attack | Flooding a server with so many requests it cannot respond to genuine users; a distributed DoS (DDoS) uses many computers |
| Interception of data | Capturing data as it travels across a network (packet sniffing), which is easy on unsecured wireless networks |
| Accidental damage or loss, theft and power failure | Deleting files by mistake, hardware failure, fire or flood, or a stolen device |
Measures to protect computer systems
- User accounts with strong passwords: use a mix of upper and lower case letters, numbers and symbols, a minimum length, and change them regularly. Never reuse them.
- Authentication: biometrics (fingerprint, face, iris) are hard to copy; two-factor authentication (2FA) needs two proofs, such as a password and a one-time code sent to a phone; digital signatures (chapter 17), digital certificates and smart cards prove identity.
- Firewall: software or hardware between a network and the internet (or between two parts of a network) that examines traffic and blocks anything that does not follow its rules; it can stop unauthorised access and also limit the programs that may use the network.
- Antivirus and anti-spyware software: scans, detects and removes malware, and must be kept up to date so it knows the latest threats.
- Keeping software updated (security patches) to close known weaknesses.
- Proxy server: sits between a user and the internet; it can filter and cache web requests, hide the user's IP address and block unsuitable websites.
- Physical security: locked rooms, security staff, ID badges, CCTV, and lockable cabinets, to stop theft and tampering.
- Access rights: users are given only the permissions they need (read only, read/write, no access).
- Secure connections (HTTPS using SSL/TLS) when using the web.
- Staff training about phishing and safe practice.
Measures to protect the data
- Encryption: the data is scrambled so it is meaningless without the key (chapter 17), whether it is stored or travelling over a network.
- Backups (copies of data stored somewhere else, ideally off site or in the cloud) so it can be restored after loss, damage or ransomware. Back up regularly, and test that the restore works.
- Access rights and user IDs with passwords on files, folders and databases, and audit logs to record who accessed what.
- Disk and file protection: for example password-protecting files, making files read only.
- Redundancy such as a RAID system or a mirrored (duplicate) server, so that one disk failure does not lose data.
- Anonymising data, and deleting it when it is no longer needed, to protect privacy.
6.2 Data integrity
Validation and verification
Validation checks
| Check | What it tests | Example |
|---|---|---|
| Presence check | A required field is not left empty | A name must be entered |
| Range check | The value lies between a lower and upper limit | Age must be between 11 and 18; month 1 to 12 |
| Length check | The data has the right number of characters | A password of at least 8 characters; a phone number of exactly 11 digits |
| Type check | The data is the right data type | The quantity must be an integer; a name must not hold digits |
| Format check | The data matches a pattern | A date as DD/MM/YYYY; a postcode pattern |
| Lookup check | The value is one of a list of allowed values | A country chosen from a list |
| Check digit | An extra digit at the end of a code, calculated from the other digits, detects mistakes such as a wrong or transposed digit | The last digit of a book's ISBN |
| Limit check | A check against one limit only (a minimum or a maximum) | The price must be greater than 0 |
| Existence check | The item exists, for example in a file or table | A product code entered must be in the stock file; a file name must belong to a file that is there |
| Consistency check | Two fields agree with each other | A date of birth that agrees with the age given |
Check digits in detail
A check digit is worked out from the other digits using a formula. When the number is entered again, the computer recalculates it; if it does not match, the number has been mistyped. ISBN-13, used for books, works like this:
- Multiply the first 12 digits alternately by 1 and 3, working from the left.
- Add the results.
- Divide the sum by 10 and take the remainder.
- If the remainder is 0, the check digit is 0; otherwise the check digit is remainder.
Example: 978030640615 has the sum . The remainder after dividing by 10 is 3, so the check digit is , giving 9780306406157.
ISBN-10 (older books) uses modulo 11: multiply the first nine digits by 10, 9, 8 ... 2, add, and choose the check digit so that the total plus the check digit is a multiple of 11 (a check digit of 10 is written X). Check digits catch single-digit errors and most transposed (swapped) digits, but not all errors.
Verification during data entry
- Visual check: the user reads the data on screen and compares it against the source. It is simple but can miss errors.
- Double entry: the data is typed in twice (often by two different people) and the computer compares them; if they differ, an error is flagged. More reliable but takes twice as long. It is used for passwords and email addresses when you "confirm" them.
Verification during data transfer
-
Parity check: a parity bit is added to each byte so that the total number of 1s is even (even parity) or odd (odd parity). The receiver counts the 1s; if the parity is wrong, an error has occurred. It cannot detect an error where two bits change, and it does not say which bit is wrong.
Example (even parity, 7-bit data
1011001): there are four 1s, which is already even, so the parity bit is 0 and the byte sent is01011001. If the receiver gets01011101it counts five 1s, an odd number, so it knows an error has happened. If two bits had been wrong the count would be even again and the error would be missed.A parity block (two-dimensional) check adds parity bits for rows and columns of a block of bytes, so a single wrong bit can be found at the intersection and corrected.
-
Checksum: a value calculated from all the data in a block (for example by adding the bytes) is sent with it. The receiver calculates the same value from the data received and compares. If different, the block is corrupt and is sent again.
-
Echo check: the receiving device sends the data back to the sender, who compares it with what was sent. Errors are detected, but it is slow, and an error could also have happened on the return trip.
-
Automatic repeat request (ARQ): the receiver sends a positive acknowledgement when data arrives correctly, or a negative acknowledgement if an error is found (or no acknowledgement within a timeout), and the sender resends the data. It repeats until the data is received correctly or a set number of attempts is made.
Practise this chapter
Every past-paper question on these topics, with the mark scheme.