WHAT YOU SHOULD ALREADY KNOW

Try these five questions before you read the first part of this chapter.

1. a) What is meant by hacking?

b) Is hacking always an illegal act? Justify your answer.
2. Contactless credit cards and debit cards are regarded by some as a security risk. Discuss the
advantages and disadvantages of using contactless cards with particular reference to data
security.
3. What are the main differences between cracking and hacking?
4. a) What are pop-ups when visiting a website? Are they a security risk?
b) What are cookies? Do cookies pose a security threat?
c) Describe: i) session cookies ii) permanent cookies iii) third party cookies.
5. Why must the correct procedures be carried out when removing a memory stick from a
computer.

KEY TERMS
Data privacy – the privacy of personal information, or other information stored on a
computer, that should not be accessed by unauthorised parties.
Data protection laws – laws which govern how data should be kept private and secure.
Data security – methods taken to prevent unauthorized access to data and to recover data if
lost or corrupted.
User account – an agreement that allows an individual to use a computer or network server,
often requiring a user name and password.
Authentication – a way of proving somebody or something is who or what they claim to be.
Access rights (data security) – use of access levels to ensure only authorised users can gain
access to certain data.
Malware – malicious software that seeks to damage or gain unauthorised access to a
computer system.
Firewall – software or hardware that sits between a computer and external network that
monitors and filters all incoming and outgoing activities.
Anti-spyware software – software that detects and removes spyware programs installed
illegally on a user’s computer system.
Encryption – the use of encryption keys to make data meaningless without the correct
decryption key.
Biometrics – use of unique human characteristics to identify a user (such as fingerprints or
face recognition).
Hacking – illegal access to a computer system without the owner’s permission.
Malicious hacking – hacking done with the sole intent of causing harm to a computer system
or user (for example, deletion of files or use of private data to the hacker’s advantage).
Ethical hacking – hacking used to test the security and vulnerability of a computer system.
The hacking is carried out with the permission of the computer system owner, for example, to
help a company identify risks associated with malicious hacking of their computer systems.
Phishing – legitimate-looking emails designed to trick a recipient into giving their personal
data to the sender of the email.
Pharming – redirecting a user to a fake website in order to illegally obtain personal data
about the user.
DNS cache poisoning – altering IP addresses on a DNS server by a ‘pharmer’ or hacker with
the intention of redirecting a user to their fake website.

1. DATA PRIVACY
Data stored about a person or an organisation must remain private and unauthorised access to
the data must be prevented – data privacy is required.
This is achieved partly by data protection laws. These laws vary from country to country, but
all follow the same eight guiding principles.
Data protection laws usually cover organisations rather than private individuals. Such laws are
no guarantee of privacy, but the legal threat of fines or jail sentences deters most people.
Ex. 1.
Fill in the gaps in the guiding principles using words and phrases from the box. There
are 2 extra words.

relevant necessary must rights stated

secure fairly transferred can laws

1. Data must be _________ and lawfully processed.

2. Data can only be processed for the _________ purpose.
3. Data must be adequate, _________ and not excessive.
4. Data _________ be accurate.
5. Data must not be kept longer than _________.
6. Data must be processed in accordance with the data subject’s _________.
7. Data must be kept _________.
8. Data must not be _________ to another country unless that country also has adequate
protection.

2. PREVENTING DATA LOSS AND RESTRICTING DATA ACCESS.

BEFORE YOU READ:
- Write a definition of ‘data security’
- In pairs discuss any ways to prevent data loss and to restrict data access that you
know.

DEFINITION:

WAYS OF PREVENTING DATA LOSS AND RESTRICTING DATA ACCESS:

Data security refers to the methods used to prevent unauthorised access to data, as well as to
the data recovery methods if it is lost.

User accounts
User accounts are used to authenticate a user (prove that a user is who they say they are).
User accounts are used on both standalone and networked computers in case the computer can
be accessed by a number of people. This is often done by a screen prompt asking for a
username and password.
User accounts control access rights. This often involves levels of access. For example, in a
hospital it would not be appropriate for a cleaner to have access to data about one of the
patients. However, a consultant would need such access. Therefore, most systems have a
hierarchy of access levels depending on a person’s level of security. This could be achieved
by username and password with each username (account) linked to the appropriate level of
access.

Use of passwords
Passwords are used to restrict access to data or systems. They should be hard to crack and
changed frequently to retain security. Passwords can also take the form of biometrics (such as
on a mobile phone, as discussed later). Passwords are also used, for example, when
» accessing email accounts
» carrying out online banking or shopping
» accessing social networking sites.
It is important that passwords are protected. Some ways of doing this are to
» run anti-spyware software to make sure your passwords are not being relayed to whoever
put the spyware on your computer
» regularly change passwords in case they have been seen by someone else, illegally or
accidentally
» make sure passwords are difficult to crack or guess (for example, do not use your date of
birth or pet’s name).
Passwords are grouped as either strong (hard to crack or guess) or weak (relatively easy to
crack or guess). Strong passwords should contain
» at least one capital letter
» at least one numerical value
» at least one other keyboard character (such as @, *, &)
Example of a strong password: Sy12@#TT90kj=0
Example of a weak password: GREEN

Ex. 2. Which of the following are weak passwords and which are strong passwords?
Explain your decision in each case.
a) 25-May-2000
b) Pas5word
c) ChapTer@06
d) AbC*N55!
e) 12345X

Digital signatures
Digital signatures protect data by providing a way of identifying the sender of, for example,
an email.

Use of firewalls
A firewall can be software or hardware. It sits between the user’s computer and an external
network (such as the internet) and filters information in and out of the computer. This allows
the user to decide to allow communication with an external source and warns a user that an
external source is trying to access their computer. Firewalls are the primary defence to any
computer system to protect from hacking, malware (viruses and spyware), phishing and
pharming.

The tasks carried out by a firewall include

» examining the traffic between the user’s computer (or internal network) and a public
network (such as the internet)
» checking whether incoming or outgoing data meets a given set of criteria
» blocking the traffic if the data fails to meet the criteria, and giving the user (or network
manager) a warning that there may be a security issue
» logging all incoming and outgoing traffic to allow later interrogation by the user (or network
manager)
» preventing access to certain undesirable sites – the firewall can keep a list of all undesirable
IP addresses
» helping to prevent viruses or hackers entering the user’s computer (or internal network)
» warning the user if some software on their system is trying to access an external data source
(such as an automatic software upgrade). The user is given the option of allowing it to go
ahead or request that such access is denied.

The firewall can be a hardware interface which is located somewhere between the computer
(or internal network external link) and the internet connection. In these cases, it is often
referred to as a gateway. Alternatively, the firewall can be software installed on a computer,
sometimes as part of the operating system.
However, sometimes the firewall cannot prevent potential harmful traffic. It cannot
» prevent individuals, on internal networks, using their own modems to by-pass the firewall
» control employee misconduct or carelessness (for example, control of passwords or user
accounts)
» prevent users on stand-alone computers from disabling the firewall.
These issues require management and/or personal control to ensure the firewall can work
effectively.

Antivirus software
Running antivirus software in the background on a computer will constantly check for virus
attacks. Although different types of antivirus software work in different ways, they all
» check software or files before they are run or loaded on a computer
» compare possible viruses against a database of known viruses
» carry out heuristic checking (check software for behaviour that could indicate a virus, which
is useful if software is infected by a virus not yet on the database)
» quarantine files or programs which are possibly infected and
– allow the virus to be automatically deleted, or
– allow the user to make the decision about deletion (it is possible that the user knows that the
file or program is not infected by a virus – this is known as a false positive and is one of the
drawbacks of antivirus software).
Antivirus software needs to be kept up to date since new viruses are constantly being
discovered. Full system checks need to be carried out regularly (once a week, for example),
since some viruses lie dormant and would only be picked up by this full system scan.

Ex. 3. Explain how firewall and antivirus software help prevent malware infections in
digital devices and networks. Provide information about the differences between the
two.

Ex. 4. Describe anti-spy software, encryption, biometrics, fingerprint scans and retina
scans. Compare your answers with a partner.
Ex. 5. Match terms with definitions.
1. Hacking
a. Malicious programs that replicate by attaching to other software,
2. Malware aiming to corrupt files or damage systems, requiring an active host
3. Viruses program or already infected system to function.
b. Programs that automate tasks on the internet; while sometimes
4. Worms
helpful, they can take control of a computer to launch attacks.
5. Logic Bombs c. Malicious software disguised as legitimate programs, replacing
6. Trojan horses parts of genuine software to compromise or damage the user’s
system.
7. Bots
d. Malicious software designed to harm or exploit any programmable
8. Spyware device or network, compromising the integrity and security of
9. Phishing data.
e. A fraudulent technique using legitimate-looking emails to trick
10. Pharming
users into sharing personal data by clicking links or attachments
that lead to fake websites or prompt them to respond with
sensitive information.
f. Unauthorized or authorized access to a computer system.
Malicious hacking involves illegal access to alter, delete, or steal
data, while ethical hacking is permitted by companies to test
system security.
g. Stand-alone malicious software that self-replicates and spreads
across networks to exploit vulnerabilities in other computers.
h. The use of malicious code on a user’s computer or web server to
redirect the user unknowingly to a fake website, often resembling
a trusted site, to steal personal data for fraud or identity theft.
i. Software that monitors user activity, such as keystrokes, to collect
and send data to the originator, often used for keylogging.
j. Malicious code embedded within legitimate software, activated by
specific conditions (e.g., a certain date) to perform harmful tasks
like deleting files or transferring data to a hacker.

1 2 3 4 5 6 7 8 9 10
Ex. 6. In pairs, add more ways of protection against phishing and pharming.

PHISHING PHARMING
Coursebook - Users need to be aware of new - using antivirus software,
ideas phishing scams. Those people in which can detect unauthorised
industry or commerce should alterations to a website
undergo frequent security address and warn the user
awareness training to become - checking the spelling of
aware of how to identify phishing websites
(and pharming) scams. - checking for https and/or the
- Look out for https and/or the green padlock symbol in the
green padlock symbol in the address bar.
address bar (both suggest that
traffic to and from the website is
encrypted).
- Regularly check online accounts
and frequently change passwords.
Students’ ideas