Welcome to Security Issues in Digital Technology!
Hello and welcome! In this chapter of AS 1: Approaches to Systems Development, we explore one of the most critical aspects of modern computing: Security. Whenever systems analysts and developers build a digital system, keeping data safe from harm, theft, and loss is a top priority.
Don't worry if security terminology seems overwhelming at first. We will break down every concept into small, easy-to-digest parts with simple everyday analogies and memory tricks.
1. Threats to Systems and Data
A threat is any potential event or action that can damage, disrupt, or steal data and computer systems. We can group these threats into distinct categories.
A. Malicious Software (Malware)
Malware is short for "malicious software". It is code written specifically to disrupt, damage, or gain unauthorised access to a system.
• Viruses: Programs that attach themselves to legitimate files and replicate when the infected file is opened. Analogy: A biological cold virus that needs a host to spread.
• Worms: Self-replicating programs that spread across networks automatically without needing a host file or user action. They often consume huge amounts of network bandwidth.
• Trojan Horses: Malware disguised as harmless or useful software (such as a free game or utility). Once installed, it unleashes a malicious payload in the background. Analogy: The Greek wooden horse trick!
• Ransomware: Software that encrypts the victim's files, making them inaccessible, and demands payment (a ransom) to unlock them.
• Spyware: Software that secretly monitors user activity (like logging keystrokes, known as a keylogger) and sends personal details (passwords, bank details) back to an attacker.
• Adware: Software that automatically displays unwanted advertisements, frequently redirecting web searches to revenue-generating pages.
B. Social Engineering
Social engineering involves manipulating and tricking people into giving away confidential information or making security mistakes.
• Phishing: Sending fraudulent emails that pretend to be from legitimate organisations (like banks or school portals) to trick users into revealing sensitive details like passwords.
• Pharming: Malicious code installed on a user's computer or server that silently redirects them to a fake, lookalike website even when the user types the correct web address.
• Pretexting (Blagging): Inventing a fake scenario or pretense to trick a victim into giving away private information (e.g., pretending to be an IT support technician on the phone).
• Shoulder Surfing: Looking over someone's shoulder while they type a PIN, password, or sensitive information on a screen or keypad.
C. Network and Direct Attacks
• Hacking / Unauthorised Access: Attempting to bypass security mechanisms to gain entry to computer systems without permission.
• Denial of Service (DoS) and Distributed Denial of Service (DDoS): Flooding a server or network with millions of fake traffic requests to overwhelm it, causing the service to crash or become unavailable to genuine users. A DDoS attack uses multiple computers (a botnet) spread around the world to launch the attack at the same time.
• Data Interception (Eavesdropping / Packet Sniffing): Intercepting packets of data as they travel across an unencrypted network (e.g., public Wi-Fi) to steal confidential information.
D. Human Error and Physical Threats
Not all security issues are caused by hackers. Many happen accidentally:
• Accidental deletion / modification: An employee accidentally deleting a database file.
• Physical theft: Laptops, backup drives, or servers being stolen.
• Natural disasters / Environmental threats: Fires, floods, power cuts, or hardware failures damaging physical equipment.
Quick Review & Takeaway: Threats come in software forms (malware), human manipulation (social engineering), network attacks (DoS, hacking), and physical/accidental events. Always check the scenario in exam questions to identify which specific threat is present!
2. Software and Logical Security Measures
Now that we know the threats, how do developers and systems administrators protect digital systems? Logical controls use software and data protection techniques.
A. Authentication and Access Control
Authentication is the process of proving who you are before being granted access.
• Usernames and Passwords: The most common method. Strong passwords should include uppercase letters, lowercase letters, numbers, and symbols, and be changed regularly.
• Biometrics: Using unique biological characteristics (e.g., fingerprint scanners, facial recognition, iris scanners). Biometrics are extremely hard to forge or steal.
• Multi-Factor Authentication (MFA / 2FA): Requiring two or more different forms of evidence to log in. Usually a combination of:
1. Something you know (password/PIN)
2. Something you have (smartphone notification, security token)
3. Something you are (fingerprint/face scan)
• User Access Levels (Permissions): Granting users access only to the data and files they strictly need for their job. For example, a student can view their own grades, but only the teacher has permission to edit them.
B. Firewalls
A firewall can be hardware, software, or both. It sits between a private network and the internet, inspecting all incoming and outgoing data packets against a set of predefined security rules. It blocks unauthorised traffic while permitting legitimate communication.
Analogy: A security guard checking ID badges at the entrance gate of a building.
C. Antivirus and Anti-Spyware Software
Antimalware software scans files and memory for known patterns of malicious code (called signatures or definitions). It isolates (quarantines) or deletes detected malware.
Important Exam Tip: Antivirus definitions must be updated regularly to protect against brand-new viruses (known as zero-day threats).
D. Encryption
Encryption is the process of scrambling readable data (plaintext) into an unreadable format (ciphertext) using a mathematical algorithm and a secret key.
• If an attacker intercepts encrypted data, they cannot read or understand it without the decryption key.
• Encryption at rest: Encrypting files saved on hard drives or USB sticks.
• Encryption in transit: Encrypting data as it travels across networks (such as using HTTPS and SSL/TLS for online banking).
E. Patch Management (Software Updates)
Software often contains bugs and vulnerabilities that hackers discover over time. Developers release patches and updates to fix these security loopholes. Keeping the operating system and applications updated prevents exploits.
Key Takeaway: Logical security involves stopping intruders via access controls (passwords, biometrics, MFA), filtering traffic (firewalls), scanning files (antivirus), and scrambling data (encryption).
3. Physical and Procedural Safeguards
Great software security is useless if a thief can simply walk into an office and steal the hard drive! Systems development requires physical and procedural safeguards too.
A. Physical Security Controls
• Locked doors and server rooms: Using keypads, swipe cards, or biometric locks to restrict physical access to servers and networking equipment.
• CCTV Cameras: Monitoring building entrances and server rooms.
• Security Guards: Controlling who enters the premises.
• Cable locks / Kensington locks: Physically chaining desktop computers and laptops to desks.
• Clean Desk Policy: Ensuring sensitive documents and portable media are locked away in drawers when employees leave their desks.
B. Backup Strategies
A backup is a copy of data stored in a separate, secure location so it can be restored if data is lost, corrupted, or infected with ransomware.
• Full Backup: A complete copy of every single file on the system. It takes the longest to create and uses the most storage, but is the quickest and easiest to restore.
• Incremental Backup: Only backs up files that have been created or changed since the last backup (whether full or incremental). It is very fast to create daily, but restoring requires the original full backup plus all subsequent incremental backups.
• Differential Backup: Backs up all files that have changed since the last full backup. It takes longer each day than incremental, but restoring only requires the full backup and the latest differential backup.
• Off-site / Cloud Backups: Storing backup copies in a different physical building or in the cloud. If the main office burns down or gets flooded, the data remains safe.
C. Policies and Staff Training
Human beings are often called the "weakest link" in system security. Organisations use clear rules and training to minimise risk:
• Acceptable Use Policy (AUP): A document outlining rules that employees and users must follow when using computer equipment (e.g., no personal USB drives, rules on downloading software, safe browsing).
• Disaster Recovery Plan (DRP): A step-by-step emergency plan detailing how an organisation will restore data, hardware, and operations after a catastrophe (such as a fire or severe cyberattack).
• Staff Training: Teaching staff how to spot phishing emails, use strong passwords, and avoid social engineering tricks.
4. Summary and Exam Revision Tips
Common Exam Mistakes to Avoid
• Confusing Phishing and Pharming: Remember, phishing uses fake emails and direct links to bait you, whereas pharming redirects your web browser without your knowledge by hijacking DNS settings or modifying host files.
• Vague answers: Never just write "make a backup" or "use security". Specify: "Perform regular automated incremental backups stored in an off-site cloud server" or "Install a software firewall to inspect incoming network packets".
• Forgetting the human element: If asked how a company can prevent security breaches, include procedural safeguards like staff training alongside technical tools like firewalls.
Quick Memory Trick: The Security "P"s
When reviewing security measures, remember the three Ps:
1. Programs (Logical): Firewalls, Antivirus, Encryption, MFA.
2. Physical: Biometric door locks, CCTV, Cable locks, Server rooms.
3. People & Policies (Procedural): AUP, Backups, Staff training, Disaster recovery plans.