Methods to detect and prevent cyber security threats

Welcome to the Cybersecurity Toolkit!

Hello future digital defenders! In this chapter, we are learning some of the most essential skills in Computer Science: how to protect systems and data from cyber threats. We've talked about the scary threats (malware, phishing, etc.), and now we focus on the good news: we have powerful tools to stop them!

Think of this chapter as learning how to build a high-security vault for all your precious digital information. Ready to become an expert digital bodyguard? Let's dive in!

Key Learning Objectives

• Understand the role of password systems, biometrics, and firewalls.
• Explain how CAPTCHA and email confirmations prevent automated attacks and verify identity.
• Explain why strong authentication (like 2FA) is vital.
• Describe how encryption keeps data secret.
• Recognise the importance of automatic software updates, patches, and backups.

Section 1: Preventing Access – The Front Door Security

The easiest way to stop a threat is to never let the attacker through the front door. This involves setting up strong rules about who can access the system and verifying who is trying to interact with it.

1. Strong Authentication and Password Systems

Authentication is the process of proving you are who you say you are. The most common form is the password, but a weak password is like having no lock at all!

How to Create Strong Passwords (Prevention Method)

• Length: Longer passwords (12+ characters) are much harder to crack.
• Complexity: Use a mix of uppercase letters, lowercase letters, numbers, and special characters (e.g., #, $, @).
• Uniqueness: Never reuse passwords across different accounts. If one account is breached, all your others are safe.

Analogy: A weak password ("12345") is like leaving your key under the doormat. A strong password ("P@ssw0rd*4TheWin!") is like a complex combination lock.

2. Biometric Measures

Biometrics use unique physical or behavioural characteristics to authenticate a user, commonly used on mobile devices and laptops.

• Fingerprint scanners: Reads the unique pattern of ridges on a finger.
• Facial recognition: Analyses facial features using cameras and sensors.
• Iris or voice recognition: Identifies unique patterns in the eye or voice.

Advantage: Biometrics are extremely difficult to steal or copy compared to written passwords, and the user cannot forget them.

3. Two-Factor Authentication (2FA)

Even strong passwords can sometimes be guessed or stolen (e.g., through phishing). Two-Factor Authentication (2FA) adds a crucial second layer of security by requiring two different types of evidence before granting access.

The three main 'factors' are:

1. Something you Know (e.g., a password or PIN)
2. Something you Have (e.g., a mobile phone to receive a code, or a physical security token)
3. Something you Are (e.g., a fingerprint or facial scan – Biometrics)

4. CAPTCHA

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge-response test designed to determine whether the user is a human or an automated bot.

• How it works: Users might be asked to type distorted text, select specific images (e.g., all pictures containing traffic lights), or click a checkbox that analyses mouse movements.
• Why it is used: Automated programs (bots) struggle to interpret distorted visual clues. This prevents brute-force login attempts, automated spam, and mass fake account registrations.

5. Email Confirmations

Using email confirmations helps confirm a user's identity when registering an account, changing sensitive account details, or resetting a forgotten password.

• The system sends a unique activation link or one-time verification code to the registered email address.
• The user must access the email and click the link or input the code to confirm they own that email address before the action is authorised.

6. Access Levels (User Permissions)

Once a user is logged in, their access level determines what actions they are allowed to perform. This is based on the principle of Least Privilege.

Only users who absolutely need Administrative (Admin) rights (the ability to install software, delete accounts, or change core settings) should have them. Most employees or students only need basic User rights.

Why this helps: If an attacker steals the login details of a low-level 'User', they can only damage the files belonging to that user. If they steal 'Admin' details, they could potentially compromise the entire network.

Section 2: Network Defences – The Digital Gatekeepers

Now we look at the tools that monitor all the data moving in and out of a network, constantly looking for trouble.

1. Firewalls (Detection and Prevention)

A Firewall is essential security software (or hardware) that acts as a barrier between your private network (like your home computer or a school system) and the outside internet.

Analogy: Think of a firewall as a strict security guard at the entrance to a building. Every person (data packet) coming in or going out must show their ID and state their purpose.

How Firewalls Work:

The firewall filters network traffic based on a set of pre-determined rules. It examines:

• Source Address: Where the data came from.
• Destination Address: Where the data is trying to go.
• Port Number: Which application (like a web browser or email client) the data is using.

If the data packet meets the rules, the firewall allows it through. If it violates a rule (e.g., trying to access a blocked server or using an unusual port), the firewall blocks the connection.

Detection Role of a Firewall

While mainly preventive, firewalls detect and log suspicious connection attempts. These logs are vital for administrators to spot attempted attacks.

2. Anti-Malware Software (Detection and Prevention)

Anti-malware software (often called Anti-Virus) is designed to detect, quarantine, and eliminate malicious software like viruses, worms, and spyware.

How Anti-Malware Detects Threats:

Anti-malware uses two main methods to spot trouble:

1. Signature Matching (Detection): The software maintains a database of known malware "signatures" (unique digital fingerprints). It scans files and compares them against this list. If there is a match, the file is identified as malware.
2. Heuristic Analysis (Detection): Used to spot new or unknown malware by monitoring programs for suspicious behaviour (e.g., trying to modify core system files or encrypt files rapidly).

Remember: Anti-malware must be constantly updated to receive the latest signature database to protect against new threats!

Section 3: Protecting Data – Making Information Useless to Thieves

Sometimes, despite all our prevention methods, an attacker might still manage to intercept a transmission or steal a file. This is where Encryption comes in.

1. Encryption (Prevention)

Encryption is the process of scrambling data so that it becomes unreadable (useless) to anyone who doesn't have the secret key needed to unlock it.

The Process of Encryption

1. The original readable data is called Plain Text.
2. The Plain Text is passed through an Encryption Algorithm (a mathematical process).
3. An Encryption Key (a secret sequence of characters) is applied during the process.
4. The result is the scrambled, unreadable data called Cipher Text.

To reverse the process (decryption), the recipient must use the corresponding decryption key.

Even if a cyber thief intercepts the Cipher Text, without the unique key, the data looks like random gibberish and cannot be read.

Section 4: System Health and Recovery

Cybersecurity isn't just about initial defences; it is also about ongoing maintenance and having a plan when things go wrong.

1. Automatic Software Updates and Patches (Prevention)

A Vulnerability is a flaw or weakness in software that an attacker could exploit to gain access or cause damage.

A Patch is an update released by developers specifically to fix a known vulnerability.

Automatic Software Updates ensure that security patches and fixes are downloaded and installed as soon as they become available without relying on the user to remember. This prevents attackers from exploiting known, publicly documented vulnerabilities.

2. Data Backups (Recovery)

Even strong security systems can experience failures, hardware crashes, or ransomware attacks. A Data Backup is making duplicate copies of data so that the original information can be restored.

Essential Backup Procedures:

• Regularity: Backups should be performed frequently (daily or weekly depending on data changes).
• Verification: Test the backup to confirm the data can be restored properly.
• Offsite/Offline Storage: Backups should be stored offline (disconnected from the network) or offsite so that malware (such as ransomware) cannot infect the backup copy too.