Chapter 7: Security Issues (AS 1: Approaches to Systems Development)
Welcome to your study guide for Security Issues! In modern software development, building a fast and functional system is only half the job. If a system is not secure, sensitive data can be stolen, corrupted, or permanently lost. In this unit, you will learn how to identify potential threats to digital systems, implement robust physical and logical defenses, and design comprehensive backup and disaster recovery strategies. Don't worry if some technical terms look intimidating at first; we will break everything down step-by-step with clear real-world analogies!
---1. Understanding Threats to Digital Systems
Before we can defend a system, we must understand what we are defending it against. In computing, a threat is defined as any circumstance or event with the potential to adversely impact a system via unauthorised access, destruction, disclosure, modification of data, or denial of service.
A. Internal Threats
Internal threats originate from within an organisation—such as current employees, contractors, or trusted partners who already have legitimate physical or network access.
• Accidental Threats: Mistakes made without malicious intent. Examples include unintentionally deleting critical files, misplacing storage media, choosing weak passwords, or accidentally clicking on fraudulent links in phishing emails.
• Malicious Insider Threats: Deliberate actions taken by disgruntled or dishonest insiders. Examples include stealing proprietary company data, sabotaging databases, unauthorized privilege escalation, or corporate espionage.
B. External Threats
External threats originate from outside the organisation's security perimeter. These attackers attempt to breach defenses over the internet or through social manipulation.
1. Malware (Malicious Software):
• Viruses: Programs that attach themselves to legitimate host files and replicate when the infected file is executed.
• Worms: Standalone programs that replicate across networks automatically without needing a host program or user interaction.
• Trojans: Malicious programs disguised as useful or legitimate software to trick users into installing them.
• Ransomware: Malware that encrypts the victim's files, rendering them inaccessible until a ransom payment is made.
• Spyware & Keyloggers: Covert software that monitors user activity and records keystrokes to steal login credentials and confidential data.
2. Network Attacks:
• Distributed Denial of Service (DDoS): An attack where a network of compromised machines floods a server with overwhelming traffic, causing legitimate users to be denied service.
• Packet Interception / Sniffing: Unauthorised monitoring and capturing of data packets traveling across an unencrypted network.
• Man-in-the-Middle (MitM) Attacks: An attacker intercepts and potentially alters communication between two parties who believe they are directly communicating with each other.
3. Social Engineering:
• Phishing: Fraudulent bulk communications (usually emails) designed to trick users into revealing sensitive data or downloading malware.
• Spear-Phishing: Highly targeted phishing attacks tailored with specific personal details to deceive a specific individual or organisation.
• Shoulder Surfing: Physically looking over someone's shoulder to capture PINs, passwords, or confidential screen data.
Key Takeaway for Section 1: Threats come from both the inside (accidental or malicious insiders) and outside (malware, network assaults, and social engineering). Defense strategies must address both directions.
---2. Defending Systems: Physical vs. Logical Security
A complete security strategy uses layered defense. This involves two core branches: Physical Security (protecting the tangible hardware and facilities) and Logical Security (software-based controls protecting data and networks).
A. Physical Security Measures
• Access-Controlled Rooms: Restricting entry to server rooms using biometric door locks (fingerprint or iris scanners), electronic keypad door locks, or swipe cards / magnetic smart cards.
• Surveillance and Physical Deterrents: Installing CCTV surveillance cameras, employing on-site security guards, and using physical locking racks and equipment tethering cables to prevent hardware theft.
• Environmental & Power Protection: Using specialized fire suppression systems (gas-based to avoid water damage to circuitry) and Uninterruptible Power Supply (UPS) battery units to protect hardware from power surges or sudden outages.
B. Logical (Software) Security Measures
• Authentication: Verifying the identity of a user attempting to access the system using usernames, strong alphanumeric passwords, Multi-Factor Authentication (MFA), or biometric scans.
• Access Control & Authorisation: Implementing Role-Based Access Control (RBAC) and setting file-level permissions (such as Read, Write, Execute, and No Access) so users can only view or modify resources necessary for their specific job role.
• Firewalls: Hardware or software packet-filtering barriers that inspect incoming and outgoing network traffic against predetermined security rules, blocking unauthorised traffic.
• Anti-Malware: Security tools combining signature detection (matching known malware code patterns) and heuristic analysis (detecting suspicious behaviour) to identify, block, and quarantine threats.
• Data Encryption: Scrambling plain text into unreadable ciphertext. Symmetric encryption uses a single shared key for encryption and decryption, whereas Asymmetric encryption uses a mathematically linked public and private key pair. Encryption protects data both at rest (on storage drives) and in transit (across networks).
Examiner Focus: Authentication vs. Authorisation
Do not mix these up in your exam!
• Authentication asks: "Who are you?" (e.g. Entering a password or fingerprint to log into the network).
• Authorisation asks: "What are you allowed to do?" (e.g. A nurse can read patient charts, but only a doctor can authorise a prescription change).
Key Takeaway for Section 2: Physical security protects the physical building and hardware, while logical security uses authentication, access permissions, firewalls, and encryption to protect the software and data inside.
---3. Backup Strategies and Disaster Recovery
Even with top-tier security, hardware failures, human errors, and natural disasters can cause catastrophic data loss. Organisations must maintain a reliable backup regime and a comprehensive recovery strategy.
A. Types of Backups
1. Full Backup:
• How it works: Creates a complete copy of all data on the system.
• Pros: Restoration is fastest and simplest because all files exist in a single backup set.
• Cons: Takes the longest time to create and requires the most storage capacity.
2. Incremental Backup:
• How it works: Backs up only the files that have changed or been created since the last backup of any kind (full or incremental).
• Pros: The daily backup process is extremely fast and uses minimal storage space.
• Cons: Restoration is the slowest and most complex. To restore, you must restore the last Full backup, followed by every single subsequent incremental backup in exact sequential order.
3. Differential Backup:
• How it works: Backs up all files that have changed since the last Full backup.
• Pros: Restoration is faster and simpler than incremental. You only need the last Full backup plus the single latest differential backup.
• Cons: Backup time and storage requirements grow larger each day until the next full backup is performed.
B. Grandfather-Father-Son (GFS) Rotation Scheme
The GFS scheme is a standard schedule used to manage backup media across time cycles:
• Son: Daily backups (usually incremental or differential).
• Father: Weekly backups (usually a full backup taken at the end of each week).
• Grandfather: Monthly backups (a full backup preserved long-term at the end of each month).
C. Off-site and Cloud Storage
Storing backups in the same room or building as the original server creates a single point of failure. If a fire, flood, or break-in occurs, both the live data and the backups are destroyed. Backups must be stored off-site in a separate physical location or uploaded to secure cloud storage.
D. Disaster Recovery Plan (DRP)
A Disaster Recovery Plan (DRP) is a documented, structured protocol outlining how an organisation will restore operations following a critical incident. A comprehensive DRP includes:
• Defined Responsibilities: Identifying key personnel and emergency response roles.
• Hardware Procurement: Protocols for obtaining replacement servers and network equipment quickly.
• Restoration Sequences: Prioritising which mission-critical databases and services are restored first.
• Business Continuity: Operational workarounds to keep vital business services running while systems are being rebuilt.
Key Takeaway for Section 3: Incremental backups save time during daily operations but take longer to restore. Differential backups balance backup time with a straightforward two-step restore (Last Full + Latest Differential). A DRP ensures the business can recover quickly when an emergency strikes.
---4. Exam Technique & Avoiding Common Pitfalls
• Avoid Vague Terms: Never write "they should install software" or "make it secure." Use precise technical terminology such as hardware packet-filtering firewall, heuristic anti-malware, multi-factor authentication, or role-based access control.
• Master the Restoration Logic: If an exam question asks what is needed to restore data after a Friday crash:
- For Incremental: Sunday Full + Monday Inc + Tuesday Inc + Wednesday Inc + Thursday Inc.
- For Differential: Sunday Full + Thursday Differential.
• Context Matters: For extended-response (QWC) questions, always tailor your physical and logical security recommendations to the given scenario (e.g. medical records in a hospital, online banking platforms, or e-commerce databases).
Quick Chapter Summary
• Threats: Internal (accidental error or malicious insider) and External (malware, DDoS, MitM, phishing).
• Physical Security: Biometrics, swipe cards, CCTV, UPS, fire suppression.
• Logical Security: Authentication (identifying users), Authorisation / RBAC (permissions), Firewalls, Anti-malware, and Encryption (symmetric / asymmetric).
• Backups: Full, Incremental, Differential, and the Grandfather-Father-Son (GFS) rotation scheme.
• Disaster Recovery: Documented DRP procedures ensure business continuity and quick data restoration from off-site or cloud storage.