D2 - Protecting Data

Question 1

What is File Permission?

Answer 1

You can set who can access the files and what they can do with them.

Question 2

What are the 3 main types of file permission and what do they do?

Answer 2

• Read Only: Files can be opened and viewed but not edited
• Read/Write: Files can be opened, viewed and edited
• Full control: Files can be opened, viewed, edited, modified and deleted

Question 3

what are the benefits of file permission?

Answer 3

protects from all threats, but especially from hacking (malicious way to gain access to data) and accidental damage.

Question 4

What are Access Levels?

Answer 4

Users are assigned an access level that is associated with their user profile login- which defines what software, data and services they are able to access.

Question 5

what are the two type pf access level and how much can we access?

Answer 5

• Administrator access : Highest level. User can access all folder with full control. They are able to alter the permission of other users and can install and delete software
  -Lowest end level: User have very limited power. They are able to access a limited amount of file and software required to perform task required

Question 6

What is a benefit of Access Level?

Answer 6

More security is insured due to the fact that users are not permitted to make installs of programs which may be malicious and that they may not have the knowledged about

Question 7

What is a benefit of Access Level?

Answer 7

More security is insured due to the fact that users are not permitted to make installs of programs which may be malicious and that they may not have the knowledge about

Question 8

What is backup and recovery procedures?

Answer 8

• To prevent loss of data, organizations and individuals take regulars back up of their data. Back up is the process of copying data and storing it in a secondary location in case of loss or damage to initial data.
• The secondary location is not within the same building. This is known as remote backup, where the data is stored somewhere else to prevent loss in case something happens to the original device

Question 9

What are the main type of backup and recovery procedures?

Answer 9

• Full Backup: A complete backup of data which provides excellent protection - however can be time consuming and requires a lot of storage
• Incremental Backup: Only data that has been changed since previous backup get saved (e.g editing a word document).Less time consuming and less storage is used up
• Differential backup : A mixture of the two previous back up. e.g at the start of the week make a full backup and throughout the week make incremental backups

Backups can be very long and can cost businesses a lot of money, therefore the time and the type of backup made depends on the business

Question 10

Passwords

Answer 10

It is a mainly used method of prevention against unauthorized access to their systems, software and user profiles.
It is important to have a strong password, that is not shared, a mixture of letters, characters and numbers and different from different systems

Question 11

Physical Access Control

Answer 11

Used to protect IT systems. Designed to protect from malicious uses from gaining access to IT systems, such as theft of equipment, loading malware onto systems and stopping hacking can be stopped.

Question 12

What are the different types of PAC?

Answer 12

• Access Cards: Cards required to be scanned or checked by security guards before gaining access of a site or a room.
• Keypad Access Control: A system that requires a passcode before gaining access, can be used on its own or alongside an access cards
• Biometric Access Control: A system that makes use of biometric data by scanning them to gain access. e.g face id, finger print, iris. Can be used alongside previous methods
• Electronic lock: These is to secure that without the use of the previous method of PAC, doors cannot be unlocked.

Question 13

What are Digital Certificates?
(Public Key Certificate)

Answer 13

A method to authenticate a user as the owner of the a public key which will allow them to make use of the the public key infrastructure to access secured encrypted communication that is shared over the internet.
They ensure security through digital signature to verify identity

Question 14

What are Protocols?

Answer 14

A set of rules that defines a method for transmitting data between different devices over a network. These protocols provide a secure encrypted format over the internet. With the use of protocols and public key, ensures that if data is intercepted by malicious users or for not authorized users, data cannot be read or misused

Question 15

What is an Anti-Virus?

Answer 15

• An utility programs used to prevent malicious software from having an impact on your computer or detect them and removed malicious software that has already infected the computer

Question 16

How do antiviruses work?

Answer 16

• Signature detection: Malware is analyzed and identify a patter (which is known as signature) for the malware code. Which then is sued to compare to programs on the hard disk to identify the viruses.
• Heuristics detection: Identify malware without the virus signature. This can be done by monitoring the behavior of programs and then detecting anything suspicious

Question 17

Features of anti viruses:

Answer 17

• Scheduled scans that can be set to run automatically at specific times each day.
• Full scans initiated on demand for your entire hard-disk, specific folders or even external storage devices.
• Full scans initiated on demand for your entire hard-disk, specific folders or even external storage devices.

Question 18

What are the implications of antiviruses ?

Answer 18

• Must be regularly maintained
• It doesn’t offer total protection
• Can slow down PC and network performance as it occupies a lot of space

Question 19

What are firewalls?

Answer 19

Hardware devices or utility programs used to monitor incoming and outgoing network traffic and block suspicious traffic. This is done by packets filtering which is when the firewall inspects by inspecting each data packet and compare it to pre-defined security rules, and flag whichever packets that do not follow these rules

Question 20

What are the main features of firewalls?

Answer 20

• Content filtering is where certain traffic is allowed through and some is not
• Controlling which programs can access the local area network/internet. It can alsomonitor the applications that are listening for incoming network connections
• Controlling which programs can access the local area network/internet. It can alsomonitor the applications that are listening for incoming network connections

Question 21

What are the implications of firewalls?

Answer 21

• Controlling which programs can access the local area network/internet. It can alsomonitor the applications that are listening for incoming network connections
• Productivity can be impaired as content required to perform a task may be blocked by the firewall
• Firewalls cannot prevent internal attacks from within the network
• Don’t offer total protection

Question 22

What is encryption?

Answer 22

is where data is converted into an encoded form so as to prevent unauthorized access. There are two types of data we encrypt, and each uses different methods. These two types are stored data and transmitted data

Question 23

What is stored data?

Answer 23

also known as data at rest, sometimes needs to be encrypted. While you might feel it is secure on your computer, if someone gains access to it, they will be able to read any data on your device
- Stored data is usually encrypted using symmetric encryption. This is also sometimes known as private-key encryption. With symmetric encryption, we use the same key to both encrypt and decrypt the data

Question 24

What are the implications to encrypting data at rest (stored data)?

Answer 24

• If you lose the encryption key then you will never be able to decrypt your data back to its original plaintext form. The data will be gone forever.
• The sharing of the encryption key can compromise security as the key could be intercepted. This is why we don’t use it for encrypting data during transmission.

Question 25

What is Data During Transmission?

Answer 25

• , also known as data in transit, requires encryptionwhen the data you are sending is private and personal. This is because it can be intercepted by a malicious user and misused
• We encrypt data in transit using asymmetric encryption. This is commonly known as public-key encryption.With asymmetric encryption, we use differentkeys to encrypt and decrypt the data
• When the recipient wants to decrypt the data they will use their private key. This is kept completely private to the recipient and is not in the digital certificate. The public key cannot decrypt the data.

Question 26

What are the implications with Data during Transmission?

Answer 26

• If working with large quantities of data this can have a real impact on your processing power. It involves quite complicated mathematics and is more processor intensive than symmetric encryption.

Question 27

What are the legislations that have been been implemented in order to protect data and IT systems from harm?

Answer 27

• Data Protection Act (1998)– protects how individuals data can be used and handled.
• Computer Misuse Act (1990)– protects against the willful harm & damage of IT systems & data.

Question 28

What are codes of practice?

Answer 28

These are not laws but ratherguidelines to help organizations follow best practice and comply with laws, such as the Data Protection Act
- The ICO is responsible for enforcing the Data Protection Act and so the codes of practicethey produce on the use and handling of data are particularly important. They produce codes of practice not just for the organization, but also for individuals so that they know their rights and how to use them.