Data Security Flashcards
What are the four main threats to data security?
Hardware failure/fault
Software failure
Human error
Deliberate/Malicious damage or access
What is data integrity?
The correctness of the data
What is data privacy?
not allowing unauthorised people to access the data
What is data security?
a term used for methods that try to ensure that integrity and/or privacy of data is maintained
Name 3 examples of hardware failure/fault
hard-disk failure, data corruption during data transfer and power failure while saving file
Name 2 examples of software failure
programming error which causes program to crash without data being saved, software not installed correctly
Name 3 examples of Deliberate/Malicious damage or access
a disgruntled ex-employee deletes important files, a virus infects PC and deletes information (or transmits to an unauthorised person), a hacker guesses a login and password and gains access to information
Name 3 ways you can protect data against hardware failure
UPS - uninterruptable power supplies - if power fails work of battery
Secondary backup power supply
Have backups (maybe off-site) of data
Name 2 ways you can protect data against software failure
Difficult/impossible to entirely sop data loss through software failure
Buy tried and tested software that has been used for a while to ensure problems have been ironed out.
Backup/recovery systems.
Name 3 ways you can protect data against Human Error
Warnings if data is being deleted
Access rights on files so that only data that user can access can be corrupted
Backups
Name 3 ways you can protect data against Malicious Intent
Login/Password/Biometrics
data transmitted across networks should be encrypted
firewalls
Why is disaster planning important?
Many organisations rely on computer systems and could not continue/survive if system data lost or failed for anything but a short time (e.g. online retailers)
What are the elements of disaster planning?
Regular backups (off-site) is the most important thing
Files archived off-site
Alternative systems
Backup power supplies, etc.
Staff need to be trained in how to recover successfully
What is a disaster plan?
A disaster plan is a vital document in any organisation to give guidance as to what the organisation will do in the event of different disasters occurring.
What is a contingency plan?
a method of recovery for a risk that has been identified
What is accidental damage?
When data is unintentionally amended or deleted;
People likely to cause accidental damage to data by deleting or amending data by accident.
What is malicious damage?
When data is intentionally amended or deleted;
Hackers likely to cause malicious damage to data
Disgruntled store employees deleting or amending data on purpose.
What is encryption used for?
Used to hide sensitive information from illegitimate recipients by using encryption algorithms and an encryption key to convert plain text to cypher text.
It will be illegible to those without the encryption and decryption key
What are the two methods of key encryption?
Symmetric key encryption
Public key (asymmetric) encryption
What is encryption?
Encryption is the process of changing data, using an algorithm, into a format that cannot be interpreted before being transmitted over the Internet.
When the encrypted data is received at the correct destination, another algorithm is applied to change it back into its original format.
What is plain text?
The term for the unencrypted message or text
What is cipher text?
The name given to the encrypted text
What is decryption?
The process of converting cipher text back into plain text
What is symmetrical encryption?
A symmetric encryption is one where knowing the encryption algorithm enables the decryption algorithm / key to be easily programmed.
Symmetric encryption is where you take a plaintext message and use public key to encrypt the message. The same public key can be used to decrypt the message.
What is symmetric key encryption?
The sender and receiver of a message share a single, common key (private key) that is used to encrypt and decrypt the message.
If the receiving system does not know the secret key, then it cannot decrypt the message.
What are the risks of symmetric key encryption?
If the secret key is sent across a network and is intercepted, a hacker is able to decrypt the data and so is not generally used for this;
If someone does get hold of the secret key this can cause a lot of damage because everything that has been encrypted with the key can be read;
Symmetric encryption is very fast (compared to asymmetric encryption);
What is asymmetric key encryption?
Known as public/private key encryption is when both parties have a pair of keys, one private and one public. The Public Key is kept in the open freely usable by anyone as is the encryption algorithm, however the Private Key is kept hidden.
The public key is used to encrypt the data and the private key decrypts it.
A message encrypted with A’s public key can only be decrypted with A’s private key.
What is a public key?
A code used to encrypt/decrypt data that can be made public and is linked to a corresponding private key.
What is a private key?
A code used to encrypt/decrypt data that is linked to a corresponding public key.
What are the disadvantages of asymmetric encryption?
more complex to generate
asymmetric encryption/decryption is slower as it takes longer to encrypt and decrypt the messages than symmetric encryption.
What are biometrics?
Attempts to confirm the identity of a user by physical characteristics, e.g. fingerprint, face, iris, DNA, hand/palm, scent/odour or behaviour, e.g. typing rhythm or voice etc.
What are the three stages of biometric identification?
Stage one – biometric reading is taken and stored in system.
Stage two – when access is required a new scan is taken and compared to those on file.
Stage three – if match is found then entry is permitted.
What are the types of malicious software/threats?
Virus Trojan Worm DoS Attacks Phishing
What is a virus?
A small computer program attached to another program or file and usually intended to harm the data on the computer.
If the virus is run it will:
- copy itself onto memory sticks or other computers via a network if possible
- Once enough copies are made it will aim to delete/corrupt files, wipe the hard-drive or display unwanted messages
What is a trojan?
Similar to a virus however involves trickery to fool a user into running a program that they think is legitimate;
Malware that is hidden within another file on your computer.
They give a hacker the opportunity to access a computer remotely without the knowledge of the user.
What is a worm?
A worm is a sub-class of virus
it uses vulnerabilities or inadequate security in systems to transmit itself across networks to other computers
doesn’t require human interaction to run or spread.
What is DoS attack?
Involves bombarding a computer system with data requests so that it becomes overloaded and unable to carry out its normal operations. This usually involves a DDoS attack (where thousands of computers bombard an internet server with millions of packets of data)
What is Phishing?
Using fake emails or websites to try and fool a user into entering personal data and/or credit card details. E.g. email pretending to be from users bank.
What can protect a computer from malicious software/threats?
Anti-virus: although not fool-proof having up-to-date to anti-virus will stop most threats;
Educate users: Do not open attachments, software or click on web links unless you’re sure it safe.
Firewalls: Running firewall software will stop many threats from gaining access via a network/Internet connection;
What is a hacker
A hacker tries to gain access to a computer or network by taking advantage of security weaknesses
They may also take advantage of unpatched (or unknown) software vulnerabilities to gain access.
What are the two types of hackers?
- Black-hat hackers
- White-hat hackers
What is a black hat hacker?
break into systems for personal gain or malicious reasons;
What is a white hat hacker?
break into systems for non-malicious reasons to try to find security weaknesses so they can report problems and help them to be fixed. They may work for the company in question;
