Systems - Security Risks

Question 1

What are the key aspects that The Computer Misuse Act (1990) recognises as offences.

Answer 1

Unauthorised access to computer material.

Unauthorised access with the intent to commit or facilitate crime.

Unauthorised modification of computer material

Making, supplying or obtaining anything which can be used in computer misuse offences.

Question 2

What is tracking cookie and why does it present a risk?

Answer 2

Acookieis a small data file created when you access a website.

These can be used to store your personal preferences or log in details, so you don’t need to re-enter these details.

Tracking cookiestake this one step further. Your details are recorded and then transmitted back to the cookie’s author.

Question 3

Explain the difference between a public key and a private key when securing the transmission of data

Answer 3

 A public key is used to encrypt the personal data.
 A private key is used to decrypt the personal data.
OR
 Public key is known to all systems.
 Private key to one system only.

Question 4

SecureBell stores customer videos on a public cloud.

(i) State two reasons why SecureBell chooses to use a public cloud rather than a private cloud to store the videos.

Answer 4

 Public cloud services can be easily increased or decreased to match current needs.
 Can set up or easily expand capacity of public cloud storage without (Securebell) purchasing hardware.
 Public cloud removes need forbackup/maintenance/
administration strategies (for SecureBell).
 Public cloud has lower initial costs than private cloud.

Question 5

(ii) Customers may have concerns about the security of video being stored on the public cloud.
State two precautions used to ensure security of data on public cloud storage.

Answer 5

 Username and passwords to access public cloud.
 Use of encryption.
 Firewall.
 Require use of digital certificate.

Question 6

Describe a suitable backup schedule for a company. Your answer should include a description of the type of backup

Answer 6

 Back up all data/(full back up) weekly/daily
 Save changes since last full backup (differential)
daily/hourly
 Saving changes since last back up of any type (incremental) daily/hourly

Question 7

What are the strategies other than back up that could be used to protect against a loss of data.

Answer 7

Cloud
Offline
Off-site repository
Distributed storage
Mirror disk
Full/incremental/differential Back up

Question 8

Catherine runs CraftyBella, an online business promoting arts and crafts.
(a) Catherine is concerned that the business data stored on the public cloud is not secure.
Explain why this is not the case.

Answer 8

 Public cloud does not mean open access
 Password protected space is rented to public
 Data may be encrypted
 Data protected by firewall

Question 9

What are the Symptoms of DOS attacks?

Answer 9

Slow performance

Inability to access

Question 10

What are the effects of a DOS attack?

Answer 10

Genuine users can’t access resources
Business may not be able to operate
Reputational damage
Customers may choose competitor

Question 11

What are the costs associated with a DOS attack?

Answer 11

LOST REVENUE: Each time a service or online shop cannot be contacted by users or customers they are losing a sale! Many businesses carry out most — or sometimes all — of their business activity via the web, so this can have a huge impact on income.

STAFF COSTS / COST OF REPAIRS: The labour costs of dealing with a DoS attack can be large. Specialist network engineers may be needed to recover crashed systems, put defences in place and try to stop an ongoing attack. The company may already employ these people, but will often rely on contracting in external help. This can be costly.

Users’ LOSS OF CONFIDENCE in the organisation

Question 12

What are the 3 types of DOS attacks?

Answer 12

Bandwidth Consumption
Resources Starvation
Domain Name Service (DNS) Attacks

Question 13

Describe Bandwidth Consumption

Answer 13

Flood of requests fills the connection up to their limit so no other requests can get through. The effect only lasts as long as the attack is maintained.

Question 14

Describe Resources Starvation

Answer 14

Requests each use a little bit of other resources, like disk space, until the server runs out and is no longer able to function correctly.

Question 15

Describe Domain Name Service (DNS) Attacks

Answer 15

Attacks-These attack the servers that route internet traffic so can impact on multiple websites. It can also lead to congestion and consumption of bandwidth\

Question 16

Describe the process of encryption

Answer 16

Encryption takes place in many situations where data is being transmitted over an internet connection.

Encryption is the process of encoding data, using encryption keys.

The encrypted data can only opened by someone who has the key.

Question 17

What’s a digital certificate?

Answer 17

Digital Certificates are the attachment to an electronic message used for security purposes

A certificate is used to verify that a user sending a message is who they claim to be and to bind their public key to them.

A digital certificate becomes the equivalent of an electronic passport. It allows individuals or companies to feel secure in exchanging information as they each know the identity of the other party. A digital certificate is exceptionally hard to forge and can be trusted as it will have been issued by a trusted agency.

Question 18

What’s a digital signature?

Answer 18

A digital signature is an electronic signature that can be used to authenticate the identity of the sender of a message or the signer of a document, and to ensure that the original content of the message or document has not been tampered with.

Digital signatures are easily transportable, cannot be forged by someone else, and can be automatically time stamped.

Question 19

What are the 2 types of encryption?

Answer 19

Symmetric and asymmetric encryptions

Question 20

What’s symmetric encryption and how does it work?

Answer 20

The simplest form of encryption
Data is encrypted using a secret key and an encryption algorithm
Both sender and receiver need a copy of the secret key

Data is encrypted with the secret key to produce ciphertext
The ciphertext is transmitted over the insecure channel
The receiver applies the secret key using the decryption algorithm which retrieves the original data

Question 21

What are the main benefits of symmetric encryption? (2)

Answer 21

Simple and fast to implement

Question 22

What are the main drawbacks of symmetric encryption? (2)

Answer 22

Difficult to manage the exchange of the secret key over an insecure channel

Question 23

What are the 3 types of asymmetrical encryption?

Answer 23

Public and Private keys
Digital Certificates
Digital signatures