Data Security (Cambridge (CIE) A Level Computer Science): Flashcards

A digital signature is a secure way to prove that a digital message or document was sent by a specific person and that it has not been altered.

A digital signature confirms who sent the data (authentication) and that the data has not been changed (integrity).

Biometrics are an individual's personal characteristics used to identify them.

Fingerprints, iris or retina scans and voice recognition are all examples of biometrics.

A firewall is a barrier between a network and the internet that prevents unwanted traffic from entering by filtering requests to ensure they are legitimate.

A hardware firewall protects the whole network, whereas a software firewall protects the individual devices on the network.

False.

A firewall can be both hardware and software, and the two are often used together to give a network stronger security.

A firewall filters requests entering a network to ensure that they are legitimate.

Anti-virus software uses a list of known malware signatures to block them immediately, and checks for updates to keep that database up to date.

Anti-spyware is security software designed to detect, block and remove spyware from a computer system.

Spyware can record keystrokes, monitor browsing habits and access files and send them to a third party.

Encryption is the process of converting data into a secret code so that only authorised users can read it.

Symmetric encryption uses the same key to encrypt and decrypt. Asymmetric encryption uses a public key to encrypt and a private key to decrypt.

Symmetric encryption is fast, but the key must be shared securely.

A hacker is someone who gains unauthorised access to computer systems or networks.

A hacker is considered a cybercriminal when their actions are illegal or harmful.

Hackers look for unpatched software, out-of-date anti-malware and weak passwords.

A hacker attack can cause data breaches, malware installation, data loss, identity theft and financial loss.

Two-factor authentication adds extra login security beyond a password alone.

Keeping all software up to date with security patches reduces the risk of being hacked.

False.

Strong passwords are only one measure. Two-factor authentication, anti-malware software, firewalls and up-to-date software are also needed.

Phishing is sending fraudulent, legitimate-looking emails to a large number of email addresses, claiming to be from a reputable company, to try to gain access to a user's details.

A phishing email tries to coax the user into clicking a login button and entering their details.

The attacker can gain unauthorised access to personal data such as login information and bank accounts, which can lead to identity theft or fraudulent activity.

Anti-spam filters stop fraudulent emails arriving in a user's inbox.

User access levels prevent staff from opening file types such as executable (.exe) and batch (.bat) files.

Pharming is when a user types a website address into a browser and is redirected to a fake website, to trick them into typing in sensitive information such as passwords.

The attacker attempts to alter DNS settings or change a user's browser settings to redirect them to a fraudulent website.

Users should keep anti-malware software up to date, check URLs regularly and make sure the padlock icon is visible.

False.

Phishing begins with a fraudulent email, whereas pharming redirects a user who has typed a website address into their browser.

Malware is any software created with malicious intent to cause harm to a computer system.

Malware can cause files to be deleted, corrupted or encrypted, an internet connection to become slow or unusable, and a computer to crash or shut down.

A computer virus is a program that can replicate itself on a user's computer and contains code that causes unwanted and unexpected events.

A Trojan disguises itself as legitimate software but contains malicious code in the background.

A virus replicates itself on a user's computer, whereas a Trojan disguises itself as legitimate software while containing malicious code in the background.

Spyware is software that allows a person to spy on a user's activities on their device.

Spyware is embedded into other software, such as games or programs downloaded from illegitimate sources.

To protect against malware you should write code correctly, keep anti-malware up to date, educate users and install a firewall.

Access rights control what users can see or do on a network.

Access rights are assigned based on a user's role, responsibilities or security clearance.

A user with full access can open, create, edit and delete files or folders.

A user with read-only access can open and view files, but cannot edit or delete them.

No access means the user cannot see or interact with the file or folder at all.

Users can be grouped so that access rights are given to the whole group at once, rather than set for each user individually.

Access rights can be assigned to files, folders or whole systems.

False.

Administrators have unrestricted access. Teaching staff have partially restricted access and cannot see other staff files.

Access rights protect confidential data, improve network security and support efficient collaboration.

Wireless data is transmitted over radio waves, which makes it easy to intercept.

An SSID (Service Set Identifier) is the name that identifies a wireless network.

The master key is created from the SSID together with the password.

The device is given a copy of the master key.

Cipher text is data that has been encrypted using the master key, before it is transmitted.

Plain text is the readable form of the data, produced when the receiver uses the master key to decrypt the cipher text.

The receiver uses the same master key to decrypt the cipher text back into plain text.

False.

The master key is never transmitted, so any intercepted data is rendered useless without it.

WPA2 is a dedicated protocol designed specifically for Wi-Fi security.

A wired network also uses a master key to encrypt and decrypt, but it is often left to individual applications to decide how encryption is used, for example HTTPS.