1. Key Definitions
| Term | Definition | Example |
|---|---|---|
| Data Security | Protecting data from unauthorized access, corruption, or theft. | Encryption, firewalls, passwords. |
| Data Privacy | Controlling who can access personal/sensitive data. | GDPR compliance, user consent for data collection. |
| Data Integrity | Ensuring data is accurate, consistent, and unaltered. | Checksums, validation rules (e.g., range checks). |
2. Threats to Data & Systems
| Threat | Description | Prevention Method |
|---|---|---|
| Hacking | Unauthorized access to systems to steal/corrupt data. | Strong passwords, firewalls, intrusion detection. |
| Malware | Malicious software (e.g., viruses, spyware) that damages systems or steals data. | Anti-virus software, regular updates. |
| Phishing | Fake emails/websites tricking users into revealing sensitive data. | User training, spam filters. |
| Pharming | Redirecting users to fake websites to steal data. | HTTPS verification, DNS security. |
| Data Breaches | Accidental or intentional exposure of sensitive data. | Encryption, access controls. |
3. Security Measures
| Measure | Purpose | Example |
|---|---|---|
| Firewalls | Blocks unauthorized network access. | Hardware/software firewalls (e.g., Windows Defender). |
| Encryption | Converts data into unreadable format without a key. | AES-256 for files, SSL/TLS for web traffic. |
| Access Rights | Restricts user permissions (read/write/execute). | Admin vs. guest accounts. |
| Backups | Creates copies of data for recovery. | Automated cloud backups (e.g., Google Drive). |
| Anti-Virus | Scans for and removes malware. | Norton, McAfee. |
4. Data Validation vs. Verification
| Aspect | Data Validation | Data Verification |
|---|---|---|
| Purpose | Checks if data is sensible/valid (but not necessarily accurate). | Confirms data matches the original source (accuracy). |
| Methods | – Range check (IF age > 120 THEN invalid)– Format check (email: *@*.*)– Presence check. | – Double entry (retype data) – Visual check (compare to source) – Checksums. |
| Example | Rejecting “999” as an invalid age. | Verifying a password by typing it twice. |
5. AI in Security
Applications:
- Anomaly Detection: AI monitors network traffic for unusual patterns (e.g., sudden large data transfers).
- Fraud Prevention: Flags suspicious transactions (e.g., banking systems).
- Automated Threat Response: Blocks attacks in real-time (e.g., AI-driven firewalls).
Risks:
- AI itself can be hacked (e.g., adversarial attacks on machine learning models).
6. Encryption Techniques
| Type | How It Works | Use Case |
|---|---|---|
| Symmetric | Same key encrypts/decrypts data (fast but less secure). | Local file encryption (e.g., BitLocker). |
| Asymmetric | Public key encrypts; private key decrypts (secure but slower). | SSL/TLS for websites. |
| Hashing | Converts data to fixed-size string (irreversible). | Password storage (e.g., SHA-256). |
7. Exam-Style Questions
- Define data integrity and describe one method to ensure it (3 marks).
- Answer: Integrity = accuracy + consistency. Method: Checksums (e.g., CRC).
- Compare phishing and pharming (2 marks).
- Answer: Both steal data; phishing uses fake emails, pharming hijacks DNS.
- Explain how encryption protects data privacy (4 marks).
- Answer: Scrambles data → unreadable without key → prevents eavesdropping.
8. Case Study: Cake Factory (from QP)
- Threat: Hacker accessing recipe servers → theft of intellectual property.
- Solution:
- Network Security: Firewalls, VPNs for remote access.
- Data Encryption: AES-256 for recipe files.
- Access Logs: Monitor unauthorized login attempts.