Prevention and Management of Threats to Data

User access restriction means stopping people who should not be there from reaching a system and the data on it. Some of that is done with software settings, such as passwords, but access can also be restricted in the real world: physical security controls who can get near the equipment. If an attacker cannot reach a machine, they cannot switch it on, plug anything into it or carry it away.

For example, a garden centre keeps its customer orders on a computer in a back office. The office door is locked while the shop is open, the yard gate is shut after trading, and visitors sign in at the till and are accompanied. Someone browsing the plant area never gets within arm's reach of the machine.

What physical measures prevent

• Theft of equipment — a thief who cannot get into the office cannot walk off with the computer.
• Damage — fewer people near a machine means fewer accidents, such as a sack trolley being wheeled into a desktop tower, as well as less deliberate damage.
• Theft of data — a machine left logged in and unattended lets a passer-by open the customer records and photograph the screen. Someone who reaches a port could also copy files onto a memory card or portable drive and walk away with them.
• Installation of malware — some malware arrives on equipment that someone plugs into a port, such as a phone charging or a tablet brought in from home. If only trusted staff can reach the ports, that route is closed.

Deterrence

A physical measure also deters attackers: a barrier, a staffed reception, a sign-in sheet or a locked door makes an intruder expect to be seen or stopped, so many do not attempt it. Physical security is wider than locks, the best-known example. Deterrence lowers the number of attempts rather than making equipment impossible to reach, so it works alongside software restrictions such as levels of permitted access.

Locks are a physical security measure. They control who can reach a room, cabinet or device, so they can secure rooms, equipment and devices. Keeping a device behind a locked door also helps protect the data on it, because an unauthorised person cannot get to the device to take it or use it.

Manual locks

A manual lock uses a key or dial rather than electronics or an IT system. A padlock on a storage cupboard, or a dial lock on a cash box, makes theft more difficult by keeping the contents locked away. A thief must spend time breaking or picking the lock, which increases the chance of being noticed. For example, a youth theatre keeps its lighting controller in a locked cupboard, so a visitor cannot simply carry it away.

Door locks used with keys have drawbacks. A key might be duplicated, mislaid or taken by someone else, and a simple lock often leaves no record of who opened it and when. If a key goes missing or is taken, the lock may have to be replaced so the building stays protected. A door lock can also be bypassed or picked, so it slows down a determined intruder rather than stopping every one.

Electronic locks

An electronic lock checks an electronic credential, such as a keypad code, before it opens. It can be programmed to allow only authorised users or credentials, and access rights need careful management when they change. For example, a school keeps its server rack behind a keypad lock; the code is changed at the end of each term so only the current IT team can open it. The user must remember the code, and a code can be shared or guessed, so it should be changed if it is no longer private. Some electronic locks open with a card rather than a keypad code. The user must carry the card, and it can be damaged, lost, stolen or copied.

A password is a widely used access restriction: it asks you to provide a secret before a system will let you in. You type the secret and the system checks it against the password record it holds for your account. If the two match, access is allowed; if they do not, access is refused.

stored_password = "Maple42"
entered_password = input("Enter password: ")

# compare the typed secret with the stored one
if entered_password == stored_password:
    print("Access granted")
else:
    print("Access denied")

Output when the user types Maple42:

Enter password: Maple42
Access granted

Passwords are simple and low cost. They need no special equipment beyond a keyboard, so they work on almost any device, and a system can hold passwords for thousands of users without buying extra hardware. They can also be changed whenever you need to: if you think someone else has learned your secret, you replace it with a new one and the old secret stops working.

The password must stay secret

A password is only effective while it stays secret. The system cannot tell the difference between you and anyone else who knows your secret, so if someone watches you type it, or reads it from a note beside the screen, it has stopped being a secret and no longer protects the account.

Hard to guess, hard to remember

A strong password is harder for someone to guess, but it can also be difficult to remember. A long, random mix of characters is not easy to recall, so a user might write it down or swap it for something memorable but easy to guess, which weakens the protection.

People may also reuse passwords across systems. For example, if the same secret unlocks a photo-sharing app and your school email account, a leak from the app could give an attacker a working password for the email account. One compromised password can therefore put several systems at risk.

A password policy is a set of rules an organisation writes to control how passwords are created and how they are looked after once in use. It turns vague advice such as "pick a good password" into clear checks that staff can follow and that a system can enforce.

Rules for creating passwords

A password is strong when it is long, because every extra character multiplies the number of guesses an attacker must make. It should also mix character types — capitals, lower-case letters, digits and symbols — so that guessing software cannot assume a narrow set of possibilities. It should avoid personal information anyone could find out, such as a favourite film or a street name, and avoid predictable sequences that attackers try first.

Strong passwords are also never reused across accounts. If one service is breached, a reused password hands the attacker the keys to every other account it opens, so a policy bans recycling and requires a fresh password each time.

Rules for protecting passwords

• Keep every password secret and never share it, even with a trusted colleague or IT staff.
• Do not write passwords down on paper, sticky notes or an unprotected file where someone could read them.
• Shield the keyboard or screen when typing so nobody can read the password over your shoulder.
• Change passwords regularly, and immediately if a breach is suspected, so a stolen password stops working.

Tools that support a policy

A password generator produces a random string of characters that is not a recognised word, so dictionary-based attacks fail and the user is not tempted to invent something guessable. A password checker tests a password against the policy — its length, its character mix and whether it appears in known lists of leaked passwords — and rates it weak or strong, so that a weak one can be replaced before it causes a problem.

An access level (also called a permission level, or level of permitted access) is a setting that decides what a user is allowed to do once they have logged in. Correct settings mean each person can reach the parts of a system their work needs, and nothing else.

Three typical levels

Read only is the safest of the three levels, because a user cannot damage or remove anything even by accident. Full control is the most powerful and the most risky, since it lets someone lock other people out or wipe stored data, so very few accounts should have it.

Choosing the right amount

The rule to follow is least privilege: give each user the minimum access they need to do their job. Too much access raises the risk, because a careless or dishonest user can then alter or delete information they should never have seen. Too little access causes a different problem, as people cannot finish their tasks and may start sharing logins or asking a colleague with higher access to do the work for them, which weakens security further. Finding the right balance between too much and too little access is important.

For example, in a veterinary practice's booking system, receptionists need read/write access to appointments so they can book and move them, but read-only access to animal treatment records. Vets need read/write on those records to add notes after a check-up. Only the practice manager has full control, so that new staff accounts and access levels can be set up.

What biometrics are

Biometrics authenticate a user by measuring a physical or behavioural characteristic that is unique to that person, such as the shape of an ear. You present the characteristic to a scanner, which compares it with a stored template. If the two match, access is granted.

Benefits and drawbacks for the user

Biometrics can be quick, because there is no password to remember and no card to carry. But a scan can fail to recognise a genuine user, which is called a false negative. This can happen because of physical changes, such as a cut, swelling or a bandage covering the characteristic, or because the user's head is not in the right position.

Some scanners need you to touch a pad or rest your hand on a surface, and a surface used by lots of people can pass on germs, so these scanners can be unhygienic.

Cost, setup and data risks

Biometrics can be expensive to buy, set up, install, maintain and repair because they need specialist equipment and expert work. Setting up is time-consuming, as every authorised user must be enrolled: their biometric data is recorded as a template before they can use the system. For example, a bakery chain uses ear-shape scanners to unlock its tills. Staff save time at the start of a shift, but the scanners cost more than keypads, a new baker must be enrolled before their first shift, and a broken scanner can leave a till out of action until it is fixed. If biometric data is compromised it cannot be changed like a password, and stolen data could be used to access other systems. Some people are also uneasy about a computer keeping a record of their biometrics.

Multi-factor authentication (MFA) is an access restriction that asks you to prove who you are in more than one way before a system lets you in. Each way is called a factor, and the factors must come from different types — typing two different passwords is not multi-factor, because both are the same type.

The three factor types

Why more than one factor is safer

A single method fails the moment that one secret leaks. Requiring a second, different factor means an attacker who learns your memorised phrase still cannot get in, because they do not also hold your registered object.

For example, the volunteer coordinator at a city farm opens the rota system by typing a phrase she has memorised, then approves a prompt on the smart watch registered to her account. Someone who sees her type the phrase still cannot log in without her watch. With only the phrase, that person would have been straight in.

Drawbacks

• It is slower: every login takes two steps instead of one, which staff may find inconvenient on a busy day.
• A factor can be lost or left behind, such as a registered device, which locks out the genuine user until it is replaced.
• Issuing and managing the extra factors takes time and money.

Two-factor authentication (2FA) is a way of restricting access to a system by asking for two different authentication factors. Using two passwords does not count, because both are the same factor: something you know. The two factors must be different types, such as something you know and something you have, or something you know and something you are.

2FA is the most common form of multi-factor authentication. Multi-factor authentication means using more than one factor, but 2FA uses exactly two of the three factor types. That extra step makes it harder for someone who has stolen or guessed your password to get in, because they still need the second factor.

A common method is a password plus a temporary one-time code. The code is sent to a device or account that only the real user controls, such as their own phone, so a thief with your password still cannot read it. When you explain 2FA, always say where the code is sent, for example 'a code is sent to the user's phone', rather than only saying that a code is used: a code that anyone could receive proves nothing.

Other second factors

Security questions can be used as a second check because the real account holder is the person expected to recall the answers. They are still a knowledge factor, so they only form part of two-factor authentication when the other factor is a different type, such as something you have.

Biometrics can be used as a second check by matching a scan against stored biometric data. After typing a password, you might scan a unique body feature that is compared with the copy saved for your account; a match lets you in.

A firewall is a hardware or software security system that monitors and controls the network traffic going in and out of a network or a single device. All traffic passes through it, so it acts as an early barrier against attacks from outside.

Hardware or software

Filtering traffic with rules

Firewalls decide what to do with each connection by following rules. An Access Control List (ACL) is a set of rules setting out which traffic is allowed and which is blocked. An allowlist permits only the traffic listed on it and blocks everything else, while a denylist blocks the traffic listed on it and lets everything else through. Rules often check IP addresses and port numbers, so a firewall can block connections from IP addresses it does not trust and other unexpected connections, preventing unauthorised access. A firewall can also alert you to unusual or suspicious activity, such as repeated failed connection attempts, so that you can investigate.

For example, a community cinema's ticket kiosk runs a software firewall. Its allowlist contains only the IP address and port used by the cinema's booking server. If an unauthorised program on the kiosk tries to contact an unfamiliar IP address, the firewall blocks the connection and displays a warning.

Keeping it current

New attacks appear all the time, so firewall software and its rules need regular updating, for example by turning on automatic updates. This keeps the firewall able to recognise recently discovered dangers.

A firewall filters network traffic, but it does not scan files for malware or remove viruses; that is the job of anti-virus software.

Anti-virus software, also called anti-malware software, monitors a device for malicious software and attempts to block infection.

What it checks

It scans files, programs, incoming emails and removable storage such as a USB stick. It can also check a link when you click it in a web page or email, before the page opens.

To judge whether something is dangerous, the software compares the suspicious file or its behaviour with a database of known malware signatures, often called the definitions. A signature is a pattern that identifies malware which has already been studied. For example, if you download a game mod from an unfamiliar website, the scanner may find that its code matches a known harmful program.

Handling a threat

If an infected or suspicious file is found, the software can remove, delete or quarantine it. Quarantining means moving the file to an isolated place where it cannot run or spread, while keeping it for checking. This protects your data and stops malware reaching other files or devices.

The software also alerts the user. That warning lets you cancel a download, avoid opening an attachment or close a page, and then decide how to respond.

Keeping it effective

Anti-virus software must be kept up to date, often by turning on automatic updates. New malware appears all the time, so an old database will not recognise the latest threats.

Anti-virus software and a firewall do different jobs. Anti-virus software scans files and looks for malware; a firewall filters network traffic. A firewall will not remove malware, and anti-virus software does not filter network traffic.

Software interface design can make software easier to use, but some features that save time or protect privacy can also reduce security. A designer has to weigh up how convenient a feature is against the risk it creates.

Obscuring data entry

When a field is obscured, each character usually shows as a dot or an asterisk, so a password or PIN is not visible to the person standing behind you. The trade-off is that you cannot spot your own typing mistakes: a player signing in to a games console cannot see that they mistyped their password, and repeated failed attempts can lock the account. Obscuring only hides the characters on screen; it does not encrypt the data.

Autocomplete

Autocomplete remembers values typed into a form, such as a name, email address or postcode, and suggests them again, for example a shopping app offering an address you used last year. This is quick and reduces typing errors, but the saved list sits on the device. If that device is shared with other people, or is lost, the suggestions can expose personal details that were never meant to be seen again.

'Stay logged in'

A 'stay logged in' option keeps an account signed in after the browser or app is closed, so you avoid retyping a password each time. The risk is that the device stays trusted. On a family tablet that is passed around, or a device that is stolen, the next person to open the app may find the account already open and usable.

Device hardening is the process of reducing a device's vulnerabilities to make it more secure. It works by making the device offer less: every feature, program or open connection left switched on is another way in, so turning it off shrinks the attack surface — the total set of routes an attacker could try.

Applying security patches

A security patch is a small update that fixes a known weakness in an operating system or a piece of software. Patches should be applied as they are issued, because until then the flaw is public and the device stays hackable. If a photo-editing program has a bug that lets a malicious image run hidden code, the patch closes that route, reducing the risk of hacking.

Reducing what the device offers

• Closing unused firewall ports: a port is a numbered channel that traffic can pass through. If a club's booking laptop has a remote-management port open but nobody ever uses it, closing that port removes a way in.
• Removing or disabling unused software and services: a tablet in a dentist's reception may arrive with a games app and a file-sharing service that staff never touch. Each one can carry its own bugs, so uninstalling them lowers the attack surface.
• Disabling unused ports: physical sockets count too. An old label-printing PC in a garden centre still has its serial and parallel sockets switched on long after the printers they were built for were replaced, and each live socket is an entry point where an unknown device could be plugged in to copy files off the machine or install malware. Turning them off in the settings closes those entry points.
• Disabling unneeded data connections: a sports centre's scoreboard controller is updated only by plugging in a cable, so its Wi-Fi and Bluetooth stay switched off, leaving fewer wireless routes for an attacker to aim at.

Changing what comes out of the box

Many devices ship with the same default password for every unit, such as a workshop's smart camera set to admin. Anyone who knows the model can look that password up and log in, so resetting default passwords to something unique prevents system settings from being altered.

A backup is a copy of data stored separately from the original, so that the original can be restored if it is lost, corrupted or damaged. Recovery is the process of restoring that data from the backup.

Backups matter after a major system failure — a hard drive that stops working, a ransomware attack, a fire in the room where the server stood, or a folder someone deleted by mistake. Once the fault is fixed, the backup is copied back and people can carry on working.

Automatic and manual backups

Many systems back up automatically on a schedule, such as every evening at 11pm. Nobody has to remember to do it, and at worst the work done since the last backup is lost. A manual backup is started by a person at a chosen moment, often just before a software update or a hardware change. Changes like these can go wrong and leave a system unusable, so a fresh copy taken beforehand means you can put everything back as it was.

Storing and testing backups

A backup should be kept securely and separately from the original data — on a different drive, in another building, or with a cloud service — and access to it should be limited to the people who need to restore it. A copy stored on the same disk as the original is no help at all: one failure destroys both. Backups should also be tested by carrying out a practice recovery, because a backup that turns out to be incomplete or corrupted is only discovered when you desperately need it.

scores = {"Amara": 12, "Ben": 9, "Cerys": 15}
backup = scores.copy()   # a separate copy kept safe

scores.clear()           # the original data is lost
print("Original now:", scores)

scores = backup.copy()   # recovery: restore from the backup
print("Restored:", scores)

Output:

Original now: {}
Restored: {'Amara': 12, 'Ben': 9, 'Cerys': 15}

A backup does not prevent a threat from happening. Malware will still infect a machine that is backed up every night, and a thief can still steal a laptop. What the backup does is let you get the data back afterwards.

Encryption is the process of scrambling data so that it cannot be understood by anyone who does not have the key to unlock it. It uses an encryption algorithm (a set of mathematical steps) together with an encryption key to turn readable plaintext into unreadable ciphertext.

To turn the ciphertext back into plaintext you decrypt it, which needs a decryption key, password or code. Without the correct key the ciphertext is meaningless rubbish, even to someone holding the file. The correct term is decrypt, not decode.

What encryption can and cannot do

Encryption does not stop data being intercepted or stolen: a thief can still copy a file or walk off with a laptop. What it does is make the stolen data unreadable, so the thief gains nothing useful.

It is also not the same as putting a password on a file. A password prompt can be bypassed by someone who knows how to get around the software, but properly encrypted ciphertext stays unreadable until it is decrypted with the key.

Encrypting stored data

Encrypting stored data means files, databases or a whole drive are held in encrypted form, so a decryption key is needed to read them. This protects the contents if a device or storage medium is lost or stolen, because whoever finds it cannot read anything on it.

For example, Priya keeps her coursework and a list of part-time job customers on a tablet. Because she encrypts the whole drive, the person who finds the tablet she left on a bus cannot open a single file. Had she encrypted only the coursework folder, her customer list would still be readable.

Following the data through

Plaintext is encrypted with the encryption key to produce ciphertext, which is stored. Later, the ciphertext is decrypted with the decryption key, giving the decrypted text, which is the plaintext again. The key features are the encryption key, the ciphertext, the decryption key and the decrypted text.

Encrypting transmitted data means scrambling information before it travels across a network so it cannot be read on the way. The sending software turns readable plaintext into ciphertext using an encryption algorithm and a key, and the receiving device needs the matching decryption key to decrypt it back into plaintext. Only the ciphertext travels, so anyone who copies it holds something unreadable.

Encryption does not stop data being copied or intercepted, and it is not the same as password-protecting a file. What it does is remove the value of a copy. A passive attack such as packet capture silently copies packets as they pass along the network without changing or stopping them, and in a man-in-the-middle attack an attacker places themselves between the two devices, passing messages on while reading them. Without the decryption key, captured ciphertext is unreadable, so the contents are not revealed.

Worked example

A student buys a concert ticket from a venue's website and types in their card number. Their browser encrypts the details before sending them, so the venue's server receives ciphertext and decrypts it with its key. Someone copying the packets on the café Wi-Fi would see only scrambled characters, not the card number.

Web traffic and checking identity

Data sent over the web can be encrypted using SSL, commonly set up through HTTPS, which creates an encrypted connection between the browser and the web server. During that set-up the server has to show that it is genuine: it presents a digital certificate containing a digital signature, which the browser checks against a trusted authority, so an impostor site cannot take its place. The same exchange lets the two ends agree a key for the encrypted connection.

VPNs

A VPN (virtual private network) encrypts the data a device sends over a network, which is useful on a network you do not trust, such as public Wi-Fi on a school trip, because the traffic cannot be read in transit.

Penetration testing is a form of ethical hacking where specialist testers deliberately attack a system on behalf of the organisation that owns it. They use the same kinds of techniques and tools as real attackers, but their aim is to find vulnerabilities before a criminal does, so they can be fixed, patched or otherwise mitigated.

What a test can cover

A test can look at operating systems, applications, program code, authentication, network configuration, encryption and physical security. It shows whether an attacker can gain access, how far they can get once inside, and what they could do — for example, whether someone could reach the membership records of a youth football club and change players' contact details.

External and internal testing

How a test runs, and what comes out of it

Testers gather information about the target and identify possible entry points before attempting to break in. If they get access, they may exploit a weakness to demonstrate the risk is real, but never in a way that disrupts the system — a shop's online ordering service must keep taking orders throughout.

Every issue is documented and security improvements are recommended, then reported to the organisation so security and employee practices can improve. Testing is repeated until security reaches a suitable standard, and any change to a system should be tested again, because new features can reopen old gaps. This helps ensure updates, patches and fixes are installed, improves incident response because staff are better prepared, and measures how strong security really is.

Organisations collect data about how their systems are used and then look for patterns that suggest a risk — something that could lead to unauthorised access, or to data being lost, stolen or changed. Analysing that data turns a pile of records into evidence you can act on. Each source reveals a different kind of behaviour.

Spotting patterns, not one-offs

A single odd record usually means nothing. Analysis is about patterns: an account failing to log in twenty times in a minute, or one department downloading far more than everyone else. Those patterns point to a possible attack or to someone breaking the rules.

What the analysis is for

The results show whether security policies are actually being followed and where improvements are needed. If logs show that half the staff in one office share a single login, the policy on personal accounts is not working, so training or tighter account rules are needed.

Blocking websites restricts what users can reach, but it is not a method of monitoring. Nothing is recorded and nothing is reviewed, so you learn nothing about what people are actually doing.