Data Level Protection

A firewall is a hardware or software security system that monitors and controls the network traffic going in and out of a network or a single device. All traffic passes through it, so it acts as an early barrier against attacks from outside.

Hardware or software

Filtering traffic with rules

Firewalls decide what to do with each connection by following rules. An Access Control List (ACL) is a set of rules setting out which traffic is allowed and which is blocked. An allowlist permits only the traffic listed on it and blocks everything else, while a denylist blocks the traffic listed on it and lets everything else through. Rules often check IP addresses and port numbers, so a firewall can block connections from IP addresses it does not trust and other unexpected connections, preventing unauthorised access. A firewall can also alert you to unusual or suspicious activity, such as repeated failed connection attempts, so that you can investigate.

For example, a community cinema's ticket kiosk runs a software firewall. Its allowlist contains only the IP address and port used by the cinema's booking server. If an unauthorised program on the kiosk tries to contact an unfamiliar IP address, the firewall blocks the connection and displays a warning.

Keeping it current

New attacks appear all the time, so firewall software and its rules need regular updating, for example by turning on automatic updates. This keeps the firewall able to recognise recently discovered dangers.

A firewall filters network traffic, but it does not scan files for malware or remove viruses; that is the job of anti-virus software.

Anti-virus software, also called anti-malware software, monitors a device for malicious software and attempts to block infection.

What it checks

It scans files, programs, incoming emails and removable storage such as a USB stick. It can also check a link when you click it in a web page or email, before the page opens.

To judge whether something is dangerous, the software compares the suspicious file or its behaviour with a database of known malware signatures, often called the definitions. A signature is a pattern that identifies malware which has already been studied. For example, if you download a game mod from an unfamiliar website, the scanner may find that its code matches a known harmful program.

Handling a threat

If an infected or suspicious file is found, the software can remove, delete or quarantine it. Quarantining means moving the file to an isolated place where it cannot run or spread, while keeping it for checking. This protects your data and stops malware reaching other files or devices.

The software also alerts the user. That warning lets you cancel a download, avoid opening an attachment or close a page, and then decide how to respond.

Keeping it effective

Anti-virus software must be kept up to date, often by turning on automatic updates. New malware appears all the time, so an old database will not recognise the latest threats.

Anti-virus software and a firewall do different jobs. Anti-virus software scans files and looks for malware; a firewall filters network traffic. A firewall will not remove malware, and anti-virus software does not filter network traffic.

Software interface design can make software easier to use, but some features that save time or protect privacy can also reduce security. A designer has to weigh up how convenient a feature is against the risk it creates.

Obscuring data entry

When a field is obscured, each character usually shows as a dot or an asterisk, so a password or PIN is not visible to the person standing behind you. The trade-off is that you cannot spot your own typing mistakes: a player signing in to a games console cannot see that they mistyped their password, and repeated failed attempts can lock the account. Obscuring only hides the characters on screen; it does not encrypt the data.

Autocomplete

Autocomplete remembers values typed into a form, such as a name, email address or postcode, and suggests them again, for example a shopping app offering an address you used last year. This is quick and reduces typing errors, but the saved list sits on the device. If that device is shared with other people, or is lost, the suggestions can expose personal details that were never meant to be seen again.

'Stay logged in'

A 'stay logged in' option keeps an account signed in after the browser or app is closed, so you avoid retyping a password each time. The risk is that the device stays trusted. On a family tablet that is passed around, or a device that is stolen, the next person to open the app may find the account already open and usable.

Device hardening is the process of reducing a device's vulnerabilities to make it more secure. It works by making the device offer less: every feature, program or open connection left switched on is another way in, so turning it off shrinks the attack surface — the total set of routes an attacker could try.

Applying security patches

A security patch is a small update that fixes a known weakness in an operating system or a piece of software. Patches should be applied as they are issued, because until then the flaw is public and the device stays hackable. If a photo-editing program has a bug that lets a malicious image run hidden code, the patch closes that route, reducing the risk of hacking.

Reducing what the device offers

• Closing unused firewall ports: a port is a numbered channel that traffic can pass through. If a club's booking laptop has a remote-management port open but nobody ever uses it, closing that port removes a way in.
• Removing or disabling unused software and services: a tablet in a dentist's reception may arrive with a games app and a file-sharing service that staff never touch. Each one can carry its own bugs, so uninstalling them lowers the attack surface.
• Disabling unused ports: physical sockets count too. An old label-printing PC in a garden centre still has its serial and parallel sockets switched on long after the printers they were built for were replaced, and each live socket is an entry point where an unknown device could be plugged in to copy files off the machine or install malware. Turning them off in the settings closes those entry points.
• Disabling unneeded data connections: a sports centre's scoreboard controller is updated only by plugging in a cable, so its Wi-Fi and Bluetooth stay switched off, leaving fewer wireless routes for an attacker to aim at.

Changing what comes out of the box

Many devices ship with the same default password for every unit, such as a workshop's smart camera set to admin. Anyone who knows the model can look that password up and log in, so resetting default passwords to something unique prevents system settings from being altered.

A backup is a copy of data stored separately from the original, so that the original can be restored if it is lost, corrupted or damaged. Recovery is the process of restoring that data from the backup.

Backups matter after a major system failure — a hard drive that stops working, a ransomware attack, a fire in the room where the server stood, or a folder someone deleted by mistake. Once the fault is fixed, the backup is copied back and people can carry on working.

Automatic and manual backups

Many systems back up automatically on a schedule, such as every evening at 11pm. Nobody has to remember to do it, and at worst the work done since the last backup is lost. A manual backup is started by a person at a chosen moment, often just before a software update or a hardware change. Changes like these can go wrong and leave a system unusable, so a fresh copy taken beforehand means you can put everything back as it was.

Storing and testing backups

A backup should be kept securely and separately from the original data — on a different drive, in another building, or with a cloud service — and access to it should be limited to the people who need to restore it. A copy stored on the same disk as the original is no help at all: one failure destroys both. Backups should also be tested by carrying out a practice recovery, because a backup that turns out to be incomplete or corrupted is only discovered when you desperately need it.

scores = {"Amara": 12, "Ben": 9, "Cerys": 15}
backup = scores.copy()   # a separate copy kept safe

scores.clear()           # the original data is lost
print("Original now:", scores)

scores = backup.copy()   # recovery: restore from the backup
print("Restored:", scores)

Output:

Original now: {}
Restored: {'Amara': 12, 'Ben': 9, 'Cerys': 15}

A backup does not prevent a threat from happening. Malware will still infect a machine that is backed up every night, and a thief can still steal a laptop. What the backup does is let you get the data back afterwards.

Encryption is the process of scrambling data so that it cannot be understood by anyone who does not have the key to unlock it. It uses an encryption algorithm (a set of mathematical steps) together with an encryption key to turn readable plaintext into unreadable ciphertext.

To turn the ciphertext back into plaintext you decrypt it, which needs a decryption key, password or code. Without the correct key the ciphertext is meaningless rubbish, even to someone holding the file. The correct term is decrypt, not decode.

What encryption can and cannot do

Encryption does not stop data being intercepted or stolen: a thief can still copy a file or walk off with a laptop. What it does is make the stolen data unreadable, so the thief gains nothing useful.

It is also not the same as putting a password on a file. A password prompt can be bypassed by someone who knows how to get around the software, but properly encrypted ciphertext stays unreadable until it is decrypted with the key.

Encrypting stored data

Encrypting stored data means files, databases or a whole drive are held in encrypted form, so a decryption key is needed to read them. This protects the contents if a device or storage medium is lost or stolen, because whoever finds it cannot read anything on it.

For example, Priya keeps her coursework and a list of part-time job customers on a tablet. Because she encrypts the whole drive, the person who finds the tablet she left on a bus cannot open a single file. Had she encrypted only the coursework folder, her customer list would still be readable.

Following the data through

Plaintext is encrypted with the encryption key to produce ciphertext, which is stored. Later, the ciphertext is decrypted with the decryption key, giving the decrypted text, which is the plaintext again. The key features are the encryption key, the ciphertext, the decryption key and the decrypted text.

Encrypting transmitted data means scrambling information before it travels across a network so it cannot be read on the way. The sending software turns readable plaintext into ciphertext using an encryption algorithm and a key, and the receiving device needs the matching decryption key to decrypt it back into plaintext. Only the ciphertext travels, so anyone who copies it holds something unreadable.

Encryption does not stop data being copied or intercepted, and it is not the same as password-protecting a file. What it does is remove the value of a copy. A passive attack such as packet capture silently copies packets as they pass along the network without changing or stopping them, and in a man-in-the-middle attack an attacker places themselves between the two devices, passing messages on while reading them. Without the decryption key, captured ciphertext is unreadable, so the contents are not revealed.

Worked example

A student buys a concert ticket from a venue's website and types in their card number. Their browser encrypts the details before sending them, so the venue's server receives ciphertext and decrypts it with its key. Someone copying the packets on the café Wi-Fi would see only scrambled characters, not the card number.

Web traffic and checking identity

Data sent over the web can be encrypted using SSL, commonly set up through HTTPS, which creates an encrypted connection between the browser and the web server. During that set-up the server has to show that it is genuine: it presents a digital certificate containing a digital signature, which the browser checks against a trusted authority, so an impostor site cannot take its place. The same exchange lets the two ends agree a key for the encrypted connection.

VPNs

A VPN (virtual private network) encrypts the data a device sends over a network, which is useful on a network you do not trust, such as public Wi-Fi on a school trip, because the traffic cannot be read in transit.