CS 0478 Topic 1.

1.4.1 Importance of security and data integrity:-

Data Security covers all activities related to keeping data safe.
It may include
• Prevention of unauthorized access.
• Intentional or Unintentional Damage or Corruption.
Data loss in the form of being recovered, copied, stolen and damage from computer systems may result in serious concerns for
companies.
Data Integrity:-
Data integrity is the maintenance of, and the assurance of the accuracy and consistency of, data over its entire life-cycle, and is a critical
aspect to the design, implementation and usage of any system which stores, processes, or retrieves data.
Possible Risks to Data:-
• Lost or damaged as a result of system crash or hard disk damage.
• Data corruption due to hardware fault or power failure.
• Data loss due to being overwritten both intentionally or accidently.
• Data Loss or Data Corruption due to a computer virus.
• Data being deleted or altered as a result of hacking.
• Data loss as a result of natural disasters, such as hurricanes and even fires.
• Data loss as a result of an act of terrorism.
• Data may be altered by employees seeking to cause harm to the company.
1.4.2 How is data kept safe?
Sensible companies and organisations take appropriate measures to ensure that the data they store remains secure. The most appropriate
measures to use will depend on:
• How important the data is.
• How confidential the data is.
• How likely it is that someone will want to steal, change or destroy the data.
If the stored data relates to identifiable individuals then a company must keep data secure to comply with the Data Protection Act. Some
of the more common measures used to ensure data security are described below.
• Making regular backups of files (backup copies should be stored in fireproof safes or in another building)
• Protecting yourself against viruses by running anti-virus software
• Using a system of passwords so that access to data is restricted.
• Safe storage of important files stored on removable disks, eg locked away in a fireproof and waterproof safe

Hassan Zulfiqar Haider

hassanzulfiqarhaider@[Link]
0323414090 Page 1
 CS 0478 Topic 1.4
• Allowing only authorised staff into certain computer areas, eg by controlling entry to these areas by means of ID cards or
magnetic swipe cards
• Always logging off or turning terminals off and if possible locking them
• Avoiding accidental deletion of files by write-protecting disks
• Using data encryption techniques to code data so that it makes no apparent sense
Types of Protection:-
• Physical Protection
• Software Protection
Physical Protection:-
As you have seen, there are many different ways that you or a business can lose valuable data. With a little bit of planning and thought
however, the risks can be reduced or even eliminated. There are many things you can do to make your equipment more secure:
• Lock the room when not in use
• Use swipe cards or keypads to activate locks
• Bolt computers to the desk
• Use special pens to mark your postcode onto the computer case
• Keep windows shut especially if on the ground floor. Use bars.
• CCTV video cameras
Safe Storage of Data :-
Important data should be stored safely. Good quality disks or tapes should be used. These should be kept in a dust-free environment that
is not too hot and is nowhere near any magnetic fields. Often important data is kept in fireproof, waterproof safes.
Limiting Physical Access to Computers:-
Access to a computer system can be limited by keeping the system in a locked room. Unauthorised people should not be able to access
the computers.
• This would not however stop an employee who had the authority to access the computer room from causing deliberate or
accidental damage or stealing important data.
• A further limitation of this solution is that it is not always possible to limit access to a computer system physically.
Some systems, such as the Automatic Teller Machines (ATMs) used by banks to dispense money have to be available for the public to
use. Also, many computers are connected to networks and can be accessed from other computers on the network.
Biometrics:-
Biometrics means to measure and analyse some human characteristic in order to correctly identify an individual. Examples of physical
characteristics which can be used are:
• fingerprints
• voice patterns
• retinas or irises
• facial patterns
• palm prints
To use biometrics an organisation needs:
• A reader or scanning device that takes a biometric reading from a person
• Software that can convert the scanned information into digital format for the computer to use.
• This computer identifies the 'match points' from the digital information
• Once the match points have been identified the data is compared to all of the records held in the company biometric database.
• If a matching record is found the individual can be positively identified.
Software protection:-
Firewall
A firewall is a program or hardware device that filters the information coming through the Internet connection into your personal
computer or into a company's network. It is set up to allow mainly one way access, i.e. you can go out onto the Internet and access pages,
but it checks everything coming back against a set of rules. If the data coming back is from an unauthorised source, then it is blocked.
You may have heard people saying, 'I can't get on that site at school because it's been blocked'; that is the firewall in action.
Firewalls use 3 types of filtering mechanisms:
• Packet filtering or packet purity:-
• Data flow consists of packets of information and firewalls that analyze these packets to sniff out offensive or unwanted
packets depending on what you have defined as unwanted packets.
• Proxy
• Firewalls in this case assume the role of a recipient & in turn sends it to the node that has requested the information
& vice versa.

Hassan Zulfiqar Haider

hassanzulfiqarhaider@[Link]
0323414090 Page 2
 CS 0478 Topic 1.4
A PROXY SERVER is a dedicated computer or a software system running on a computer that acts as an intermediary between an endpoint device,
such as a computer, and another server from which a user or client is requesting a service. The proxy server may exist in the same machine as a firewall
server or it may be on a separate server, which forwards requests through the firewall.

Firewalls can be customised using the following methods based on their threat levels:-
You can create or disable firewall filter rules based on conditions such as:
• IP Addresses
Blocking off certain IP addresses, which you think are harmful.
• Domain names:-
You can only allow certain specific domain names to access your systems/servers. Or even specify the types of
domains such as .edu or .org
• Protocols:-
A firewall can decide which of the systems can allow or have access to common protocols like TCP/IP, FTP
or UDP.
• Ports:-
Blocking or disabling ports of servers that are connected to the internet will help maintain the kind of data
flow you want to see it used for & also close down possible entry points for hackers or malignant software
• Keywords:-
Firewalls also can sift through the data flow for a match of the keywords or phrases to block out offensive or
unwanted data from flowing in

User Name and Password Security Systems

If a password system is in use then before you can access a computer system you must enter a valid user name and password. The process
of entering this information and being granted (or refused) access to a computer is known as logging on. Passwords can be cracked
(guessed) therefore it is important that:-
• Change your password regularly.
• Make your password at least eight characters long.
• Do not write down your password or tell it to anyone else.
• Do not use proper words of phrases - these can be found using a dictionary cracker.
• Use a mixture of upper and lower case letters and numbers.
Attempting to guess a password to gain unauthorised entrance to a computer system is an offence under the Computer Misuse Act 1990.
As with limiting physical access to a computer system, the use of a password system will not prevent authorised users such as employees
from damaging or stealing data.
Access Rights should be defined:-
A user should only be given access to files that he or she needs to use. Limiting the files that a user can access will limit the amount of
damage that he or she might do either deliberately or accidentally.
Logs/audit log files:-
One effective way of deterring authorised users from damaging or stealing data from a computer system is to get the system to keep logs
of all of the actions that each user carries out. A log must be used together with a user name and password system. All of the actions that
a user carries out are stored together with their user name in a log. If data is deleted, copied or changed the computer system manager
can identify the person responsible by examining the logs.
User Date and Time Action

Anas 27/04/2017 09:54 Log In

Munhib 27/04/2017 09:55 Deleted File “xyz”

Ahmed 27/04/2017 09:56 Copied File “abc”

Sample Audit file
Taha 27/04/2017 10:00 Checked email

If users know that their actions are being monitored then they are less likely to deliberately damage or steal data. Logs can also be used to
help trace any accidental damage to data. A log cannot stop a person from damaging or stealing data but it can help identify the culprits

Backups:-

Hassan Zulfiqar Haider

hassanzulfiqarhaider@[Link]
0323414090 Page 3
 CS 0478 Topic 1.4
Whatever measures are implemented to try and avoid data being deleted or changed, it is impossible to guarantee that this will not
happen. Therefore it is vital that extra copies are made of important data. For important data a regular backup procedure should be
implemented. Backups should be kept away from the computer room so that they will not be damaged by fires / floods etc. There is no
point in keeping a backup if it is likely to get damaged when the original data gets damaged. The type of backups that are kept usually
depend on the type of processing being carried out:-
• Batch Processing systems use the Grandfather-Father-Son or Ancestral backup system.
• With Transaction Processing systems a regular backup of the master file is made. As transactions are carried out details of each
transaction are stored in a transaction log file. If the master file becomes corrupted the latest backup master file and the
transaction log file can be used to recreate it.
• In Real-Time systems there is often little point in keeping backups of data. However much backup hardware is used to reduce
the likelihood of the system failing. Sometimes backing up data to disk can be useful in real-time systems.
• Although this data could not be used to put the system back into its proper state, it could be used to analyse why a
system failed. e.g. an aeroplane "black box".
SSL:-
SSL stands for 'Secure Socket Layer'. It is a web browser security technology. SSL is built into a web browser. SSL allows confidential data
to safely pass from your web browser to a distant server via the Internet. The confidential data is 'encrypted' or scrambled so that only the
server can read it. For example, e-commerce shops use SSL to keep your credit card details secret. You can tell when SSL is being used as
a small padlock appears on the bottom right of the browser window. If you click on the padlock, a 'certificate' window appears that
confirms you are connected to the real server and not a fake one.

Accessing a website using SSL

Transport Layer Security (TLS):-

It is similar to SSL but is a more recent security system. TLS is a form of protocol that ensures the security and privacy of data between
devices and users when communicating over the internet. It is essentially designed to provide encryption, authentication and data
integrity in a more effective way than its predecessor SSL. TLS is formed of two layers:
• Record protocol: This part of the communication can be used with or without encryption (it contains the data being
transferred over the internet).
• Handshake protocol: This permits the website and the client (user) to authenticate each other and to make use of encryption
algorithms (a secure session between client and website is established)
Encryption:-
Encryption ensures that data being sent across a network is kept secure. Before data is sent, it will be encrypted to the point that it will
not be recognisable if intercepted during transmission. An algorithm is used to scramble the data and this is known as encoding. Once
the data gets to the destination system it must be decoded (unscrambled). For this system to work it is necessary to use encryption keys.
Encryption keys contain code that has been generated using an algorithm. This code is used to encrypt and decrypt data.

Hassan Zulfiqar Haider

hassanzulfiqarhaider@[Link]
0323414090 Page 4
 CS 0478 Topic 1.4
There are two methods of key encryption:

• Symmetric key encryption using one secret key:-

Symmetric key encryption is an encryption system in which the sender and receiver of a message share a single,
common key that is used to encrypt and decrypt the message. The success of this method of encryption depends on the need to
keep the key secret and on the method for passing the key from one system to another. If the receiving system does not know
the secret key, then it cannot decrypt the message.

There is also a very big risk of interception. If the secret key is sent across a network and this key is intercepted, then a
hacker is able to decrypt the data as they have possession of the secret key.

Despite these issues, symmetric encryption is reliable and allows for fast decryption. It is still a very popular method of
encryption and is used by many large organisations to manage the transmission of online communication. Symmetric key
encryption is simple and fast but its main drawback is that the two parties must somehow exchange the key in a secure way.

This problem is overcome by using public and private key encryption to transfer the symmetric key before then using
the symmetric system to transfer data. In order to transfer the symmetric key securely, public and private key encryption is often
used.

• Public key (asymmetric) encryption using two keys - one public key and one private key:-
Public key encryption is used to transfer data but is actually often used to transfer the key needed to allow symmetric
encryption to take place. This is because symmetric encryption is a much faster method than using public and private keys.
Public keys are keys that are unique to a user profile on an operating system and are available to all systems trying to
communicate with the user’s computer.

If a message has to be sent to the user’s computer, then the public key that matches their profile is used to encrypt the
data. Private keys are also unique to a user profile when running an operating system but are not available to any other
computers and are not transferred from system to system. This means, with private keys there is no risk of interception. If an
operating system receives a public key, it needs to use its own private key to decrypt the data. If the public key it has received
was actually intended for another system, the private key will not be able to decode the data. If the public key it receives is its
own public key, then the private key will decode the data.

When system A wishes to send a secure message to system B, it will use system B’s public key to encrypt the data.
System B then uses its own private key to decrypt the data.

Using public and private keys to exchange symmetric keys securely is a very common occurrence. Symmetric keys are
then used to transfer the actual data.

Hassan Zulfiqar Haider

hassanzulfiqarhaider@[Link]
0323414090 Page 5
 CS 0478 Topic 1.4

1.4.3 Need of keeping online systems safe

We need to keep online systems safe from attacks including
• denial of service attacks
• Phishing (already discussed section 1.5)
• Pharming (already discussed section 1.5)
Denial Of Service (DoS) Attacks:-
DoS stand for Denial of Service. A malicious hacker uses a DoS attack to make a computer resource (i.e. – website, application, e-mail,
voicemail, and network) stop responding to legitimate users. The malicious hacker does this by commanding a fleet of remotely-
controlled computers to send a flood of network traffic to the target. The target becomes so busy dealing with the attacker’s requests that
it doesn’t have time to respond to legitimate users’ requests. That can cause the target system to stop responding, resulting in long delays
and outages.
1.4.4 Internet Security for Real Life Scenarios
Online Banking:-
When you bank online, after you’ve logged in, you will notice that the http in the address bar has changed to https. This indicates that a
secure connection between your computer and the bank's computer has been established. Data sent between the two computers is
encrypted so that anyone trying to intercept your data will receive meaningless data. The data can only be decrypted into readable data by
using a key that is known only to the two computers - yours and the bank's.
Online Shopping:-
• Don't shop at a site if you're not comfortable with the website.
• Never click on links from spam emails to make purchases.
• Check the web address to make sure you are on the correct site.
• Check that the site is secure.
• Use a credit card or an online payment service.
• Do not use a public computer to shop online.
• Only use a secure connection when you place your order.
• Use strong passwords.

Hassan Zulfiqar Haider

hassanzulfiqarhaider@[Link]
0323414090 Page 6