Cambridge AS & A Level · Part 1 · Chapter 9
Security, privacy and data integrity
Keeping data safe, keeping it private and keeping it correct are three different jobs. This page covers every definition, threat, defence, worked example, question and exam question in the chapter, with labs to try each check yourself.
Guru Jazzy🎯 Learning objectives
By the end of this chapter you should be able to:
- explain the difference between the terms security, privacy and integrity of data
- show appreciation of the need for both the security of data and the security of the computer system
- describe security measures that protect computer systems, from the stand-alone PC to a network of computers
- show understanding of the threats to computer and data security posed by networks and the Internet
- describe methods that can be used to restrict the risks posed by threats
- describe security measures designed to protect the security of data
- describe how data validation and data verification help protect the integrity of data
- describe and use methods of data validation
- describe and use methods of data verification during data entry and data transfer
🔤 9.01 Integrity, privacy and security
Is the data correct? Accurate and up to date.
Who is allowed to see it? Only authorised users.
Is it there when needed, unchanged, and recoverable if lost?
Data integrity
Integrity is easy to define but hard to guarantee. Only data that is accurate and up to date has integrity, and every person or organisation that stores data needs it. This chapter covers ways to achieve it; Chapter 11 (Sections 11.01 and 11.02) comes back to it for databases.
Data privacy: a requirement for data to be available only to authorised users.
Data privacy
Privacy means keeping data out of the public domain. It can apply to a person or to an organisation (for example, the minutes of management meetings), but the book focuses on individuals. Every person has an almost limitless amount of data connected with them. Unless they are involved in criminal or subversive activity, they should control which of it is made public and which stays private.
An individual has little chance of privacy without a legal framework that can punish people who breach it. That framework is a data protection law. Points to note about such laws:
- They mainly cover personal, and therefore private, data that an individual gives to an organisation.
- The organisation may use the data, but only for purposes the individual understood and agreed to.
- They oblige organisations to ensure both the privacy and the integrity of that data.
- Having a law does not guarantee people obey it, but the threat of legal proceedings acts as a deterrent.
Data protection normally applies to data stored in computer systems with the individual's consent. Should these laws be extended to cover data obtained from telephone calls or search engine usage?
Teacher's note: in Thailand the law is the Personal Data Protection Act B.E. 2562 (PDPA), fully in force since June 2022. Like the EU's GDPR, it needs a lawful basis (such as consent) for collecting personal data and gives people the right to see, correct and delete it.
Data security
Data is secure if it is available when needed and the data you get back is the data that was originally stored. Security has been breached if any data has been lost or corrupted.
Security must come first: without it you cannot have integrity or privacy. But security on its own guarantees neither. One requirement for protecting data is the security of the system that stores it. System security protects more than data; it has two main aims:
- to make sure the system keeps carrying out the tasks users need
- to make sure only authorised users have access to the system.
🎮 Integrity, privacy or security?
Which requirement has failed in each story?
⚠️ 9.02 Threats to a computer system and its data
Threats to the security of a system include:
- an individual user not taking appropriate care
- Internal mismanagement
- Natural disasters
- unauthorised intrusion into the system by an individual
- malicious software entering the system.
Threats posed by networks and the Internet
We all rely on systems, our own and those of organisations, and almost none of them are stand-alone. They are all connected to networks, and through them to the Internet. Two causes of concern stand out:
- The hacker: someone intent on gaining unauthorised access to a computer system. Once in, a hacker might read private data, delete files or disrupt how the system runs.
- Malicious software entering the system.
🦠 Types of malware
Malware is software introduced into a system for a harmful purpose. One group works by introducing program code:
| Type | What it does |
|---|---|
| Virus | Tries to replicate itself inside other executable code. |
| Worm | Runs independently and transfers itself to other network hosts. |
| Logic bomb | Stays inactive until some condition is met. |
| Trojan horse | Replaces all or part of a previously useful program. |
| Spyware | Collects information and transmits it to another system. |
| Bot | Takes control of another computer and uses it to launch attacks. |
The differences are not large and some examples fit more than one category. Viruses are often sub-divided by the software they attach to, for example boot sector viruses and macro viruses.
Malware can also be classified by the activity involved:
| Activity | What happens |
|---|---|
| Phishing | An email or electronic message from an apparently legitimate source asks for confidential information. |
| Pharming | A bogus website is set up that appears to be a legitimate site. |
| Keylogger | Records the legitimate user's keyboard use. |
Carry out some research to find some examples of how phishing and pharming might be attempted.
Phishing (the victim is sent a message):
- An email "from your bank" says your account is locked and links to a page asking for your login and PIN.
- An SMS says a parcel could not be delivered and asks for a small "re-delivery fee" by card.
- A message that seems to come from the head teacher asks staff to buy gift cards and send the codes.
- Spear phishing targets one person using details found on social media to sound convincing.
Pharming (the victim goes to a site, but ends up somewhere else):
- Malware edits the computer's hosts file so that typing the real bank address opens a fake copy.
- DNS cache poisoning corrupts a DNS server so that everyone using it is sent to the bogus site's IP address.
- A look-alike domain (for example a capital I instead of a lower-case l) catches people who mistype the address.
The key difference: phishing needs the user to act on a message; pharming can catch a user who typed the correct address.
🎮 Name that malware
Read the incident, then pick the best match.
👤 System vulnerability from user activity
Many vulnerabilities come from the actions of legitimate users. Two that need no malware at all:
- Weak passwords, especially ones with a direct link to the user (a pet's name, a birthday). A would-be hacker has a strong chance of guessing one.
- Not recognising a phishing or pharming attack, and giving away sensitive information as a result.
A user with a grievance might introduce malware on purpose. Far more often it is introduced by accident, by:
- Attaching a portable storage device
- Opening an email attachment
- Accessing a website
- downloading a file from the Internet.
🧱 Vulnerability from within the system itself
- Operating systems often lack good security. They tend to grow more complex over time, which creates more chances for weak security. Regular updates are often released because a new security weakness has been found.
- In the past, common application packages let macro viruses spread, but this problem is now largely under control.
- Buffer overflow. Programs written in C, and there are very many, do not automatically check array bounds. A program can deliberately write past the end of an array set up as a buffer, overwriting whatever is stored next to it. When a later program reads the overwritten memory it will not run as it should. Sometimes that is a minor disruption; a cleverly designed attack can give the attacker unauthorised access.
🔬 Lab: buffer overflow
The program reserves an 8-byte buffer for a password. The next bytes in memory hold a flag that decides whether the user is an administrator (0 = no). Type an input and press Store.
🌪️ 9.03 Disaster recovery
For a large installation that the organisation depends on every day, continuity of operation is vital. The system must keep working whatever happens or, if it has to shut down, it must be guaranteed to restart within a very short time.
These measures come under disaster recovery contingency planning. The plan is based on a risk assessment and provides an alternative system to bring into action. If a full replacement system is always ready, it is called a hot site. By definition a hot site is remote from the original, so that the organisation can recover from natural disasters such as earthquakes or floods.
Safe system update
A major update of hardware and/or software is a special source of vulnerability. Organisations used to install and test a new system over a weekend when no service was running. Today systems are expected to be available at any time, often from any location; the business never closes. So the original system and its replacement may run in parallel for a while to keep the service going.
Teacher's starting points: technology failure: the July 2024 CrowdStrike update that crashed millions of Windows PCs, grounding flights and closing hospitals' systems; the 2018 TSB bank migration that locked customers out for weeks. Natural disaster: the 2011 Thailand floods, which shut hard-disk factories and data centres in Ayutthaya; Hurricane Sandy (2012), which flooded New York data centres.
🔑 User authentication
Even a PC used by one person should have a user account, and accounts are essential on a multi-user (time-sharing) system. Its main security feature is authentication. The normal method links a password to each account. To be effective, the password needs many characters, drawn from a variety of those in the ASCII scheme.
- Create an example of a secure password using eight characters (but not one you are going to use).
- Assuming each character is taken from the ASCII set of graphic characters, how many different passwords could be defined by eight characters?
- Do you think this is enough characters to assume the password would not be found by someone trying all possible passwords in turn?
🔬 Lab: how big is the password space?
Choose the character sets, the length and how fast an attacker can guess. Possible passwords = (number of characters)length.
1 Something like k7#Rq!2v: lower case, upper case, digits and symbols mixed, with no dictionary words or personal details.
2 ASCII has 94 graphic (printable) characters, codes 33–126; 95 if you count the space. So there are 948 ≈ 6.1 × 1015 possible passwords (958 ≈ 6.6 × 1015).
3 Not really, against an offline attack. At 1011 guesses per second, trying every one takes about 6.1 × 104 seconds, which is under a day (half that on average). It is fine against an online attack where the system locks the account after a few wrong tries. Longer passwords grow the space far faster than extra symbols do: 12 characters gives about 4.8 × 1023.
Other ways to authenticate
- Biometric methods: examining a fingerprint, the face or the eye.
- Security token: a small item of hardware given to each user that confirms their identity.
- Software that asks the user for further input after the password has been entered.
Normal practice is to combine one of these with the password system (two-factor authentication).
👍 Good practice
- Do not leave the computer switched on when unattended.
- Do not let anyone watch you access the computer.
- Do not write down how you access it.
Attaching portable storage devices increases the risk of bringing in malware. An organisation can ban or limit their use, although that is hard when normal business needs data to be portable.
🧱 Firewall, digital signature, anti-virus and intrusion detection
Firewall
The primary defence against malware arriving through a network connection is a firewall. Ideally it is a hardware device that works like the security gate at an international airport: nothing passes without being inspected. It can also run as software: the data then enters the system but is inspected straight away. A firewall can inspect the addresses in a transmission, and sometimes the data itself, for anything unusual or inappropriate.
🔬 Lab: be the firewall
Rules: allow web traffic (port 80 and 443) and email (port 25) from anywhere; block everything from the blacklisted address 203.0.113.66; block remote desktop (port 3389) from outside the school network 10.x.x.x. Allow or block each packet.
Digital signature
If an email arrives, you may want to check the identity of the sender. The solution is to insist the sender attaches a digital signature. Chapter 21 (Section 21.02) explains how it works.
Anti-virus software and intrusion detection
Restricting access never guarantees every threat is kept out, so programs also need to run on the system to check for problems:
- Anti-virus software (in practice aimed at any type of malware) runs regular scans to detect malware and remove or deactivate it. Special-purpose anti-spyware may also be installed.
- An intrusion detection system takes an audit record of system use as input and looks for activity that does not match what is expected.
People intent on damage keep using more sophisticated methods, so defences have to be improved continually.
🎮 Pick the defence
Which measure best deals with each threat?
🛟 9.04 Recovering from data loss
Apart from malicious activity, data can be lost by accident when:
- A disk or tape gets corrupted
- A disk or tape is destroyed
- The system crashes
- a file is erased or overwritten by mistake
- the location of a file is forgotten.
So every system needs a backup procedure, decided by the system administrator. The traditional principles are simple:
- a full backup is made at regular intervals, perhaps weekly
- at least two generations of full backup are kept
- incremental backups are made daily.
For maximum security the backup disks or tapes are kept away from the system, in a fire-proof and flood-proof location.
This works when the incremental backup runs overnight and the full backup at the weekend. A system running 24/7 may change at any moment, and a simple backup could leave the data in an inconsistent state. Two solutions:
- A backup program that freezes the file store while it copies. Changes made meanwhile are recorded elsewhere and applied once the backup is stored.
- Disk mirroring: data is stored on two disk systems at the same time during normal operation. The two systems can be at remote locations as part of a disaster recovery plan.
🔬 Lab: restore after a crash
A full backup runs every Sunday night; an incremental backup (only the files changed since the previous backup) runs every other night. Tap the day the disk fails, during the day before that night's backup. Which backups do you need, in which order?
🚪 Restricting access to data
A logged-in user is authorised to use the system, but not necessarily all of it. The administrator can identify categories of user with different needs. For example, an employee should be able to look up a colleague's internal phone number, but that must not let them see the colleague's salary.
The solution is an authorisation policy that gives different access rights to different files for different people. For one file a person might have no access at all, or read access but not write access; in another case read access but not unrestricted write access.
| File | Employee | HR officer | Payroll manager |
|---|---|---|---|
| Phone directory | Read | Read / write | Read |
| Salary file | None | Read | Read / write |
| Own timesheet | Read / write (until approved) | Read | Read |
| Staff appraisals | None | Read / write | None |
An example access-rights table (mine, not the book's).
🎮 Allowed or denied?
Use the access-rights table above.
🔒 Protecting data content
Even with good security, someone may break in and reach the data. That effort is wasted if the stored data cannot be read, so data can be encrypted. Encryption methods are covered in Chapter 21 (Sections 21.01 and 21.03–21.06).
✔️ 9.05 Validation of data entry
Integrity can never be guaranteed, but the chances improve if checks are made when data first enters a system or is transmitted from one system to another.
"Validation" is a misleading word. It sounds as if validated data is accurate, which is far from true. If a name is expected and the wrong name is typed, it is still a name, so it is accepted. Validation can only stop data that is of the wrong type, in the wrong format or out of range.
Validation is done by software attached to the data entry interface. Typical checks:
| Check | Example |
|---|---|
| Presence | An entry field is not left blank. |
| Format | A date has to be dd/mm/yyyy. |
| Length | A telephone number has the right number of digits. |
| Range | The month in a date must not exceed 12. |
| Limit | A maximum number of years for a person's age. |
| Type | Only a numeric value for the month in a date. |
| Existence | A file exists with the filename given in the data entry. |
🔬 Lab: a validated form
Each field runs the check named beside it as you type. Notice that a wrong but sensible value still passes.
Files that exist in this pretend folder: report.docx, marks.xlsx, photo.jpg, notes.txt.
🎮 Which validation check?
👀 Verification of data entry
For data entry, verification means getting the user to confirm that the data entered is what they intended. It still does not mean the data is correct.
- Double entry: the most common example is choosing a new password, where you are asked to type it again.
- Visual check: read through what you typed, for example a completed form, before sending it.
Verification: confirmation of data received by a system.
🔢 Check digit
When a series of numbers identifies something, a check digit can verify it. All schemes do a calculation on the digits that ends with an integer division; the remainder (or a value worked out from it) is added as one or two extra digits at the end. In one single-digit scheme the letter X stands for 10. When the number is read later, the same calculation is done and the result compared with the stored check digit. Bar codes and ISBNs use this.
🔬 Lab: check-digit calculator
Type the first 9 digits (ISBN-10) or 12 digits (ISBN-13) to get the check digit, or a whole ISBN to verify it. Hyphens are ignored.
📡 Verification during data transfer
Data can be corrupted in transmission, often when one bit is flipped from 1 to 0 or 0 to 1. Verification has to check some property of the bit pattern.
Parity check
The simplest is a one-bit parity check. It is easy when data is sent in bytes using a seven-bit code: even or odd parity goes in the eighth bit. With even parity:
- At the transmitting end, the number of 1s in the seven-bit code is counted.
- If the count is even, the parity bit is set to 0.
- If the count is odd, the parity bit is set to 1.
- This is repeated for every byte in the transmission.
- At the receiving end, the number of 1s in the eight-bit code is counted.
- If the count is even, the byte is accepted.
- This is repeated for every byte in the transmission.
If no errors are found the transmission is accepted, but that does not prove it is error-free. Two flipped bits in the same byte keep the parity correct. That is unlikely, so it is sensible to assume no error. The limitation: parity detects an error but cannot say which bit is wrong, so re-transmission has to be requested.
🎮 Set the parity bit
What goes in the most significant bit?
Checksum
At the transmitting end, a block is a number of bytes. Whatever the bytes represent, each one's bits are treated as a binary number, and the sum of the block is sent as a checksum. This is repeated for every block. The receiver does the same sum and compares it with the transmitted checksum. Again an error is detected but its position cannot be found.
🔬 Lab: checksum
The sender adds the four bytes and keeps the total modulo 256 so it fits in one byte. Flip some bits "on the line", then let the receiver check.
🧮 Parity block check
Finding the exact position of an error, so it can be corrected, is harder. One approach is the parity block check. Like the checksum it is longitudinal: it checks a sequence of binary digits spread over a number of bytes.
WORKED EXAMPLE 9.01 · Using a parity block check
At the transmitting end a program reads a group of seven bytes (Figure 9.01). Each byte holds a seven-bit code; bit 7, the most significant bit, is undefined, so it is left blank.
The parity bit of each byte is set to achieve even parity (Figure 9.02).
An extra byte is then created. Each of its bits is the parity bit for the bits in that position, including the column of parity bits (Figure 9.03).
The program transmits the eight bytes in sequence. At the receiving end, a program checks the parity of each byte and of each bit position.
The transmission is serial, so this is longitudinal checking, but the checking algorithm works on a matrix of bits. If there is just one error in the seven bytes, the failing row and the failing column cross at the bad bit. The receiver can therefore correct it and accept the transmission.
🔬 Lab: parity block simulator
Load some data, let the sender add the parity bits and parity byte, then tap bits to corrupt them in transit. Press Receiver: check to see the failing rows and columns.
Assume the seven bytes in Figure 9.04 contain data. The most significant bit is set to 0 but is undefined at this stage, because a seven-bit ASCII code represents character data. Choose a parity and change the most significant bit of each byte to match it. Then create the eighth byte that would be used for transmission in a parity block check method.
| Data (7 bits) | Number of 1s | Byte sent |
|---|---|---|
| 1001000 (H) | 2 | 01001000 |
| 1000101 (E) | 3 | 11000101 |
| 1110010 (r) | 4 | 01110010 |
| 1100011 (c) | 4 | 01100011 |
| 0101100 (,) | 3 | 10101100 |
| 1010101 (U) | 4 | 01010101 |
| 0110010 (2) | 3 | 10110010 |
| Parity byte (column by column) | 11010111 | |
With odd parity every bit flips: the bytes start 1, 0, 1, 1, 0, 1, 0 and the parity byte is computed the same way with odd parity. Load "Question 9.02 data" in the simulator to check either choice.
The eight bytes in Figure 9.05 were received in a transmission using the parity block method. The first seven bytes contain the data and the last byte contains the parity check bits.
a Identify what has gone wrong during the transmission.
b What would happen after the transmission is checked?
The first byte, 01001000, has an even number of 1s, so the scheme is even parity.
a Byte 3 (11110001, five 1s) and byte 5 (01001010, three 1s) both fail the row check. Yet every column, checked against the parity byte 01110010, passes. So two bits have been corrupted, one in byte 3 and one in byte 5, in the same bit position: their two errors cancel out in that column.
b The receiver knows the two bad bytes but cannot tell which column the errors are in, so it cannot correct them. It rejects the block and requests re-transmission.
📌 Summary
- Important considerations for stored data are data integrity, data privacy and data security.
- Data protection laws relate to data privacy.
- Security measures for computer systems include authentication of users, prevention of unauthorised access, protection from malware and methods for recovery after system failure.
- Security methods for data include backup procedures, user authorisation and access control.
- Data entry should be subject to validation and verification.
- Verification for data transmission can use a parity check, a checksum or a parity block check.
🃏 Key-term flashcards
Tap a card to flip it.
✅ Quick quiz
📝 Exam-style questions
Write your answer first, then open the model answer. These are my mark-scheme-style points, not official mark schemes.
(i) Accuracy (also accept: correctness, or being up to date).
(ii) Validation is done automatically by software, which checks that data is reasonable: the right type, format or range. Verification checks that the data entered matches what was intended or the source, for example by double entry or a visual check by the user. Neither guarantees the data is correct.
(iii) For example, a range check makes sure a value lies between set limits: a month must be 1–12. (Or a presence, format, length, type, limit or existence check, with a matching example.)
(iv) Validation only checks that data is sensible, not that it is true: a wrong but valid value (for example, a mistyped age of 34 instead of 43) is accepted. Data can also become out of date after it is entered, for example when a customer moves house.
- Authorisation / access rights: each user is given rights to specific files, such as none, read-only or read-write, so a user who logs in still cannot open files they have no rights to.
- Encryption: stored data is encrypted, so even if someone gets access to the files, the content is unreadable without the key.
- (Also acceptable: authentication with strong passwords or biometrics, so only legitimate users can log in; a firewall that blocks unauthorised network access.)
(i) Any three: a disk or tape is corrupted or destroyed; the system has crashed; the file was deleted or overwritten by mistake; the file's location is forgotten; malware has deleted or encrypted it; a natural disaster has damaged the hardware.
(ii) A full backup at regular intervals (e.g. weekly) with daily incremental backups; at least two generations of full backup kept; backups stored off-site in a fire-proof and flood-proof place; disk mirroring for systems that run 24/7.
(i) Any event that stops the system working for a long time, especially one that destroys the installation: a natural disaster such as an earthquake, flood or fire, or a major technology failure.
(ii) An alternative system ready to take over, ideally a hot site: a full duplicate system kept ready at a remote location, so service restarts within a very short time.
- Firewall: inspects all incoming and outgoing traffic, checking addresses (and sometimes content), and blocks anything not allowed by its rules.
- Anti-virus / anti-malware software: kept up to date and run regularly, it scans for malware and removes or quarantines it.
- (Also acceptable: an intrusion detection system checking audit records for unusual activity; installing operating-system security updates; authentication of every user.)
(i) Sender and receiver agree on even (or odd) parity. At the transmitting end, the 1s in each seven-bit code are counted, and the eighth (most significant) bit is set to 0 or 1 to make the total even (for even parity). At the receiving end, the 1s in each eight-bit byte are counted. If the count is even the byte is accepted; if it is odd an error is reported and the data is re-transmitted.
(ii) The data is split into blocks of bytes. The sender treats each byte as a binary number and adds them up; the sum is sent with the block as the checksum. The receiver repeats the calculation and compares its result with the checksum received. If they differ, an error has occurred and the block is re-sent.
- It can detect that an error has happened but cannot locate it, so it cannot correct it; re-transmission is needed.
- Some errors go undetected: two flipped bits in one byte keep the parity correct, and errors that cancel out give the same checksum.
- Most bytes have an even number of 1s, so the scheme is even parity.
- Byte 3 (11010000) has three 1s, so its row parity fails.
- Checking each column against byte 8, only bit 3 (the fifth from the left) fails: that column has one 1 in the data, but the parity bit is 0.
- The failing row and column cross at byte 3, bit 3 (bits numbered 7 to 0, so the fifth from the left): there is a single error there.
- The receiver flips that bit from 0 to 1, so byte 3 becomes 11011000, and accepts the transmission with no need to re-send.
Try "Exam Q3c (received)" in the simulator to see it.
- Firewall: hardware or software that monitors and controls network traffic. It stops unauthorised access and malware arriving from the network.
- Authentication: verifying a user's identity, for example by password, biometrics or a token. It means only legitimate users can log in and reach the data.
- Integrity is about data being accurate and up to date; security is about data being available, kept from unauthorised users, and recoverable if lost.
- Integrity is protected by validation and verification; security is protected by backups, authentication, access rights, firewalls and so on.
- Security is a pre-requisite: you can have secure data that lacks integrity (stored safely but wrong), but not integrity without security.
(i) Validation: for example a range check that a month is 1–12, or a format check that a date is dd/mm/yyyy. Verification: for example double entry of a new password, or a visual check of a form before submitting it.
(ii) Parity check: an eighth bit makes each byte's count of 1s even (or odd), and the receiver re-counts. Checksum: the sum of the bytes in a block is sent with it and recalculated by the receiver. (Or the parity block check, which can also locate and correct a single error.)
Cambridge International AS & A Level Computer Science 9608, Paper 13 Q3, June 2015
- Validation: an automatic check by the program that the data is reasonable and follows the rules (type, format, range…). Needed to stop impossible or nonsensical data entering the system.
- Verification: a check that the data entered matches the original or what the user intended, for example double entry or proof-reading. Needed because valid data may still have been mistyped or copied wrongly.
Cambridge International AS & A Level Computer Science 9608, Paper 12 Q8, November 2015
Guru Jazzy · Cambridge AS & A Level Computer Science · Chapter 9 Security, privacy and data integrity · Figures from the Cambridge coursebook (Langfield & Duddell)