Data security and data integrity

Security, privacy and integrity are three different things

Three words that sound interchangeable, and the examiner tests the difference. Data security is the set of measures that stops data being read, changed or destroyed by anyone who is not entitled to read, change or destroy it. Privacy is about who is allowed to hold information about a person, and what they may do with it. Data integrity is about whether the stored data is an accurate, complete and up-to-date record of what it claims to describe.

The quickest way to keep them apart is to give each one its own question. Security asks who could get at this, and how do we stop them? Privacy asks should this have been collected at all, and who has a right to know it? Integrity asks is it still right?

The three fail independently, which is why the distinction matters. A payroll database behind strong passwords and full-disk encryption, containing a bank account number mistyped three years ago, is secure and private and still has poor integrity: the person it belongs to is not paid. In the same way, a hospital can hold complete and accurate records and still destroy privacy by leaving a printout on a reception desk.

Why you need both the system and the data to be secure

Security of the computer system means protecting the hardware, the operating system, the installed software and the network from unauthorised use, damage and malware. It covers the physical side (locked server room, locked cases, cable locks, controlled access to the building), the operating system (user accounts, permissions, up-to-date patches, services switched off), the network (firewall, separate segments for staff and guests) and the software (anti-virus, application updates).

Security of the data means protecting the data itself, wherever it happens to be: on a hard disk, on a backup tape in a cupboard, on a USB stick in someone's pocket, in an email in transit, or inside a database table. The controls that work at this level are encryption and access rights, because they travel with the data rather than with the machine.

You need both because each one fails where the other still works. If an attacker gets a legitimate account on a server, the system has been compromised and every file that account can reach is open - unless the files themselves are encrypted or the account's rights stop at the files it needs. In the other direction, a fully patched, firewalled network still leaks data when a manager copies a customer list onto a memory stick and loses it, or emails it to the wrong person; only encryption and rights limit the damage then.

The general principle is layered defence: several independent controls, so that an attacker has to defeat all of them. A single control is a single point of failure, and the exam answers that score highest are the ones that place controls at more than one layer.

User accounts and passwords

A user account ties every action on a system to a named person. Without individual accounts, work cannot be attributed, rights cannot differ between users, and a shared login means nobody can be held responsible for anything done with it. Each account carries a username, a password or other credential, and a set of rights.

A password is a credential the user knows. What makes it strong is the number of guesses an attacker would need: length matters most, then a mix of upper and lower case, digits and symbols, and avoiding dictionary words, names and dates that a guessing tool tries first. The system has to help as well: store only a hash of the password rather than the password itself, limit the number of failed attempts and lock the account, force a change after a suspected breach, disable the accounts of staff who leave immediately, and never issue a default password that is never changed.

Other account controls do as much work as the password. Least privilege gives each user only the rights the job needs, so a receptionist cannot delete the accounts table. A separate administrator account is used only when administration is actually needed, so day-to-day browsing with full rights cannot install anything. Logging records who signed in, when and from where, which is how an intrusion is noticed at all.

• Unique account per person, never shared, disabled when the person leaves
• Strong password rules plus lockout after repeated failures
• Least privilege: rights granted to a group or role, not to everybody
• Separate administrator account, used only for administration
• Audit log of logins and failed logins, reviewed rather than merely kept

Authentication: digital signatures and biometrics

Authentication is proving that a user or a message really is what it claims to be. Credentials fall into three groups: something you know (password, PIN), something you have (a smart card, a code generated on a phone, a hardware token) and something you are (a fingerprint, an iris, a face). Using two credentials from different groups is multi-factor authentication, and it is much stronger than two passwords because stealing one factor is not enough.

A digital signature authenticates a message rather than a person at a keyboard. The sender runs the message through a hashing algorithm to produce a short fixed-length digest, then encrypts that digest with the sender's private key and attaches it. The receiver decrypts the signature with the sender's widely available public key, recomputes the hash of the message as received, and compares the two. If they match, only the holder of the private key could have produced the signature and the message has not changed since; this gives authenticity, integrity and non-repudiation, because the sender cannot later deny signing.

Biometrics measure a physical characteristic and compare it with a stored template, not a photograph: a fingerprint's ridge pattern, the pattern of the iris, the geometry of the face, the shape of the hand, a voice print. Because the measurement is never identical twice, the system compares against a threshold, which produces two kinds of error: a false acceptance (the wrong person is let in) and a false rejection (the right person is turned away).

Biometrics cannot be forgotten, lent, written on a sticky note or guessed, and they need the person to be present. Against that, a biometric cannot be changed if it is copied, the reader costs money, some users cannot enrol or fail on a given day, and the template itself is personal data that has to be protected. Any system relying on a biometric therefore needs a fallback method.

Restricting the risks: firewalls, anti-virus and anti-spyware

A firewall sits between two networks, usually the internal network and the internet, and decides which traffic may pass. It examines each packet against a set of rules built from source and destination IP address, port number and protocol, and the safe default is to block everything that has not been specifically allowed. That stops an outside attacker from reaching a service that was never meant to be public, and it can also block outgoing connections so that malware cannot contact the server that controls it. A firewall logs the attempts it blocked, which is often the first evidence that a network is being probed.

A firewall cannot see inside traffic it has allowed. If port 443 is open for web browsing, a virus arriving inside a downloaded file passes straight through, and if email is allowed, so are infected attachments. That is the gap that anti-virus software fills: it scans files when they are opened, saved or downloaded, scans email attachments and removable media, and checks memory and startup areas. It detects known malware by matching signatures and unfamiliar malware by heuristics, watching for behaviour that looks wrong, and it then quarantines, repairs or deletes the file. Definitions have to be updated constantly, because a signature cannot exist for a virus written this morning.

Anti-spyware targets the software that hides and reports on the user: keyloggers that record every keystroke, programs that report browsing habits, browser toolbars and hijackers that change the home page or search engine. It scans for unauthorised changes to browser settings and startup entries, and removes the tracking and monitoring code. Many commercial suites bundle anti-virus, anti-spyware and a personal firewall, but the exam expects you to say which component answers which threat.

Threats from networks and the internet

Malware is software written to damage a system, disrupt it or give someone access to it. A virus is code that inserts a copy of itself into another program or file, its host, and runs when the host is run; it then infects further files, and its payload may corrupt data, fill a disk or delete files. A virus needs the user to do something - open the attachment, run the downloaded program, plug in the infected stick - because it cannot spread on its own. Spyware is installed without consent and runs quietly: it records keystrokes, screenshots, browsing history and logins and sends them to a third party, and it may open a back door for more malware. The same family includes worms, which spread across a network by themselves, trojans, which arrive disguised as something useful, and ransomware, which encrypts files and demands payment.

Hackers gain unauthorised access to a system. The way in is usually mundane: an unpatched program with a known flaw, a default or weak password on a router or camera, a service left running that nobody needed, or a convincing phone call to a member of staff. Once inside, the attacker tries to raise their rights to administrator, installs a back door so the access survives a reboot, copies or alters data, and clears the logs that would show what happened.

Phishing is an attack on the user rather than on the machine. A message that appears to come from a bank, a supplier, a colleague or a delivery company asks the recipient to click a link to a login page that is a copy of the real one, or to open an attachment. The login page harvests the username and password; the attachment installs malware. Spear phishing is the same trick aimed at one named person, using details from social media to make the message convincing.

Pharming redirects the user to a fake site without any action by the user at all. The attacker either poisons the cache of a DNS server, so that a correct domain name resolves to the attacker's IP address, or modifies the hosts file on the victim's machine through malware. The address typed is the right one and the browser shows the real URL, so the usual advice to check the link does not help.

• Apply operating system and application patches promptly, especially for flaws that are already being exploited
• Switch off services, ports and accounts that are not needed, and change every default password
• Give ordinary users ordinary rights, and keep administrator rights for administration only
• Filter email at the gateway and train staff to expect a convincing fake
• Back up offline and test a restore, so that ransomware costs time rather than the data
• Log and review activity, so that an intrusion is found in days rather than months

Protecting the data itself: encryption and access rights

Encryption turns plaintext into ciphertext using an algorithm and a key, so that the data is meaningless to anyone without the key. In symmetric encryption the same key encrypts and decrypts: it is fast and suits large volumes, but the key has to reach the other side somehow, and that transfer is itself a risk. In asymmetric encryption each user has a pair of keys, a public key that anyone may hold and a private key that never leaves its owner; data encrypted with one key can only be decrypted with the other, which solves the key distribution problem and makes digital signatures possible.

Encryption protects data in transit - the padlock in a browser is an encrypted connection between the browser and the server, and a VPN encrypts traffic across the internet - and it protects data at rest: a whole disk, a database column of card numbers, a backup tape, a memory stick. The value is that the protection travels with the data, so a stolen laptop or intercepted email gives the attacker ciphertext. What encryption does not do is keep data available: it cannot stop a file being deleted, corrupted or held to ransom.

Access rights control what a logged-in user may do with a particular file, folder, record or field. Typical rights are read, write, execute, delete and create, granted to users or to groups. A well-set system gives a user the rights their role needs and nothing more, makes reference data read-only, keeps the accounts table away from everyone except the payroll system, and logs who changed what. Access rights protect against the insider and against accident - the clerk who would otherwise overwrite the price list - which encryption does not address at all, because an authorised user has the key.

Validation: keeping rubbish out at the point of entry

Validation is an automated check, made by the system as data is entered, that the data is sensible, reasonable and of the right type before it is accepted. Data that fails is rejected with an error message and the user must correct it, so the database never fills with values that could not possibly be true. Validation checks plausibility, not truth: a date of birth of 01/01/1990 passes every check even if the customer was born in 1975.

The seven checks in the syllabus each answer a different kind of mistake, and the skill is choosing the right one for a given field.

A check digit is an extra digit calculated from the other digits by a fixed rule, usually a weighted sum followed by a modulus, and stored as part of the code. When the code is keyed in, the system recalculates the digit from the digits entered and compares it with the one supplied. Because each position carries a different weight, the check catches a single wrong digit and most cases of two digits typed in the wrong order - 1234 keyed as 1324 gives a different weighted sum. It cannot catch a code that is itself valid but belongs to the wrong person, such as a correctly formed customer number for another customer, and it cannot catch a mistake in a field that carries no check digit at all.

Verification: data entry and data transfer

Verification is a check that the data has been copied or transmitted without error - that what the system now holds is what the source actually said. Validation asks is this acceptable?; verification asks is this the same as the original? A value can be perfectly acceptable and still wrong, so the two work as a pair.

During data entry there are two methods. A visual check means a person reads the screen or the printed record and compares it with the source document, which is cheap and catches obvious slips, but it depends on attention and is useless if the operator is tired or the volume is high. Double entry means the data is keyed in twice, usually by two different operators, and the system compares the two versions; a difference is flagged for correction. It catches almost every keying error, but it doubles the cost, so it is reserved for data where an error is expensive, such as bank details or medical records.

During data transfer the receiving system has to be able to tell that the bits arriving are the bits that were sent, because a phone line, a wireless link or a failing disk can flip a bit without any warning. A parity check adds one extra bit to each byte - byte parity - set so that the total number of 1 bits is always odd (odd parity) or always even (even parity). The receiver counts the 1s again, and a mismatch means an error occurred. Because the position of the bad bit is unknown, the byte has to be re-sent, and an even number of flipped bits in the same byte leaves the count unchanged, so it goes undetected.

Block parity adds a parity bit to each byte and also a parity byte for the block, so there is a parity check for every row and every column. A single flipped bit then fails both its row parity and its column parity, the intersection identifies the bit, and the receiver can flip it back - so block parity can correct one error, not merely detect it. A checksum is calculated from the data itself, for example the sum of the byte values, and sent with it; the receiver recalculates and compares. It catches error patterns that parity misses, but it cannot say where the error is, and two errors that cancel each other out in the sum still slip through.