5.3.2 - Protecting systems and data
A single security measure cannot do every job. In 5.3.2, you will learn how anti-malware, encryption, acceptable-use policies, backup and recovery protect systems and data, then match each method to a risk and explain its effect precisely.
Different jobs
Imagine a school stores reports and coursework on its network. Malicious software could reach a computer, someone could obtain a copy of a report, a user could make a risky choice, or live files could be damaged. These are different problems, so they need methods that act in different ways.
| Protection method | Main job | What it cannot do by itself |
|---|---|---|
| Anti-malware | Detect, block, isolate or remove malicious software | Guarantee that every threat is found or replace lost data |
| Encryption | Make data unintelligible to someone who does not have the required key | Detect malicious software or restore a deleted file |
| Acceptable-use policy (AUP) | Set rules and responsibilities for people using a system | Technically stop every prohibited action |
| Backup and recovery | Keep separate copies and restore usable data after loss or damage | Keep a stolen live file secret or prevent an infection |
The methods are complementary: they can be used together because each deals with a different stage or cause of harm. For example, encryption can make reports on a stolen laptop unreadable, while a backup can provide replacement copies. The backup does not stop the person holding the laptop from trying to read its files, and encryption does not recreate a file that has been deleted.
A precise Paper 1 explanation names the method, states what it does and links that action to the required protection. "Use security" is too vague; "encrypt the reports so an unauthorised person who copies them cannot understand the ciphertext without the required key" contains both the method and its effect.
Choose a protection by its mechanism: detect malicious software, conceal meaning, govern user behaviour, or restore data.
Anti-malware
Anti-malware
Software designed to detect and respond to malicious software, for example by blocking it, quarantining it or removing it.
Anti-malware may check files when they are downloaded, opened or scanned. Two detection approaches are useful to understand:
- Signatures: the software compares features of a file with stored patterns associated with known malware.
- Suspicious behaviour: the software looks for actions that resemble malicious activity, which can help with threats that do not match a known signature exactly.
Detection is followed by a response. Blocking stops the file from running or being accessed. Quarantine isolates a suspected file so it cannot normally run while it is reviewed. Quarantine is not the same as deletion. Removal deletes or cleans the detected malicious content where the product can do so.
Anti-malware software and its detection information must be kept up to date. An old signature set may not contain patterns for more recent malicious software. Even an up-to-date product cannot guarantee that every threat will be found, especially if a threat is new or disguised, so anti-malware is one layer of protection rather than a complete solution.
Worked example
A user downloads an unapproved program. Before the file opens, anti-malware compares it with current detection information, recognises a known malicious pattern and moves it to quarantine. This protects the system because the isolated file cannot normally execute and cause harm. It does not prove that all other files are safe, and it does not repair data that was damaged before detection.
Encryption
Encryption
The use of a cryptographic algorithm and one or more keys to transform readable plaintext into unintelligible ciphertext, so the original data cannot be understood without the required key.
The core process is:
plaintext --(encryption algorithm and key)--> ciphertext
ciphertext --(decryption and required key)--> plaintext
Plaintext is the original usable data. Ciphertext is its encrypted form. A key is a value used by the cryptographic process; the required key must be protected so that an unauthorised person cannot use it to recover the plaintext.
Encryption can protect data in two common situations:
- Stored data: files on a laptop or removable drive can remain unintelligible if the device is lost or stolen.
- Data being transferred: an intercepted transmission contains ciphertext rather than readable plaintext.
Encryption protects the meaning of data, but it does not make the whole system invulnerable. If an authorised user has already unlocked a device, someone using that session may be able to read the decrypted data. Encryption also does not stop a file from being deleted or damaged, and it does not create a replacement copy. Secure key handling and backup therefore remain important.
Worked example
A teacher's laptop stores encrypted assessment records. If the powered-off laptop is stolen, a person who copies the encrypted file obtains ciphertext. Without the required key, the file's contents are unintelligible. If the only copy of the encrypted file is deleted, however, encryption cannot recover it; that requires a backup.
Acceptable-use policies
Acceptable-use policy
A documented set of rules and responsibilities that states how people are permitted to use an organisation's digital systems and data.
An acceptable-use policy, often shortened to AUP, is a people-focused protection. Its exact contents depend on the organisation, but relevant rules could require users to:
- use only approved software and services;
- avoid opening untrusted files or links;
- keep account details private;
- use systems only for permitted purposes;
- report security warnings or suspected incidents;
- accept stated consequences when rules are broken.
Continue this lesson.
You’re previewing NovaLearn without an account. Create a free account to read the rest.
Create free account