ECDL/ICDL IT SECURITYYear 10 ICT

What is it about?

This module sets out essential concepts and skills relating to the ability to understand main concepts underlying the secure use of ICT in daily life. It also teaches us to use relevant technologies and applications to maintain a secure network connection, use the internet safely and securely, and manage data and information appropriately.

Goals of this Module

Understand the key concepts relating to the importance of secure information and data, physical security, privacy and identity theft.

Protect a computer, device or network from malware and unauthorised access.

Understand the types of networks, connection types and network specific issues including firewalls.

Browse the World Wide Web and communicate on the internet securely.

Understand security issues related to communications including email and instant messaging.

Back up and restore data appropriately and safely, and securely dispose of data and devices.

1 Security Concepts

This section will introduce the main concepts underlying the secure use of ICT in daily

life. It will explain threats to your data, and give you an understanding of measures you

can take to protect it.

Data Threats

When working with Data, it is important to be aware of potential threats that may pose a security risk through theft or loss of data.

Once you are aware of potential threats, it is easier to protect yourself against them.

Distinguishing between Data and Info Data is facts, images and/or numbers that

are collected to be examined and considered in order to help make decisions.

Information is the interpretation of this data in a structured way.

Example: You ask 200 people what type of phone they have. The answers you receive are classified as data. When you analyse this date, you get information.

Cybercrime

Cybercrime is the use of any computer, or network, to commit a crime.

Financial Scam Computer Hacking Downloading Pornographic Images from the

Internet Virus Attacks Stalking by email Creating Websites that promote racial hatred Identity theft Social Engineering.

Hacking, Cracking and Ethical Hacking A hacker is an individual who

attempts to bypass the security mechanisms of a network or information system.

A cracker is someone who exploits the weaknesses and security holes with malicious intent such as blocking accounts, or stealing information.

Hacking, Cracking and Ethical Hacking Ethical hackers are computer

security experts. They are employed by a company to attempt to bypass the security of said company’s information systems. The company can then act on this information, making their network safer.

Threats to Data

Force majeure relates to unforeseen events beyond the control of the company. Items include war, natural disasters, system crashes and corruption.

Employees can pose a risk to confidential information. They could pass information on to other people, or use it for their own advantage. They could even accidentally delete it.

Value of Information

Personal Information is any info or combination of information that enables the identification of an individual.

Personal information must be protected to prevent: Internet based fraud Identity Theft

Value of Information

Commercially Sensitive Information includes:

Statements of financial information Information of a company’s pricing

structure Information in the nature of

operating and financial information Current client lists, production costs,

hourly rates etc.

Value of Information

Commercially sensitive information must be protected to prevent:

Theft Misuse of client details Misuse of financial information

Preventing Unauthorized Access to Data Using a username and have a good

password How strong is your password?

(school, social media, home) www.passwordmeter.com

Protecting Data

Data Encryption

The process of transforming information (plaintext) using an algorithm (cipher) to make it unreadable to anyone except those possessing special knowledge. The resulting product is encrypted information (ciphertext).

Reversing the process is called decryption.

Data and the Law

The way computers can process, store and transfer data has necessitated some form of legislation to protect the privacy of individuals.

Data and the Law

Anyone with personal data on their computer (Data Controllers) must ensure that: Personal data is processed fairly and lawfully Personal data is always processed in accordance

with good practice Personal Data is only collected for specific

explicitly stated and legitimate purposes. Personal data is not processed for any purpose

that is incompatible with that for which the information is collected.

Personal Data that is processed is adequate and relevent in relation to the purposes of the processing.

Data and the Law

No more personal data is processed than is necessary having regard to the purposes of the processing.

Personal data that is processed is correct and, if necessary, up to date.

All reasonable measures are taken to complete, correct, block, or erase data to the extent that such data is incomplete or incorrect, having regard to the purposes for which they are processed.

Personal data is not kept for a period longer than is necessary.

Personal Security

Social engineering is a way to manipulate or influence people with the goal to illegally obtain sensitive data.

Social engineers gather this information through phone calls, phishing and shoulder surfing.

Definitions

Phishing: A technique of fraudulently obtaining private information. Usually in the form of a fake email, that appears to be from a legitimate business requesting verification of information.

Shoulder Surfing: Looking over someone's shoulder to see information they are entering into a computer.

Implications of Identity Theft Personal

Can be devastating, causing emotional distress, anxiety, and even triggering depression.

Financial Financial histories and credit records can suffer from

identity theft leading to the loss or misuse of one of more existing accounts.

Business Particularly in credit and financial fields, also suffer

financial losses. A business can suffer from lost time and productivity when the victim is an employee.

Legal Re-establishing a legal identity, including personal

details, passport and tax records.

Methods of Identity Theft

Information Diving The practice of recovering technical data

Skimming An electronic method of capturing a victim’s

personal information used by identity thieves. The skimmer is a small device that scans a credit card and stores the information found in the magnetic strip.

Pretexting Creating and using an invented scenario to

engage a targeted victim.

Setting Macro Settings

Setting a Password on a .docx

Advantages and Limitations of Encryption Advantages:

Protect information stored on your computer from unauthorised access

Protect information while it is in transit from one computer system to another

Deter and detect accidental or intentional alterations

Verify whether or not the author of a document is really who you think it is.

Advantages and Limitations of Encryption Limitations

If you forget your password then there is almost no chance of recovering your data

Some forms of encryption only offer nominal protection and can be broken easily.

Encrypted files attracts a suspicion as to what it is you are trying to protect.

Cannot prevent deletion of data.

Review

The process of intentionally accessing a computer without authorisation or exceeds access is known as: A) Cracking B) Phishing C) Hacking D) Pretexting

Review

The process of intentionally accessing a computer without authorisation or exceeds access is known as: A) Cracking B) Phishing C) Hacking D) Pretexting

Review

Which of the following is not a basic characteristic of information security? A) Confidentiality B) Locality C) Integrity D) Availability

Review

Which of the following is not a basic characteristic of information security? A) Confidentiality B) Locality C) Integrity D) Availability

Review

Encryption is the process of transforming plaintext using an algorithm to create ________ and make it unreadable by the use of a key A) Pretext B) Short Text C) Gibberish Text D) Ciphertext

Review

Encryption is the process of transforming plaintext using an algorithm to create ________ and make it unreadable by the use of a key A) Pretext B) Short Text C) Gibberish Text D) Ciphertext

Review

Which one of the following terms describes the process of someone monitoring you keying in your ATM pin with malicious intent? A) Shoulder Surfing B) Phishing C) cyber Bullying D) Cracking

Review

Which one of the following terms describes the process of someone monitoring you keying in your ATM pin with malicious intent? A) Shoulder Surfing B) Phishing C) cyber Bullying D) Cracking