Year 11 · ICT · Autumn 1
Safety and security; audience; communication · Lesson 2 of 5
Security of data
Theory8.3 Security of data4.2 Network issues and communication
Year 11 · ICT · Safety and security; audience; communication · Lesson 2 of 5
You will learn to
- Describe hacking, phishing, pharming, smishing, vishing, viruses and malware.
- Describe card fraud: shoulder surfing, card cloning and key logging.
- Explain how each threat can be prevented.
- Describe how biometrics, encryption, firewalls and two-factor authentication protect data.
Year 11 · ICT · Safety and security; audience; communication · Lesson 2 of 5
Success criteria
You have got it when you can say:
- I can tell phishing, smishing and vishing apart.
- I can match each threat to one defence.
- I can answer a threat question with a mark-scheme phrase for each mark.
Year 11 · ICT · Safety and security; audience; communication · Lesson 2 of 5
Retrieval starter
Questions from before. Write your answers, then show them.
- Last lesson
An intranet differs from the internet because…
A It has no pagesB It is slowerC It is private to an organisation
C. It is private to an organisation
- Last year
.csv is…
A A pictureB A web pageC Comma-separated values: a generic data format
C. Comma-separated values: a generic data format
- Last lesson
A presentation for young children should have…
A Formal languageB Dense data tablesC Big text and pictures, few words
C. Big text and pictures, few words
Year 11 · ICT · Safety and security; audience; communication · Lesson 2 of 5
Key words (1 of 7)
- Data protection act
- A law controlling how organisations collect, store and use personal data.
- Personal data
- Data about a living person who can be identified from it.
- Sensitive personal data
- Personal data, such as health or religion, that could cause harm or unfair treatment if leaked.
- Hacking
- Getting into a computer system without permission.
Year 11 · ICT · Safety and security; audience; communication · Lesson 2 of 5
Key words (2 of 7)
- Phishing
- A fake email with a link to a fake website that steals personal details.
- Smishing
- Phishing using SMS text messages.
- Vishing
- Phishing using voice calls or voicemail.
- Pharming
- Malicious code that redirects a user to a fake website even when the correct address is typed.
Year 11 · ICT · Safety and security; audience; communication · Lesson 2 of 5
Key words (3 of 7)
- Malware
- Any software written to cause harm, such as viruses, worms, spyware or ransomware.
- Shoulder surfing
- Watching someone enter a PIN or password to steal it.
- Card cloning
- Copying the magnetic stripe of a card to make a fake copy.
- Key logging
- Recording every key a user presses to steal passwords and card numbers.
Year 11 · ICT · Safety and security; audience; communication · Lesson 2 of 5
Key words (4 of 7)
- Biometrics
- Using unique body features such as fingerprints for authentication.
- Digital certificate
- An electronic document from a trusted authority that proves a website is genuine.
- SSL
- A protocol that encrypts data between a browser and a web server; shown by https and a padlock.
- Encryption
- Scrambling data with a key so only someone with the right key can read it.
Year 11 · ICT · Safety and security; audience; communication · Lesson 2 of 5
Key words (5 of 7)
- Firewall
- Hardware or software that checks incoming and outgoing traffic and blocks what breaks set rules.
- Two-factor authentication
- Logging in with two different types of proof, such as a password and a code sent to a phone.
- Network
- Two or more devices connected so they can share data and resources.
- NIC
- Network interface card: hardware that connects a device to a network.
Year 11 · ICT · Safety and security; audience; communication · Lesson 2 of 5
Key words (6 of 7)
- IP address
- An address that identifies a device on a network or the internet.
- LAN
- Local area network: covers one building or site.
- WAN
- Wide area network: covers a large area, joining many LANs.
- Authentication
- Proving a user is who they say they are.
Year 11 · ICT · Safety and security; audience; communication · Lesson 2 of 5
Key words (7 of 7)
- One-time password
- A code that works only once, made by a token.
- Zero login
- Authentication without typing, using biometrics and behaviour.
- Anti-malware
- Software that detects, quarantines and removes malicious software.
8.3 Security of data · The explanation · step 1 of 17 · part 1 of 2
Hacking
Hacking is getting into a computer system without permission.
A hacker may steal data, delete or change data, or lock the system. This can lead to identity theft or fraud.
Prevention: firewalls, strong passwords and user IDs, two-factor authentication, keeping software up to date, and encryption so stolen data is unreadable.
8.3 Security of data · The explanation · step 1 of 17 · part 2 of 2
Hacking (continued)
Encryption does not stop hacking. It stops the hacker understanding the data they steal. Say this clearly in exam answers.
8.3 Security of data · The explanation · step 2 of 17 · part 1 of 4
Phishing, smishing and vishing
Phishing: a fake email that looks like it is from a real company, such as a bank. A link takes the user to a fake website that steals their login or card details.
Smishing (SMS phishing): the same trick by text message. Example: 'Correos: your parcel is held, pay 1.99 EUR at this link.'
Vishing (voice phishing): the same trick by phone call or voicemail. The caller pretends to be the bank or the police.
8.3 Security of data · The explanation · step 2 of 17 · part 2 of 4
Phishing, smishing and vishing (continued)
Prevention: do not click links in unexpected messages; type the company's address yourself; check the sender's address; never give passwords or PINs by phone; use spam filters; report it.
8.3 Security of data · The explanation · step 2 of 17 · part 3 of 4
Phishing, smishing and vishing (continued)
8.3 Security of data · The explanation · step 2 of 17 · part 4 of 4
Phishing, smishing and vishing (continued)
These attacks trick people, not computers. Spotting the red flags is the best defence, because the message itself contains no virus.
There is something to try for this step in the IGCSE library.
8.3 Security of data · The explanation · step 3 of 17 · part 1 of 2
Pharming
Pharming: malicious code is installed on the user's computer or on a DNS server. It sends the user to a fake website even when they type the correct address.
The fake site looks real and collects login and bank details.
Prevention: anti-malware software that scans for pharming code; check the web address and the padlock (HTTPS) before typing details; check the website's digital certificate; do not open unknown attachments.
8.3 Security of data · The explanation · step 3 of 17 · part 2 of 2
Pharming (continued)
| Phishing | Pharming | |
|---|---|---|
| How the user reaches the fake site | Clicks a link in an email | Types the correct address but is redirected |
| Needs the user to act | Yes, must click the link | No action needed after the code is installed |
| Where the trick is | In the message | In code on the computer or DNS server |
The key difference: in phishing the user clicks a link; in pharming the user types the real address and is still sent to the fake site.
8.3 Security of data · The explanation · step 4 of 17 · part 1 of 2
Viruses and other malware
Malware means malicious software: any program written to cause harm.
A virus is a program that copies itself and attaches to other files. It can delete or damage data and make the computer crash or run slowly.
Other malware: worms spread across networks on their own. Trojan horses pretend to be useful software. Spyware secretly records what the user does.
8.3 Security of data · The explanation · step 4 of 17 · part 2 of 2
Viruses and other malware (continued)
Ransomware encrypts files and demands payment to unlock them. Adware shows unwanted adverts.
Prevention: anti-virus/anti-malware software, kept up to date, with regular scans. Do not open unknown attachments or download from untrusted sites. Keep backups so data can be restored.
Anti-virus works by comparing files with a list of known viruses. New viruses appear every day, so an out-of-date list misses them.
8.3 Security of data · The explanation · step 6 of 17 · part 1 of 2
Protection 1: user ID, password and two-factor authentication
A user ID says who you are. A password proves it. Only someone who knows both can log in.
A strong password is long (at least 8 characters, better 12+) and mixes upper case, lower case, digits and symbols. It is not a real word or your name or birthday.
Two-factor authentication (2FA) asks for two different types of proof: something you know (a password) and something you have (your phone) or are (a fingerprint).
8.3 Security of data · The explanation · step 6 of 17 · part 2 of 2
Protection 1: user ID, password and two-factor authentication (continued)
Example: you type your password, then the bank sends a 6-digit code to your phone. A thief with only your password cannot log in.
Passwords can be guessed, stolen by key loggers or phished. 2FA means a stolen password alone is not enough.
A password plus a security question is not 2FA. Both are 'something you know'.
The explanation · 12 more steps
More on the lesson page
The lesson page has the rest of the explanation, step by step:
- Card fraud: shoulder surfing, card cloning and key logging
- Protection 2: biometrics
- Protection 3: encryption, SSL and digital certificates
- Protection 4: firewalls
- Putting it together: threat and protection
- Security of data transfer
- Strong and weak passwords
- Passwords and biometrics
- Cards and tokens
- Zero login
- Anti-malware
- Electronic conferencing
Year 11 · ICT · Safety and security; audience; communication · Lesson 2 of 5
Try it: How long to crack it?
Year 11 · ICT · Safety and security; audience; communication · Lesson 2 of 5
Quick quiz · 1 of 3
Copyright protects…
- A Only software
- B Creative work automatically, from the moment it is made
- C Only registered work
B. Creative work automatically, from the moment it is made
Writing, music, photos, code and games are all covered.
Year 11 · ICT · Safety and security; audience; communication · Lesson 2 of 5
Quick quiz · 2 of 3
A dongle is used to…
- A Store photos
- B Speed up the internet
- C Stop software running without it
C. Stop software running without it
A physical key against piracy, with licences and product keys.
Year 11 · ICT · Safety and security; audience; communication · Lesson 2 of 5
Quick quiz · 3 of 3
Software piracy is…
- A A type of virus
- B Illegal copying of software
- C A licence
B. Illegal copying of software
Using software without a valid licence.
Year 11 · ICT · Safety and security; audience; communication · Lesson 2 of 5
Exit ticket
Answer on paper before you go. Then check.
Bcc is used so that…
A It arrives fasterB Recipients cannot see each other's addressesC The email is bigger
B. Recipients cannot see each other's addresses Blind carbon copy. Use it for a class mailing.
Netiquette is…
A Polite behaviour onlineB A search engineC A network cable
A. Polite behaviour online No shouting in capitals, think before you forward, respect privacy.