Security, privacy and data integrity
Definitions of data integrity, privacy and security:
Data integrity – A requirement for data to be accurate and up to date
Data privacy – A requirement fir data to be available only to authorised users
Data security – A requirement for data to be available for use when needed, ensures that
inly authorised users have access to the system and data can be recovered if lost or
corrupted
Threats to the security of a computer system and
of the data stored in it:
Malware – Malicious software that has the intention of causing harm to a system or its
contents.
Trojan horse – Replaces all or part of a previously useful program
Spyware – Collects information and transmits it to another system
Bot Takes control of another computer and uses it to launch attacks
Phishing – Sending an email or electronic message from an apparently legitimate
source requesting confidential information.
Pharming – Setting up a bogus website which appears to be a legitimate site.
Keylogger – Recording keyboard usage by the legitimate user of the system.
System vulnerability arising from user activity – Many system vulnerabilities are associated
directly with the activities of legitimate user of a system:
The use of weak passwords, this makes it easy for the hacker to guess the password.
A user not recognising a phishing or pharming attack.
A legitimate user might introduce a malware deliberately or by accident. This is done by:
Attaching a portable storage device
Opening an email attachment
Accessing a website
Downloading a file from the Internet
Vulnerability arising from within the system itself – System themselves often have security
weakness. Here are some examples:
Lack of good security
Commonly used application packages allow micro viruses to spread
Buffer overflow
Security measures for protecting computer
systems:
Disaster recovery – If there was to be a system shutdown at the very least the service
should be back up and running after a very short time if it is in a continuity of operation.
Safe system update – The company service should never be shut down so when they are
doing an update they have to have the original system and its replacement running in
parallel for a period to ensure continuity of service.
User authentication – For any account or PC there should always be a way to authenticate if
the user trying to login is the correct user.
