Explain the need for encryption

Cambridge A‑Level IT 9626 – Data Processing and Information

Topic 1 – Data Processing and Information

1.1 Data & Information

• Data: raw, unprocessed facts (numbers, text, images, sensor readings).
• Information: data that has been organised, processed or interpreted to give meaning.
• Sources of data
  • Direct – collected straight from the source (questionnaire, interview, sensor).
  • Indirect – obtained from another source or compiled (census, weather reports, web‑scraped data).
• Advantages / disadvantages of direct data
  • Advantage – high relevance and control over collection.
  • Disadvantage – time‑consuming and often expensive.
• Advantages / disadvantages of indirect data
  • Advantage – readily available, cheaper, large volumes.
  • Disadvantage – may be less relevant, outdated, or of uncertain quality.

1.2 Quality of Information

Quality criterion	What it means	Example
Accuracy	Correctness of the data	Correct postcode for a customer
Relevance	Useful for the purpose	Age of a user is needed for a health‑app, not favourite colour
Age / Timeliness	How recent the data is	Stock levels updated every hour
Completeness	All required fields are present	Every order record contains product ID, quantity and price
Consistency	No contradictions within the data set	Same customer ID does not have two different addresses
Validity	Data conforms to defined rules (e.g., format, range)	Phone number follows the national format
Uniqueness	Each entity appears only once	Only one employee record per employee number

1.3 Encryption – Why It Is Needed

Encryption transforms readable data (plaintext) into unreadable data (ciphertext) using an algorithm and a key. It safeguards the confidentiality, integrity and, indirectly, the availability of information.

Key reasons for using encryption

• Confidentiality: Prevent unauthorised parties from reading sensitive data.
• Integrity: Detect unauthorised alteration (often combined with hash functions).
• Legal & regulatory compliance: GDPR, HIPAA, PCI‑DSS, etc., require encryption for certain data.
• Risk mitigation: Reduces impact of eavesdropping, device loss, insider threats and malware.

Common threats mitigated by encryption

1. Eavesdropping on network traffic (Wi‑Fi sniffing).
2. Interception of email or file transfers.
3. Physical loss or theft of storage devices.
4. Unauthorised insider access.
5. Malware attempting to read or exfiltrate data.

Encryption protocols – advantages & disadvantages (A‑Level focus)

Protocol / Method	Type (symmetric / asymmetric / hybrid)	Typical use	Advantages	Disadvantages
AES (Advanced Encryption Standard)	Symmetric	File‑level, full‑disk, VPN payloads	Very fast, strong security (128/192/256‑bit keys)	Key distribution problem
RSA	Asymmetric	Secure key exchange, digital signatures	No prior secret key needed; supports authentication	Slower, large keys (2048 bits +) required for adequate security
TLS/SSL (HTTPS)	Hybrid (asymmetric for handshake, symmetric for data)	Web traffic, email (STARTTLS), VPN‑like tunnels	Provides confidentiality + integrity for data in transit; widely supported	Requires certificate management; vulnerable to mis‑configuration
IPsec	Hybrid	Site‑to‑site and remote‑access VPNs, secure LANs	Transparent to applications; works at network layer	Complex configuration; interoperability issues between vendors
PGP / S/MIME	Asymmetric (used for end‑to‑end email)	Email encryption & signing	Only sender & intended recipient can read the message; supports non‑repudiation	Key‑management overhead for end users

Encryption counter‑measures for the listed threats

Threat	Encryption counter‑measure	Resulting benefit
Eavesdropping on network traffic	TLS/SSL (HTTPS) or IPsec VPN	Data remains confidential while in transit
Lost / stolen storage device	Full‑disk encryption (BitLocker, FileVault, LUKS)	Data unreadable without proper authentication
Unauthorised email access	End‑to‑end encryption (PGP / S/MIME)	Only sender and intended recipient can view the message
Malware attempting data exfiltration	Application‑level encryption of sensitive fields (e.g., credit‑card numbers)	Even if intercepted, data is unintelligible

Size impact of block‑cipher encryption (example)

When a block cipher such as AES (block size = 16 bytes) is used with padding, the ciphertext length C is:

\( C = \left\lceil \dfrac{P}{b} \right\rceil \times b \)

where P is the plaintext length in bytes and b the block size. This shows that encryption can increase storage requirements – an important design consideration.

Legal & ethical considerations

• Data‑protection laws (GDPR, HIPAA, PCI‑DSS) explicitly require encryption for personal or financial data.
• Failure to encrypt can lead to fines, loss of reputation and loss of customer trust.
• Ethically, organisations have a duty to protect users’ privacy and prevent misuse of data.

1.4 Checking the Accuracy of Data

Validation – checks performed at the point of entry

• Presence check – is a value supplied?
• Range check – does a number fall within allowed limits?
• Format check – does the data match a pattern (e.g., email regex)?
• Length check – is the text the correct length?
• Lookup check – does the entry exist in a reference table?
• Limit (or threshold) check – is the value below/above a business‑defined limit?
• Check‑digit verification – e.g., ISBN or credit‑card Luhn check.

Verification – checks performed after entry

• Double‑entry verification – two operators input the same data; differences are flagged.
• Checksum / hash verification – e.g., verifying a downloaded file’s SHA‑256 hash.
• Cross‑reference verification – compare with an external source (e.g., bank account number against a master list).

Example

When a student registers for a course, the system:

1. Validates the student ID (numeric, 8‑digit, exists in the student table) and the email format.
2. After entry, a verification script checks that the total number of registered students does not exceed the course capacity.

1.5 Data Processing Methods

Method	How it works	Typical use‑case	Advantages	Disadvantages
Batch processing	Collects data over a period, then processes it all at once	Payroll, end‑of‑day sales reports	Efficient use of resources; easy to schedule	Not suitable for time‑critical decisions
Online (transaction) processing	Processes each transaction immediately as it occurs	Banking, e‑commerce checkout	Provides up‑to‑date information; supports immediate feedback	Requires higher system availability; can be resource‑intensive
Real‑time processing	Data is processed within a guaranteed time limit (often milliseconds)	Air‑traffic control, industrial control systems	Enables instant response; essential for safety‑critical systems	Complex, expensive hardware/software; strict timing constraints

Algorithm – Choosing a processing method

INPUT  dataVolume, responseTimeRequirement, resourceAvailability
IF responseTimeRequirement = "none" OR responseTimeRequirement > 1 hour THEN
    SELECT "Batch processing"
ELSE IF responseTimeRequirement ≤ 5 seconds AND resourceAvailability = "high" THEN
    SELECT "Real‑time processing"
ELSE
    SELECT "Online (transaction) processing"
END IF
OUTPUT selectedMethod

Pseudocode example – batch salary calculation

FOR each employee IN employeeFile
    READ basicPay, overtimeHours
    grossPay = basicPay + (overtimeHours * overtimeRate)
    tax      = grossPay * taxRate
    netPay   = grossPay - tax
    WRITE employeeID, netPay TO payrollReport
END FOR

Topic 2 – Hardware & Software

2.1 Computer types

Computer type	Typical use	Key characteristics
Mainframe	Large‑scale transaction processing (banks, airlines)	Very high reliability, massive I/O capacity, supports many simultaneous users
Supercomputer	Complex scientific calculations (climate modelling, particle physics)	Extreme processing speed, parallel architectures, specialised cooling
Personal computer / Laptop	General office, education, home use	Moderate performance, interactive OS, portable (laptop)
Embedded system	Appliances, automotive control units, IoT devices	Dedicated function, limited resources, often real‑time

2.2 Software – System vs. Application

• System software: Operating systems, device drivers, utility programs – manage hardware resources and provide a platform for applications.
• Application software: Word processors, databases, web browsers – perform specific user‑oriented tasks.

2.3 Utility software

Utilities are specialised system‑software tools that maintain, analyse or optimise a computer. Examples include:

• Disk defragmenter
• Backup & restore utilities
• Antivirus / anti‑malware scanners
• File compression (ZIP, RAR)
• System monitoring tools (CPU/memory usage)

2.4 Custom vs. Off‑the‑shelf software

Aspect	Custom software	Off‑the‑shelf software
Development cost	High (design, coding, testing)	Low (purchase licence)
Fit to business process	Exact match	May need adaptation or work‑arounds
Time to deploy	Long (months‑to‑years)	Immediate or short‑term
Maintenance	Owner responsible	Vendor provides updates

2.5 Proprietary vs. Open‑source software

• Proprietary: Source code is closed; licence fees usually required; vendor supplies support and updates.
• Open‑source: Source code freely available; often free of charge; community or commercial support may be available; users can modify the code.

2.6 User‑interface (UI) types and symbols

UI type	Typical device / context	Common symbols
Command‑line interface (CLI)	Servers, network equipment, developer tools	Prompt (e.g., >), text commands, error codes
Graphical user interface (GUI)	Desktops, laptops, tablets	Windows, icons, menus, buttons, scrollbars
Dialogue box (modal / non‑modal)	Any GUI application	OK / Cancel buttons, checkboxes, radio buttons, input fields
Touch / gesture interface	Smartphones, tablets, kiosks	Swipe, pinch, tap, drag‑and‑drop icons
Voice‑controlled interface	Smart speakers, mobile assistants	Wake word, spoken commands, audio feedback

Topic 3 – Monitoring & Control

3.1 Sensors and Actuators

• Sensor: Detects a physical quantity (temperature, pressure, light, motion) and converts it into an electrical signal.
• Actuator: Converts an electrical signal into a physical action (motor, valve, speaker, LED).

3.2 Calibration methods

• Zero‑adjustment – set the sensor output to zero when the measured quantity is zero.
• Span (or gain) adjustment – align the sensor output with a known reference value at the upper end of its range.
• Two‑point calibration – uses both a low‑reference and a high‑reference to define a linear relationship.
• Software calibration – applies correction factors in firmware or application code.

3.3 Control technologies

• Open‑loop control – No feedback; action is based solely on input (e.g., a timed sprinkler).
• Closed‑loop (feedback) control – Output is measured and compared with the desired set‑point; the system adjusts accordingly (e.g., thermostat).

Simple sensor‑actuator loop (textual diagram)

[Sensor] → (measure) → [Controller] → (compare to set‑point) → [Actuator] → (adjust environment) → [Sensor] …

Control algorithm example – thermostat (closed‑loop)

READ currentTemperature FROM temperatureSensor
SET desiredTemperature = 22°C
IF currentTemperature < desiredTemperature - 0.5 THEN
    TURN heater ON
ELSE IF currentTemperature > desiredTemperature + 0.5 THEN
    TURN heater OFF
ELSE
    MAINTAIN current state
END IF

Algorithm – Selecting a monitoring approach

INPUT  requiredAccuracy, budget, environmentVariability
IF requiredAccuracy = "high" AND budget ≥ "moderate" THEN
    SELECT "Calibrated sensor with closed‑loop control"
ELSE IF environmentVariability = "low" THEN
    SELECT "Simple open‑loop sensor"
ELSE
    SELECT "Periodic manual checks"
END IF
OUTPUT chosenMonitoringMethod