Know and understand secure socket layer (SSL) including encrypted links between the server and the client computer

ICT Syllabus – Quick Reference (IGCSE / A‑Level)

1. Personal Data & Legal/Ethical Principles (Syllabus 8.1)

Safe‑online Checklist for Students

• Never share passwords, PINs, or personal photos with strangers.
• Use strong, unique passwords; change them regularly.
• Only log in to sites that display a padlock icon and start with https://.
• Do not click links or open attachments from unknown senders.
• Report cyber‑bullying, phishing, or suspicious activity to a teacher or trusted adult.

2. Threats to ICT Security & Protection Measures (Syllabus 8.3)

Security Toolbox (Common Protection Tools)

• Firewalls – hardware or software that filters incoming and outgoing network traffic based on predefined rules.
• Anti‑virus / anti‑malware software – scans for, quarantines, and removes malicious code.
• Encryption

  • File‑level encryption (e.g., BitLocker, VeraCrypt) protects data stored on disks.
  • Email encryption (PGP, S/MIME) secures messages.
  • SSL/TLS encrypts data in transit (see Section 5).

• Strong passwords & password managers – generate and store complex passwords securely.
• Two‑factor authentication (2‑FA) – adds a second verification step (OTP, authenticator app, hardware token).
• Digital certificates – electronic documents issued by a Certificate Authority (CA) that bind a public key to an entity’s identity.

3. Recognition & Authentication Methods (Syllabus 8.4)

4. What Is SSL/TLS?

Secure Socket Layer (SSL) – now superseded by Transport Layer Security (TLS) – is a cryptographic protocol that creates an encrypted link between a web server (the “server”) and a web browser (the “client”). The link guarantees:

• Confidentiality – data cannot be read by eavesdroppers.
• Integrity – any alteration of the data is detected.
• Authentication – the client can verify it is communicating with the intended server.

Key Cryptographic Concepts Used by SSL/TLS

• Encryption – converting plaintext into ciphertext using an algorithm and a key.
• Decryption – reversing the process with the correct key.
• Asymmetric (public‑key) cryptography – a pair of mathematically linked keys: a public key (shared) and a private key (kept secret).
• Symmetric cryptography – a single secret key used for both encryption and decryption; much faster than asymmetric encryption.
• Digital certificate – an electronic document issued by a trusted Certificate Authority (CA) that binds a server’s public key to its domain name.

SSL/TLS Handshake – How the Secure Link Is Created

The handshake occurs before any application data is exchanged. It uses asymmetric encryption to agree on a symmetric session key, then switches to fast symmetric encryption.

Encryption After the Handshake

1. Application data (e.g., a web form) is taken as plaintext.
2. The data is encrypted with the symmetric session key using a fast block cipher such as AES‑GCM.
3. The ciphertext travels across the network.
4. The receiver decrypts it with the same session key to obtain the original plaintext.

5. SSL/TLS Vulnerabilities & How to Avoid Them

• Out‑dated protocol versions (SSL 2.0, SSL 3.0) – vulnerable to POODLE, BEAST, etc.

  
  Fix: Disable these versions; use TLS 1.2 or TLS 1.3 only.

• Weak cipher suites (RC4, DES, 3DES, CBC without MAC) – can be broken with modern hardware.

  
  Fix: Configure servers to allow only strong ciphers such as AES‑256‑GCM or ChaCha20‑Poly1305.

• Improper certificate validation – allows attackers to present fake certificates.

  
  Fix: Ensure browsers/clients check the CA signature, expiry, revocation status, and that the domain matches the certificate.

• Heartbleed (CVE‑2014‑0160) – information leak in OpenSSL.

  
  Fix: Update OpenSSL libraries; re‑issue certificates if private keys may have been exposed.

Best Practices for Maintaining SSL/TLS Security

1. Use the latest TLS version supported by both client and server (currently TLS 1.3).
2. Disable obsolete protocols and weak cipher suites on the server.
3. Obtain certificates from reputable Certificate Authorities; renew before expiry.
4. Implement HTTP Strict Transport Security (HSTS) to force browsers to use HTTPS.
5. Run regular external scans (e.g., Qualys SSL Labs) to detect mis‑configurations.
6. Combine SSL/TLS with other security measures: firewalls, anti‑virus, strong passwords, and 2‑FA.

6. Common Browser Indicators of a Secure Connection

• Padlock icon in the address bar.
• URL begins with https:// rather than http://.
• Clicking the padlock shows certificate details (issuer, validity dates, domain).
• In some browsers, the address bar may turn green for Extended Validation (EV) certificates.

7. Mapping Topics to Assessment Objectives

8. Sample Exam‑Style Questions (Security Section)

1. AO2 – Application
   

   A school website currently supports only TLS 1.0. Explain why this is a security risk and describe two steps the school IT officer should take to improve the site’s security.

2. AO3 – Evaluation
   

   Two‑factor authentication (2‑FA) is introduced for the school’s virtual learning environment. Evaluate the advantages and possible drawbacks of this measure for students and staff.

3. AO1 – Knowledge
   

   Define the term “digital certificate” and state the role of a Certificate Authority (CA) in the SSL/TLS process.

4. AO2 – Application
   

   You receive an email that appears to be from your bank asking you to confirm your account details via a link. Using the “safe‑online checklist”, list three actions you should take before responding.

9. Summary

SSL/TLS creates a secure, encrypted link between a client computer and a server. The handshake uses asymmetric cryptography to exchange a secret pre‑master value, from which both parties derive a fast symmetric session key. All subsequent data is encrypted with this key, ensuring confidentiality, integrity, and authentication. Understanding SSL/TLS, together with the broader ICT concepts – personal data protection, common threats, authentication methods, and the full range of syllabus topics – equips students to use technology safely, evaluate security measures critically, and meet the demands of the Cambridge IGCSE/A‑Level ICT examinations.