Know and understand characteristics and methods of protecting data including biometrics, digital certificate, secure socket layer (SSL), encryption, firewall, two-factor authentication, user id and password

Safety and Security – ICT 0417

Learning objective

Know and understand the characteristics and methods of protecting data, including:

  • Biometrics

  • Digital certificates

  • Secure Socket Layer / Transport Layer Security (SSL/TLS)

  • Encryption

  • Firewalls

  • Two‑factor authentication (2FA)

  • User ID and password

and be able to relate these methods to the CIA triad, relevant legislation and everyday eSafety practice.

1. Why data protection is required

  • Legal & ethical drivers – Data Protection Act (UK) and GDPR principles (lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity & confidentiality, accountability).

  • Personal & sensitive data – full name, date of birth, NI number, medical history, bank details, biometric templates. Misuse can lead to identity theft, fraud, discrimination, or reputational damage.

  • Physical safety of hardware – electrocution, fire, tripping hazards, heavy equipment, overheating of servers and storage devices.

Physical safety – main hazards and mitigation checks

HazardPotential impactPractical mitigation
Exposed cables / overloaded socketsElectric shock, fire, equipment damageUse mains‑rated power strips with surge protection; keep cables tidy and away from walkways.
Overheating of laptops, servers or UPS unitsHardware failure, data loss, fireEnsure adequate ventilation, clean dust filters regularly, monitor temperature, use a UPS with temperature alarm.
Heavy or unstable equipment (e.g., tower PCs, server racks)Physical injury, equipment toppleSecure racks to walls or floor, use anti‑tip brackets, lift with two people or mechanical aids.
Water damage (spills, flooding)Short‑circuit, data lossPlace devices away from liquids, use waterproof floor mats, have a spill‑response plan.
FireDestruction of hardware and dataInstall smoke detectors, fire‑suppression systems (e.g., FM‑200), keep fire extinguishers nearby, conduct regular fire drills.

2. Core concepts

  • Authentication – confirming who a user *is* (e.g., password, fingerprint).

  • Authorisation – defining what an authenticated user *may* do (e.g., file permissions, role‑based access).

  • CIA triad – Confidentiality, Integrity, Availability. All protection methods aim to support one or more of these pillars.

3. Threats to data (overview)

ThreatTypical impactMitigation methods
Hacking / unauthorised accessLoss of confidentiality, data alterationFirewalls, strong passwords, 2FA, encryption, digital certificates
Phishing & social engineeringCredential theft, malware infectionUser education, 2FA, email filters, safe‑browsing habits
Malware (viruses, ransomware)Data loss, loss of availabilityAntivirus/anti‑malware, regular backups, firewalls, application whitelisting
Card/identity fraudFinancial loss, identity theftEncryption of transactions, SSL/TLS, digital certificates, tokenisation
Insider threatUnauthorised data disclosure or alterationAuthorisation controls, audit logs, least‑privilege policies, separation of duties
Physical damage (fire, water, power failure)Loss of hardware and dataUPS, fire‑suppression, proper cabling, regular backups, off‑site storage

4. Methods of protecting data

MethodHow it worksAdvantagesLimitationsReal‑world exampleCIA contribution
BiometricsUses unique physiological or behavioural traits (fingerprint, iris, voice, facial pattern) to verify identity.Hard to duplicate; convenient; provides non‑repudiation.Requires specialised hardware; may fail due to injury or ageing; privacy concerns.Smartphone fingerprint unlock; airport e‑gate facial recognition.Confidentiality, Integrity
Digital certificateElectronic document that binds a public key to an entity’s identity, signed by a trusted Certificate Authority (CA).Enables trusted online transactions; essential for SSL/TLS.Depends on CA trustworthiness; certificates expire and must be renewed.Bank’s HTTPS site showing a padlock and “Issued by DigiCert”.Confidentiality, Integrity
SSL / TLSProtocol that encrypts data between client and server. Uses asymmetric encryption to exchange a symmetric session key, then encrypts all traffic with that key.Provides confidentiality and integrity for web traffic; visible as “https://”.Older versions (SSL 2.0/3.0) are insecure; requires valid certificates.Online shopping checkout page using TLS 1.3.Confidentiality, Integrity
EncryptionTransforms readable plaintext into unreadable ciphertext using an algorithm and a secret key (symmetric) or a key pair (asymmetric).Protects data at rest (e.g., encrypted drives) and in transit (e.g., VPN). Strong algorithms are mathematically robust.Key management is critical; weak keys/algorithms can be broken.BitLocker full‑disk encryption on Windows laptops.Confidentiality, Integrity
FirewallHardware or software that monitors and controls network traffic according to a set of security rules (packet filtering, stateful inspection, proxy).Blocks unauthorised inbound/outbound traffic; can segment networks into zones.Mis‑configured rules may create gaps; does not stop insider attacks.Corporate perimeter firewall blocking port 23 (Telnet) but allowing port 443 (HTTPS).Confidentiality, Availability
Two‑factor authentication (2FA)Requires two independent credentials: something you know (password), something you have (token, mobile app), or something you are (biometric).Greatly reduces risk of unauthorised access even if one factor is compromised.Can be inconvenient; tokens or phones can be lost or stolen.Bank sends a one‑time code to a smartphone app after password entry.Confidentiality, Integrity
User ID & passwordTraditional knowledge‑based authentication; the user supplies a unique identifier and a secret string.Simple to implement; familiar to most users.Weak passwords are vulnerable to guessing, phishing, brute‑force attacks; passwords may be stored insecurely.Corporate email login requiring a username and a complex password.Confidentiality

5. Mapping methods to the CIA triad

  • Confidentiality – Encryption, SSL/TLS, firewalls, strong passwords, 2FA, biometric verification, digital certificates.

  • Integrity – Digital certificates, SSL/TLS (MACs), audit logs, checksums, 2FA (prevents credential tampering).

  • Availability – Firewalls with DoS protection, regular backups, UPS and fire‑suppression, redundant network paths, load‑balancing.

6. eSafety (Internet, email, social media, online gaming)

  • Safe browsing – Look for “https://” and a padlock; avoid clicking unknown links.

  • Phishing awareness – Check sender address, hover over links, never provide credentials via email.

  • Social‑media privacy – Set profiles to “friends only”, avoid sharing personal identifiers (DOB, address, phone).

  • Online gaming etiquette – Use in‑game chat responsibly, do not share personal details, enable parental controls for younger users.

  • Public Wi‑Fi – Use a VPN or avoid transmitting sensitive data on unsecured networks.

  • Parental controls & content filters – Configure routers or device‑level controls to block inappropriate sites.

Exam tip

When answering a question on eSafety, note the command word:

  • Describe – give a brief account of each eSafety area (browsing, email, social media, gaming, public Wi‑Fi).

  • Explain – discuss why each practice protects users (e.g., “HTTPS encrypts data, preventing eavesdropping”).

  • Evaluate – weigh the advantages and disadvantages of a particular eSafety measure (e.g., VPNs vs. trusted networks).

7. Password management – best‑practice checklist

  • Minimum length: 12 characters (more for high‑risk accounts).

  • Mix of upper‑case, lower‑case, numbers and symbols.

  • Avoid dictionary words, personal information, repeated characters.

  • Change passwords regularly (e.g., every 90 days) and after a suspected breach.

  • Never reuse passwords across unrelated services.

  • Store passwords securely – use a reputable password manager (encrypted locally or cloud‑based with zero‑knowledge architecture).

  • Enable 2FA wherever possible.

8. Backup & recovery

  • Regular backups – at least weekly full backup plus daily incremental backups.

  • 3‑2‑1 rule – keep three copies of data, on two different media, with one copy off‑site (e.g., cloud storage).

  • Testing – periodically restore a sample file to verify backup integrity.

  • Encryption of backups – protect backup media from unauthorised access.

  • Disaster‑recovery plan – define Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for critical services.

9. Practical example – secure online banking (good practice)

  1. User enters user ID and password (knowledge factor).

  2. Bank prompts for a one‑time code sent to the user’s mobile device (possession factor – 2FA).

  3. Browser establishes an SSL/TLS session; the server presents a valid digital certificate issued by a trusted CA.

  4. All data exchanged (account numbers, transaction details) is encrypted using the session key.

  5. Bank’s internal network is protected by a firewall that blocks unauthorised inbound traffic.

  6. Optional: the banking app may request a fingerprint scan (biometric factor) to authorise high‑value transfers.

10. Practical example – unsafe practice (what to avoid)

  • Logging into online banking over public Wi‑Fi without a VPN.

  • Using the same simple password for banking and social media.

  • Ignoring browser warnings about an expired or self‑signed certificate.

  • Disabling the firewall to “speed up” the connection.

  • Storing passwords in plain‑text documents on the desktop.

11. Glossary of key terms

TermDefinition (Cambridge wording)
BiometricsAuthentication based on a person’s unique physiological or behavioural characteristics.
Digital certificateElectronic document that binds a public key to an individual or organisation, signed by a trusted Certificate Authority.
SSL / TLSProtocols that provide encrypted communication over a network; TLS is the successor to SSL.
EncryptionProcess of converting plaintext into ciphertext using an algorithm and a secret key.
FirewallSystem (hardware or software) that controls network traffic according to a set of security rules.
Two‑factor authentication (2FA)Security method requiring two different forms of verification (something you know, have, or are).
User IDUnique identifier assigned to a user for login purposes.
PasswordSecret string known only to the user, used to prove identity.
ConfidentialityEnsuring that data is accessible only to authorised persons.
IntegrityEnsuring that data is accurate, complete and has not been unauthorisedly altered.
AvailabilityEnsuring that data and services are accessible when required.
Certificate Authority (CA)Trusted third‑party that validates identities and issues digital certificates.
eSafetyPractices that protect users from online risks such as phishing, cyber‑bullying, identity theft and unsafe content.

12. Revision questions

  1. Define authentication and authorisation and explain how they differ.

  2. List three advantages and two limitations of biometric security.

  3. What is the role of a Certificate Authority in the SSL/TLS process?

  4. Why is two‑factor authentication more secure than using a password alone?

  5. Describe how a firewall protects a network and give an example of a rule it might enforce.

  6. State three elements that must be included in a strong password.

  7. Explain the 3‑2‑1 backup rule and why it is important.

  8. Identify two eSafety risks when using public Wi‑Fi and how to mitigate them.

  9. Give one physical‑safety check you would carry out before installing a new server.

  10. Match each of the following protection methods to the CIA component(s) it primarily supports: (a) SSL/TLS, (b) backup, (c) biometric login, (d) firewall.

Answers (for teacher use)

  1. Authentication verifies *who* a user is; authorisation determines *what* the verified user is allowed to do.

  2. Advantages: difficult to forge, convenient for users, provides non‑repudiation. Limitations: expensive hardware, may fail due to injury or ageing, raise privacy concerns.

  3. The CA validates the identity of the certificate holder and digitally signs the certificate, creating trust in the public key used for SSL/TLS.

  4. 2FA combines two independent factors (knowledge + possession or biometrics), so compromising one factor does not give full access.

  5. A firewall filters traffic based on rules; e.g., block inbound traffic on port 23 (Telnet) while allowing port 443 (HTTPS).

  6. Minimum 12 characters, mix of upper‑case/lower‑case letters, numbers and symbols; avoid personal information; use a password manager.

  7. Three copies of data, on two different media types, with one copy stored off‑site. This protects against media failure, theft and site‑wide disasters.

  8. Risks: data can be intercepted (sniffed) and credentials stolen; malicious hotspots may inject malware. Mitigate by using a VPN and ensuring the site uses HTTPS.

  9. Check that the server rack is securely anchored to the floor/wall and that there is adequate ventilation to prevent overheating.

  10. (a) SSL/TLS – Confidentiality & Integrity; (b) Backup – Availability; (c) Biometric login – Confidentiality & Integrity; (d) Firewall – Confidentiality & Availability.