Cambridge Notes, Past Papers, Revision Questions

Cambridge A-Level Computer Science 9618 – Data Security

6.1 Data Security

Objective

Show understanding of the threats to computer and data security posed by networks and the Internet.

Key Concepts

Confidentiality, Integrity, Availability (CIA triad)

Threats: passive vs active, internal vs external

Common attack vectors on networks and the Internet

Types of Threats

Threat Category	Description	Typical Examples
Interception	Unauthorized access to data in transit.	Sniffing, packet capture, wiretapping
Interruption	Disruption of service or loss of data.	DDoS attacks, power failure, hardware failure
Modification	Unauthorised alteration of data.	Man‑in‑the‑middle, malware injection, SQL injection
Fabrication	Insertion of false data or commands.	Phishing, spoofed emails, forged certificates

Network‑Based Threats

Eavesdropping / Sniffing
Attackers capture packets on a shared medium (e.g., Wi‑Fi) to read unencrypted data.

Man‑in‑the‑Middle (MitM)
Attacker positions between two communicating parties, altering or relaying messages.

Denial‑of‑Service (DoS) / Distributed DoS (DDoS)
Flooding a target with traffic to exhaust resources, causing service unavailability.

IP Spoofing
Forging the source IP address to hide the attacker’s identity or to bypass access controls.

ARP Poisoning
Manipulating the ARP cache to redirect traffic through the attacker’s machine.

Internet‑Based Threats

Phishing and Social Engineering
Deceptive communications that trick users into revealing credentials or installing malware.

Malware Distribution
Viruses, worms, Trojans, ransomware delivered via web downloads, email attachments, or drive‑by attacks.

SQL Injection
Injecting malicious SQL statements into web forms to manipulate databases.

Cross‑Site Scripting (XSS)
Injecting client‑side scripts into webpages to steal cookies or perform actions on behalf of the user.

Drive‑by Download
Automatic download of malicious code when a user visits a compromised website.

Impact on the CIA Triad

Threat	Confidentiality	Integrity	Availability
Eavesdropping	Compromised	Unaffected	Unaffected
DoS/DDoS	Unaffected	Unaffected	Compromised
Malware (Ransomware)	Compromised	Compromised	Compromised
SQL Injection	Compromised	Compromised	Potentially affected

Mathematical Example: Probability of Successful Attack

Assume the probability of a single security control failing is \$p\$, and an attacker must bypass \$n\$ independent controls. The probability \$P_{success}\$ of a successful attack is:

\$\$

P_{success} = p^{\,n}

\$\$

If \$p = 0.1\$ and \$n = 3\$, then \$P_{success} = 0.1^3 = 0.001\$ (0.1%).

Mitigation Strategies

Use strong encryption (e.g., TLS) to protect data in transit.

Implement firewalls and intrusion detection/prevention systems (IDS/IPS).

Apply regular patch management and software updates.

Enforce strong authentication (multi‑factor authentication).

Educate users about phishing and safe Internet practices.

Network segmentation and least‑privilege access controls.

Regular backups and tested disaster‑recovery plans.

Suggested diagram: Layered security model (defence‑in‑depth) showing perimeter, network, host, application, and data layers.

Summary

Networks and the Internet expose computers and data to a wide range of threats that can compromise confidentiality, integrity, and availability. Understanding the nature of these threats—whether they arise from passive eavesdropping, active manipulation, or service disruption—allows developers and administrators to implement layered security controls that reduce risk to an acceptable level.

Show understanding of the threats to computer and data security posed by networks and the internet