Show understanding of the threats to computer and data security posed by networks and the internet

6.1 Data Security

Objective

Show understanding of the threats to computer and data security posed by networks and the Internet, and of the measures that can be be used to restrict those risks.

Key Concepts (as stated in the Cambridge syllabus)

• Confidentiality, Integrity, Availability (CIA triad) – the three fundamental security objectives.
• Data security vs. Data integrity – security protects data from unauthorised access, while integrity ensures data are accurate and unaltered.
• Encryption, Encryption protocols and Digital certificates – e.g. AES (symmetric), RSA/ECC (asymmetric), TLS/SSL, VPN, X.509 certificates.
• Privacy – the right of individuals to control how personal data are collected, used and disclosed (e.g. GDPR requires consent before a social‑media site shares a user’s photo).
• Threat classification – passive vs active, internal vs external.

Security Controls at Each Computing Layer

Controls must be applied from a stand‑alone PC through a LAN to the global Internet. The table matches each layer with typical controls that appear in the syllabus.

Threat Taxonomy (Syllabus Requirement)

Network‑Based Threats

1. Eavesdropping / Sniffing – Capturing packets on an unsecured medium (e.g., open Wi‑Fi) to read unencrypted data.
2. Man‑in‑the‑Middle (MitM) – Attacker inserts themselves between two parties, relaying or altering messages. Countered by TLS, certificate pinning.
3. Denial‑of‑Service (DoS) / Distributed DoS (DDoS) – Flooding a target with traffic to exhaust CPU, memory or bandwidth.
4. IP Spoofing – Forging the source IP address to hide the attacker’s identity or bypass ACLs.
5. ARP Poisoning / ARP Spoofing – Corrupting the ARP cache so traffic is redirected through the attacker’s machine.

Internet‑Based Threats

1. Phishing & Social Engineering – Deceptive e‑mails or web pages that trick users into revealing credentials or installing malware.
2. Malware Distribution – Viruses, worms, Trojans, ransomware delivered via web downloads, e‑mail attachments or drive‑by attacks.
3. SQL Injection – Inserting malicious SQL into a web form to read, modify or delete database records.
4. Cross‑Site Scripting (XSS) – Injecting client‑side scripts into a web page to steal cookies or perform actions on behalf of the user.
5. Drive‑by Download – Automatic download of malicious code when a user visits a compromised site.

Impact on the CIA Triad

Mathematical Example – Probability of a Successful Attack (AO2)

If the probability that a single security control fails is p, and an attacker must bypass n independent controls, the probability of a successful attack is:

\[

P_{\text{success}} = p^{\,n}

\]

Example: with p = 0.1 (10 % chance of failure) and n = 3 controls,

\[

P_{\text{success}} = 0.1^{3} = 0.001 \;(0.1\%)

\]

This illustrates the benefit of a layered (defence‑in‑depth) approach.

Mitigation Strategies – Defence‑in‑Depth (Syllabus Requirement)

• Encryption

  • Data in transit – TLS 1.3, IPSec VPN, SSH.
  • Data at rest – AES‑256 full‑disk encryption, database column encryption.
  • Public‑key infrastructure – X.509 certificates, digital signatures, certificate authorities.

• Firewalls – Perimeter (router) firewall, host‑based firewall, stateful inspection.
• IDS/IPS & WAF – Detect and block malicious traffic; signature‑based and anomaly‑based detection.
• Patch Management – Regular OS, firmware and application updates; automated patch deployment.
• Authentication & Authorisation

  • Strong passwords + account‑lockout.
  • Multi‑factor authentication (MFA) for remote access.
  • Least‑privilege principle; role‑based access control (RBAC).

• Network Segmentation – VLANs, DMZ for public services, separate management network.
• Backup & Disaster Recovery – Regular encrypted backups, off‑site storage, periodic restoration tests.
• User Education – Awareness of phishing, safe browsing, strong password creation, reporting suspicious activity.

Suggested Diagram – Layered Security Model

Illustrate a five‑layer defence‑in‑depth stack:

1. Perimeter layer – External firewall, ISP filtering.
2. Network layer – IDS/IPS, VLANs, secure routing.
3. Host layer – Host‑based firewall, anti‑malware, OS hardening.
4. Application layer – Web‑Application Firewall, input validation, secure coding.
5. Data layer – Encryption (AES, RSA), access controls, regular backups.

Syllabus Alignment (Assessment Objectives)

• AO1 – Knowledge: Definitions of CIA, encryption algorithms, TLS, digital certificates, threat classifications.
• AO2 – Application: Calculating probability of attack success; matching threats to appropriate controls; selecting suitable encryption protocol for a given scenario.
• AO3 – Design & Evaluation: Design a defence‑in‑depth architecture for a small business network; evaluate the strengths/weaknesses of chosen controls against the identified threats.

Summary

Networks and the Internet expose computers and data to a wide range of threats that can compromise confidentiality, integrity, availability and privacy. By understanding the taxonomy of threats (interception, interruption, modification, fabrication) and applying layered security controls—from strong passwords on a stand‑alone PC to TLS encryption and digital certificates on the global Internet—students can design robust solutions that meet the Cambridge Computer Science syllabus requirements.