Safe Computing: Study Guide (Computer Science Principles 5.6)

Why safe computing matters

Computing is useful because it stores, moves and uses information about people. That is also why it carries risks. This topic covers three connected questions:

1. What information about us is collected, and what can others learn from it? (privacy)
2. How do we stop the wrong people getting in, and how do we keep messages secret? (authentication and encryption)
3. How do attackers try to get in, and how do we defend? (malware and attacks)

Personal data and privacy

Personally identifiable information (PII) is information about an individual that identifies, links, relates or describes them. Examples: a Social Security number, age, race, phone number, medical information, financial information and biometric data (such as fingerprints).

Many systems collect more than we notice:

• Search engines can record and keep a history of searches and use it to suggest websites or for targeted marketing.
• Websites can record a history of who has viewed their pages.
• Devices, websites and networks can collect location information, including where you have been, how you got there and how long you stayed.

Collected data can be put to good use: PII stored online can simplify making purchases, and location data can improve maps. But there are risks.

• Aggregation. Disparate pieces of data, such as location, cookies and browsing history, can be combined to create knowledge about an individual that no single piece reveals. Combining information posted on social media with other sources can be used to deduce private information.
• Unintended use. Information placed online can be used in ways that were not intended, such as a message being forwarded or a post being seen by a future employer.
• Permanence. Once information is placed online, it is difficult to delete.
• Crime. PII can be used to stalk a person, steal an identity or help plan other crimes.
• Permissions. Users can control the permissions programs have for collecting information, and should review the permission settings of programs to protect their privacy.

Authentication: proving who you are

Authentication measures protect devices and information from unauthorised access. Two key measures are:

• Strong passwords. A strong password is easy for the user to remember but difficult for someone else to guess based on knowledge of that user. Long, unusual combinations are stronger than short words or personal details such as birthdays.
• Multifactor authentication (MFA). Access is granted only after the user presents several separate pieces of evidence, typically from at least two of these categories:

Category	Meaning	Example
Knowledge	Something you know	A password or PIN
Possession	Something you have	A phone that receives a code, or a security key
Inherence	Something you are	A fingerprint or face scan

MFA requires at least two steps to unlock protected information, and each step adds a new layer of security that must be broken to gain unauthorised access. A stolen password alone is no longer enough.

Encryption: keeping messages secret

Encryption is the process of encoding data to prevent unauthorised access; decryption is decoding it again. There are two common approaches:

• Symmetric key encryption uses one key for both encryption and decryption. Both sides must share the key in advance, which is a problem if they have never met.
• Public key encryption uses a pair of keys: a public key for encryption and a private key for decryption. The sender needs only the receiver’s public key to encrypt; the receiver’s private key is required to decrypt, and the receiver never has to share it.

How do you know a public key really belongs to Ben? Certificate authorities issue digital certificates that validate the ownership of encryption keys used in secure communications, based on a trust model. When your browser shows a secure connection to a site, a certificate is part of how it knows it has the site’s real key. The specific mathematics of encryption is outside the course.

Malware, updates and attacks

Malware is software intended to damage a computing system or take partial control of its operation. A computer virus is a malicious program that can copy itself and gain unauthorised access to a computer; it often attaches itself to a legitimate program and starts running on its own. Virus and malware scanning software can help protect a system.

All real-world systems have errors or design flaws that can be exploited, so regular software updates that fix errors help keep systems safe.

Common ways attackers gain access:

Threat	What it is	Defence
Phishing	Tricking a user into giving personal information, for example by an email that looks like it comes from a bank	Be sceptical of unexpected messages; do not enter details after following a link; contact the organisation another way
Keylogging	A program that records every key pressed, to steal passwords and other confidential information	Scanning software; avoid untrustworthy downloads; MFA limits what a stolen password can do
Rogue access point	A wireless access point that gives unauthorised access to secure networks, letting data sent over a public network be intercepted, analysed or modified	Avoid sensitive tasks on unknown public Wi-Fi; use encrypted connections
Malicious links and attachments	Links disguised on a page or in an email, or unsolicited attachments and forms, which may come from unknown senders or from known senders whose security has been compromised	Do not open unexpected attachments; check where a link really leads
Untrustworthy downloads	Free software from freeware or shareware sites that may contain malware	Download only from trusted sources

Worked example 1: the strength of a PIN, and why MFA helps

Scenario. A fictional phone lets an attacker try guesses at the PIN, at 1,000 guesses per second (the attacker uses a program, and the phone does not slow down guesses).

Task. (a) How many possible 4-digit PINs and 6-digit PINs are there? (b) How long would it take to try every one of each? (c) How does multifactor authentication change the situation?

(a) Possibilities. Each digit has 10 possibilities. A 4-digit PIN has 10 × 10 × 10 × 10 = 10,000 possibilities. A 6-digit PIN has 10 to the power 6 = 1,000,000. Two extra digits make the number 100 times larger (1,000,000 ÷ 10,000).

(b) Time to try every possibility. 4 digits: 10,000 ÷ 1,000 = 10 seconds. 6 digits: 1,000,000 ÷ 1,000 = 1,000 seconds, which is 1,000 ÷ 60 = about 16.7 minutes.

(c) With MFA. Suppose access also needs a code sent to the owner’s second device (possession). Even if the attacker finds the PIN, they cannot unlock the phone without also having that device. Each factor must be broken separately.

Interpretation. A short, guessable PIN falls in seconds if guesses are not limited. Longer secrets help, and limiting the number of guesses and adding a second factor help much more. Note also that an attacker rarely tries every possibility in order: common choices such as 1234 or a birth year are tried first, which is why a strong password or PIN must also be hard to guess from knowledge of the user.

Check. The 100 times increase comes from two extra digits, each multiplying the possibilities by 10. The time scales the same way (10 seconds to 1,000 seconds is 100 times).

Worked example 2: a toy symmetric key, and spotting attacks

Part A: a toy symmetric cipher. This is for illustration only; it is far too weak to use for security, and the course does not require any particular method. Use the key 3: to encrypt, move each letter 3 places forward in the alphabet; to decrypt, move each letter 3 places back.

Encrypt CAT: C moves to F, A moves to D, T moves to W, giving FDW. Decrypt FDW with the same key 3: F back to C, D back to A, W back to T, giving CAT. The same key does both jobs, so this is symmetric. The problem: Ana and Ben must share the key 3 in advance by a safe route; if an attacker learns it, every message can be read. Public key encryption avoids this: Ben publishes a public key for anyone to use and keeps the private key to himself.

Part B: classify the attacks.

Scenario	Threat	Suggested protection
An email says “Your account will be closed. Click here and enter your password.”	Phishing	Do not click; go to the website by typing the address; report it
A free game from an unknown website installs a program that records everything typed	Untrustworthy download carrying keylogging malware	Download only from trusted sources; keep scanning software updated
In a café, a wireless network named like the café’s appears, but it is run by someone else who can see the traffic	Rogue access point	Avoid sensitive tasks on public Wi-Fi; use encrypted connections; ask staff for the real network name
A message from a friend’s account has an unexpected attachment	Malicious attachment from a compromised known sender	Check with the friend by another route before opening

Check. Each row names the threat, matches its definition and offers a protection that fits it, not just “be careful”.

Common misconceptions

• “PII is only my name.” It includes many items that identify, link or describe a person, such as a phone number, biometric data or medical information.
• “Deleting a post removes it.” Once information is online it is difficult to delete.
• “A long password of my own name is strong.” A strong password is hard to guess even with knowledge of the user.
• “MFA means two passwords.” It requires evidence from at least two categories (knowledge, possession, inherence).
• “Encryption makes a message impossible to intercept.” It makes an intercepted message unreadable without the key.
• “Public key encryption needs the receiver’s private key to send.” The sender uses the public key; only the receiver’s private key decrypts.
• “If a message comes from a friend, it is safe.” A friend’s account may have been compromised.
• “Updates are only about new features.” They fix errors that attackers could exploit.

Where this leads

This completes Big Idea 5. Privacy and security connect back to data collection (Topic 2.3), networks (Topic 4.1) and the effects of innovation (5.1). Test yourself with the practice questions, recap with the revision notes, and check your skills on the checklist. Then try the Unit 5 diagnostic.