Please enable JavaScript.
Coggle requires JavaScript to display documents.
Topic D2 - Protecting Data - Coggle Diagram
Topic D2 - Protecting Data
Passwords
Guidelines for good password security say that you password should be:
At least 10 characters in length.
Containing uppercase letters, lowercase letters, numbers and symbols.
It's also considered best practice to not use the same password repeatedly in different systems. Many users now use a unique password for every user account they own and use a password locker application to remember all of their different passwords.
Physical Access Control
While passwords control access from a software perspective, we also use physical access controls, particularly in businesses, to protect our IT systems.
Physical access control includes things like:
Access cards - Cards that must be scanned to unlock rooms. Thry can be encoded to work on only certain doors and can also be used as identification from security guards (if they contain id information such as a name and photo).
Keypad Access Control - A system that requires a passcode to gain entry to a room. It can be used in place of, or alongside access cards.
Biometric Access Control - A system that scans biometric data to gain access to a room. This might be, for example, fingerprint, iris or facial recognition. Again, this can be used alongside the other above methods to gain access
Electronic Locks - All of the above methods require electronic locks to be used to lock an unlock doors electronically when sent signals from the above access control systems.
This is designed to protect malicious users from gaining access to our IT systems. This helps prevent the theft of equipment, someone loading malware onto a system, and stopping hackers from gaining access to data from within the business' own building.
Digital Certificates
Also known as a public key certificate, this is used to authenticate a user as the owner of a public key. This allows them to make use of the public key infrastructure (PKI) that is used for secure encrypted communications over the internet.
A business obtains a digital certificate from a certificate authority. You've almost certainly used a website where the URL has HTTPS:// as opposed to HTTP:// (there may also be a padlock symbol by the URL too). The extra S means "secure" ad it means the website is encrypting the data being transmitted between you and it.
However, you might not know that to do this, the business requires a digital certificate. You can actually view a websites digital certificate by going through the options settings in your web browser.
There are several different contents to a digital certificate but the really important bits are the digital signature, which verifies the sender's identity, and their public-key, which is what is used to encrypt data when sending it to the website (such as your login details that you enter in a web form).
Protocols
When transmitting data over a network there are specific security protocols. The most commonly used of these are Secure Socket Layers (SSL) and Transport Layer Security (TLS). TLS is the more modern and secure protocol and is replacing SSL in use.
These protocols provide a secure connection between two computing devices so that data can be transmitted in a secure encrypted format over the internet. We looked at this a little bit above, where we said about web pages having HTTPS:// in their URL and this meaning they're encrypting data. This is SSL/TLS being used.
This along with the digital certificates we looked at, ensure that out data, if intercepted by a malicious user, cannot be read or misused.