Qualification:
Cambridge Advanced Nationals in Computing (AAQ)
Certificate:
Computing: Application Development (H029 / H129)
Unit:
F161: Developing Application Software
4.1 - Security Considerations
Watch on YouTube:
Security threats
Physical security
Digital security
You need to know the risks that specific security threats pose to applications, including botnets, DDoS attacks, hacking and malware.
You need to know how both physical security mitigations (e.g. biometrics, locks and RFID) and digital security mitigations (e.g. encryption, firewalls and anti-malware) protect application software against threats.
What You Need to Know
Security Threats
Common threats to application software include:
Botnet
A botnet is a group of compromised devices that are remotely controlled by an attacker, often without their owners knowing, and used together to carry out malicious activities.
DoS / DDoS Attack
A Denial of Service (DoS) attack attempts to make a system or service unavailable by overwhelming it with requests or traffic. A Distributed Denial of Service (DDoS) attack does this using many devices at the same time, often through a botnet.
Hacking
Hacking is the process of gaining unauthorised access to a computer system, network or data. This potentially allows data to be viewed, changed, stolen or deleted.
Lack of Supplier Support
A lack of supplier support occurs when a developer no longer provides updates, security patches or technical assistance for its software, leaving newly discovered vulnerabilities potentially unfixed.
Malicious Spam
Malicious spam is unwanted messages sent to large numbers of users that contain harmful or deceptive content. This may include links designed to steal information or distribute malware.
Malware
Malware is software intentionally designed to damage, disrupt or gain unauthorised access to systems or data. Examples include viruses, worms, ransomware and spyware.
Out-of-date Software
Out-of-date Hardware
Out-of-date Firmware
Out-of-date software may contain known security vulnerabilities that newer versions have fixed, making it easier for attackers to compromise the system.
Out-of-date hardware may lack modern security features, be incompatible with newer security software or no longer receive support from its manufacturer.
Firmware is software built into a device that controls how its hardware operates. Out-of-date firmware may contain unpatched security vulnerabilities that attackers could exploit to access or interfere with the device.
Physical Security Mitigations
Physical security mitigations are measures used to prevent unauthorised physical access to systems that run application software.
Biometrics
Biometrics use unique physical characteristics, such as fingerprints or facial features, to verify a person's identity and prevent unauthorised users from physically accessing devices and application software.
Cable Locks
Cable locks physically secure devices such as laptops to a fixed object like a table, reducing the risk of equipment being stolen and the application software or data on it being accessed.
Cameras
Cameras like CCTV can monitor and record areas containing computer equipment, helping to deter unauthorised access or theft and providing evidence if a security incident occurs.
Locks
Locks restrict physical access to rooms, cabinets or equipment for unauthorised people, helping prevent devices and the application software they contain from being accessed, stolen or damaged.
RFID
Radio Frequency Identification (RFID) uses radio waves to communicate wirelessly between an RFID tag or card and a reader. It can be used to identify authorised users and control physical access to restricted areas, such as server rooms.
Safe
A safe provides secure physical storage for devices or storage media, protecting them against unauthorised access, theft and potentially physical damage.
Swipe Cards
Swipe cards require users to swipe or scan an authorised card to enter restricted areas, preventing unauthorised people from physically accessing devices and systems containing application software.
Digital Security Mitigations
Digital security mitigations use software and technology to protect applications and data from security threats.
Access Rights
Access rights control what resources and actions different users are allowed to access, such as viewing, editing or deleting data. This helps prevent unauthorised access or changes.
Anti-Malware
Anti-malware is software that detects, blocks and removes malware, such as a virus or worm. It helps prevent malicious software from damaging applications, stealing data or gaining unauthorised access.
Back-up
A back-up creates a separate copy of data that can be restored if the original is lost, damaged or corrupted, for example following a malware attack or hardware failure.
Cryptography
Cryptography uses mathematical techniques to protect data and communications, helping keep data confidential, verify its authenticity and prevent unauthorised changes.
2FA
Two-factor authentication (2FA) requires a user to provide two different forms of authentication before gaining access, such as a password plus a code from another device. This makes unauthorised access more difficult if one factor is compromised.
Encryption
Encryption converts data (plaintext) into an unreadable form (ciphertext) that requires the correct key to decrypt. It prevents unauthorised users from understanding the data if they gain access.
-
Encryption at rest protects stored data, such as files on a device or records in a database, if the storage is accessed or stolen.
-
Encryption in transit protects data while it is being transferred across a network, reducing the risk of intercepted data being read.
Firewall
A firewall monitors and controls network traffic using security rules, helping prevent unauthorised or suspicious connections.
-
A hardware firewall is a physical network device, often built into a router, that can protect multiple devices by filtering traffic entering or leaving a network.
-
A software firewall is installed on a specific device that monitors and controls network traffic for that device and its applications.
Questo's Questions
4.1 - Security Considerations:
1. Describe the following security threats: botnets, DoS/DDoS attacks, hacking, lack of supplier support, malicious spam and malware. [2 each]
2. Explain why out-of-date software, hardware and firmware can create security risks for application software. [3]
3. Explain how physical security measures, including biometrics, cable locks, cameras, locks, RFID, safes and swipe cards, can protect application software and systems. [2 each]
4. Explain how access rights, anti-malware, backups, cryptography, encryption, firewalls and 2FA can protect application software from security threats. [2 each]
5. For an online mobile game, recommend suitable physical and digital security mitigations and justify how they would protect against specific threats. [6]
The WannaCry ransomware attack of 2017 affected hundreds of thousands of computers worldwide, including NHS systems. It exploited a vulnerability in older or unpatched Windows systems and resulted in an estimated 19,000 NHS appointments and operations being cancelled.
Did You Know?
