IGCSE ICT 0417 - Safety and Security

This section explores the crucial aspects of safety and security in information communication technology. It aims to equip you with the knowledge to identify potential risks and implement effective strategies to mitigate them.

Causes of Safety Issues

Malware

Malware (malicious software) is a broad term encompassing various types of harmful programs designed to infiltrate and damage computer systems. Common causes of malware infections include:

• Downloading infected files from untrusted sources.
• Opening malicious email attachments.
• Visiting compromised websites.
• Using infected removable media (e.g., USB drives).

Phishing

Phishing is a type of online fraud where attackers attempt to deceive individuals into revealing sensitive information such as usernames, passwords, and credit card details. Causes of phishing attacks include:

• Deceptive emails or messages that appear legitimate.
• Fake websites that mimic genuine ones.
• Social engineering techniques to manipulate users.

Unauthorized Access

Unauthorized access occurs when someone gains access to a computer system or network without proper permission. Causes can include:

• Weak passwords.
• Poorly configured security settings.
• Exploiting software vulnerabilities.
• Social engineering to obtain login credentials.

Data Breaches

Data breaches happen when sensitive information is accessed and stolen by unauthorized individuals. Causes often involve:

• Weak security measures protecting data.
• Insider threats (e.g., disgruntled employees).
• External attacks targeting data storage systems.

Physical Security Risks

Physical security risks involve threats to hardware and data due to physical events. Causes include:

• Theft of devices (laptops, smartphones, servers).
• Damage from natural disasters (floods, fires).
• Unauthorized physical access to premises.

Strategies for Preventing Safety Issues

Malware Prevention

Implementing the following strategies can help prevent malware infections:

1. Install and regularly update antivirus and anti-malware software.
2. Be cautious when downloading files and only download from trusted sources.
3. Avoid opening suspicious email attachments or clicking on unknown links.
4. Keep operating systems and software up to date with the latest security patches.
5. Use a firewall to block unauthorized network access.

Phishing Prevention

To avoid falling victim to phishing attacks:

1. Be wary of unsolicited emails or messages asking for personal information.
2. Carefully examine the sender's email address and website URLs.
3. Do not click on suspicious links or download attachments from unknown senders.
4. Verify requests for personal information through alternative channels (e.g., contacting the organization directly).
5. Enable two-factor authentication wherever possible.

Unauthorized Access Prevention

Strategies to prevent unauthorized access:

1. Use strong, unique passwords for all accounts.
2. Enable multi-factor authentication (MFA) whenever available.
3. Implement access control measures to restrict access to sensitive data.
4. Regularly review and update user permissions.
5. Use a firewall to control network traffic.

Data Breach Prevention

Measures to prevent data breaches:

1. Implement robust data encryption techniques.
2. Regularly back up data to secure locations.
3. Control physical access to data storage facilities.
4. Conduct regular security audits and vulnerability assessments.
5. Train employees on data security best practices.

Physical Security

Protecting against physical security risks involves:

1. Secure devices with passwords or PINs.
2. Store devices in secure locations when not in use.
3. Implement physical access controls to premises (e.g., locks, security guards).
4. Use surge protectors and other protective equipment.
5. Have a disaster recovery plan in place.

Security Measures in a Network

Security Measure	Description
Firewall	A network security system that monitors and controls incoming and outgoing network traffic based on pre-defined security rules.
Intrusion Detection System (IDS) / Intrusion Prevention System (IPS)	IDS monitors network traffic for malicious activity, while IPS can actively block or prevent detected intrusions.
Access Control Lists (ACLs)	Rules that specify which users or devices have access to network resources.
Virtual Private Network (VPN)	Creates a secure, encrypted connection over a public network (e.g., the internet).
Data Encryption	Converts data into an unreadable format to protect its confidentiality.

By understanding the causes of safety and security issues and implementing appropriate preventative measures, individuals and organizations can significantly reduce the risks associated with using information and communication technologies.