e-Consult | Revision Qns

1.

Describe a range of malware prevention strategies that can be implemented on a personal computer. Your answer should include details of how each strategy works and its potential limitations.

A comprehensive approach to malware prevention involves layering multiple strategies. Here's a breakdown of key methods:

Antivirus Software: This is a fundamental defense. Antivirus software scans files and system memory for known malware signatures. It works by comparing file hashes against a database of known malicious code.
- How it works: Signature-based detection, heuristic analysis (identifying suspicious behaviour), real-time scanning.
- Limitations: Ineffective against new or polymorphic malware (malware that changes its code to evade detection). Can be resource-intensive, potentially slowing down the system.

Firewall: A firewall acts as a barrier between the computer and the network, controlling incoming and outgoing network traffic.
- How it works: Examines network packets and blocks those that don't meet predefined security rules. Can be configured to block specific ports or IP addresses.
- Limitations: Can be bypassed by sophisticated malware that uses legitimate ports or protocols. Requires careful configuration to avoid blocking legitimate traffic.

Software Updates (Patching): Regularly updating the operating system and applications is crucial. Updates often include security patches that fix vulnerabilities exploited by malware.
- How it works: Software vendors release updates to address security flaws. These updates are installed by the user or automatically.
- Limitations: Users may delay or neglect updates, leaving systems vulnerable. Updates can sometimes introduce new problems.

User Education: Educating users about phishing, social engineering, and safe browsing habits is vital.
- How it works: Training users to recognize suspicious emails, websites, and attachments. Promoting safe browsing practices (e.g., avoiding suspicious downloads).
- Limitations: Users can still be tricked, even with training. Requires ongoing reinforcement.

Regular Backups: Creating regular backups of important data allows for recovery in the event of a malware infection.
- How it works: Copies data to a separate storage location (e.g., external hard drive, cloud storage).
- Limitations: Backups must be stored securely to prevent them from being infected. Restoring backups can be time-consuming.

A layered approach, combining multiple strategies, provides the best protection.

2.

Question 3: Create a table outlining the key features of Trojan horses, worms, spyware, and ransomware. Your table should include columns for 'Malware Type', 'Propagation Method', 'Primary Objective', and 'Typical Impact'.

Malware Type	Propagation Method	Primary Objective	Typical Impact
Trojan Horse	User interaction (e.g., infected file)	Create backdoor, steal data, remote access	Affects individual systems; limited damage (usually).
Worm	Exploits vulnerabilities; self-replication	Network congestion, data theft, backdoors	Widespread impact; disruption and data loss.
Spyware	Bundled with legitimate software; often through malicious websites	Secretly monitor user activity; collect sensitive data	Compromises user privacy; identity theft, financial fraud.
Ransomware	Phishing emails, malicious websites, exploited vulnerabilities	Encrypt files and demand ransom for decryption	Data loss, disruption; no guarantee of file recovery even after payment.

3.

Question 1: Explain the key concepts of personal data security and confidentiality. In your answer, discuss the potential consequences of a breach of personal data and outline three measures an organisation can implement to mitigate these risks.

Key Concepts:

Personal Data: Any information relating to an identified or identifiable natural person. This includes names, addresses, email addresses, financial details, health information, and online identifiers.

Data Security: The protection of data from unauthorised access, use, disclosure, disruption, modification, or destruction. This encompasses both technical and organisational measures.

Confidentiality: The principle that access to personal data is restricted to those who are authorised to have it. It's about preventing unauthorised disclosure of information.

Potential Consequences of a Data Breach:

Financial Loss: Direct financial loss to individuals (e.g., fraud, identity theft) and to the organisation (e.g., fines, legal costs, remediation).

Reputational Damage: Loss of public trust and damage to the organisation's brand.

Legal and Regulatory Penalties: Fines under data protection laws like GDPR, and potential legal action from affected individuals.

Identity Theft: Individuals' personal information being used to commit fraud or other crimes.

Three Mitigation Measures:

Access Control: Implementing strong authentication methods (e.g., multi-factor authentication), role-based access control, and regular reviews of user permissions to ensure only authorised individuals can access personal data.

Encryption: Encrypting personal data both at rest and in transit to render it unreadable to unauthorised parties. This includes using strong encryption algorithms.

Data Loss Prevention (DLP): Implementing DLP solutions to monitor and prevent sensitive data from leaving the organisation's control (e.g., through email, file sharing).

5 eSecurity (3)