Data & Computer security
DATA SECURITY AND CONTROL
Introduction
Data & Information must be protected against unauthorized access, disclosure, modification or
damage. This is because; it is a scarce & valuable resource for any business organization or
government. It is mostly used in transactions, it can be shared, and has high value attached to it.
Data & Information security:
Data security is the protection of data & information from accidental or intentional disclosure to
unauthorized persons.
Data & Information privacy:
Private data or information is that which belongs to an individual & must not be accessed by or
disclosed to any other person, without direct permission from the owner.
Confidential data or information – this is data or information held by a government or
organization about people. This data/information may be seen by authorized persons without the
knowledge of the owner. However, it should not be used for commercial gain or any other
unofficial purpose without the owner being informed.
Review Questions
1. Differentiate between private and confidential data.
2. Why is information called a resource?
3. (a) Explain the term ‘Information security’.
(b) Recently, data and information security has become very important. Explain.
SECURITY THREATS TO DATA & INFORMATION
1). COMPUTER VIRUSES
A computer virus is a destructive program that attaches itself to other files when the files
are opened for use, and installs itself on the computer, without the knowledge of the user.
A computer virus is a program designed specifically to damage other programs or
interfere with the proper functioning of the computer system.
A virus is a computer code usually designed to carry out 2 tasks:
(a) To copy itself from one computer system to another.
(b) To locate itself within a computer system enabling it to amend/destroy program & data
files, by interfering with the normal processes of the operating system.
Types of computer viruses.
1. Boot sector viruses – they destroy the booting information on storage devices.
2. File viruses – they attach themselves to files either erasing or modifying them.
3. Hoax viruses – they come as e-mails with an attractive subject & activate themselves
when the e-mail is opened.
4. Trojans – they appear to perform necessary functions, but perform other undesirable
activities in the background without the knowledge of the user.
5. Worms – viruses that stick in the computer memory.
6. Backdoors – may be a Trojan or Worm that allows hidden access to a computer system.
-1-
, Data & Computer security
Types of destructions/damages caused by a virus attack.
Delete or modify data, information & files on storage devices (disks) or memory during
normal program execution, e.g., may attack the format of a disk making any program or
data on it impossible to recover.
Systematically destroy all the data in the computer memory.
Might lock the keyboard.
Can change keystroke values or data from other I/O devices, e.g., change the effect of
SHIFT key.
Delete characters displayed on a visual display.
Uses up computer memory/space, hence slowing down its performance or causing the
system to crash.
Changes colour of the display.
Cause boot failure.
Sources of viruses.
a) Contact with contaminated systems:
If a diskette is used on a virus infected computer, it could become contaminated. If the
same diskette is used on another computer, then the virus will spread.
b) Use of pirated software:
Pirated software may be contaminated by a virus code or it may have been amended to
perform some destructive functions which may affect your computer.
c) Infected proprietary software:
A virus could be introduced when the software is being developed in laboratories, and
then copied onto diskettes containing the finished software product.
d) Fake games:
Some virus programs behave like games software. Since many people like playing
games on computers, the virus can spread very fast.
e) Freeware and Shareware:
Both freeware & shareware programs are commonly available in Bulletin board
systems.
Such programs should first be used in controlled environment until it is clear that the
program does not contain either a virus or a destructive code.
f) Updates of software distributed via networks:
Viruses programs can be spread through software distributed via networks.
Symptoms of viruses in a computer system.
The following symptoms indicate the presence of a virus in your computer:
Boot failure.
Files & programs disappearing mysteriously.
Unfamiliar graphics or messages appearing on the screen, e.g., the virus might flash a
harmless message such as “Merry Christmas” on the computer terminal.
Slow booting.
Gradual filing of the free space on the hard disk.
Corruption of files and programs.
Programs taking longer than usual to load.
Disk access time seeming too long for simple tasks.
Unusual error messages occurring more frequently.
Frequent read/write errors.
-2-
, Data & Computer security
Disk access lights turning on for non-referenced devices.
Computer hags anytime when running a program.
Less memory available than usual, e.g., Base memory may read less than 640KB.
Size of executable files changing for no obvious reason.
Control measures against viruses.
i). Install up-to-date (or the latest) antivirus software on the computers.
ii). Restrict the movement of foreign storage media, e.g., diskettes in the computer room.
If they have to be used, they must be scanned for viruses.
iii). Avoid opening mail attachments before scanning them for viruses.
iv). Write-protect disks after using them.
v). Disable floppy disk drives, if there is no need to use disks in the course of normal
operation.
vi). Backup all software & data files at regular intervals.
vii). Do not boot your computer from disks which you are not sure are free from viruses.
viii). Avoid pirated software. If possible, use the software from the major software houses.
ix). Programs downloaded from Bulletin Boards & those obtained from computer clubs
should be carefully evaluated & examined for any destructive code.
2). UNAUTHORIZED ACCESS
Data & information is always under constant threat from people who may want to access it
without permission. Such persons will usually have a bad intention, either to commit fraud,
steal the information & destroy or corrupt the data.
Unauthorized access may take the following forms:
a). Eavesdropping:
This is tapping into communication channels to get information, e.g., Hackers mainly use
eavesdropping to obtain credit card numbers.
b). Surveillance (monitoring):
This is where a person may monitor all computer activities done by another person or
people.
The information gathered may be used for different purposes, e.g., for spreading
propaganda or sabotage.
c). Industrial espionage:
Industrial espionage involves spying on a competitor so as to get or steal information
that can be used to finish the competitor or for commercial gain.
The main aim of espionage is to get ideas on how to counter by developing similar
approach or sabotage.
d). An employee who is not supposed to see some sensitive data gets it, either by mistake or
design.
e). Strangers who may stray into the computer room when nobody is using the computers.
f). Forced entry into the computer room through weak access points.
g). Network access in case the computers are networked & connected to the external world.
Control measures against unauthorized access.
i). Enforce data & information access control policies on all employees to control access to
data.
ii). Keep the computer room closed when nobody is using it.
-3-
DATA SECURITY AND CONTROL
Introduction
Data & Information must be protected against unauthorized access, disclosure, modification or
damage. This is because; it is a scarce & valuable resource for any business organization or
government. It is mostly used in transactions, it can be shared, and has high value attached to it.
Data & Information security:
Data security is the protection of data & information from accidental or intentional disclosure to
unauthorized persons.
Data & Information privacy:
Private data or information is that which belongs to an individual & must not be accessed by or
disclosed to any other person, without direct permission from the owner.
Confidential data or information – this is data or information held by a government or
organization about people. This data/information may be seen by authorized persons without the
knowledge of the owner. However, it should not be used for commercial gain or any other
unofficial purpose without the owner being informed.
Review Questions
1. Differentiate between private and confidential data.
2. Why is information called a resource?
3. (a) Explain the term ‘Information security’.
(b) Recently, data and information security has become very important. Explain.
SECURITY THREATS TO DATA & INFORMATION
1). COMPUTER VIRUSES
A computer virus is a destructive program that attaches itself to other files when the files
are opened for use, and installs itself on the computer, without the knowledge of the user.
A computer virus is a program designed specifically to damage other programs or
interfere with the proper functioning of the computer system.
A virus is a computer code usually designed to carry out 2 tasks:
(a) To copy itself from one computer system to another.
(b) To locate itself within a computer system enabling it to amend/destroy program & data
files, by interfering with the normal processes of the operating system.
Types of computer viruses.
1. Boot sector viruses – they destroy the booting information on storage devices.
2. File viruses – they attach themselves to files either erasing or modifying them.
3. Hoax viruses – they come as e-mails with an attractive subject & activate themselves
when the e-mail is opened.
4. Trojans – they appear to perform necessary functions, but perform other undesirable
activities in the background without the knowledge of the user.
5. Worms – viruses that stick in the computer memory.
6. Backdoors – may be a Trojan or Worm that allows hidden access to a computer system.
-1-
, Data & Computer security
Types of destructions/damages caused by a virus attack.
Delete or modify data, information & files on storage devices (disks) or memory during
normal program execution, e.g., may attack the format of a disk making any program or
data on it impossible to recover.
Systematically destroy all the data in the computer memory.
Might lock the keyboard.
Can change keystroke values or data from other I/O devices, e.g., change the effect of
SHIFT key.
Delete characters displayed on a visual display.
Uses up computer memory/space, hence slowing down its performance or causing the
system to crash.
Changes colour of the display.
Cause boot failure.
Sources of viruses.
a) Contact with contaminated systems:
If a diskette is used on a virus infected computer, it could become contaminated. If the
same diskette is used on another computer, then the virus will spread.
b) Use of pirated software:
Pirated software may be contaminated by a virus code or it may have been amended to
perform some destructive functions which may affect your computer.
c) Infected proprietary software:
A virus could be introduced when the software is being developed in laboratories, and
then copied onto diskettes containing the finished software product.
d) Fake games:
Some virus programs behave like games software. Since many people like playing
games on computers, the virus can spread very fast.
e) Freeware and Shareware:
Both freeware & shareware programs are commonly available in Bulletin board
systems.
Such programs should first be used in controlled environment until it is clear that the
program does not contain either a virus or a destructive code.
f) Updates of software distributed via networks:
Viruses programs can be spread through software distributed via networks.
Symptoms of viruses in a computer system.
The following symptoms indicate the presence of a virus in your computer:
Boot failure.
Files & programs disappearing mysteriously.
Unfamiliar graphics or messages appearing on the screen, e.g., the virus might flash a
harmless message such as “Merry Christmas” on the computer terminal.
Slow booting.
Gradual filing of the free space on the hard disk.
Corruption of files and programs.
Programs taking longer than usual to load.
Disk access time seeming too long for simple tasks.
Unusual error messages occurring more frequently.
Frequent read/write errors.
-2-
, Data & Computer security
Disk access lights turning on for non-referenced devices.
Computer hags anytime when running a program.
Less memory available than usual, e.g., Base memory may read less than 640KB.
Size of executable files changing for no obvious reason.
Control measures against viruses.
i). Install up-to-date (or the latest) antivirus software on the computers.
ii). Restrict the movement of foreign storage media, e.g., diskettes in the computer room.
If they have to be used, they must be scanned for viruses.
iii). Avoid opening mail attachments before scanning them for viruses.
iv). Write-protect disks after using them.
v). Disable floppy disk drives, if there is no need to use disks in the course of normal
operation.
vi). Backup all software & data files at regular intervals.
vii). Do not boot your computer from disks which you are not sure are free from viruses.
viii). Avoid pirated software. If possible, use the software from the major software houses.
ix). Programs downloaded from Bulletin Boards & those obtained from computer clubs
should be carefully evaluated & examined for any destructive code.
2). UNAUTHORIZED ACCESS
Data & information is always under constant threat from people who may want to access it
without permission. Such persons will usually have a bad intention, either to commit fraud,
steal the information & destroy or corrupt the data.
Unauthorized access may take the following forms:
a). Eavesdropping:
This is tapping into communication channels to get information, e.g., Hackers mainly use
eavesdropping to obtain credit card numbers.
b). Surveillance (monitoring):
This is where a person may monitor all computer activities done by another person or
people.
The information gathered may be used for different purposes, e.g., for spreading
propaganda or sabotage.
c). Industrial espionage:
Industrial espionage involves spying on a competitor so as to get or steal information
that can be used to finish the competitor or for commercial gain.
The main aim of espionage is to get ideas on how to counter by developing similar
approach or sabotage.
d). An employee who is not supposed to see some sensitive data gets it, either by mistake or
design.
e). Strangers who may stray into the computer room when nobody is using the computers.
f). Forced entry into the computer room through weak access points.
g). Network access in case the computers are networked & connected to the external world.
Control measures against unauthorized access.
i). Enforce data & information access control policies on all employees to control access to
data.
ii). Keep the computer room closed when nobody is using it.
-3-
