Computer Science 0-

What is the role of ethical hacking in network security?

Ethical hacking improves security by finding and fixing vulnerabilities before criminals exploit them.

What is the purpose of ethical hacking?

To identify weaknesses, improve system security, and prevent unauthorised access.

What is penetration testing?

A controlled security test where ethical hackers attempt to exploit vulnerabilities to assess system security.

What is the difference between ethical and unethical hacking?

Ethical hacking has permission and aims to improve security; unethical hacking is unauthorised and may cause harm or steal data.

What is the purpose of the Privacy Act 1988?

It protects personal information by regulating how organisations collect, store, use and disclose data.

What are the Australian Privacy Principles (APPs)?

A set of 13 principles that guide how personal information must be handled by organisations.

What are the 13 Australian Privacy Principles (APPs)?

• Open and Transparent Management: Policies must be clear, current, and publicly available.

• Anonymity and Pseudonymity: Individuals must be given the option to interact anonymously where practicable.

• Collection of Solicited Info: Only collect personal information that is directly necessary for your functions.

• Unsolicited Personal Info: Safely destroy or de-identify data you didn't ask for and couldn't lawfully collect.

• Notification of Collection: Tell individuals why you are collecting their data and how you will use it.

• Use and Disclosure: Only use data for the primary purpose it was collected, unless an exception applies.

• Direct Marketing: Strict rules for using personal information to market products; individuals must always be able to opt out.

• Cross-Border Disclosure: Organizations are accountable for protecting data that gets sent overseas.

• Government-Related Identifiers: Do not adopt or use government identifiers (like Medicare numbers) as your own.

• Quality of Personal Information: Take reasonable steps to ensure the data collected is accurate, complete, and up-to-date.

• Security of Personal Information: Actively protect data from misuse, loss, and unauthorized access.

• Access to Personal Information: Individuals have the right to request access to the personal information you hold about them.

• Correction of Personal Information: Take reasonable steps to correct data if it is inaccurate or out-of-date.

How do the Australian Privacy Principles relate to data security?

They require organisations to protect personal information from misuse, loss, and unauthorised access.

What is authentication?

The process of verifying a user's identity before allowing access.

What are characteristics of a strong password?

Long, complex, unique, and contains a mix of uppercase/lowercase letters, numbers and symbols.

What is an organisational password policy?

Rules created by an organisation to manage password security, such as password length and expiry requirements.

How do password policies improve data security?

They reduce weak passwords and make unauthorised access more difficult.

What is two-factor authentication (2FA)?

A security method requiring two forms of identification, such as a password and a code.

What is biometric authentication?

Using unique physical characteristics, such as fingerprints or facial recognition, to verify identity.

What is the purpose of encryption?

To protect data by converting it into an unreadable form that only authorised users can decode.

What is symmetric encryption?

Encryption that uses the same key to encrypt and decrypt data.

What is public key (asymmetric) encryption?

Encryption that uses two keys: a public key for encryption and a private key for decryption.

What is the difference between a Public Key and a Private Key?

• Public Key: Shared openly with anyone; used to encrypt messages intended for the owner or verify their digital signature.

• Private Key: Kept strictly secret by the owner; used to decrypt incoming messages or create digital signatures.

What is the difference between symmetric and asymmetric encryption?

Symmetric uses one shared key; asymmetric uses a public and private key pair.

What is social engineering?

Manipulating people into revealing information or performing actions that compromise security.

What is phishing?

A social engineering attack where fake messages or websites trick users into revealing information.

What is a denial-of-service (DoS) attack?

An attack that overwhelms a system with traffic, making it unavailable to users.

What is a back door?

A hidden method of accessing a system while bypassing normal security controls.

What is IP spoofing?

Changing the source IP address of a device to disguise its identity.

What is SQL injection?

An attack where malicious SQL commands are inserted into a database query to access or modify data.

What is a man-in-the-middle (MITM) attack?

An attack where someone secretly intercepts communication between two parties.

What is cross-site scripting (XSS)?

An attack where malicious scripts are inserted into websites to target users.

What is malware?

Malicious software designed to harm, disrupt, or steal data from a device or network.

What is a virus?

Malware that attaches to files and spreads when the infected file is opened.

What is a worm?

Malware that automatically spreads across networks without needing a host file.

What is a Trojan horse?

Malware disguised as legitimate software to trick users into installing it.

What is spyware?

Malware that secretly monitors user activity and collects information.

What is adware?

Software that displays unwanted advertisements, often tracking user behaviour.

What is ransomware?

Malware that blocks access to data or systems until a payment is made.

What are physical security threats?

Threats involving physical access, damage, or theft of hardware and data.

• Device theft

• Unauthorised access to buildings

• Hardware damage

What is the CIA Triad?

A model used to analyse and improve information security.

• Confidentiality

• Integrity

• Availability

What is confidentiality?

Ensuring information is only accessible to authorised users.

What is integrity?

Ensuring data remains accurate and is not altered without permission.

• Hashes

• Digital signatures

What is availability?

Ensuring systems and data are accessible when needed.

• Backups

• Extra servers

How is the CIA Triad used to analyse security threats?

It identifies whether a threat affects confidentiality, integrity, availability, or multiple areas.

What is the AAA framework?

A security model based on Authentication, Authorisation and Accounting.

What is authentication in AAA?

Verifying who a user is.

• Token

• Password

• Biometrics

What is authorisation in AAA?

Determining what resources a user can access.

What is accounting in AAA?

Recording and monitoring user activity.

• Session duration

• Actions performed

How is AAA used for security analysis and auditing?

It checks who accessed systems, what they accessed, and what actions they performed.

What is the purpose of cryptography?

To protect information by securing communication and preventing unauthorised access.

What is plain text?

Original readable data before encryption.

What is cipher text?

Encrypted unreadable data produced after encryption.

What is a substitution cipher?

A cipher that replaces letters or symbols with different ones.

What is a rotation cipher?

A substitution cipher where letters are shifted by a fixed number of positions.

What is a random substitution cipher?

A cipher where each letter is replaced with another letter using a random mapping.

• No rule

What is a polyalphabetic cipher?

A cipher that uses multiple substitution alphabets, such as the Vigenère cipher.

What is the Atbash cipher?

A substitution cipher where the alphabet is reversed (A becomes Z, B becomes Y, etc.).

A → Z
B → Y
C → X

What is a Caesar shift cipher?

A substitution cipher that shifts each letter by a fixed number of positions in the alphabet.

Shift +3: A → D, B → E, C → F

What is a Vigenère cipher?

A polyalphabetic substitution cipher that uses a keyword to encrypt messages.

How is the Vigenère cipher different from Caesar shift?

Caesar uses one fixed shift; Vigenère uses multiple shifts based on a keyword.

What is an advantage of public key encryption?

Users can securely communicate without sharing a secret key beforehand.

What is a secret key?

A secret key is a private piece of information used in encryption that is known only by the authorised sender and receiver. The same secret key is used to encrypt (scramble) and decrypt (unscramble) data in symmetric encryption.

What is a zero-day vulnerability?

A security weakness that is unknown to the developer and has no available fix.

Why are zero-day vulnerabilities dangerous?

Attackers can exploit them before security updates are created.

What is cipher cracking?

The process of breaking encryption to reveal the original message.

What is brute force cracking?

Trying every possible key until the correct one is found.

What is frequency analysis?

Analysing how often letters appear to identify patterns in encrypted messages.

Strengths and Weaknesses of Common Ciphers

Cipher	Strengths	Weaknesses
Rotation Cipher	Simple to implement and understand	Easily cracked using brute force (only 25 possible shifts)
Random Substitution Cipher	More secure than a rotation cipher	Vulnerable to frequency analysis if the ciphertext is long enough
Vigenère Cipher	Harder to crack than simple substitution ciphers	Vulnerable to advanced frequency analysis, especially with a short keyword

What are hashes?

Hashes are one-way functions that convert data into a fixed-length string of characters. They are used to check data integrity and store passwords securely.

What are MACs?

MACs (Message Authentication Codes) are used to verify that a message is authentic and has not been changed. They use a secret key to create a code that checks message integrity.

What is Non-repudiation?

Non-repudiation ensures that a person cannot deny sending a message or performing an action. It provides proof of who did something, often using digital signatures.

What are digital signatures?

Digital signatures are a way to verify who sent a message and prove that it has not been changed. They use a person's private key to create the signature and a public key to verify it.