LU7: Errors, Threats, and Security

Q1: What does GIGO stand for?

Garbage In, Garbage Out

what does GIGO mean

incorrect input produces incorrect output.

Q2: What are human input errors?

inputting data that is

• incorrect

• inaccurate

• invalid

• wrong type of data

what are the four sources of errors

1. human errors

2. arithmetic

3. data transmission

4. programming

List and explain the four different types of arithmetic errors (8)

1. Rounding: Accuracy is lost in decimal places when a number is rounded.

2. Truncation: Removing decimal values by cutting off a number, e.g. converting a decimal to an integer.

3. Fixed Number of Bits: available bits limit the highest and lowest numbers that can be stored. Numbers outside this range cannot be stored.

4. Overflow: When a calculation produces a result that exceeds the maximum value allowed for a data type, causing an incorrect answer. (still performed)

what are data transmission errors

• When Data doesn't reach its destination intact, And there is a risk of data corruption

What are three causes of data transmission errors? (6)

Atmospheric conditions: Excessive heat or moisture damages cables.

Distance limits: Signals weaken over long distances due to attenuation.

Interference-causing devices: Motors, fluorescent lights and nearby electrical cables interfere with signals, causing data loss or corruption.

What are programming errors?

Bugs in computer programs that can cause incorrect results or system failures.

List 3 solutions for errors

verification, validation, techniques for input

What is data verification?

Checking that data meets set standards for completeness, correctness and consistency, by evaluating performance

Give an example of verification.

Entering a password twice and checking that both entries match.

What is data validation?

Checking the accuracy and quality of inputted data

What happens if data fails validation? (2)

The user is asked to re-enter the data, or the program assigns a valid default value.

What are the different types of validation checks? (10)

1. Presence

2. range

3. uniqueness

4. length

5. format

6. logical

7. check digit

8. checksum

9. data transmission check (parity).

What is a presence check? Explain and give an example

A: Ensures that data has been entered.

- Example: An ID number must be entered.

What is a range check? give example.

A: Ensures that data falls within an allowed minimum and maximum.

- Example: The number of hours worked cannot exceed the allowed range.

What is a uniqueness check? example

A: Ensures that no duplicate data exists.

- Example: Each user must have a unique login name.

What is a length check? example.

A: Ensures that data contains the required number of characters.

- Example: A South African ID number must contain 13 digits.

What is a format check? example.

A: Ensures that data follows a required pattern or format.

- Example: A date must follow the correct date format.

what is a type check? example.

A: data must be of appropriate type

• Example: date and time must be of a DataTime type

What is a logical check? example

A: Ensures that data makes sense logically.

- Example: A delivery date cannot be earlier than the order date.

What is a check digit? example,

A: A digit calculated from other digits to help detect data-entry errors.

- Example: Used in ISBN numbers.

What is a checksum? example

A: A value calculated from data to check whether it has changed or become corrupted during transfer.

• Example: the CRC algorithm used in the trailer of a data packet

Q18: What is a data transmission check (parity)?

A: Adds an extra bit to data to help detect errors during transmission.

What is important in checks?

order of checks

presence check must be first

What is the difference between Validation and Verification? (6)

Validation

• Timing: typically occurs at the point of data entry

• Purpose: ensures input data meets criteria (data type, format, range)

• Methods: using input masks, drop down lists, error messages to alert user to rectify invalid entries

Verification

• Timing: occurs after data has been captured & stored in database

• Purpose: ensures accuracy & consistency (compares against og sources)

• Methods: cross referencing with source documents, performing checksums, conducting audits to check if data is correct

What are the 7 techniques for input?

1. keyboard input

2. barcode scanner

3. QR codes

4. Biometric input

5. ORC

6. RFID

7. GUI components

Why should alternative input methods be used instead of keyboards?

They can reduce typing errors

Therefore, must key in as little as possible.

The more data entered, the higher chance of errors.

Why is keyboard input less favourable? (2)

user is free to key in whatever from keyboard

more inputted data = more difficult to validate

What is a barcode scanner?

A: A device that reads a barcode to enter data automatically into a computer. (pointer to a record in a database)

How does a barcode scanner work in a shop?

A: It reads an item's barcode to retrieve its details and price from a database.

What are the advantages of barcode scanners?

• Faster and more accurate than manual typing.

• Can automatically update prices and apply discounts.

• Reduces the need for manual data entry.

What is a QR code?.

A: A two-dimensional barcode

What are the advantages and uses of QR codes over and above barcodes? (3)

• Can be scanned using a smartphone.

• Doesn’t require hardware & software like a barcode would

• Can link to websites, documents and URLs.

What are examples of GUI components?

• Menus

• Drop-down boxes

• Radio buttons

• Checkboxes

What does RFID stand for

radio frequency identification

What is RFID?

Uses radio signals to transfer data from a tag attached to an object to a receiving device.

How does RFID work?

A reader detects the tag using radio signals and reads its stored simple identification data

Receiving device usually a bar code scanner (uses infrared light technology)

Do RFID tags that can be read over short distances need power? Why or why not (3)

• no power required

• tags are powered using magnetic fields

• thus no optical scanning hardware needed

How do RFID tags communicate over long distances (3)

• have embedded power source (battery)

• emits radio waves (doesn’t need to be within line of sight of scanner)

• electronically stored info

What are the uses of RFID? (4)

• Tracking vehicles and industrial items.

• Warehouse stock control.

• Tracking livestock and pets.

• Tracking clothing and shop stock.

What is biometric device?

security identification device to verify a person using unique physical or behavioural characteristics.

Q7: Give examples of biometric input.

• Fingerprints

• Facial recognition

• Voice recognition

What does ORC stand for (2)

optical character recognition

optical character reader

What is OCR?

A: Converts printed or handwritten text into machine-readable digital text that is also editable

What is the purpose of OCR? (2)

• electronically edit text

• stored more compactly

What are the 5 influences of database management system integrity?

1. accuracy

2. relevance

3. correctness

4. completeness

5. currency

7.3.1 Accuracy

Q10: What is data accuracy? Give example (2)

How closely a stored value matches the true value.

• # of decimal places

7.3.2 Correctness

Q11: What is data correctness? Give example.

A: Data conforms to an accepted standard, rule or known truth.

• GIGO

• Data can be valid but incorrect- student has grade stored as 10 but in reality is grade 11

7.3.3 Currency

Q13: What is data currency? example.

A: Data is up to date and not outdated.

- Example: Stock prices are only current for a day

7.3.4 Completeness

Q14: What is data completeness? What can be done to ensure this?

A: All required data is present in the database.

• presence check

Q15: How can a presence check improve completeness?

A: It ensures that essential fields are not left blank.

What are the three criteria used to assess data completeness?

A: Fact, value and occurrence — these help determine how complete the data in a database is.

7.3.5 Relevance

Q1: What is data relevance?

A: Data is relevant if it relates to the situation or problem and provides useful information.

What are the 6 threats to computer systems?

1. SQL injection

2. Hardware failure

3. Malware

4. Denial of service attacks

5. Open ports

6. Botnets

7. Wifi vulnerabilities

DBMS

DataBase Management Systems

7.4.1 SQL Injection

Q2: What is SQL injection?

A: A cyberattack where malicious SQL code is inserted into an input field to access or delete database information without permission.

Q3: How does SQL injection work? (3)

• An attacker enters malicious SQL code (OR 0=0 since it will always be true) into an input field, such as a username or password field.

• The database executes the code instead of treating it as normal input.

• The attacker may gain unauthorised access to confidential information or modify or delete data.

What can SQL injection allow an attacker to do? (3)

• Bypass login authentication.

• Access confidential data.

• Modify or delete database records.

Give 3 examples of how hardware failures cause a chain reaction.

1) NIC damaged from lightning: no access to internet

2) Faulty server: no other devices can access the network

3) DHCP server has network card failure: computers cannot receive IP addresses & disconnected from network

7.4.2 Hardware Failure

Q5: What is hardware failure?

A: When a hardware component stops working correctly, preventing the computer or network from functioning properly.

7.4.2.1 Storage Failure

Q7: What is storage failure?

A: When a storage device fails, making data inaccessible, damaged or lost.

7.4.2.2 Power Failure

Q9: What is a power failure?

A: An interruption with the electrical power supply that can cause a computer to shut down unexpectedly.

Q6: What are the two main causes of hardware failure? Explain the 2 damages caused by each of them & possible solution for the first one (8) → (3) + (5)

Storage failure: hard drive crashes

• expensive to recover data

• Data may become inaccessible or corrupted.

Power Failure

• speakers: tear in diaphragm from high volume

• data dmg: data in cache not yet written back to a file & file becomes unreadable

• Hardware components: damaged by power surges.

• Computer: may fail to start correctly.

• Registry & file system: corrupted

Name the solutions for power failure and storage failure (6) → (2) + (4)

Storage Failure

• restore data from backup on new hard drive

• recovery services

Power Failure

• operating systems: has shutdown procedure

• 1. close programs

• 2. save changes

• 3. update registry (configuration settings in Windows)

Q11: What is a power surge? Why is it dangerous for the computer? (4)

A sudden increase in electrical voltage that can damage computer components.

• if surge pushes through to memory, overload dmgs components beyond repair

• system won’t boot

• flushes data in BIOS

What can power surges be stopped by? (3)

• circuit breaker

• surge protectors

• PSU (power supply units)

7.4.3 Malware

Q12: What is malware?

A: Malicious software that can get through the firewall/ software sources from portable media (flash drives)

List the 7 different types of malware

1. phishing

2. email spoofing

3. virus

4. trojan horse

5. spyware

6. pharming

7. ransomware

What is phishing? (4)

• The victim receives a convincing email

• They are encouraged to click a link to a fake website.

• The website asks for confidential information (passwords or banking details)

• Criminals have access to bank account

What kind of crime can phishing be used for?

Identity Theft: someone pretends to be another person by stealing their personal details (banking details, name, credit card number) to access resources, gain financial credit, or commit fraud in their name.

Q: What is email spoofing?

Fraudulent email activity where the sender's address or header details are altered to make it look like the email came from a legitimate source.

Q: What is website spoofing? (2)

Creating a fake website designed to look like a legitimate site to mislead users, often using a URL & design similar to the original.

Q: What is a computer virus? (2)

Executable programs that attaches itself to a program or file and spreads from computer to computer (leaving a copy of itself)

altering/corrupting data so it becomes unusable.

Q: What is a Trojan horse?

A: A harmful program disguised as legitimate, useful software that causes damage to a system once run.

Q: What types of damage can a Trojan horse cause?

(2)

• Changing desktop icons

• Deleting files

What is spyware (2)

software that spies on your computer & sends data to criminals comp

What types of sensitive data can spyware obtain from your computer (3)

emails, usernames, passwords

Q: How can spyware be installed on a device?

(2)

• Opening infected email attachments

• Spyware is bundled inside installer files for other programs

Q: What is pharming? How can it be done? (3)

A: An attack that redirects web traffic from a legitimate website to a bogus site

• changing host file on victim’s comp

• poisoning DNS servers

Why is pharming done? (2)

• gain unprotected access to a target computer

• home comp; not business server

Q: What is ransomware?

Malicious software that encrypts files on a user's computer system, demanding payment (ransom) to restore access.

some ransomware encrypts files using:

• an extremely long key

DoS

denial of service

What are the 2 types of DoS attacks

• DoS attacks

• DDoS attacks

Q: What is a Denial of Service (DoS) attack? How is it done? (2)

A: An attack that attempts to make a server or network resource unavailable to users by flooding it with massive requests

• interrupting host service by exploiting vulnerability in app

What devices are susceptible to being attacked by DoS (5)

• computer

• port of a target system

• network connection

• disk space

• bandwidth

DDoS

Distributed Denial of Service

Q: What is a Distributed Denial of Service (DDoS) attack?

A: uses more than 1 computer distributed worldwide to place heavy burden on service

What are the 2 key differences between DoS & DDoS (4)

DoS:

• attackers use 1 computer & 1 internet connection

• easy resolution: if inward traffic is recognised as an abnormal traffic spike, hosts can take immediate action to block source

DDoS

• attackers use widely distributed network of computers & many internet connections

• almost impossible to block out: many sources sending requests

What are open ports used for on the internet? What is the problem with this? (3) → (2) + (1)

• communication on internet

• services (web browsers, email clients) use them to receive info; they need to be open

• open ports exploited

Synonym for botnet

zombie armies

Q: What is a botnet (or zombie army)?

A: A collection of internet computers set up to forward transmission (spam/viruses) to other computers without the owners' knowledge.

What is a zombie/ bot in a botnet?

computer that is set up to forward transmission to other comps without owner’s knowledge

How are the zombies/bots “taken over” to serve in the zombie army (2)

1. failure to provide effective firewalls/safeguards

2. open port- Trojan program installed

Q: What are the main security risks associated with open public Wi-Fi networks? (2)

• Most open public networks do not use encryption, making all transmitted data visible to anyone nearby.

• Unsecured apps and sites risk a data leak, where sensitive information is intercepted or harvested by a malicious actor.

What is needed for a wifi network connection to be encrypted?

pre-shared-key (certificate)

Q: What is a captive portal vulnerability on Wi-Fi networks?

A: An open “guest” network displays captive portal page that prompts users for personal information in exchange for internet access, placing their data at risk.

List 11 possible security solutions

1. RAID

2. Backup

3. Uninterruptible Power Supply

4. Redundant Power Supplies

5. Passwords & Biometrics

6. Multiuser Access Control

7. Encryption

8. Firewall

9. Audit Trails

10. Anti-Malware

11. Updates & Upgrades

RAID

Redundant array of inexpensive disks

Q: What is RAID?

Protection against hard drive failures

• uses two or more hard disks so that if one drive fails, the other drive(s) contain copy of data to prevent data loss.