Fundamentals of cyber security

(a) Cyber security consists of the processes, practices and technologies (1) designed to protect networks, computers, programs and data (1) from attack, damage or unauthorised access (1).

(b) Two purposes:

• To keep data confidential — ensuring that only people who are authorised can read it, such as customers' payment details or patients' medical records (1)
• To keep systems available — keeping networks and services working, so that an attack cannot prevent an organisation from operating (1)

(Also creditable: keeping data accurate and complete; preventing unauthorised access; protecting programs and devices from malware; meeting legal duties to protect personal data.)

(a) A password system checks something the user knows — a secret that only the legitimate user should have — before granting access (1).

(b) Two features of a stronger password:

• Greater length, since each extra character multiplies the number of possible combinations an attacker must try (1)
• A mixture of upper case, lower case, digits and symbols, and not a dictionary word or personal information that could be guessed or found on social media (1)

(c) Two system-level measures:

• Limit the number of login attempts and lock the account after, say, three failures (1). This defeats an automated brute-force attack even if the password itself is weak, because the attacker cannot make thousands of guesses (1)
• Require two-factor authentication, combining the password with a code sent to the user's phone (1). A stolen or guessed password alone is then insufficient, so phishing a password no longer gives access

(6 max)

(a) A CAPTCHA is a test designed to distinguish a human user from an automated program (a bot) — for example reading distorted text or selecting matching images (1). It prevents automated actions such as bots creating thousands of accounts, submitting spam to forms, or making rapid repeated password guesses (1).

(b) An email confirmation sends a link or code to the address the user gave, and the account is only activated once the user follows it — proving that they actually control that email address (1). It prevents accounts being created with fake or mistyped addresses, someone registering using another person's address, and bulk automated sign-ups, since each would need a working mailbox (1).

(c)

• CAPTCHA — it is annoying for genuine users and can be difficult or impossible for users with visual or motor impairments, raising accessibility problems (1)
• Email confirmation — it proves control of a mailbox, not the identity of a person, so someone using a throwaway address still passes (1)

(6)

Advantages

• Speed, and therefore actual use. A phone is unlocked dozens of times a day, so typing a PIN each time is slow and irritating, whereas a fingerprint takes a fraction of a second (1). Because it is convenient, users leave the lock switched on, where an inconvenient measure would simply be disabled — leaving the phone unprotected (1)
• It cannot be forgotten, shared or shoulder-surfed. The user always has their finger with them, and watching them unlock the phone reveals nothing — which matters because phones are used in public places where a PIN can easily be observed (1)

Disadvantages

• False negatives. A wet, dirty or injured finger may be rejected, locking out the legitimate owner — which is why phones always keep a PIN as a fallback (1)
• A biometric cannot be changed. If the stored fingerprint data is compromised, the user cannot be issued a new fingerprint, whereas a PIN can be reset in seconds (1). There are also privacy concerns, since biometric data is deeply personal and a breach of it is permanent (1)

(6 max)

(a) Software contains vulnerabilities — flaws that an attacker can exploit to gain access or cause damage (1). When one is found, the developer releases a patch, and installing it closes that vulnerability. Updates also refresh antivirus definitions, without which the scanner cannot detect malware discovered since its last update (1).

(b) Once a vulnerability becomes publicly known, attackers actively search for machines that have not yet been patched, so the gap between release and installation is exactly when attacks succeed (1). Automatic updates install the patch as soon as it is released, minimising that window, whereas staff forget or postpone updates (1). Across 200 machines, relying on individuals guarantees that some are always out of date — and a single unpatched machine can be the way in to the whole network (1).

(c) Any one of: updates use bandwidth and storage; they may require a restart at an inconvenient moment; an update can occasionally introduce a new fault or break compatibility with other software the company relies on (1).

(6)

(a) CAPTCHA (1). The problem is automation, and a CAPTCHA is a test that distinguishes a human user from an automated program, so the bots cannot complete the registration form at scale (1). (Adding email confirmation strengthens this further, since each account would then also need a working mailbox.)

(b) Automatic software updates (1). A vulnerability in software can only be fixed by a patch from the developer, and because the flaw is already being actively exploited, the patch must be installed immediately rather than whenever a user notices the prompt (1).

(c) Biometric measures (1). The threat is an attacker gaining physical possession of the phone, so the protection must control access to the device itself. A fingerprint or face lock cannot be guessed or shoulder-surfed, and is quick enough that staff will actually leave it enabled — which is why the specification highlights biometrics particularly for mobile devices (1).

(6)

CAPTCHA — for the bots. A CAPTCHA distinguishes a human user from an automated program, so a bot cannot complete a purchase at the moment tickets go on sale, giving real customers a fair chance (1).

A stronger password system — for the broken-into accounts. Enforce a minimum length and a mixture of character types, and reject known-common passwords, so accounts cannot be opened by guessing (1). Crucially, also limit the number of login attempts before locking the account, which defeats an automated guessing attack even against a weak password (1). Two-factor authentication would go further, making a stolen password insufficient on its own (1).

Email confirmation — for the non-existent addresses. Activate an account only when the user follows a link sent to the address they gave, proving they control that address — which also gives the company a working channel for order confirmations and account alerts (1).

Automatic software updates — for the compromised server. The flaw had been patched three months earlier, so the software was not insecure — the delay in installing the patch was the whole cause. Automatic updates would have closed the vulnerability as soon as the patch was released, removing that three-month window entirely (1).

Why no single measure is sufficient. Each problem has a different cause, so each needs a different measure: a CAPTCHA does nothing about a stolen password; a strong password does nothing about an unpatched server; email confirmation does nothing about bots that own a mailbox (1). The weakest link decides the outcome — an attacker only needs one way in, so the measures must be layered, which is exactly why cyber security is defined as processes, practices and technologies together rather than as any one tool (1).

(8)

The bank's argument has real force. A fingerprint cannot be forgotten, shared or written down, and cannot be shoulder-surfed — watching a customer unlock the app reveals nothing (1). It is also very quick, and that convenience is itself a security benefit, because customers keep a fast lock enabled where they would disable a slow one (1).

But replacing passwords entirely creates serious problems.

• False negatives. A wet, dirty or injured finger may be rejected. With no password fallback, a legitimate customer would be locked out of their own bank account with no way in — unacceptable for a service people depend on (1)
• A biometric cannot be changed. If the stored fingerprint data is compromised, the bank cannot issue the customer a new fingerprint, whereas a password can be reset in seconds. The damage is permanent (1)
• Hardware dependence. A phone with a broken or absent sensor could not be used at all, and sensors have been fooled by photographs or moulds in the past (1)
• Accessibility. Some customers cannot reliably use a fingerprint sensor, so a biometric-only system would exclude them (1)

Recommendation: combine, do not replace (1). Use the fingerprint for routine convenience, keep a password or PIN as a fallback so nobody is locked out and a compromised biometric is survivable, and add two-factor authentication — a code sent to the customer's phone — for transfers and payments, so no single stolen factor is sufficient (1).

(8)

What the policy gets right. Requiring a mixture of character types does increase the number of possibilities per character, and telling staff not to write passwords down is sound in principle (1).

Where it fails.

• 'Exactly 8 characters' caps the strength. Length is the single biggest factor in password strength, since each extra character multiplies the possible combinations — so imposing a maximum length actively limits security rather than improving it (1)
• Forcing a change every 30 days produces predictable patterns. `Summer1!` becoming `Summer2!` means that an attacker who learns one password can guess the next, so the frequent changes have made the passwords weaker, not stronger (1)
• The policy has caused the notes in the drawer. Unmemorable passwords changed monthly cannot realistically be remembered, so staff have written them down — and a password on paper in an unlocked drawer is far more exposed than a memorable one that is never changed (1)
• Nothing limits login attempts. The policy addresses only what a password contains, and does nothing about an attacker guessing automatically, which is the more likely attack (1)

Relating this to the definition. Cyber security consists of processes, practices and technologies. This policy is a process that has made practices worse: it has pushed staff into predictable patterns and written notes, so overall security has fallen even though every password now technically complies (1).

Recommendation. Set a minimum length with no maximum and encourage long memorable passphrases; drop the 30-day cycle in favour of changing a password when there is reason to think it has been exposed (1). Add system measures the policy omits: limit login attempts before locking the account, reject known-common passwords, and use two-factor authentication so a leaked password alone is not enough (1).

(8)