Security, privacy and integrity are often used as if they meant the same thing, but examiners treat them as three separate ideas. Learn the precise meaning of each, why both the data and the computer system need protecting, and how a system checks who a user really is.
Data security means protecting data from loss, damage and unauthorised access. Data privacy is about who has the right to see and use personal data, and is protected by law (data protection legislation). Data integrity means the data is accurate, complete, consistent and up to date. Security measures protect privacy and integrity, but they are not the same thing. A system needs user accounts and authentication (passwords, biometrics, digital signatures) to know who is using it, access rights to limit what each user can do, and encryption so that stolen data cannot be understood.
Fig. 1: security, privacy and integrity ask different questions about the same data
Section 01
Security, privacy, integrity.
Think of a hospital database of patient records. The same records raise three different questions, and a 9618 answer must keep them apart.
Term
Meaning
Hospital example of a failure
Data security
Keeping data safe from loss, corruption and unauthorised access, and being able to recover it
A disk fails and there is no backup; a hacker copies the records
Data privacy
The right of individuals to control who can see and use their personal data; data must only be used for the purpose it was collected for
A receptionist looks up a famous patient's diagnosis out of curiosity
Data integrity
Data is accurate, complete, consistent and up to date
A blood type is typed in as A instead of AB
Privacy is a legal and ethical idea: data protection laws require personal data to be collected fairly, kept accurate, kept secure, used only for stated purposes and not kept longer than needed.
Security supports both: without security, privacy cannot be guaranteed and data can be altered, so integrity is lost.
Integrity can be lost without any attack: a typing mistake or a transmission error damages integrity; validation and verification (Section 6.2) defend against this.
Your turn
A bank stores a customer's balance as 1500 when it should be 15 000. Which of the three has been lost?
Integrity: the data is no longer accurate. Security and privacy may be fine, since nobody unauthorised has seen or changed it.
Examiner trap
Do not define one term using another ("privacy means keeping data secure"). Privacy is about who has the right to see personal data; security is about protecting data; integrity is about data being correct.
Section 02
Protect the data and the system.
The syllabus asks you to appreciate the need for both. They are protected in different ways and lost in different ways.
Security of data: the data must not be lost, corrupted, stolen or read by the wrong people. Measures: backups, encryption, access rights, validation and verification.
Security of the computer system: the hardware, software and network must keep working and must only be used by authorised people. Measures: user accounts and passwords, firewalls, anti-virus and anti-spyware software, software updates, physical locks.
Why both: a system that is hacked can be used to steal or change data, to spread malware to other computers, or to stop working altogether (lost service, lost income). Data that is lost may be impossible to replace and its loss may break data protection law.
Worked example Data or system?
A school's network is infected with ransomware that locks every computer until a fee is paid. The student records are backed up off site each night. Explain what has been protected and what has not.
The data is protected against loss: the off-site backup means the student records can be restored, losing at most one day of changes.
The system was not protected: malware got in, so there was no effective anti-malware, firewall or update policy.
The school still loses the use of its computers until they are cleaned and restored, so lessons and administration are disrupted.
Answer: Backups protected the data; the system itself was not secure, so the service was lost.
Examiner trap
A backup protects against loss of data. It does nothing to stop unauthorised access: a stolen backup is a privacy breach unless it is encrypted.
Stage 1 · Learn
Check what the sim just showed you
Four quick checks. Each correct answer earns XP and records this skill on your profile.
Quick check+10 XP
A spreadsheet of exam marks contains a mark of 92 that should be 29. What has been lost?
Quick check+10 XP
Which statement best describes data privacy?
Quick check+10 XP
In the lab's asymmetric mode, the sender encrypts with the receiver's public key. Which key decrypts the message?
Quick check+10 XP
Which is a biometric authentication method?
Section 03
Who are you?
Every security measure that limits users depends on first knowing who the user is. In the lab, compare symmetric encryption with a public and private key pair; the private key is also what makes a digital signature work.
Measure
How it works
Strength or weakness
User account
Each user has a unique user ID with a profile that sets their access rights
Lets the system log and limit what each person does
Password
Something the user knows; stored as a hash, compared at log-in
Can be guessed, shared or seen; use long passwords, mixed characters, lock-out after several failed attempts
Biometrics
Something the user is: fingerprint, iris or retina, face, voice; compared with a stored template
Cannot be forgotten or easily shared; can give false rejections, and a stolen template cannot be changed
Digital signature
The sender encrypts a hash (digest) of the message with the sender's private key; the receiver decrypts it with the sender's public key and compares it with its own hash of the message
Proves who sent the message and that it was not changed in transit
Access rights
Each user or group is given no access, read-only or read/write access to each file or area
Limits the damage any one account can do
Encryption
Data is scrambled with a key so only someone with the right key can read it
Does not stop data being intercepted or stolen, but makes it meaningless to the thief
Your turn
Explain why a digital signature is encrypted with the sender's private key and not the receiver's public key.
Only the sender holds the sender's private key, so a signature that decrypts correctly with the sender's public key can only have come from that sender. This authenticates the sender. Encrypting with the receiver's public key would keep the message secret but would not prove who sent it.
Examiner trap
Encryption does not prevent hacking or interception. Write that it makes intercepted data unintelligible (meaningless) to anyone without the key.
Stage 2 · Exam
Exam-style questions
Unlocks once the four checks above are done. Worth more XP, written to AS Paper 1 and Paper 2 standard.
Finish the four checks above to unlock the exam questions
Exam style+20 XP
Which measure protects data against loss but NOT against unauthorised access?
Exam style+20 XP
How does a receiver check a digital signature?
Exam style+20 XP
Why is encryption described as a method of protecting data rather than the computer system?
Exam style+20 XP
A user can open a file but cannot change or delete it. What has been set?
Skill unlocked
Security, privacy and integrity, kept apart.
This skill is now recorded on your profile. Keep the chain going.