Data Security, Integrity and Ethics: Computer Science 9618 (Cambridge International AS & A Level)

Which of the following best describes the difference between a computer worm and a computer virus?

Greenfield School is building an online admissions form for parents. The form includes:

• a Month of Birth box, which only accepts a whole number for the month the child was born
• a Home Postcode box, which must always contain something before the form can be submitted
• a Confirm Reference Number box, which asks the parent to type their 6-digit School Reference Number a second time, after typing it once into an earlier box

(a) State one difference between data validation and data verification. [2]

(b) State the name of a suitable validation check for the Month of Birth box, and use it to explain whether an entry of 13 would be accepted by this check. [2]

(c) Name the validation check that would be used to make sure the Home Postcode box is never left empty when the form is submitted, and explain what this check tests for. [2]

(d) Name the verification method used by the Confirm Reference Number box, and describe how it would detect that a parent has mistyped their reference number into one of the two boxes. [2]

StoreForward Ltd assigns each item in its warehouse a 4-digit stock number. A check digit is then calculated and appended to create a 5-digit stock code, using the following algorithm:

• multiply the 1st digit of the stock number by 7, the 2nd digit by 5, the 3rd digit by 3, and the 4th digit by 2
• add these four results together to give a weighted sum
• calculate the remainder when the weighted sum is divided by 11, using integer division
• this remainder becomes the check digit, appended as the 5th (final) digit of the new stock code

For example, stock number 1234 gives a weighted sum of (1 x 7) + (2 x 5) + (3 x 3) + (4 x 2) = 7 + 10 + 9 + 8 = 34. Dividing 34 by 11 using integer division gives a remainder of 1 (since 11 x 3 = 33), so the check digit is 1 and the new stock code is 12341.

(a) A new item has the stock number 4213. Calculate the check digit for this stock number, showing your working, and state the new 5-digit stock code. [2]

(b) A warehouse worker needs to enter the stock code 42133 into the system, but mistypes it as 42163. Use the check-digit algorithm to determine whether the system would accept or reject the code 42163, showing your working. [2]

(c) A different data integrity check, even parity, is used whenever a byte of data is transmitted across StoreForward's network, with the leftmost bit of each byte reserved as the parity bit. State what is meant by even parity, and determine the correct parity bit for the 7-bit data value 1011001. [2]

(d) State one limitation of a simple even parity check, giving an example of a situation in which it would fail to detect an error. [1]

TaxWise Accountants store their clients' financial records on a server in their office, and staff regularly email encrypted copies of documents to clients over the internet.

Last month, several staff received an email that appeared to come from the company's bank. The email asked them to click a link, which opened a convincing copy of the bank's real website, and enter their online banking username and password.

(a) Name the type of attack described in this scenario, and state one way that TaxWise could reduce the risk of a staff member falling for it. [2]

(b) Explain the difference between encrypting data "at rest" and encrypting data "in transit". In your answer, identify which type of encryption best protects (i) the financial records stored on the office server, and (ii) a document while it is being emailed to a client. [3]

(c) Suggest one method, other than encryption, that TaxWise could use to stop an unauthorised person who has gained access to the office network from being able to open the financial records stored on the server. Explain how this method would achieve this. [2]

A university student has written a mobile app and wants to publish it so that:

• anyone can download and use the app at no cost, and
• anyone can view, modify and redistribute the app's source code, provided that any modified version they redistribute is released under the same licence.

Which type of software licence would BEST meet both of these requirements?

A school stores students' contact details and exam grades in a single database. Three separate incidents occur during one term:

• Incident 1: A member of staff who has been granted full access to the database looks up the exam grades of a student who is not in any of their classes, purely out of personal curiosity.
• Incident 2: A software fault during a scheduled backup silently changes some students' exam grades to incorrect values, even though no unauthorised person has accessed the database.
• Incident 3: An unauthorised outsider guesses a weak administrator password and downloads a copy of the entire database.

Which one of these incidents is best described as a breach of data integrity, as opposed to a breach of privacy or a breach of security?

GreenLeaf Grocers runs an online store at www.greenleafgrocers.com. Last week, several customers reported that after typing this address correctly into their browser themselves, without clicking any link in an email or message, they were taken to a convincing fake copy of the checkout page that asked for their payment card details. Investigators later found that malicious software running on GreenLeaf's own DNS server had altered the records used to direct traffic for the site, so that the correct web address now pointed to a server controlled by an attacker.

(a) Name this type of attack, and explain one way in which it is different from phishing. [2]

(b) Explain how installing a firewall on GreenLeaf's network could help to reduce the risk of an attacker being able to reach the DNS server and alter its records in the first place. [2]

(c) State one other technical measure, other than a firewall, that GreenLeaf could use to detect and remove the malicious software that altered the DNS records, and explain how it works. [2]

BrightBooks is building a new account registration system for its online store.

• The Membership Code box must contain exactly 2 uppercase letters followed by 4 digits (for example, AB1234).
• The Password box must contain at least 8 characters.
• Completed order files are sent from the website's server to the warehouse computer over a network link. Before sending a file, the website server adds up the numeric value of every byte in the file to produce a single total, and sends this total along with the file. After receiving the file, the warehouse computer recalculates the same total from the data it has actually received and compares it to the total that was sent.

(a) Name a suitable validation check for the Membership Code box, and use it to explain whether the entry "AB123" would be accepted. [2]

(b) Name a suitable validation check for the Password box, and use it to explain whether the entry "Cats22" would be accepted. [2]

(c) Name the check being used to check the order file after it has been transferred, and explain how it detects that the file has been corrupted during transfer. [2]

A developer downloads a photograph from a photo-sharing website to use as an image in a commercial mobile app, without checking the photograph's licence or asking the photographer for permission. The photograph was publicly viewable on the website for anyone to see.

Which of the following best explains why using this photograph in this way could still be a breach of copyright law?

Jamal is a software developer working for MedApp Ltd on a mobile health-tracking app. While fixing an unrelated bug, Jamal discovers that the app silently sends each user's exact GPS location to an advertising company every few minutes, a practice that is not mentioned anywhere in the app's published privacy policy or terms of use. Jamal reports this to his manager, who tells him to leave the code unchanged because the location data is a valuable source of extra advertising revenue for MedApp, and instructs him not to raise the issue with anyone else.

(a) State one reason why continuing to implement this feature without further action would go against professional ethics for a computing professional. [2]

(b) State two actions, other than simply doing nothing, that Jamal could take that would be consistent with acting professionally and ethically in this situation. [2]

(c) Jamal's manager has not broken any specific line of code or introduced a technical fault by giving this instruction. State one reason why Jamal's situation should still be considered an ethical issue. [1]