Access Levels, Anti-Malware & Authentication

Syllabus & Goals 3 min

Cambridge 5.3 · Keeping data safe — access levels, anti-malware, authentication Paper 1 · Computer Systems

By the end of this lesson you can:

1. Describe how access levels and anti-malware (anti-virus, anti-spyware) keep data safe.
2. Describe authentication by user name and password, and judge password strength.
3. Describe biometrics and two-step verification, with benefits and drawbacks.

Textbook: Chapter 5, §5.3.2 — Access levels to two-step verification (pp. 198–204)

Recap / Warm-Up 5 min

Lessons 5–7 covered the threats. Lessons 8–10 cover the solutions. In Unit 4 you met anti-virus software as a utility program.

Quick starter

Your phone unlocks with your fingerprint, and a bank sends you a code by text. Which "proof of identity" is each one?

Key Concept 14 min

1 · Access levels

User accounts control what each person can do. Different people get different levels of access, arranged as a hierarchy. In a hospital, a consultant needs patients' medical records; a cleaner must not see them. Access is usually granted by a user name and password.

In databases, access levels decide who can read, write and delete data. Different views of a table let each user see only certain fields.

Social networks usually offer four access levels, set with privacy settings rather than passwords:

1. Public — anyone can see this data.
2. Friends — only people the owner has marked as friends.
3. Custom — the owner refines what friends see, hiding content from chosen people.
4. Data owner — only the owner can see it.

2 · Anti-malware

The two most common types are anti-virus (Unit 4: it checks files against known viruses and quarantines or deletes them) and anti-spyware. Anti-spyware detects and removes spyware using either:

• rules — it looks for typical features of spyware; or
• file structures — certain file structures are linked with spyware.

Features of anti-spyware:

Anti-spyware is now often bundled with anti-virus and a personal firewall in one package.

3 · Authentication: proving who you are

Authentication is a user proving who they are. There are three common factors:

4 · Passwords and user names

Passwords restrict access to data and systems — email, online banking, shopping and social networks. The user name and password must match before access is allowed.

How systems and users protect passwords:

• The password shows as ******** when typed, so nobody can read it over your shoulder.
• New passwords are typed twice as a verification check for input errors.
• Only a limited number of attempts is allowed (usually three) before the account locks.
• A forgotten password is reset through a link sent by email, in case someone else tried to change it.
• Users should run anti-spyware and change passwords regularly.

5 · Biometrics

Biometrics uses a unique human characteristic to identify a user: fingerprint scans, retina scans, face recognition and voice recognition.

• Fingerprint scans compare the pattern of ridges and valleys with images stored in a database. A match means the user is recognised.
• Retina scans use infrared light to scan the unique pattern of blood vessels at the back of the eye. The person sits still for 10–15 seconds. There is no known way to copy the pattern.

A biometric door system. A company controls entry to its laboratories with retina scanners:

6 · Two-step verification

Two-step verification needs two methods of authentication. It is used especially for online purchases by card. For example, Kim logs in to a shop with a user name and password (step 1). The site then sends a one-time pass code to Kim's registered phone or email (step 2). Kim types the code and is authorised to buy.

The password is something Kim knows; the phone is something Kim has. A criminal who steals only the password still cannot log in.

Worked Example 12 min

(a) Judge four passwords

Scenario: Jo was born on 4 June 2009 and has a dog called Rover. Jo suggests four passwords.

1. Check the three character rules first. a strong password needs a capital, a number and another keyboard character.
2. Then ask: could someone who knows Jo guess it? 04-Jun-2009 passes the rules but fails here. rules alone are not enough — personal facts are the first things tried.
3. Then ask: is it in a common-password list or dictionary? sunshine would fall to a word list. recall the brute-force attack order from Lesson 5.
4. Only T!gerM0th_83q passes all three checks. "explain" answers must give the reason for each verdict, not just the verdict.

(b) Put two-step verification in order

Question: five stages are listed in a random order. Arrange them. [4]

• P — the user is authenticated and can place an order
• Q — a one-time code is sent to the user's registered phone
• R — the user enters their user name and password
• S — the user types the one-time code into the website
• T — the user reads the code on their phone

1. Everything starts with the first factor: R. the site cannot know where to send a code until it knows who you claim to be.
2. The site sends the second factor: Q. the phone was registered earlier, so only the real user should have it.
3. The user reads it: T, then enters it: S. reading must come before typing.
4. Access last: P. Order: R, Q, T, S, P. typically one mark per correctly placed stage after the first.

Try It Yourself 12 min

📝 Exam Practice 10 min

Recap & Key Terms 3 min

Access levels give each user only the rights they need. Anti-malware finds and removes viruses and spyware. Authentication uses what you know, have or are: passwords, tokens and biometrics. Two-step verification combines two of them.

Access levels

Different levels of access in a computer system, forming a hierarchy that depends on a user's level of security.

Anti-spyware

Software that detects and removes spyware, based on typical spyware rules or known file structures.

Authentication

Proving a user's identity using something they know, something they have or something unique to them.

Biometrics

Authentication using a unique human characteristic, such as fingerprints, voice or retina blood-vessel pattern.

Two-step verification

Authentication that requires two methods of verification to prove a user's identity.

Homework 1 min

Task (≤ 15 min): a research company is choosing between fingerprint scanners and retina scanners for its laboratory doors. Compare the two, and recommend one with a reason. [5]