Security strategies and their appropriate uses

Security strategies and their appropriate uses

Start with the vulnerability

A security strategy is appropriate when it addresses a particular weakness or threat. Naming a powerful-sounding technology is not enough.

For example, if anyone can edit every record after signing in, stronger encryption does not fix the permission problem. Role-based access control does.

Choose the missing link

A sports centre encrypts bookings while they travel between its app and server. However, every staff account can change payment records.

Analyse the weakness. Is the most appropriate additional strategy encryption, a checksum or role-based access control? Justify your choice.

Check your answer

Role-based access control is most appropriate. It can restrict changes to payment records to authorised finance staff, reducing unauthorised changes and protecting integrity. Encryption in transit is already present, while a checksum could detect an accidental transmission error but would not decide who may edit a record.

Authentication: prove who or what you are

Authentication verifies a claimed identity before access is granted. It may authenticate a person, device, application programming interface (API) or server.

Factor	Meaning	Example
Something you know	A secret remembered by the user	Password or PIN
Something you have	A device or token in the user's possession	Authenticator app or security key
Something you are	A biometric characteristic	Fingerprint or facial recognition

Two-factor authentication (2FA) uses two different factor types. Multi-factor authentication (MFA) uses two or more. A password followed by a second password is two steps, but not two factors: both are something the user knows.

Verification codes and biometrics

A verification code from an authenticator app demonstrates possession of a registered device. A biometric comparison tests a physical or behavioural characteristic.

• Verification code: can be changed by re-registering the device, but the user needs access to it.
• Biometric: convenient and difficult to share casually, but false matches or rejections are possible and a biometric characteristic cannot be replaced like a password.

Check for understanding

Determine which sign-in process uses two different factors.

1. Password followed by a PIN.
2. Password followed by a code from an authenticator app.
3. Fingerprint followed by facial recognition.

Check your answer

Option 2. The password is something the user knows and the authenticator code demonstrates something the user has. Option 1 uses two knowledge factors, while option 3 uses two biometric methods from the same factor type.

Authorisation: control what an identity may do

Authentication asks, “Who are you?†Authorisation asks, “What are you allowed to access or change?†Authorisation occurs after identity is established.

Role-based access control (RBAC) assigns permissions to roles rather than granting every user the same access.

Role	View bookings	Edit own booking	Refund payments
Customer	Own only	Yes	No
Receptionist	All	All	No
Finance manager	All	All	Yes

The principle of least privilege gives each identity only the access needed for its work. This limits both accidental damage and misuse of a compromised account.

Apply least privilege

A school event app has student, teacher and administrator roles. Students need to view events and save favourites. Teachers also publish notices. Only administrators approve new user accounts.

Recommend permissions for each role and justify why students should not receive administrator access.

View a sample solution

• Student: view events and manage their own favourites.
• Teacher: student permissions plus publish notices.
• Administrator: teacher permissions plus approve accounts.

Students do not need account-approval permission. With least privilege, a mistake or compromised student account cannot create unauthorised users, protecting confidentiality and integrity.

Encryption: make intercepted data unreadable

Encryption transforms plaintext into ciphertext using an algorithm and key. An authorised recipient uses the required key to decrypt it.

• Data in transit: encrypt data as it travels between a device, server or service.
• Data at rest: encrypt stored files, databases, devices or backups.

Encryption primarily supports confidentiality. It is appropriate when an unauthorised party might intercept a transmission or access stolen storage.

Symmetric and asymmetric approaches

Approach	Keys	Useful feature	Challenge
Symmetric	The same secret key encrypts and decrypts.	Efficient for larger amounts of data.	The shared secret key must be exchanged securely.
Asymmetric	A public and private key form a pair.	The public key can be shared without revealing the private key.	Generally more computationally demanding.

Real secure exchanges may combine both approaches: asymmetric techniques establish or protect a shared secret, then symmetric encryption efficiently protects the session data.

Check for understanding

A student sends assessment feedback through café Wi-Fi. Recommend a strategy for protecting the feedback while it is transmitted and explain its effect.

Check your answer

Use an encrypted connection between the student's device and the service. If network traffic is intercepted, the feedback is ciphertext rather than readable plaintext, reducing unauthorised disclosure and protecting confidentiality. The service must also authenticate the server so the student is not securely sending data to an impostor.

Hashing: create a one-way digest

A cryptographic hash function accepts input of any practical length and produces a fixed-length digest. A small input change should produce a very different digest.

• It is designed to be one-way: the original input is not decrypted from the digest.
• The same input produces the same digest with the same algorithm.
• Comparing digests can reveal that data has changed.

For password verification, a system stores a salted password hash rather than a decryptable password. At sign-in, it hashes the entered password with the stored salt and compares the result with the stored digest.

Hashing and integrity

A sender can calculate a digest before transfer and the receiver can recalculate it afterwards. Different digests show that the data changed. However, a plain hash alone does not prove who created the data: an attacker who can replace both file and digest could make them match.

Select encryption or hashing

For each purpose, determine whether encryption or hashing is more appropriate.

1. A clinic must recover and display a patient's stored notes.
2. An app must check an entered password without storing the password itself.
3. A recipient must detect whether a downloaded file differs from the expected file.

Check your answer

1. Encryption: authorised staff must recover the original notes.
2. Hashing: the entered password's salted digest can be compared without decrypting a stored password.
3. Hashing: comparing digests can reveal a change to the file.

Checksums: detect transmission errors

A checksum is a value calculated from a block of data. The receiver recalculates it and compares the values. A mismatch indicates that the data was altered or corrupted during storage or transmission.

Checksums are useful for detecting accidental errors, such as a damaged packet. They do not hide the data and a simple checksum is not reliable protection against a malicious attacker who can alter both the data and checksum.

Technique	Main purpose	Can recover original?	Hides content?
Encryption	Protect confidentiality	Yes, with the required key	Yes
Cryptographic hash	Create a one-way digest; help verify integrity	No	It does not transmit the original content
Checksum	Detect accidental corruption	No	No

Layer strategies instead of searching for one fix

One strategy rarely addresses every risk. Defence in depth combines controls so that one failure does not expose the whole system.

For a payment exchange:

• server authentication helps the app recognise the intended server
• encryption protects payment details in transit
• MFA makes a stolen password less useful
• role-based access control restricts which staff can view refunds
• hashing supports password verification and change detection
• monitoring and audit logs help identify suspicious actions.

Match controls to weaknesses

A community health portal has these weaknesses:

1. Patients can sign in using only a reused password.
2. Appointment details cross an untrusted network as readable text.
3. Receptionists can open clinicians' private case notes even though their work does not require it.
4. A transmitted booking sometimes arrives with digits missing.

For each weakness, recommend the most directly relevant strategy from MFA, encryption in transit, role-based access control or checksum. Justify each match.

Check your answer

1. MFA: a stolen or reused password is not enough without a different factor, reducing unauthorised account access.
2. Encryption in transit: intercepted appointment data is unreadable without the required key, protecting confidentiality.
3. Role-based access control: receptionist permissions can exclude case notes, applying least privilege.
4. Checksum: a recalculated value that does not match reveals accidental corruption during transmission.

Write a justified recommendation

A strong recommendation names the specific strategy, connects it to scenario evidence and explains the protective mechanism.

Recommend [specific strategy] because [evidence identifies the vulnerability]. It [explain the mechanism], which reduces [event or consequence] and protects [CIA property]. [Relevant limitation or supporting control].

Worked example

A tutoring app uses one shared staff login. Tutors need to view session times, but only the coordinator should change invoices.

Too vague: Use better security so hackers cannot enter.

Justified: Use individual accounts with role-based access control because the shared login gives every tutor the same permissions and actions cannot be reliably attributed. Give tutors read access to session times and reserve invoice changes for the coordinator. This reduces unauthorised or accidental changes and protects invoice integrity. MFA could additionally reduce account takeover, but it would not replace permission controls.

Independent practice: festival wallet

A school festival uses a mobile wallet. Students add funds before the event and scan a code at stalls. The proposed system has these characteristics:

• The app sends student identifiers and payment amounts to the server over the venue's shared wireless network.
• An account uses only an email address and password.
• Volunteers and finance staff have identical access to balances, refunds and personal details.
• The database currently stores each user's password as readable text.
• Occasional network faults corrupt a transaction packet before it reaches the server.

On paper, analyse the system and recommend four security strategies. For each recommendation:

1. quote or paraphrase the relevant evidence
2. name a specific strategy
3. explain how it works in this context
4. justify the CIA property it helps protect.

At least one response must address authentication, one must address authorisation and one must secure data transmission.

View a sample solution

1. Encryption in transit: Because identifiers and payment amounts cross a shared wireless network, use an authenticated encrypted connection between the app and server. Intercepted traffic would be unreadable without the required key, protecting confidentiality.
2. MFA: Because an account currently needs only an email address and password, require a second factor such as a code from a registered authenticator app. A stolen password alone would not authenticate the attacker, reducing unauthorised access to balances and personal details.
3. Role-based access control: Because volunteers and finance staff have identical access, give volunteers only the permissions needed to accept payments and reserve refunds and broader personal data for finance staff. This applies least privilege and protects confidentiality and integrity.
4. Salted password hashing: Because passwords are readable in the database, store a salted cryptographic hash and compare hashes during sign-in. A database disclosure would not directly reveal the original passwords. MFA remains valuable because weak passwords may still be guessed.

A checksum is also a valid additional recommendation for detecting the described accidental packet corruption. It would support integrity by flagging a mismatch so the packet could be rejected or retransmitted, but it would not provide confidentiality.