Methods of Protecting Data
Overview
While Methods of Protecting Networks focuses on keeping attackers out, protecting data focuses on ensuring data remains safe, usable and private, even if an attacker does gain access. Four main methods:
- Anti-malware software
- Encryption
- Acceptable Use Policies (AUP)
- Backup and recovery procedures
1. Anti-Malware Software
- Protects computers and files from malicious software
- Scans files and monitors system activity for known threats
- Removes or quarantines detected threats
- Most modern OSes include built-in malware protection (e.g., Windows Defender) enabled by default
- Third-party tools offer additional layers of protection
Must Be Kept Up to Date
Anti-malware software is only effective against threats it has signatures for. Outdated software cannot detect new malware variants. Enable automatic updates.
2. Encryption
Encryption converts plaintext into ciphertext, an unreadable, scrambled form, using an encryption algorithm and a unique key. Only someone with the correct key can decrypt it back to plaintext.
Plaintext: "Hello World"
│
│ + Encryption key + Algorithm
▼
Ciphertext: "X7#qP9!mZrL"
│
│ + Correct decryption key
▼
Plaintext: "Hello World"
What Encryption Does and Doesn’t Do
| It does… | It doesn’t… |
|---|---|
| Make stolen data unreadable | Prevent the data from being stolen |
| Protect data in transit | Stop hackers gaining access to the system |
| Protect stored data if a device is lost | Replace other security measures |
Encryption Alone Is Not Enough
Encryption reduces the impact of a breach but does not prevent one. It must be used alongside other measures (anti-malware, firewalls, backups).
3. Acceptable Use Policy (AUP)
An Acceptable Use Policy is a document that sets out the rules governing how users are permitted to use a network or computer system.
- Schools and businesses issue AUPs to staff and students
- Users typically must read and agree to the policy before being granted access
- Sets out what is allowed and what is prohibited
What It Does
- Acts as a deterrent, people are less likely to misuse systems if they know the rules and the consequences
- Makes it easier to take action against misuse if it occurs (evidence of agreed rules)
What It Doesn’t Do
- Does not physically prevent misuse, it is a policy, not a technical control
- Relies on users complying voluntarily
4. Backup and Recovery Procedures
Backups create copies of data so it can be restored if originals are lost, deleted or corrupted.
Why Backups Are Essential
- Critical information now exists primarily in digital form
- Data can be lost due to hardware failure, malware (ransomware), human error or natural disaster
- Without a backup, lost data may be permanently irretrievable
Types of Backup
| Type | What Is Saved | Speed | Storage |
|---|---|---|---|
| Full backup | Complete copy of all selected data | Slow | Large |
| Incremental backup | Only data changed since the last backup | Fast (after first) | Smaller |
Backup Storage Options
- Removable media: DVDs, external HDDs, USB drives
- Off-site storage: Physically separate location (protects against fire/flood at primary site)
- Cloud backup: Automatic, off-site, accessible from anywhere (requires internet)
Backup Scheduling
- Can be manual or automated on a schedule
- Many OSes include built-in backup tools; third-party software is also available
Combining Methods, Layered Security
No Single Method Is Sufficient
, Encryption makes stolen data useless but doesn’t stop theft , Anti-malware stops known threats but not zero-day exploits , AUP deters but doesn’t prevent , Backups recover from damage but don’t prevent it
Effective security requires multiple layers working together.
Exam Questions
Q: Explain why encryption alone is not enough to fully protect a digital system.
Encryption converts data into ciphertext so it cannot be understood without the key. However, it does not prevent an attacker gaining access to the system in the first place. Other measures such as anti-malware software and firewalls are needed alongside encryption for fuller protection.
Q: Describe two types of backup and explain why backing up is important.
A full backup saves a complete copy of all data. An incremental backup only saves data changed since the previous backup. Backing up is important because so much critical information is stored digitally, without a backup, data lost due to hardware failure or malware may be impossible to recover.
Q: What is the purpose of an acceptable use policy?
An AUP sets out the rules for permitted use of a network. It acts as a deterrent against misuse and makes it easier to take action if the rules are broken. It does not physically prevent misuse.
Exam Tip
For evaluation questions, always pair each method with its limitation. Examiners want evidence you understand that no single defence is perfect.