Exam practice

• Confidentiality: data is kept secret, seen only by the people who should see it. Lost: a stranger guesses a password and reads someone’s messages, or private photos are shared publicly.
• Integrity: data is kept correct, and can’t be changed without permission. Lost: someone changes students’ marks on the school computer, or a thief changes the account number on a payment request, so the money goes to him.
• Availability: data is there when it is needed. Lost: a phone with the only copy of the family photos is stolen, or a government website is flooded with requests and nobody can use it for hours.

Availability is lost: the records still exist and are still correct and secret, but nobody can use them.
It is dangerous because doctors need the records at once: which medicines a patient takes, what they are allergic to, the results of tests. Without them, treatment is delayed or done without knowing important facts, operations may be put off and patients sent to other hospitals, as happened in the United Kingdom with WannaCry in 2017. A hospital needs its data to be available as much as it needs it to be secret.

Any four, each with its defense:

• an APK file or an app from outside the app store (sent in a chat or an ad): install apps only from the phone’s official app store;
• a cracked (free) copy of a paid program or game: use free programs from their makers’ own websites, or pay for the real one;
• a pen drive used on other computers: let the computer’s protection scan it, and never run a program found on it;
• an attachment or a link from a stranger, or from a friend’s account that was taken over: don’t open it; check with the person another way;
• a hole in old software: install updates soon after they come;
• a fake warning pop-up (“your phone has viruses”): close it; never install what it offers.

• A virus hides inside other files or programs and spreads when they are opened or copied: it needs people to carry it from place to place, as Brain was carried on floppy disks.
• A worm spreads by itself from computer to computer over a network, without anyone opening anything, as WannaCry did.
• A trojan pretends to be a useful program, so people install it themselves; once installed, it does harm (steals codes, spies, lets the thief control the device).

1. The thief sends a message with a reason to act now (the wallet will be blocked, a prize, a KYC update) and a link.
2. The link opens a page that copies the look of the wallet’s real login page.
3. The victim types their phone number and password; they go to the thief.
4. At once, the thief types them into the real wallet. The real wallet sends a code to the victim’s phone.
5. The fake page asks the victim for that code; the victim types it, and the thief enters it in the real wallet within seconds.
6. The thief is in, and moves the money.

The code didn’t help because the victim handed it over. The defenses: never log in from a link (open the app yourself), read who owns an address, and never type or tell a code anywhere except in the real app you opened yourself.

• i.Owner lalupatebank (.com.np): the real bank. /loans is a page on its site.
• ii.Owner lalupatebank (.com.np): the real bank. “online.” is a part the bank itself added in front of its name.
• iii.Owner lalupatebank-online (.com): not the bank. The name contains the bank’s name, but it is a different name, which anyone could buy.
• iv.Owner bank-verify (.org): not the bank. The ending is .org and the name before it is bank-verify; “lalupatebank.com.np” at the front was put there to fool readers.

The customer showed a fake or old “payment successful” screen: a screenshot of an earlier payment, an edited picture, or a screen made by a fake app. No money was ever sent.
Next time, the shopkeeper should check in the shop’s own wallet app (or listen for the shop’s payment speaker) that the exact amount has arrived from that customer, before handing over the goods. Money is real only when it shows in your own app.

An authenticator app’s code is made on your own phone, from a secret it shares with the website, so it never travels by the phone network. A thief can’t read it by getting a new SIM card with your number, and it works even with no signal. It also changes every 30 seconds.
Neither can stop you handing over the code: a caller or a fake page that asks for it, and gets it, can use it straight away. Only you can stop that, by never telling or typing a code except in the real app or website you opened yourself. (A security key or passkey is safer still, because it checks the website’s address itself.)

It tells you that someone else knows your password: they have passed the first step and are waiting at the second. Two-step login has stopped them so far.
Tap No. Then change the password of that account, from the app or the real website, to a new random-word password not used anywhere else, and change it on any other account that had the same password. Tell an adult. Check the account’s security page for any phones or logins you don’t recognize, and sign them out.

A good plan (details will differ):

• What: all the family’s photos and videos, and the scans of important documents.
• Where: an automatic online backup on each phone (on Wi-Fi only), plus a copy on a laptop or external hard disk at home, and a pen drive or hard disk kept with a relative in another place, brought back to update.
• How often: the online backup every day by itself; the copies at home and at the relative’s once a month, on a fixed day.
• Checking: every few months, open some photos from each copy to see that they really open.

At least one copy must be away from home because some losses take everything in one place at once: a fire, a flood, an earthquake, a burglary, or ransomware that scrambles every device it can reach. A copy somewhere else survives them.

Not quite. A long random-word password does stop guessing. But a password can be lost in other ways that have nothing to do with guessing: a website your friend uses can be breached, and if its passwords were weakly scrambled, or your friend used the password there too, it can be stolen; a fake login page can collect it; spyware can record it as it is typed. Then the thief has the whole password, however strong. Two-step login stops a thief who has only the password, so it protects your friend against the attacks a strong password can’t. The two work best together.

Example answer (others are fine if explained):

First: the habit of never telling a code, because it costs nothing, it stops the most common attack, and no setting can do it for you. Next, the automatic backup and two-step login, which take a few minutes to set up and then work by themselves for years.