Security & Governance

This is Unit Eleven of Computer Science: security. Every unit before this one described systems working. This one describes people attacking them — and the first thing it does is refuse to treat security as the only thing that matters. It is one of six qualities a system gets judged on, and the others do not stop mattering because this one is at stake. The centre of the unit is a taxonomy, and the error entry defends it. Calling every infection a virus collapses a set of distinctions with real consequences — because what a piece of malware is determines how it spreads, where it hides, and what stops it. Then cryptography, which has a fixed cast of parts that has not changed since it was done with pen and paper — and one arrangement that removes the oldest problem in the field, which is how two people share a secret before they can talk safely. And the capstone continues the thread: the transit app that was built in Unit Nine and deployed in Unit Ten now stands inspection against the whole taxonomy. By the end you will be able to do five things. One: name the assets a security policy actually protects. Two: say what is lost by calling every infection a virus. Three: name the fixed cast of a cryptographic system. Four: say what a key pair does that a shared key cannot. Five: say what makes a threat persistent.

Two entries, and the second is a piece of restraint worth noticing. Security is one of six qualities a system gets evaluated on — and a system made maximally secure at the cost of the other five has not been improved.

What is at stake.

CS 0611 The Cyber Resource

The platforms, solutions, processes, policies and procedures storing, processing and managing an organisation's information. Not only machines — the procedures count as resources too.

Six qualities.

CS 0612 The Six Qualities

Evaluated against six expected qualities, with security one of them alongside safety, performance, usability, reliability and the rest. Security competes with the others rather than overriding them.

Three entries naming the actual assets. Five things get protected, one category of data is the general target of most attacks, and one property answers a question the others do not — proving that something came from who it claims to.

Five assets.

CS 0613 The Security Policy's Assets

A policy names what it protects — confidentiality, integrity, availability of service, privacy and authenticity. Five separate assets, and an attack usually threatens one of them without touching the others.

The general target.

CS 0614 Personally Identifiable Information

Names, addresses, identification numbers, payment details — the general target of most data theft, because it retains value independently of the system it was taken from.

Proof of origin.

CS 0615 Nonrepudiation

Proof of data's origin, authenticity and integrity, achieved cryptographically. It makes denying an action impossible rather than merely difficult — which is a different guarantee from secrecy.

Five entries, and the error entry in the middle is the reason the taxonomy is here at all. The distinctions are not pedantry — a worm and a rootkit differ in how they arrive, where they live, and what removes them.

The category.

CS 0618 Malware

Malicious software enabling unauthorised access or damage, with several distinct variants underneath the single word.

Two mechanisms.

CS 0619 Virus and Worm

A virus propagates by arranging to have itself executed, typically infecting stored documents or code, usually needing a user action. A worm does not need one.

And the error.

CS 0620 "Every Infection Is a Virus"

Calling all malware a virus collapses a taxonomy with real teeth. The virus is one mechanism among several, and the mechanism is what determines how something spreads and what stops it.

Hiding, and returning.

CS 0621 Rootkit and Backdoor

A rootkit modifies the operating system itself to conceal its own existence. A backdoor is a hidden route back in. One hides presence, the other preserves access.

Appearing useful.

CS 0622 The Trojan Horse

Software appearing to serve a beneficial purpose while designed for covert malicious activity. The deception is the delivery mechanism — the user installs it willingly.

Seven entries covering the attack shapes. They differ in what they want — money, access, information, or nothing but disruption — and one of them is defined not by its method but by how long it manages to stay.

Captured machines.

CS 0623 The Botnet

A network of compromised machines under one attacker's unified control. The individual machines are the resource, and their owners generally do not know.

Encryption, weaponised.

CS 0624 Ransomware

Malware encrypting data and demanding payment to unlock it or to prevent its exposure. The same mathematics that protects data, aimed the other way.

Access already granted.

CS 0625 The Insider Threat

Current or former employees, partners or contractors misusing access they were legitimately given. Nothing has to be broken into, which is what makes it hard to detect.

Attacking the person.

CS 0626 Phishing

Tricking users into providing personal information through fabricated messages. It bypasses every technical control by targeting the one component that cannot be patched.

Overloading.

CS 0627 The Distributed Denial of Service

Overwhelming a server or network with traffic from many coordinated sources. Nothing is stolen and nothing is broken — availability, one of the five assets, is the target.

Staying.

CS 0628 The Advanced Persistent Threat

Infiltrating systems to observe and extract data while remaining undetected for as long as possible. What makes it persistent is duration rather than technique — the goal is to still be there next year.

How it gets in.

CS 0629 How Malware Gets In

Malware arrives through recognised scenarios — a vulnerable client reaching a hostile system, an exploited service, a compromised supply chain. The routes are known and enumerable.

Four entries, and the last one solves a problem that stood for most of the field's history. If two people need a shared secret to communicate safely, how do they share it safely in the first place? A key pair answers that.

The cast.

CS 0632 Cryptography's Cast

Plaintext needing protection, an algorithm and a key producing ciphertext, and the reverse on the other end. The cast has not changed since this was done by hand.

The first mechanism.

CS 0633 The Substitution Cipher

Producing ciphertext by substituting characters, bits or blocks with alternates. The characters change and their order does not.

The second.

CS 0634 The Transposition Cipher

Rearranging the plaintext characters rather than replacing them. The characters are unchanged and their order is not — the exact complement of the previous mechanism.

And the pair.

CS 0635 Public and Private Keys

A key pair, where the sender encrypts with the recipient's public key and only the private key decrypts it. The two parties never have to have shared anything secret in advance.

One procedure, and it does the work by hand. A single fixed mapping applied to a short word, and then the same mapping run backwards — which is how the whole idea becomes something you have done rather than something you have read.

Watch one word get enciphered.

CS 0640 One Word, Enciphered

A monoalphabetic substitution runs by one fixed mapping, and enciphering a short word by hand and then deciphering it back shows both directions of the operation on the same material.

Two entries closing the unit. One widens the frame past attack and defence to computing's obligations generally — and then the capstone, which continues the course's longest thread.

The wider frame.

CS 0636 Responsible Computing

A systemic approach to computing's current and future challenges, sustainability among them. It places security inside a set of obligations rather than treating it as the whole of them.

The capstone. The app, inspected.

CS 0645 The App Under Attack

The transit app that ascended to the cloud in Unit Ten now stands inspection against this unit's full threat taxonomy — every attack shape asked of one real system.

Five things you can now do. You can name the assets a security policy protects — confidentiality, integrity, availability, privacy and authenticity — and say that an attack usually threatens one of them without touching the rest. You can say what is lost by calling every infection a virus: a taxonomy where the mechanism determines how something spreads, where it hides, and what removes it. You can name cryptography's fixed cast — plaintext, an algorithm, a key, ciphertext — and that substitution changes characters while transposition moves them. You can say what a key pair does that a shared key cannot: it lets two parties communicate securely without ever having shared a secret in advance. And you can say what makes a threat persistent — duration rather than technique, with the goal of still being there long after.