9-10 Digital Technologies Vic Curric - Digital Systems and Security Hangman

The 83 key terms

1digital system

A combination of hardware and software that inputs, processes, stores and outputs data for a purpose, such as a laptop, tablet, smart speaker or games console.

2operating system

The software that manages a device's hardware and runs other software, like Windows, macOS, ChromeOS, Android or iOS. It handles files and memory and gives you the user interface.

3device driver

Software that lets the operating system talk to a piece of hardware, such as a printer, so the device works properly.

4network

A group of digital systems connected together so they can share data, files, printers and an internet connection. Each connected device is called a node.

5client-server

A client, like your browser, sends a request for data and a server stores that data and sends a response back.

6IP address

A unique number that identifies a device on a network, like a postal address, so data knows where to go. IPv4 looks like 192.168.1.5.

7packet

A small chunk of data with the sender, destination and order number attached. Packets travel a network by different routes and are put back in order at the destination.

8protocol

An agreed set of rules that devices follow so they can communicate, like HTTP for web pages. Both devices must use the same protocol to understand each other.

9router

A device that directs data between networks, such as joining a home LAN to the internet and choosing the path data packets take. A home Wi-Fi router also shares the connection wirelessly.

10network switch

A device that connects computers on the same network and sends data only to the device it is meant for, using its ports. A router links different networks.

11wireless access point

A device that connects to a wired network and broadcasts a Wi-Fi signal so wireless devices can join the network.

12data path

The route data takes across a network, passing through devices like a router and ISP from the sender to the receiver (a server), then the reply travels back along the route.

13Confidentiality

Only authorised people or systems can read data. Everyone else is kept out, like student marks seen only by the student and teacher. A breach is when someone else sees them.

14Integrity

Data stays accurate and unaltered unless an authorised person changes it. Accidental or deliberate changes break it, such as a tampered bank balance.

15Availability

Authorised users can reach data and systems when they need them, such as a school network that stays up. Attacks and hardware failure can reduce it.

16Authentication vs authorisation

Authentication checks who you are, like logging in. Authorisation decides what you can do once you are known, like which files you can open. Authentication always comes first.

17authentication factor

A type of proof that you are who you say you are: something you know (password, PIN), something you have (phone, key), or something you are (fingerprint, face).

18permission

A rule that lets an account read, write or execute a file or resource. Read only views it, write can change or delete it, and execute runs it as a program.

19principle of least privilege

Give every user, program and device only the minimum access it needs to do its job. This limits the damage if an account is stolen, and unneeded access should be removed.

20Role-based access control (RBAC)

A way to manage access by giving permissions to roles, like student, teacher or admin, then assigning each user a role. Changing a user's role changes what they can access.

21access control list (ACL)

A table attached to a resource, like a file or router, that lists which users or groups may access it and what they can do. If you are not listed, access is denied.

22ISM access controls guideline

A rule that tells organisations to only give people access to the parts of the network they actually need, after checking who they are.

23access log

An automatic record of who accessed a system or file, what they did and when. It helps spot failed logins and misuse, and holds users accountable for their actions.

24hash

A one-way scrambled value made from a password. A system stores it instead of the real password and checks a login by hashing what you type and comparing. It can't be reversed.

25salt

A random value added to a password before hashing, so identical passwords give different hashes. Each user gets their own salt, which defeats precomputed hash tables.

26brute-force attack

An attack that tries many passwords automatically until one works. A dictionary attack tries common words and leaked passwords first. Long passwords and lockouts slow it down.

27passphrase

A password made of several unrelated words that is long but easy to remember. You can add numbers or symbols to make it stronger.

28password manager

A tool that stores and fills in many passwords for you, kept safe behind one strong master passphrase that only you know.

29MFA methods

Ways to prove it's you: an SMS code, an authenticator app, a biometric like a fingerprint, or a physical security key. They differ in how easy they are to use and how strong they are.

30second factor

An extra proof of identity, like a code from your phone, needed after the password. A thief with only your stolen password can't log in without it.

31MFA fatigue

A trick where a scammer spams you with login prompts hoping you approve one, or talks you into sharing your code. Never share codes, never approve prompts you didn't start, and report them.

32HTTPS

A secure way for your browser to talk to a website. It encrypts the data you send and receive, and shows https:// and a padlock in the address bar. A padlock does not prove a site is trustworthy.

33asset

Anything of value in a digital system that needs protecting, such as data, accounts, devices or services. Examples: a student database (data) or a school laptop (hardware).

34threat

Anything that could cause harm to an asset, such as an attacker, malware, human error or a power failure. Threats can be deliberate or accidental, and internal or external.

35threat actor

A person or group that carries out an attack on a system, described by their motive (why) and skill (how able). Examples: cybercriminals, hacktivists, insiders and nation-state groups.

36vulnerability

A weakness in software, hardware, a process or a person that a threat could use to harm an asset. A vulnerability is only a weakness, not an attack.

37exploit

A method or piece of code that takes advantage of a vulnerability (a weakness) to attack a system. The weakness is the open door; the exploit is the tool that gets through it.

38attack surface

All the points where an attacker could try to get into a system or take data out, such as open ports, running services and user accounts. A smaller attack surface means fewer ways in.

39software vulnerability

A flaw or bug in a program's code or settings, such as a coding mistake or an insecure default, that an attacker could use to get access or cause damage.

40input validation

Checking that data a user enters is the expected type, length and format before the program uses it, so bad or harmful input is rejected.

41SQL injection

An attack where database commands are typed into an input field and run because the program joins the input straight into a query. Parameterised queries stop it.

42buffer overflow

When a program writes more data into a memory area than it can hold, spilling over and overwriting nearby memory. This can crash the program or let an attacker run their own code.

43zero-day

A vulnerability that attackers know about before the software maker has released a fix. With no patch available yet, defenders rely on workarounds and monitoring.

44Outdated software

Software that hasn't been updated with the latest security patches, leaving known vulnerabilities open for attackers to exploit.

45Operating system update

Installing the latest patches for the OS, fixing known security vulnerabilities and bugs.

46Applying firmware

Installing the latest low-level software on a hardware device to patch known security vulnerabilities.

47Malware

Malicious software designed to damage, disrupt, or gain unauthorised access to a computer system

48Virus

Malware that attaches to a host file and spreads by replicating itself when a user runs the infected file

49Worm

Malware that spreads by replicating itself across a network without needing a host file or user action

50Spyware

Malware that secretly monitors a user's activity and collects information without their knowledge or consent

51Ransomware

Malware that encrypts or locks a victim's files and demands payment to restore access

52Antivirus software

A program that detects, blocks and removes malicious programs from a device.

53Denial of service attack

An attack that floods a target with traffic, overwhelming its resources and blocking legitimate users

54Unauthorised access

Gaining entry to a network or system without permission, often to steal or damage data

55social engineering

Tricking people, instead of hacking systems, into giving away access or information, often by pretending to be someone trusted or creating urgency. Phishing is one type.

56phishing red flags

Warning signs that a message is a scam: an odd sender address, urgent or threatening tone, a generic greeting like 'Dear user', spelling errors, or requests for your details.

57Misleading link

A link whose shown text hides a different real web address. Hover to check the address before you click or log in, watch for look-alike names, or type the address yourself.

58smishing and vishing

Smishing is phishing by text message and vishing is phishing by phone call. Examples are a fake delivery text or a fake bank call that tries to trick you into sharing private details.

59Weak password

A password that is short, common, or predictable, making it easy for attackers to guess or crack.

60password re-use

Using one password on many accounts. If a data breach leaks it, attackers try it on other sites and can unlock every account that shares it.

61Improper credential management

When passwords, keys or tokens are stored, shared or reused insecurely, letting attackers steal them and gain unauthorised access.

62insider threat

Harm to data or systems caused by someone with legitimate access, either on purpose (malicious insider) or by mistake, like emailing the wrong person or setting a file to public.

63Staff procedure

A documented rule employees must follow, such as reporting incidents or locking devices, to reduce cyber security risk.

64software supply chain

Everything used to make and deliver software: code libraries, tools, build systems, suppliers and updates. Most of an app is other people's code, so you trust every link in the chain.

65dependency

A library or package written by someone else that your program imports and relies on. If it has a flaw, every app that uses it is affected, including via dependencies of dependencies.

66Supply chain attack

An attack where criminals hide malicious code in a trusted supplier's software update, so users install it believing it is safe.

67typosquatting

Publishing a malicious package or site with a name almost the same as a trusted one (like reqeusts for requests), hoping people install or visit it by mistake.

68Code signing

Code signing adds a digital signature to software so a computer can check it came from the named publisher and has not been changed since it was signed.

69SBOM

A software bill of materials: a list of every component and library inside a piece of software, with version numbers, so owners can check each one for known vulnerabilities.

70reduce supply chain risk

Use fewer, trusted dependencies, pin versions, verify integrity and scan for known vulnerabilities so a weak link in code you rely on cannot harm your system.

71risk = likelihood x impact

Risk is how likely a threat is to succeed combined with how much harm it would cause. Rate each as low, medium or high to decide which risks matter most.

72risk matrix

A grid that plots how likely a threat is against how bad its impact would be, giving each risk a priority rating (such as low, medium or high) so you know which to fix first.

73data flow diagram

A diagram that shows how data moves between users, processes, data stores and external services in a system, using labelled arrows for each flow.

74trust boundary

A line on a diagram where data passes between parts of a system with different levels of trust, such as from a user's device to a server. Threats often cluster here.

75STRIDE

A memory aid for six threat types: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. Use it to ask what could go wrong in a system.

76attack tree

A diagram with the attacker's goal at the top, branching into the different ways to reach it. OR branches are alternatives, AND branches are all needed.

77security control

A measure that reduces risk by preventing an attack, detecting it or helping recovery. Controls can be technical, physical or procedural, and layering several works best.

78threat model table

A table with one row per threat. Columns record the asset, threat, vulnerability, risk rating and chosen control, e.g. a school app storing student data.

79threat model review

Checking and updating a threat model whenever the system, its users or the known threats change, for example after a new feature, a new dependency or a new control.

80Ethical hacking

Authorised testing of a system to find security vulnerabilities before malicious attackers can exploit them.

81The Essential Eight

A set of eight baseline security strategies created by the Australian government to help reduce the risk of cyber security incidents.

82data breach

When attackers get into an organisation's stored data, such as usernames and passwords. Find out through alerts, then change your password and turn on MFA.

83Respond to a compromise

If an account or device may be hacked, act fast: tell a trusted adult, change the password, turn on MFA and check for odd activity. Also report phishing, change shared passwords and scan for malware.