VCE Data Analytics - U4O2 - Cyber Security: Data Security Hangman

The 149 key terms

1organisational goals and objectives

Goals are broad aims like growth, profit and customer trust. Objectives are measurable steps toward them. Both depend on secure, reliable data.

2business continuity

Keeping systems and data working so daily business can carry on. Security limits downtime so services keep running when a threat or failure occurs.

3Mitigation

Using strong security to cut the money lost (fines, recovery costs, lost customers, falling share price) and the damage to brand and public trust after a data incident.

4Regulatory compliance

Meeting the legal and industry rules that govern how an organisation must secure its data and systems.

5asset

Anything of value in a digital system that needs protecting, such as data, accounts, devices or services. Examples: a student database (data) or a school laptop (hardware).

6threat

Anything that could cause harm to an asset, such as an attacker, malware, human error or a power failure. Threats can be deliberate or accidental, and internal or external.

7accidental threat

Harm to data caused by a mistake with no intent to cause damage, such as emailing the wrong person, deleting files by accident, misconfiguring sharing or losing a device.

8deliberate threat

An intentional action by an attacker or malicious insider to steal, damage, alter or block access to data, usually for profit or revenge.

9events-based threat

An event outside anyone's control, such as fire, flood, storm or power failure, that damages data or systems or blocks access to them.

10insider threat

Harm to data or systems caused by someone with legitimate access, either on purpose (malicious insider) or by mistake, like emailing the wrong person or setting a file to public.

11Malware

Malicious software designed to damage, disrupt, or gain unauthorised access to a computer system

12Ransomware

Malware that encrypts or locks a victim's files and demands payment to restore access

13social engineering

Tricking people, instead of hacking systems, into giving away access or information, often by pretending to be someone trusted or creating urgency. Phishing is one type.

14Denial of service attack

An attack that floods a target with traffic, overwhelming its resources and blocking legitimate users

15Unauthorised access

Gaining entry to a network or system without permission, often to steal or damage data

16vulnerability

A weakness in software, hardware, a process or a person that a threat could use to harm an asset. A vulnerability is only a weakness, not an attack.

17risk = likelihood x impact

Risk is how likely a threat is to succeed combined with how much harm it would cause. Rate each as low, medium or high to decide which risks matter most.

18risk matrix

A grid that plots how likely a threat is against how bad its impact would be, giving each risk a priority rating (such as low, medium or high) so you know which to fix first.

19Integrity

Data stays accurate and unaltered unless an authorised person changes it. Accidental or deliberate changes break it, such as a tampered bank balance.

20accuracy

Data is accurate when it is correct and free from errors, so it matches the real-world fact it records. Typos, faulty measurements and out-of-date values make data inaccurate.

21Authenticity

Data is authentic when it genuinely comes from the source it claims and has not been forged or spoofed. Verifying its origin shows it can be trusted.

22Correctness

Data is correct when it is in the right form and follows set rules, such as the right data type, format, valid values and calculation. It is not the same as accuracy.

23reasonableness

Data is reasonable when its value is sensible and believable in its context, so impossible values or odd outliers (like an age of 250) are flagged by reasonableness checks.

24relevant data

Data that relates directly to the question or purpose it is used for. Unneeded fields or data from the wrong population are not relevant, so they lower the quality of the information.

25timeliness

Data is timely when it is up to date and available when needed. Out-of-date records or delayed updates can lead to poor time-critical decisions.

26data integrity

How trustworthy data is. Test it against six characteristics, one at a time: accuracy, authenticity, correctness, reasonableness, relevance and timeliness. Failing any one means it can't be trusted.

27loss of reputation

When an organisation's data is wrong or tampered with, customers and partners lose trust in it, often after public errors and media coverage, and take their business elsewhere.

28Poor decision-making

Decisions made from inaccurate or untimely data are likely to be wrong, causing wrong forecasts, misleading analysis and false conclusions.

29financial loss

Money lost when corrupted or incorrect data causes errors, rework, refunds and lost sales, such as wrong payments and the cost of fixing the data.

30Legal issues from diminished data integrity

Keeping or acting on inaccurate data can breach laws like privacy obligations, leading to fines, penalties or legal claims by affected people.

31impacted operations

Poor data integrity disrupts daily business, causing delayed orders, systems taken offline to fix data errors, and staff time wasted checking and correcting records.

32Confidentiality

Only authorised people or systems can read data. Everyone else is kept out, like student marks seen only by the student and teacher. A breach is when someone else sees them.

33integrity criterion

Judging a security strategy by whether it stops unauthorised people changing or corrupting data, using tamper detection, hashes and checksums, and limits on who can edit.

34Availability

Authorised users can reach data and systems when they need them, such as a school network that stays up. Attacks and hardware failure can reduce it.

35Evaluate against CIA

Judge how well a security strategy protects confidentiality, integrity and availability, using evidence to rate each one and weigh up trade-offs between them.

36evaluation criteria

Measurable standards, such as incidents per year or recovery time, used to judge how well a security strategy meets its goals and protects confidentiality, integrity and availability.

37security control

A measure that reduces risk by preventing an attack, detecting it or helping recovery. Controls can be technical, physical or procedural, and layering several works best.

38Authentication vs authorisation

Authentication checks who you are, like logging in. Authorisation decides what you can do once you are known, like which files you can open. Authentication always comes first.

39authentication factor

A type of proof that you are who you say you are: something you know (password, PIN), something you have (phone, key), or something you are (fingerprint, face).

40Weak password

A password that is short, common, or predictable, making it easy for attackers to guess or crack.

41Multi-factor authentication

A login method that requires two or more independent proofs of identity, such as a password plus a one-time code.

42MFA methods

Ways to prove it's you: an SMS code, an authenticator app, a biometric like a fingerprint, or a physical security key. They differ in how easy they are to use and how strong they are.

43biometric authentication

Proves who you are using a physical or behavioural trait, such as a fingerprint, face or voice, that is matched against stored data. It can wrongly accept or reject users.

44Adaptive authentication

Login checks that change with risk signals like location, device or time. A known device gets an easy login; an unusual location triggers extra proof.

45MFA fatigue

A trick where a scammer spams you with login prompts hoping you approve one, or talks you into sharing your code. Never share codes, never approve prompts you didn't start, and report them.

46permission

A rule that lets an account read, write or execute a file or resource. Read only views it, write can change or delete it, and execute runs it as a program.

47principle of least privilege

Give every user, program and device only the minimum access it needs to do its job. This limits the damage if an account is stolen, and unneeded access should be removed.

48Role-based access control (RBAC)

A way to manage access by giving permissions to roles, like student, teacher or admin, then assigning each user a role. Changing a user's role changes what they can access.

49access control list (ACL)

A table attached to a resource, like a file or router, that lists which users or groups may access it and what they can do. If you are not listed, access is denied.

50Firewall

A device or program that monitors and controls incoming and outgoing network traffic according to defined security rules.

51Antivirus software

A program that detects, blocks and removes malicious programs from a device.

52Malware definition update

Refreshing the database used by security software so it can recognise and detect newly discovered threats.

53Operating system update

Installing the latest patches for the OS, fixing known security vulnerabilities and bugs.

54Staff procedure

A documented rule employees must follow, such as reporting incidents or locking devices, to reduce cyber security risk.

55physical security controls

Barriers such as locks, swipe cards, CCTV and secure server rooms that stop unauthorised people reaching hardware and stored data.

56ISM segmentation guideline

A rule that tells organisations to divide their network into separate zones and limit access between them, so a breach stays contained.

57access log

An automatic record of who accessed a system or file, what they did and when. It helps spot failed logins and misuse, and holds users accountable for their actions.

58Data loss prevention (DLP)

Controls that detect and block sensitive data leaving an organisation, such as by email, USB or upload, and alert staff to risky transfers like large exports.

59security measures

Controls such as passwords, access control, encryption and backups that protect personal information in a dataset from misuse, loss or unauthorised access.

60Encryption

Turning a readable message into a scrambled, unreadable message using a key, so it can only be read again with decryption.

61data at rest

Data stored on a device, server or backup, not moving. Protect it with encryption (disk or database) and access control, so a stolen laptop or backup is unreadable.

62data in transit

Data moving across a network, such as email or web traffic. It is protected by encrypting it (e.g. HTTPS or a VPN) so intercepted data cannot be read.

63HTTPS

A secure way for your browser to talk to a website. It encrypts the data you send and receive, and shows https:// and a padlock in the address bar. A padlock does not prove a site is trustworthy.

64Caesar cipher

A cipher that encrypts a message by shifting each letter forward by a fixed number, and decrypts it by shifting each letter back by the same number.

65Polyalphabetic cipher

A cipher that uses a repeating list of shift numbers, so different letters in a message are shifted by different amounts.

66Vigenere cipher

A cipher that uses a keyword, where each keyword letter sets a different shift for the matching letter of the message.

67Symmetric encryption

Using the exact same secret key to both lock and unlock a message.

68AES

A widely used method of symmetric encryption that uses one shared key, which can be 128, 192, or 256 bits long, to lock and unlock data.

69Asymmetric encryption

Encryption that uses a linked pair of keys: a public key to encrypt data and a private key to decrypt it, with no shared secret key needed.

70RSA

A way of locking and unlocking messages using two matching keys: a public key anyone can have, and a private key kept secret by its owner.

71ECDH

A method where two people each combine their own secret with the other's shared piece, ending up with the same matching result without sending the secret.

72ECDSA

A digital signature algorithm that uses a private key to sign a message and the matching public key to verify it.

73symmetric vs asymmetric

Symmetric: one shared secret key, fast but hard to share safely. Asymmetric: public and private key pair, no secret to share but slower. Often combined.

74hash function

A one-way function that turns any input into a fixed-length value. The same input always gives the same hash, a tiny change gives a very different one, and it cannot be reversed.

75hash comparison

Hash the file before and after transfer. If both hashes (checksums) match, the data is unchanged. A different hash shows the file was altered or tampered with, so its integrity is lost.

76hash

A one-way scrambled value made from a password. A system stores it instead of the real password and checks a login by hashing what you type and comparing. It can't be reversed.

77salt

A random value added to a password before hashing, so identical passwords give different hashes. Each user gets their own salt, which defeats precomputed hash tables.

78Match technique to job

Choose symmetric encryption for stored data, asymmetric keys to swap keys and sign, and hashing to check integrity and store passwords. Justify the choice.

79disaster recovery plan

A plan made in advance that sets out who does what to protect people and restore data and systems after a disruption, so downtime is limited.

80evacuation procedure

A set of steps that gets people safely out of a site to an assembly point during an emergency like a fire. People come first, before any equipment or data recovery begins.

81Backup strategy

A plan for how and when backups are taken and stored, such as scheduling regular backups and keeping copies in multiple locations.

82full backup

A backup that copies all selected files every time it runs. Restoring is simple, but it uses lots of storage and takes longer than other backup types.

83incremental backup

A backup that copies only files changed since the last backup of any type. It is small and fast, but a restore needs the full backup plus every increment.

84differential backup

Copies all files changed since the last full backup. It grows each day, and a restore needs the full backup plus only the latest differential.

85full vs incremental vs differential

They differ in size, time and restore steps: full copies all data, incremental saves changes since the last backup, differential saves changes since the last full backup.

86Backup system

A system that creates and retains separate copies of data so it can be recovered if the original is lost.

873-2-1 rule

Keep 3 copies of data on 2 different types of media, with 1 copy stored offsite (such as cloud storage), so one disaster cannot destroy both the data and its backups.

88restoration

The ordered process of bringing systems and data back into use from backups after a disruption, restoring critical systems first and then checking the restored data is correct and complete.

89communication plan

Part of a disaster recovery plan stating who tells staff, customers, regulators and media what happened, and how, using contact lists, a spokesperson and timely updates.

90Testing a recovery plan

Running drills and test restores to check a disaster recovery plan really works, then fixing any gaps found and updating the plan.

91Evaluating a disaster recovery plan

Checking a plan covers evacuation, backup, restoration, communication and testing, then judging each against the organisation's needs to find gaps, risks and improvements.

92personal data

Information that identifies you or can be linked to you, such as your name, birthday, address, photos or school. A favourite colour on its own is not personal data.

93sensitive information

A special kind of personal information, like health, ethnic origin, religion or biometric data, that the Privacy Act protects more strictly because misuse can cause serious harm.

94Privacy Act 1988

Commonwealth legislation that sets rules for how organisations must collect, use, and store people's personal information.

95Australian Privacy Principles (APPs)

13 legal principles in the Privacy Act 1988 that set rules for how organisations collect, use, store, give access to and correct personal information. Use them as a checklist.

96Australian Privacy Principle 1

Requires organisations to be open and transparent about managing personal information, with a clear, available, up-to-date policy.

97APP 3

Australian Privacy Principle 3: only collect personal information that is reasonably necessary for your functions, and collect it lawfully and fairly. Take extra care with sensitive information.

98APP 4 unsolicited personal information

APP 4: if an organisation gets personal information it did not ask for, it must decide if it could have collected it. If not, it must destroy or de-identify it.

99APP 5 notification

APP 5 says an organisation must tell people, at or before it collects their info, who is collecting it, why it is needed, and who it may be shared with.

100Australian Privacy Principle 6

Requires organisations to only use or disclose personal information for the purpose it was originally collected for, unless consent or an exception applies.

101APP 7 direct marketing

APP 7 stops an organisation using or disclosing personal information for direct marketing unless conditions are met, such as the person's consent or an easy way to opt out.

102Australian Privacy Principle 11

Requires organisations to protect personal information from misuse, loss, and unauthorised access, and to destroy it when no longer needed.

103APP critique

Check a system against one APP at a time: say what it does, judge if it meets that principle using evidence from the policy or audit, then suggest an improvement.

104Privacy and Data Protection Act 2014

Victorian legislation that sets rules for how the Victorian public sector must collect and securely protect personal information.

105IPP 1

Information Privacy Principle 1 (Vic): only collect personal information that is necessary for your functions, collect it lawfully and fairly, and tell people why you are collecting it.

106Information Privacy Principle 2

Requires personal information to be used or shared only for the purpose it was originally collected for, unless consent or an exception applies.

107Information Privacy Principle 4

Requires organisations to take reasonable steps to protect personal information from misuse, loss, unauthorised access, and unwanted modification.

108Information Privacy Principle 5

Requires organisations to be open and transparent about managing personal information, with a clear, available, up-to-date policy.

109IPP 10: sensitive information

Victorian privacy principle: sensitive information (health, ethnic origin, beliefs) can only be collected with the person's consent or when the law allows it.

110Health Records Act 2001

Victorian legislation that sets rules for how health information must be collected and kept secure by public and private providers.

111HPP 1

Health Privacy Principle 1: collect health information only if necessary for the service, by lawful and fair means, and tell the person why it is collected.

112Health Privacy Principle 2

Requires health information to be used or disclosed only for the purpose it was originally collected for, unless consent or an exception applies.

113HPP 4

Health Privacy Principle 4: protect health information from misuse, loss and unauthorised access, and securely destroy or de-identify it when it is no longer needed.

114Health Privacy Principle 5

Requires organisations to be open and transparent about managing health information, with a clear, available, up-to-date policy.

115Which privacy law applies

The Privacy Act covers federal agencies and large private firms, the PDP Act covers Victorian public bodies, and the Health Records Act covers health information. Work out which apply.

116data breach

When attackers get into an organisation's stored data, such as usernames and passwords. Find out through alerts, then change your password and turn on MFA.

117Privacy Amendment (Notifiable Data Breaches) Act 2017

Amends the Privacy Act so covered organisations must tell the OAIC and affected people after an eligible data breach, so people can protect themselves.

118eligible data breach

Unauthorised access to, disclosure or loss of personal information that is likely to result in serious harm to the individuals it concerns (ss 26WE, 26WF).

119s 26WH assessment

If an entity suspects an eligible data breach, it must quickly and reasonably assess within 30 days whether serious harm is likely and whether a breach has occurred.

120Statement to the Commissioner

After an eligible data breach, the organisation must prepare a statement of required details and give it to the Australian Information Commissioner as soon as practicable.

121s 26WL

Organisation must tell individuals at risk of serious harm about an eligible data breach, what information was involved and what steps to take, directly or by publishing a notice.

122NDB scheme steps

Check if a breach is eligible (serious harm likely), then notify the OAIC and affected people as soon as practicable. Failing to notify risks penalties under the Privacy Act.

123privacy-enhancing practices

Newer practices like data minimisation, anonymisation and encryption by default that reduce the personal data an organisation holds and exposes, lowering privacy risk.

124Emerging trend

A new threat, technology or practice reshaping cyber security, meaning current controls may need to be updated to stay effective.

125Machine learning

AI learns patterns from large amounts of training data, then uses those patterns to make predictions or generate content.

126AI-based network security software

Software that learns an organisation's normal network behaviour and flags deviations from it.

127Machine learning traffic analysis

Using a trained model to classify network traffic as normal or anomalous, based on learned patterns rather than fixed rules.

128Real-time monitoring

Continuously checking network activity as it happens and immediately alerting the right people when a threat is detected.

129Intrusion detection system (IDS)

A system that monitors network traffic for suspicious activity and raises an alert when it finds it.

130Intrusion prevention system (IPS)

A system that sits inline in the traffic path, detects threats, and automatically blocks them before they reach the network.

131incident response

Set stages for handling a security incident: detect it, contain it, remove the cause, recover systems, then review what happened to improve future security.

132Respond to a compromise

If an account or device may be hacked, act fast: tell a trusted adult, change the password, turn on MFA and check for odd activity. Also report phishing, change shared passwords and scan for malware.

133Zero Trust Architecture

A security model that trusts no user or device by default and verifies every request, even from inside the network.

134User behaviour analytics

Records how each user normally acts, such as login times, locations and files accessed, to build a per-user baseline. Activity that departs from it can be flagged.

135anomaly detection

Flagging user behaviour that departs from their normal baseline, such as a midnight overseas login or huge download, and giving it a risk score to spot compromised accounts or insider threats.

136Behaviour monitoring limits

Monitoring user behaviour protects data but can intrude on employee privacy and raise false positives, so staff should be told about it and people must review alerts.

137AI-powered attack

An attack where criminals use AI to work faster and fool people more easily, such as realistic phishing emails, deepfake voices and automated scanning for weaknesses.

138Ethical data collection

Collecting only the data needed for security and using it as people expect. Over-collection or hidden monitoring of staff or customers, without clear consent, is an ethical issue.

139Misuse of personal data

Using or sharing personal data in ways the person did not agree to or that harm them, such as selling it, identity theft, or using it for a different purpose.

140identity theft

Using someone's stolen personal information, such as from a data breach, to pose as them and commit fraud. Organisations have an ethical duty to protect people and warn them.

141Lack of transparency

When people are not told what data is collected, how it is used or how a conclusion was reached, such as hidden data collection, unexplained AI decisions or unclear privacy policies.

143anonymise

To remove or replace names and other identifying details in data, like using ID numbers, so people cannot be recognised.

144Data repurposing

When an AI system reuses or shares data collected for one purpose, such as training, without the knowledge or consent of the people it came from. Removing it from a trained model is hard.

145AI Ethics Principles

A voluntary Australian framework of guidelines intended to help ensure AI systems are designed and used safely, fairly, and responsibly

146Ethical issue analysis

Name the issue, identify the stakeholders affected and the harm done, link it to an APP, then recommend an action to fix it.

147Breach impact analysis

Describing the cause of a breach, which data and people were affected, and the impact on operations, finances, reputation and legal standing.

148describe a security strategy

State what the strategy is, name the threat it addresses, and say whether it prevents, detects or responds. Strategies can be technical, physical or procedural.

149legal and ethical consequences

Penalties under privacy law and ethical criticism faced when weak security exposes data, such as breaching privacy law or failing to notify. Link each to evidence in the case.

150Security recommendation

A specific improvement that is tied to a weakness found in the strategy and justified using the CIA criteria, legal obligations and its cost and practicality.