Evaluating the security impacts of a data exchange

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A school app collects student emails for sign-up but later uses them to send ads. Which aspect of a security-impact evaluation does this mainly raise?

A Use of data

B Accuracy of data

2. An app sends users' location history to an advertising company without asking them. Which aspect is being judged?

A Dissemination to other parties

B Storage and protection

3. A student record database keeps passwords as plain text on an unencrypted server. Which aspect does this evidence belong to?

A Ownership of data

B Storage and protection

4. A data exchange keeps a student's old address after they have moved, so mail goes to the wrong house. Which aspect is this?

A Dissemination to other parties

B Accuracy of data

5. A fitness app's terms say the company owns all health data users upload and can keep it after accounts are deleted. Which aspect is this?

A Ownership of data

B Use of data

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Use of data		AEvidence: the API uses HTTPS and the database file is encrypted
2Dissemination of data		BChecks which other parties receive the data, such as third-party APIs, partners or advertisers
3Storage and protection: evidence is that data is encrypted at rest and in transit		CIgnores that the data owner keeps control and rights over their data, so the data cannot be passed on without permission.
4Recommending a fix: name a specific change that removes the weakness found		DChecks what the exchange does with the data and whether that purpose matches what the user agreed to
5Evaluation: 'The exchange is secure because it is fast.'		EGives no evidence for any of the five aspects. Speed says nothing about use, dissemination, storage, accuracy or ownership.
6Ownership: 'We collected the data, so we can sell it to anyone.'		FFix: move the API key into an environment variable, not the code

Definitions

Security-impact evaluation

Fill in the Blanks

Complete each line of code by filling in the missing parts.

five = ["use", "_____________", "storage"]

findings["________"] = "no checks on input"

findings["_________"] = "user cannot delete"

five = ["use", "dissemination", "storage"] for aspect in ____: print(aspect)

if "storage" __ findings: fix = "encrypt data at rest"

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A ev = {}

B ev["use"] == "Marks only"

C ev["store"] = "Plain text"

Question 2

A aspects = ["use", "storage"]

B for a in aspects

C print("Evaluate:", a)

Question 3

A risk = "high"

B if risk == "high":

C print("Keep it plain")

Question 4

A shared = ["school", "vendor"]

B for party in shared:

C print("Sent to " + shared)

Question 5

A owner = "student"

B holder = "school"

C if owner != holder:

D print("Ownership clear")

Answer Key

Evaluating the security impacts of a data exchange

Section A: Quick Questions

A — Use of data

A — Dissemination to other parties

B — Storage and protection

B — Accuracy of data

A — Ownership of data

Section B: Match the Pairs

Use of data → Checks what the exchange does with the data and whether that purpose matches what the user agreed to

Dissemination of data → Checks which other parties receive the data, such as third-party APIs, partners or advertisers

Storage and protection: evidence is that data is encrypted at rest and in transit → Evidence: the API uses HTTPS and the database file is encrypted

Recommending a fix: name a specific change that removes the weakness found → Fix: move the API key into an environment variable, not the code

Evaluation: 'The exchange is secure because it is fast.' → Gives no evidence for any of the five aspects. Speed says nothing about use, dissemination, storage, accuracy or ownership.

Ownership: 'We collected the data, so we can sell it to anyone.' → Ignores that the data owner keeps control and rights over their data, so the data cannot be passed on without permission.

Section C: Definitions

Security-impact evaluation — Judging a data exchange on five aspects: use, dissemination, storage, accuracy and ownership of data, with evidence for each, then recommending a fix.

Section D: Fill in the Blanks

five = ["use", "dissemination", "storage"]

findings["accuracy"] = "no checks on input"

findings["ownership"] = "user cannot delete"

five = ["use", "dissemination", "storage"]
for aspect in five:
    print(aspect)

if "storage" in findings:
    fix = "encrypt data at rest"

Section E: Spot the Error

B — == compares values, it does not store evidence for the 'use' aspect. Saving evidence in the dictionary needs the assignment operator =.

B — A for loop header must end with a colon. It should be: for a in aspects:

C — A high storage risk needs a fix that protects the data. The recommendation should be to encrypt it, not leave it as plain text.

C — shared is a list, and a list cannot be joined to a string with +. Dissemination should name each party in the loop, so use party.

D — The condition owner != holder is True when the owner and the holder are different people, so ownership is unclear. The message should be Ownership unclear.