Impacts of computing

Class 12 Computer Science, unit 6, book pages 159–182

This unit is about using computers and online platforms safely and fairly. It explains security protocols and why they are needed, the risks of sharing private information and how to prevent identity theft, the main cyber-attacks (DDoS, ransomware, spyware, viruses, phishing), security methods such as 2FA and biometric verification, and safe data transmission through cryptography and protocols like TLS, SSH and HTTPS. It ends with troubleshooting and identifying threats, computational perspectives, collaboration in design, resources for equal access to information and common collaborative tools.

Learning outcomes (3)

Identify and apply safe practices when collaborating on digital or online platforms.
Discuss security threats and mitigation such as 2FA, biometric verification, and secure techniques for transmitting data.
Collaborate on strategies to provide equity and equal access to information.

Introduction: working safely online

Today students, teachers and office staff work together on online platforms such as Google Drive, Microsoft Teams and Zoom. These platforms are useful, but every shared file, message and meeting link can also be misused. This unit teaches how to keep information safe (security protocols, 2FA, biometrics, cryptography), how attackers work, how to find and fix security problems, and how to make information available to everyone equally.

Safe practices when collaborating on digital platforms

Strong, unique passwords for every account, kept in a password manager.
Turn on 2FA / MFA so a stolen password alone cannot open the account.
Share with the right people only: give view or comment rights when edit rights are not needed, and remove access when a project ends.
Check links and senders before clicking; report suspicious (phishing) messages.
Use secure connections (HTTPS websites, a VPN on public Wi-Fi) and keep software updated.
Do not post private details (CNIC number, address, bank card) in group chats or shared documents.
Keep backups of important shared work, and lock meetings with a passcode or waiting room.

6.1Security protocolsOften examined

A protocol is a set of agreed rules. A security protocol is a set of rules and procedures that protects data and communication from unauthorized access, tampering (changing) and interception (spying while data travels).

Security protocol: A set of rules and procedures used to protect data and communication on networks, so that data stays private, unchanged and reaches only authorized users. Examples: HTTPS, SSL/TLS, SSH, IPsec.

According to the book, security protocols do the following jobs:

ensure confidentiality through encryption;
maintain data integrity (data is not changed);
verify user identity through authentication methods;
control access and secure data transmission;
ensure compliance with laws and regulations;
protect against malware, support backup and recovery, reduce risks and build trust.

6.1.1Need of security protocolsOften examined

Security protocols are needed because data is valuable and is attacked in three ways: someone may read it (unauthorized access), change it (tampering) or catch it in transit (interception). Fig. 6.2 of the book lists seven reasons.

Seven needs of security protocols (book Fig. 6.2)
Need	What it means	How protocols achieve it
Confidentiality	Only authorized people can read the data.	Encryption turns data into a form readable only with the decryption key.
Data integrity	Data stays accurate, consistent and unaltered in storage, transmission and processing.	Encryption, hashing and digital signatures detect or prevent unauthorized changes and fraud.
Authentication	Verifying the identity of a user or device.	Usernames and passwords, multi-factor authentication, digital certificates.
Access control	Deciding who can access, change or send data.	Permissions, roles and access control lists allow only authorized users.
Secure transmission	Data travelling on the internet cannot be understood by spies.	SSL/TLS for websites, VPNs for remote connections.
Protection against malware and cyberattacks	Keeping viruses, spyware and attackers out.	Firewalls and anti-malware tools that rely on protocols.
Data backup and recovery	Lost data can be brought back.	Regular backups and secure storage rules.

Digital certificate: An electronic document, issued by a trusted authority, that proves the ownership of a public key or website, used for authentication.
VPN (Virtual Private Network): A service that creates an encrypted tunnel over the internet so a remote user can connect to a network securely.

6.1.2Information usage and collection

Organizations collect a lot of personal data. The main rules for collecting and using data are: be clear (transparency), get permission (consent) and follow the law. Organizations should explain why they collect data, ask for permission when needed, and protect the data well. Breaking these rules causes legal problems and loss of people's trust.

Collection: The process of gathering information from various sources for analysis and decision-making, using methods like surveys, interviews, sensors or software, in forms such as numbers, text or images.
Usage: What the collected data is used for, for example offering services, improving products, customizing content and doing analytics.

Examples of data usage

Understanding customer preferences and improving products or services.
Tracking student performance and improving learning methods.
Monitoring patient health and developing treatments.
Training AI models or improving apps and systems.

6.2Risks of sharing private informationOften examined

Private information includes your name, CNIC number, address, phone number, passwords, bank or credit card details and photos. Sharing it carelessly makes identity theft more likely.

Identity theft: A crime in which someone uses your personal details, like your name or credit card information, without permission to commit fraud. It can cause loss of money and harm to your reputation.

Thieves usually get personal information through these ways:

How identity thieves obtain personal information
Way	How the information is stolen	Example
Phishing	Fraudulent emails, texts or messages appear to come from trusted organizations and ask for passwords or financial details.	An SMS saying your bank account is blocked, with a link to a fake bank page.
Data breaches	An organization or website is attacked and loses its customers' data; your data is at risk too.	Leaked customer database of an online shop.
Lost or stolen items	Wallets, laptops, phones or documents containing personal information are lost or stolen.	A stolen phone with saved passwords and photos of your CNIC.
Online scams	Fake websites or advertisements fool people into giving information or paying money to the wrong place.	A fake prize or job advert asking for a registration fee and CNIC copy.

6.3Best practices to prevent identity theftOften examined

Most identity theft can be stopped by careful habits. The book lists these best practices:

Be careful about sharing personal information, especially when asked through email, phone or social media.
Use strong, unique passwords for each online account, and a password manager to keep track of them.
Enable multi-factor authentication (MFA) for extra security.
Check financial statements and credit reports regularly for unusual activity.
Protect physical items with sensitive information, like IDs, passports and credit cards.
Learn about common scams and be cautious with unfamiliar people or organizations.

6.4, 6.4.1Cyber-attacks and their typesOften examined

A cyber-attack is a deliberate attempt to damage, disrupt or gain unauthorized access to computers, networks or data. Cyber-attacks put both people and organizations at risk by targeting their security (systems stop working, data is changed) and their privacy (personal data is stolen). Staying informed and using strong cybersecurity measures helps protect against them.

Types of cyber-attacks

DDoS (Distributed Denial of Service) attack: Many infected computers (a botnet) work together to flood a website or system with too much traffic. The target is overloaded and becomes slow or completely unavailable to regular users.
Ransomware: Malicious software that locks or encrypts your files so you cannot access them; the attackers then demand money (a ransom) to unlock or decrypt them.
Spyware: Harmful software that secretly collects information about someone without their knowledge. It can record what you type, take screenshots or watch your online activities and send the data to a remote attacker.
Virus: A program that copies itself and infects a computer's files or software. It spreads to other systems when infected files are shared and can corrupt data or crash the system.
Phishing: An attack that deceives people into giving away sensitive details like passwords or credit card numbers by pretending to be a reliable source, usually through fake emails, websites or messages.
Malware (malicious software): The general name for harmful software such as viruses, spyware, Trojans, worms, ransomware and adware, which can damage computer systems or steal information.

DDoS attack: many infected computers flood one target

Comparison of cyber-attacks
Attack	How it works	Main harm	Main defence
DDoS	Botnet floods the target with traffic	Service becomes slow or unavailable (availability lost)	Firewalls, traffic filtering, extra server capacity
Ransomware	Encrypts or locks files, then demands a ransom	Data becomes unusable; money is lost	Regular offline backups, updates, not opening unknown attachments
Spyware	Hides and secretly records activity and keystrokes	Privacy lost; passwords stolen	Anti-malware scans, installing apps only from trusted sources
Virus	Attaches to files and copies itself when files are shared	Corrupted data, system crashes	Antivirus software, scanning shared files
Phishing	Fake email, website or message tricks the user	User gives away passwords or card numbers	User awareness, email filters, checking links, 2FA
Malware (general)	Any harmful software (virus, worm, Trojan, spyware, ransomware, adware)	Damage to systems or theft of information	Anti-malware tools, firewalls, updates

6.5Security methods: 2FA and biometric verificationOften examined

A password alone is weak: it can be guessed, stolen by phishing or leaked in a data breach. Security methods such as two-factor authentication (2FA) and biometric verification improve security by requiring more than one form of identity. If one factor is breached, the other still protects the account.

Two-factor authentication (2FA)

Two-factor authentication (2FA): A security method that requires two separate forms of identification, from two different categories, to access a system, account or app.

The factors come from three categories:

Something you know: a password or PIN.
Something you have: a smartphone (one-time code, OTP), a security token or a smart card.
Something you are: a fingerprint or facial recognition (biometrics).

The three authentication factors

This approach ensures that if one factor (for example a password) is compromised, the attacker still needs the second factor to gain access. Multi-factor authentication (MFA) is the general name when two or more factors are used.

Biometric verification

Biometric verification: A method that confirms a person's identity using unique physical or behavioral traits, such as fingerprints, facial features, iris patterns, voice, or typing and walking patterns.

Process

Enrolment: the person's trait (for example a fingerprint) is scanned once and stored as a template.
Sample: to access a system or device, the user provides a biometric sample, such as a fingerprint or face scan.
Matching: the system compares the sample with the stored data.
Decision: if they match, access is granted; otherwise it is refused.

Biometric verification
Advantages	Disadvantages / privacy concerns
Convenient: no password or PIN to remember	Biometric data is very sensitive; if stolen it cannot be changed like a password
Hard to fake, copy or share	Privacy concerns about how and where the data is stored and used
Fast (touch or look)	Special hardware is needed; injuries, dirt or poor light can cause false rejection

2FA compared with biometric verification
Feature	2FA	Biometric verification
Idea	Two different factors must both be correct	Identity checked from a body or behaviour trait
Example	Password + OTP code on phone	Fingerprint, face, iris, voice
Weakness	Phone may be lost; OTP may be phished	Privacy concerns; traits cannot be changed if leaked

6.6, 6.6.1, 6.6.2Safe transmission of data and cryptographyOften examined

Safe data transmission means securing information while it moves between locations (for example from your phone to a bank server). The main tool is cryptography: readable data is converted into an unreadable form that only authorized users can decode, so data stays private and unchanged. Common methods are symmetric and asymmetric encryption and protocols like SSL/TLS.

Cryptography: The practice of securing communication and data by transforming it into a form that only authorized parties can read.
Plaintext: The original, readable message.
Ciphertext: The encrypted, unreadable message.
Encryption: Converting plaintext to ciphertext.
Decryption: Converting ciphertext back to plaintext.
Key: A secret parameter (value) used by the cipher for encryption and decryption.

Types of cryptography

Symmetric cryptography uses the same key to encrypt and decrypt data. It is fast and efficient, ideal for large volumes of data, but the key must be shared securely, because anyone who has it can read the data.

Asymmetric cryptography (public-key cryptography) uses two keys: a public key for encryption and a private key for decryption. The public key can be given to anyone; only the owner keeps the private key. This allows secure communication without sharing a secret key. It is slower than symmetric cryptography but gives easy key distribution and digital signatures for authentication.

Symmetric (same key) and asymmetric (key pair) cryptography

Symmetric versus asymmetric cryptography
Point	Symmetric	Asymmetric
Keys	One shared secret key	Pair: public key and private key
Encryption / decryption	Same key for both	Public key encrypts, private key decrypts
Speed	Fast and efficient	Slower (heavier mathematics)
Best use	Large data volumes, file and disk encryption	Key exchange, digital signatures, secure e-mail
Main problem	Key must be shared securely	Slower; needs key management (certificates)
Examples	AES, DES	RSA, ECC

6.6.3Popular cipher methodsOften examined

A cipher is a method (algorithm) for encryption and decryption. The book describes four classical ciphers.

Caesar cipher

The Caesar cipher is a simple, very old encryption method in which each letter is shifted by a fixed number of positions in the alphabet. With a shift of 3, A becomes D, B becomes E, and so on; X, Y, Z wrap round to A, B, C. It is a basic substitution cipher.

Caesar cipher with shift 3

Caesar cipher by hand

Encrypt HELLO WORLD with a Caesar shift of 3.

Write each letter's position (A = 0, ..., Z = 25) and add the key 3, taking the remainder after dividing by 26 so that the count wraps round.
$C = (P + 3) mod 26$
H(7) $\to$ 10 = K, E(4) $\to$ 7 = H, L(11) $\to$ 14 = O, L $\to$ O, O(14) $\to$ 17 = R.
W(22) $\to$ 25 = Z, O $\to$ R, R(17) $\to$ 20 = U, L $\to$ O, D(3) $\to$ 6 = G. The space is not changed.
Decryption subtracts the key.
$P = (C - 3) mod 26$

HELLO WORLD \to KHOOR ZRUOG

def caesar_encrypt(text, shift):
    result = ""
    for ch in text:
        if ch.isupper():
            result += chr((ord(ch) - 65 + shift) % 26 + 65)
        elif ch.islower():
            result += chr((ord(ch) - 97 + shift) % 26 + 97)
        else:
            result += ch          # spaces and digits stay the same
    return result

def caesar_decrypt(text, shift):
    return caesar_encrypt(text, -shift)

cipher = caesar_encrypt("HELLO WORLD", 3)
print("Ciphertext:", cipher)
print("Plaintext :", caesar_decrypt(cipher, 3))

Caesar cipher in Python

Ciphertext: KHOOR ZRUOG
Plaintext : HELLO WORLD

Output

Substitution cipher

A substitution cipher replaces each letter of the plaintext with a different letter, using a fixed system called a substitution alphabet (the key). The Caesar cipher is one type of substitution cipher, but any mixed alphabet can be used. The book's Fig. 6.29 shows ROT13 (shift 13): HELLO becomes URYYB.

plain_alpha  = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
cipher_alpha = "QWERTYUIOPASDFGHJKLZXCVBNM"   # substitution alphabet (the key)
table = str.maketrans(plain_alpha, cipher_alpha)
print("HELLO".translate(table))

Substitution with a mixed alphabet: HELLO is encrypted with the key alphabet QWERTY...

ITSSG

Output

Transposition cipher

A transposition cipher encrypts by rearranging the positions of the characters according to a fixed pattern, without changing the characters themselves. For example, in a 2-rail (rail fence) transposition, the letters in odd positions are written first and then the letters in even positions.

def rail_fence(text):
    # 2-rail transposition: letters at even positions, then odd positions
    return text[0::2] + text[1::2]

print(rail_fence("HELLOWORLD"))

Rail fence transposition of HELLOWORLD

HLOOLELWRD

Output

Vigenère cipher

The Vigenère cipher uses a keyword to decide how much to shift each letter. Each letter of the message is shifted by the matching letter of the keyword (A = 0, B = 1, ...), and the keyword is repeated as needed. Because different letters get different shifts, it is harder to break than the Caesar cipher.

Vigenère cipher

Encrypt ATTACKATDAWN with the keyword LEMON.

Plaintext	A	T	T	A	C	K	A	T	D	A	W	N
Key letter	L	E	M	O	N	L	E	M	O	N	L	E
Shift	11	4	12	14	13	11	4	12	14	13	11	4
Ciphertext	L	X	F	O	P	V	E	F	R	N	H	R

For example T (19) + M (12) = 31, and $31 mod 26 = 5$ = F.

ATTACKATDAWN \to LXFOPVEFRNHR

def vigenere_encrypt(plain, key):
    result = ""
    k = 0                          # position in the keyword
    for ch in plain:
        if ch.isalpha():
            shift = ord(key[k % len(key)]) - 65
            result += chr((ord(ch) - 65 + shift) % 26 + 65)
            k += 1
        else:
            result += ch
    return result

print(vigenere_encrypt("ATTACK AT DAWN", "LEMON"))

Vigenère cipher in Python

LXFOPV EF RNHR

Output

Comparison of the four classical ciphers
Cipher	Type	How it works	Key	Strength
Caesar	Substitution	Every letter shifted by the same number	A number (1 to 25)	Very weak: only 25 keys to try
Substitution	Substitution	Each letter replaced by a letter from a mixed alphabet	The substitution alphabet	Weak: broken by letter frequency
Transposition	Transposition	Letters kept, positions rearranged	The pattern (for example number of rails)	Weak alone; stronger when combined
Vigenère	Polyalphabetic substitution	Each letter shifted by the matching keyword letter	A keyword	Stronger than Caesar; still breakable

6.7, 6.7.1Types of security protocolsOften examined

Security protocols are rules and procedures that protect data and communication on networks. They keep sensitive information, like passwords, private; verify user identities; and make sure data is not changed during transmission. The important protocols are:

TLS (Transport Layer Security) / SSL (Secure Sockets Layer): Cryptographic protocols that secure internet communication. They provide encryption and authentication so that data between a client and a server stays confidential and unaltered. SSL is the older predecessor; TLS is used today in web browsers, e-mail clients and many online services.
IPsec (Internet Protocol Security): A set of protocols that secures Internet Protocol (IP) communication by authenticating and encrypting each IP packet. It is often used for VPNs, to create secure channels between networks, remote clients and gateways.
SSH (Secure Shell): A protocol for secure remote access to servers and network devices, with strong authentication and encrypted communication; essential for secure system administration (normally port 22).
Secure file transfer protocols: Protocols that protect files during transfer: SFTP (SSH File Transfer Protocol) sends files through an encrypted SSH connection; FTPS (FTP over SSL) adds SSL/TLS encryption to FTP.
HTTPS (Hypertext Transfer Protocol Secure): An extension of HTTP used for secure communication over a computer network. It encrypts data exchanged between a web browser and a website (using TLS), so passwords and payment details are protected from eavesdropping and tampering.

Comparison of security protocols
Protocol	Protects	Main use	Example
SSL/TLS	Any client-server connection	Web browsing, e-mail, online services	Padlock in the browser
IPsec	Every IP packet at the network layer	VPNs, network-to-network links	Office VPN for staff working from home
SSH	Remote command sessions	Secure remote login and server administration	Admin logs in to a web server
SFTP / FTPS	Files in transit	Uploading and downloading files securely	Uploading website files to a host
HTTPS	Web pages and forms	Secure browsing, online banking and shopping	$https://$ bank website

HTTP compared with HTTPS
HTTP	HTTPS
Data sent as plain text	Data encrypted with TLS
Port 80	Port 443
Anyone on the path can read or change data	Protects against eavesdropping and tampering
No proof of website identity	Digital certificate proves the website is genuine

6.8Troubleshooting security problemsOften examined

Troubleshooting security problems means finding and fixing issues to protect systems and applications. It involves understanding the setup, checking logs and running vulnerability tests, and following good practices such as keeping software updated, educating users and planning for incidents. Security is an ongoing process that needs constant assessment and adjustment.

Steps for troubleshooting security problems (book Fig. 6.38)

Identify the issue: clearly define the security problem; gather all information about the symptoms and the systems or applications involved.
Understand the environment: learn how the systems and apps are set up, what they need to work and how they are linked in the network, to find weaknesses attackers may use.
Access control and permissions: check access control lists, user permissions and roles so only authorized users reach sensitive data and functions.
User education: teach users not to click strange emails or websites, to make strong passwords and to report security issues quickly.
Regular backups: back up data and check that it can be restored, which is crucial after attacks like ransomware.
Document and learn: write down what happened and how it was fixed, so similar problems do not happen again.
Regular testing and assessment: continuously test security measures to find and reduce new threats.

6.9, 6.9.1Identifying a cybersecurity threatOften examined

A common cybersecurity threat is a phishing attack: tricking people into giving away passwords or personal data through fake emails, websites or messages.

Warning signs of a phishing message

Urgent or threatening language ('your account will be closed today').
Sender address or link that does not exactly match the real organization (for example $hbl-support.xyz$ ).
Requests for passwords, OTP codes, PINs or card numbers, which genuine organizations never ask for by message.
Unexpected attachments, spelling mistakes and offers that are too good to be true.

Strategies for identifying cybersecurity threats

Strategies for identifying and reducing threats
Strategy	What is done	How it helps
Employee training and awareness	Regularly train staff to spot phishing; be careful with unexpected emails asking for sensitive information or containing suspicious links or attachments	The user becomes the first line of defence
Email filtering and anti-phishing software	Strong filters catch and block phishing emails; software scans emails for threats	Threats are stopped before reaching inboxes
Secure communication protocols	Use HTTPS websites and encrypted email; check that websites and senders are genuine	Data cannot be read in transit; fake sites are noticed
Web content filtering	Web filters block known phishing sites and harmful content	Users cannot open dangerous sites even by mistake
Security updates and patch management	Update all software, operating systems and applications with the latest security patches	Known weaknesses are closed, so attacks are less likely

6.10, 6.10.1Computational perspectives

Computational perspectives involve using computers to solve problems by breaking complex tasks into simple steps. This approach helps us create efficient solutions and innovate. Learning these skills improves problem-solving and critical thinking and prepares students for future careers.

Significance of computational perspectives

Future careers: as technology advances, almost every job uses computing, so these skills keep students competitive in a digital world.
Solving complex problems efficiently: computational thinking (decomposition, patterns, abstraction, algorithms) turns a large problem into manageable steps.
Innovation: new ideas come from seeing how computing can improve a task.
Critical thinking and adaptability: students learn to test ideas, judge results and adapt to new technologies, which the job market values.

6.11, 6.11.1Computing applications and the role of collaboration

Good computing applications are rarely made by one person. When diverse teams work together, they combine their skills, experiences and perspectives, which leads to more innovative and user-friendly software that meets the needs of a wider audience. Collaboration also allows resource sharing and more effective problem-solving, improving the quality of the final product.

Importance of collaboration in enhancing computing application design

Benefit	Explanation
Diverse perspectives	People from different backgrounds bring a wider range of ideas, so designs are more creative and appeal to a broader audience.
Enhanced innovation	People from different fields combine various technologies and methods, giving groundbreaking innovations.
User-centric design	Involving end-users and stakeholders makes the product meet their needs; feedback makes apps more user-friendly and accessible.
Resource sharing	Teams share knowledge, tools and money, so work moves faster and the product is better.
Problem solving	Different ideas and skills make the team's problem-solving stronger.

6.12Resources for equal information accessibilityOften examined

Equal information accessibility (equity of access) means that everyone can get and use information, no matter who they are, where they live, how much money they have or whether they have a disability. The gap between people who have access to digital technology and those who do not is called the digital divide (digital gap). The book suggests these resources:

Resources for equal information accessibility
Resource	What it is	Who it helps
Digital libraries	Online libraries with free access to textbooks and articles for anyone with internet	Students who cannot buy books; reduces the digital gap and encourages lifelong learning
Accessible learning platforms	E-learning platforms with screen readers, captions and alternative content formats	People with disabilities and different learning needs
Community information centers	Centers with computers, internet and learning materials in underserved areas	Rural and poor communities; gives access, skills and social connection
Mobile applications	Easy phone apps for healthcare or job help, respectful of cultures, in many languages	People who own only a phone or read only local languages
Open Educational Resources (OER)	Free resources that anyone can use, change and share	Teachers and learners who adapt content to their needs
Digital literacy programs	Programs that teach wise internet use: finding reliable information, using tools safely, protecting privacy	New internet users, elderly people, communities at risk of scams
Partnerships and collaborations	Government, schools, non-profits and businesses working together on access problems	Everyone who lacks access, whatever their money or other problems

Strategies to provide equity in collaboration

Make sure every participant has the needed device, internet and skills (lend devices, offer offline or low-data options).
Share material in accessible formats (captions, readable fonts, screen-reader friendly documents) and in languages people understand.
Record meetings and use shared documents so people in other time zones or with weak connections can still contribute.

6.13Collaborative toolsOften examined

Collaborative tools are software applications designed to make teamwork and communication easy for people who may be working remotely or in different places. They let team members work on projects together, share information and communicate effectively.

Well-known collaborative tools
Tool	Type	Main features	Typical use
Google Drive	Cloud storage and file sharing	Save documents, spreadsheets and presentations in the cloud; real-time co-editing, seeing changes as they happen	Group assignment written together
Slack	Team messaging	Channels based on topics or projects, direct messages, file sharing, connection with other tools	Daily team communication
Trello	Project management	Boards, lists and cards; move cards as tasks progress; comments, attachments and due dates	Tracking who is doing which task
Microsoft Teams	Collaboration platform	Chat, video meetings, file storage and app integration in one place	Online classes and office teamwork
Zoom	Video conferencing	Virtual meetings, webinars and calls; screen sharing, chat and recording	Remote meetings and lectures

Key terms

Security protocol: A set of rules and procedures that protects data and communication from unauthorized access, tampering and interception.
Confidentiality: Keeping data readable only by authorized people, mainly through encryption.
Data integrity: Information remaining accurate, consistent and unaltered during storage, transmission and processing.
Authentication: Verifying the identity of a user or device, for example with passwords, MFA or digital certificates.
Access control: Mechanisms that decide who can access, change or send data.
Digital certificate: An electronic document used to prove ownership of a public key or website.
VPN (Virtual Private Network): An encrypted tunnel over the internet for secure remote connections.
Data collection: Gathering information from sources such as surveys, interviews, sensors or software for analysis and decision-making.
Identity theft: Use of someone's personal details without permission to commit fraud.
Data breach: An attack in which an organization or website loses its customers' data.
Online scam: A fake website or advertisement that fools people into giving personal information or money.
Cyber-attack: A deliberate attempt to damage, disrupt or gain unauthorized access to systems or data, targeting security and privacy.
DDoS attack: Many infected computers flood a website or system with traffic so it becomes slow or unavailable.
Botnet: A network of infected computers controlled by an attacker, used for example in DDoS attacks.
Ransomware: Malicious software that locks or encrypts files and demands a ransom to unlock them.
Spyware: Harmful software that secretly collects information about a user and sends it to an attacker.
Virus: A program that copies itself, infects files or software and spreads when infected files are shared.
Phishing: Tricking people into giving sensitive details through fake emails, websites or messages that pretend to be from a reliable source.
Malware: Malicious software such as viruses, spyware, Trojans, worms, ransomware and adware.
Two-factor authentication (2FA): Security method requiring two separate forms of identification from different categories (know, have, are).
Multi-factor authentication (MFA): Authentication that uses two or more independent factors.
Biometric verification: Confirming identity with unique physical or behavioral traits such as fingerprints, face, iris or voice.
Cryptography: Securing communication and data by transforming it into a form only authorized parties can read.
Plaintext / ciphertext: The original readable message / the encrypted unreadable message.
Encryption / decryption: Converting plaintext to ciphertext / converting ciphertext back to plaintext.
Key: A secret parameter used for encryption and decryption.
Symmetric cryptography: Encryption using the same key for encryption and decryption; fast and efficient.
Asymmetric cryptography: Public-key encryption using a public key to encrypt and a private key to decrypt.
Caesar cipher: Substitution cipher in which every letter is shifted by a fixed number of positions.
Substitution cipher: Cipher that replaces each letter with another according to a substitution alphabet.
Transposition cipher: Cipher that rearranges the positions of characters without changing them.
Vigenère cipher: Cipher that shifts each letter by the matching letter of a repeated keyword.
TLS / SSL: Cryptographic protocols that encrypt and authenticate internet communication; SSL is the predecessor of TLS.
IPsec: Protocol suite that authenticates and encrypts each IP packet; used for VPNs.
SSH: Secure Shell: protocol for secure remote access to servers and network devices.
SFTP / FTPS: Secure file transfer: FTP through SSH / FTP with SSL/TLS encryption.
HTTPS: HTTP secured with TLS, encrypting data between browser and website.
Troubleshooting security problems: Finding and fixing security issues to protect systems and applications.
Patch management: Regularly updating software with the latest security patches.
Web content filtering: Blocking access to known phishing sites and harmful content.
Computational perspectives: Using computers to solve problems by breaking complex tasks into simple steps.
Digital divide: The gap between people who have access to digital technology and information and those who do not.
Digital library: Online repository offering free access to educational materials.
Accessible learning platform: E-learning platform designed for people with disabilities, with screen readers and captions.
Community information center: A center with computers, internet and learning materials for underserved communities.
Open Educational Resources (OER): Free educational materials that anyone can use, change and share.
Digital literacy: The skill of using the internet and digital tools wisely, safely and critically.
Collaborative tools: Software that helps people work and communicate together remotely, such as Google Drive, Slack, Trello, Microsoft Teams and Zoom.

Multiple choice questionsp. 179–180

12026 Annual I, Set D, MCQ 10

What is the primary purpose of security protocols?

ATo speed up data transmission
BTo protect data and prevent unauthorized accessAnswer
CTo lower the cost of data transmission
DTo improve the appearance of web pages

Why

Security protocols are rules and procedures that protect data from unauthorized access, tampering and interception. Speed, cost and appearance are not their purpose; encryption can even make transmission slightly slower.

What technique is used by security protocols to maintain confidentiality?

AAuthentication
BEncryptionAnswer
CData backup
DData recovery

Why

Encryption changes data into a form that only authorized parties with the decryption key can read, which keeps it confidential. Authentication checks identity; backup and recovery bring back lost data.

Which method ensures data integrity during transmission?

AEncryption
BHashing and digital signaturesAnswer
CPhishing
DFile sharing

Why

A hash is a short fingerprint of the data; if even one bit changes on the way, the hash no longer matches. A digital signature (an encrypted hash) also proves who sent the data. Together they detect any change, which is exactly what integrity means.

Encryption mainly gives confidentiality, so it is a tempting but weaker choice. Phishing is an attack.

Which of the following verifies user or device identity?

AAccess control
BEncryption
CAuthenticationAnswer
DData recovery

Why

Authentication verifies the identity of a user or device, for example with a password, multi-factor authentication or a digital certificate. Access control comes after it and decides what the verified user may do.

What do security protocols use to control who can access or modify data?

AAuthentication
BAccess controlAnswer
CMalware protection
DCryptography

Why

Access control mechanisms (permissions, roles, access control lists) decide who can access, change or send data.

What type of software protects against malware and viruses?

ADigital signatures
BFirewalls and anti-malware toolsAnswer
CAccess control mechanisms
DSSL/TLS

Why

The book names firewalls and anti-malware tools as security measures that protect against malware, viruses and cyberattacks. SSL/TLS protects data in transit, not the computer from malware.

Which of the following is an example of a type of cyberattack mentioned in the text?

AAuthentication
BRansomwareAnswer
CAccess Control
DHardware failure

Why

Ransomware locks or encrypts files and demands a ransom; it is one of the cyber-attacks in section 6.4.1. Authentication and access control are defences, and hardware failure is an accident, not an attack.

What does Two-Factor Authentication (2FA) typically combine?

AA password and encryption
BA password and a secondary form of IDAnswer
CAn IP address and encryption
DA virus scan and a firewall

Why

2FA combines two different factors, usually a password (something you know) with a second form of identification such as an OTP on a phone (something you have) or a fingerprint (something you are).

What is an example of asymmetric cryptography?

ASharing a common key for encryption
BUsing public and private keysAnswer
CUsing the same key for encryption and decryption
DChanging data transmission speed

Why

Asymmetric (public-key) cryptography uses a key pair: a public key to encrypt and a private key to decrypt. Options A and C describe symmetric cryptography.

Which security protocol is commonly used to secure internet communication?

ATLS/SSLAnswer
BFTP
CUDP
DHTTP

Why

TLS and its predecessor SSL encrypt and authenticate data between a client and a server. FTP and HTTP send data as plain text, and UDP is a transport protocol with no security.

Which cipher shifts each letter by a fixed number in the alphabet?

AVigenère cipher
BTransposition cipher
CCaesar cipherAnswer
DSubstitution cipher

Why

The Caesar cipher shifts every letter by the same fixed number, for example 3 (A to D). Vigenère uses a different shift for each letter from a keyword, and transposition only rearranges letters.

Which security protocol is used for secure remote access?

AIpsec
BSSHAnswer
CHTTP
DFTP

Why

SSH (Secure Shell) gives secure remote access to servers and network devices with strong authentication and encryption. IPsec is also used for VPNs, but the book names SSH as the protocol for secure remote access and administration.

What is phishing?

AA type of encryption method
BAn attack where fake emails trick users into giving sensitive informationAnswer
CA method to secure data transmission
DA secure file transfer protocol

Why

Phishing deceives people into giving away passwords or card numbers by pretending to be a trusted source, usually through fake emails, websites or messages.

Which best practice can help prevent identity theft?

ASharing passwords with trusted individuals
BUsing strong, unique passwordsAnswer
CStoring all sensitive information in the cloud
DIgnoring financial statements

Why

Strong, unique passwords for every account (kept in a password manager) are a best practice from section 6.3. Sharing passwords and ignoring statements increase the risk.

What does cryptography protect?

APhysical hardware
BData and communicationAnswer
CMarketing strategies
DSystem updates

Why

Cryptography secures communication and data by transforming them into a form that only authorized parties can read.

Which of the following is an example of a security method used to enhance user authentication?

ADDoS attack
BSpyware
CBiometric verificationAnswer
DPhishing

Why

Biometric verification confirms identity using fingerprints, face or iris, so it strengthens authentication. The other three options are attacks.

Which of the following tools is commonly used to support online collaboration in computing projects?

APhotoshop
BGoogle DriveAnswer
CExcel
DVLC Media Player

Why

Google Drive stores files in the cloud and lets several people edit the same document in real time. Photoshop and VLC are single-user applications, and desktop Excel is not a collaboration service by itself.

Short response questions (SRQs)p. 180–181

13 marks

Why is it important to apply security measures when using online platforms?

Solution

Online platforms (e-mail, cloud drives, video meetings, social media) hold and transmit our personal and project data over the internet, where attackers can reach it. Security measures are important because they:

protect privacy: passwords, CNIC numbers and bank details are not stolen, which prevents identity theft and fraud;
stop cyber-attacks such as phishing, malware and ransomware from damaging files or accounts;
keep shared work accurate and available, so no unauthorized person changes or deletes it, and build trust between collaborators.

Examples of such measures are strong passwords, 2FA, HTTPS connections and limited sharing permissions.

23 marks

What are the main functions of security protocols in today's digital world?

Solution

A security protocol is a set of rules and procedures that protects data and communication on networks. Its main functions are:

Confidentiality: encrypt data so only authorized people can read it.
Integrity: make sure data is not changed during storage or transmission.
Authentication: verify the identity of users and devices (passwords, MFA, digital certificates).
Access control: allow only authorized users to access or change data.
Secure transmission: protect data in transit, for example with SSL/TLS and VPNs.
Protection and recovery: guard against malware and support backup and recovery.

32026 Annual I, Set B, Q.2 (ii) OR3 marks

What are the key reasons for using security protocols to protect data?

Solution

Data is attacked by unauthorized access, tampering and interception, so security protocols are used for these key reasons:

to keep data confidential through encryption;
to maintain data integrity, so that data stays accurate and unaltered;
to authenticate users and devices and to control access to data;
to transmit data securely (SSL/TLS, VPN) so spies cannot read it;
to protect against malware and allow backup and recovery after an attack or hardware failure;
to follow laws (compliance), reduce risk and build users' trust.

Example: HTTPS protects a student's login details when an online admission form is submitted.

43 marks

How can sharing private information lead to identity theft?

Solution

Identity theft is the use of someone's personal details (name, CNIC, card number) without permission to commit fraud. When we share private information carelessly, thieves can collect it:

Phishing: a fake message makes us type our password or card details on a false website.
Data breaches: details we gave to a website are leaked when that website is hacked.
Over-sharing online and online scams: posts showing date of birth, address or ID photos, or fake prize offers, give thieves enough data.
Lost or stolen items: a lost phone or wallet exposes documents.

With these details the thief can open accounts, take loans or shop in our name, causing money loss and damage to reputation.

53 marks

What are the benefits and potential privacy issues of biometric verification?

Solution

Biometric verification confirms identity using unique physical or behavioral traits such as fingerprints, face, iris or voice.

Benefits

Convenient: no need to remember passwords or PINs.
Hard to fake, guess or share, so it is secure.
Fast: a touch or a glance unlocks the device.

Privacy issues

Biometric data is very sensitive; if it is stolen it cannot be changed like a password.
Users may not know how and where their data is stored, shared or used (for example for tracking).

63 marks

What does Two-Factor Authentication (2FA) require for user identification?

Solution

2FA requires two separate forms of identification, taken from two different categories, before access is given to a system, account or app. The categories are:

something you know, such as a password or PIN;
something you have, such as a smartphone receiving a one-time code, a token or a smart card;
something you are, such as a fingerprint or face scan.

Example: a bank app asks for the password and then an OTP sent by SMS. If the password is stolen, the attacker still needs the phone.

73 marks

Name one advantage and one disadvantage of Biometric Verification.

Solution

Biometric verification identifies a person by a unique trait such as a fingerprint, face or iris.

Advantage

It is convenient and hard to fake: the user does not need to remember a password or PIN, and a fingerprint cannot easily be guessed, copied or shared with another person.

Disadvantage

It raises privacy concerns: biometric data is sensitive, and if the stored template is stolen it cannot be replaced the way a password can be changed. It also needs special hardware and may fail with an injured finger.

83 marks

What is the primary purpose of cryptography in data transmission?

Solution

The primary purpose of cryptography in transmission is to keep data secure while it moves between locations. It converts readable plaintext into unreadable ciphertext using a key, so only an authorized receiver with the correct key can decrypt it.

Confidentiality: an eavesdropper who intercepts the data sees only meaningless ciphertext.
Integrity: any change made on the way can be detected (hashes, digital signatures).
Authentication: digital signatures prove who sent the data.

Example: SSL/TLS encrypts card details between a browser and an online shop.

92026 Annual I, Set B, Q.2 (xi)3 marks

Describe the Caesar Cipher in brief.

Solution

The Caesar cipher is one of the oldest and simplest encryption methods. It is a substitution cipher in which every letter of the plaintext is shifted by a fixed number of positions (the key) in the alphabet; the letters wrap round after Z.

C = (P + k) mod 26, P = (C - k) mod 26

Here $P$ is the position of the plain letter (A = 0), $k$ is the shift and $C$ the position of the cipher letter. With $k = 3$ : A becomes D, B becomes E, and HELLO becomes KHOOR. It is easy to break because there are only 25 possible keys.

103 marks

What protocol is used for secure communication over the internet?

Solution

HTTPS (Hypertext Transfer Protocol Secure), which works on top of TLS/SSL (Transport Layer Security / Secure Sockets Layer), is used for secure communication over the internet.

TLS/SSL encrypts the data and authenticates the server, so data between client and server stays confidential and unaltered.
HTTPS uses TLS to encrypt everything exchanged between a web browser and a website, such as passwords and payment details.
It protects against eavesdropping and tampering; the padlock and $https://$ in the address bar show it is active.

Other secure protocols are SSH for remote access and IPsec for VPNs.

113 marks

Why is it important to understand how and when your information is collected and used online?

Solution

Websites and apps collect data through forms, cookies, sensors and app permissions, and use it for services, advertising and analytics. Understanding this is important because:

we can give informed consent and refuse permissions an app does not need (for example a torch app asking for contacts);
we can protect our privacy and reduce the risk of identity theft if the data is leaked or sold;
we can check that organizations are transparent, ask permission and follow the law, and hold them responsible if they misuse data;
we can make better choices about which services to trust.

123 marks

Why is collaboration important in the design of computing technologies, especially when addressing equity in access to information?

Solution

Collaboration brings together people with different skills, backgrounds and needs. In design this gives diverse perspectives, more innovation, user-centric design, resource sharing and stronger problem solving.

For equity of access it is especially important because:

users with disabilities, rural users and speakers of different languages can tell designers what they need (screen readers, captions, local languages, low-data modes);
government, schools, non-profits and businesses can share money and infrastructure to reach underserved communities;
the final product then serves everyone, not only the people who built it.

Extended response questions (ERQs)p. 181

15 marks

How do security protocols ensure data protection in today's digital world, and what specific techniques and measures do they employ to maintain confidentiality, integrity, and authentication?

Solution

Security protocols

A security protocol is a set of rules and procedures that protects data and communication from unauthorized access, tampering and interception. Every time we log in, pay online or send a file, protocols such as HTTPS, SSL/TLS, SSH and IPsec work in the background to protect the data.

How they ensure data protection

They encrypt data so it cannot be read by outsiders.
They verify identities before any data is exchanged.
They control access so users reach only what they are allowed to.
They secure transmission over the internet using SSL/TLS and VPNs.
They support firewalls and anti-malware tools, backup and recovery, and legal compliance, which reduces risk and builds trust.

Confidentiality: techniques

Confidentiality means only authorized people can read the data. It is maintained by encryption: plaintext is converted into ciphertext with a key.

Symmetric encryption (one shared key) for fast encryption of large data.
Asymmetric encryption (public and private keys) for safe key exchange.
SSL/TLS and HTTPS encrypt data between browser and server; VPNs/IPsec encrypt all traffic of a remote user; SFTP/FTPS encrypt file transfers.

Integrity: techniques

Integrity means data stays accurate, consistent and unaltered during storage, transmission and processing.

Hashing: a hash (fingerprint) of the data is sent with it; a changed message gives a different hash.
Digital signatures: the sender signs the hash with a private key, so changes and forgery are detected.
Encryption and access control stop unauthorized changes and fraud; backups restore correct data after damage.

Authentication: techniques

Authentication verifies who the user or device is.

Usernames and passwords (something you know).
Multi-factor / two-factor authentication such as password plus OTP.
Biometric verification (fingerprint, face).
Digital certificates: electronic documents that prove a website or device owns its public key; HTTPS uses them to show the website is genuine.

Goal	Technique	Protocol example
Confidentiality	Encryption (symmetric, asymmetric)	HTTPS, TLS, IPsec, SFTP
Integrity	Hashing, digital signatures	TLS, IPsec
Authentication	Passwords, 2FA, biometrics, digital certificates	TLS certificates, SSH keys

Conclusion

By combining encryption, integrity checks and strong authentication with access control and backups, security protocols keep data private, correct and available in today's digital world.

22026 Annual I, Set D, Q.2 (iv) OR5 marks

What are the primary risks associated with sharing private information online, and how can individuals protect themselves against identity theft?

Solution

Introduction

Private information includes name, CNIC number, address, phone number, passwords and bank card details. Sharing it online increases the risk of identity theft: the use of someone's personal details without permission to commit fraud, which causes money loss and damage to reputation.

Primary risks of sharing private information

Phishing: scammers send fraudulent emails, SMS or messages that look as if they come from a bank or trusted organization and ask for passwords or financial details.
Data breaches: when an organization or website is attacked, customer data is leaked; anyone who shared data with that site is at risk. Thieves then pretend to be trustworthy to get even more information.
Lost or stolen items: wallets, laptops, phones or documents with personal data can be lost or stolen and used by identity thieves.
Online scams: fake websites and advertisements (prizes, jobs, cheap products) fool people into giving personal information or paying money to the wrong place.
Over-sharing on social media: birthdays, school names and location tags help criminals answer security questions or guess passwords.

How to protect yourself against identity theft

Be careful about sharing personal information, especially when asked by email, phone or social media; genuine banks never ask for a PIN or OTP.
Use strong, unique passwords for every account and a password manager to remember them.
Enable multi-factor authentication (MFA/2FA), so a stolen password alone is useless.
Check bank statements and credit reports regularly for unusual activity and report it at once.
Protect physical items such as CNIC, passport and cards; lock phones and laptops with a PIN or biometric.
Learn about common scams, verify links and senders, use HTTPS websites, and be cautious with unfamiliar people or organizations.
Keep devices updated and use antivirus software, so spyware cannot steal data.

Conclusion

Most identity theft starts with information that the victim shared or failed to protect. Staying alert and following these practices greatly reduces the risk.

32026 Annual I, Set B, Q.5 OR5 marks

How do different types of cyber-attacks, such as DDoS, ransomware, spyware, viruses, and phishing, threaten the security and privacy of individuals and organizations?

Solution

A cyber-attack is a deliberate attempt to damage, disrupt or gain unauthorized access to computers, networks or data. Attacks threaten security (systems stop working, data is damaged) and privacy (personal data is stolen).

DDoS (Distributed Denial of Service)

Many infected computers (a botnet) flood a website or system with too much traffic at the same time. The target is overloaded and becomes slow or unavailable. Threat: an online bank, e-commerce site or government portal cannot serve real users; organizations lose money and reputation; sometimes the attack hides another break-in.

DDoS attack

Ransomware

Malicious software that locks or encrypts files and demands a ransom to unlock them. Threat: hospitals, companies and individuals lose access to important data; work stops; paying the ransom does not guarantee recovery, and data may also be leaked.

Spyware

Harmful software that secretly records what you type, takes screenshots and watches online activity, then sends the data to an attacker. Threat: a serious privacy attack; passwords, bank details, private messages and business secrets are stolen without the victim knowing.

Viruses

Programs that copy themselves, infect files and spread when infected files are shared. Threat: corrupted or deleted data, crashed systems, and spreading infection across an organization's network.

Phishing

Fake emails, websites or messages pretend to be a reliable source and trick people into giving passwords or credit card numbers. Threat: account takeover, identity theft and financial fraud for individuals; for organizations, one fooled employee can let attackers into the whole network.

Attack	Security threat	Privacy threat
DDoS	Service unavailable	Low (may cover another attack)
Ransomware	Files locked, work stops	Data may be stolen and leaked
Spyware	Hidden software on system	High: keystrokes and passwords stolen
Virus	Corrupts data, crashes system	Can open a backdoor for data theft
Phishing	Account takeover	High: user gives away personal data

Protection

Firewalls and anti-malware tools, regular updates, offline backups, 2FA, email filtering and user awareness training reduce these threats.

45 marks

Discuss the process and benefits of Biometric Verification, as well as the privacy concerns associated with it.

Solution

Biometric verification

Biometric verification is a security method that confirms a person's identity using unique physical traits (fingerprints, facial features, iris patterns) or behavioral traits (voice, typing pattern, walking pattern). It is something you are, so it can also be one factor of 2FA.

Process

Enrolment: the user's trait is captured once by a sensor (fingerprint scanner, camera) and converted into a digital template that is stored securely.
Capture of sample: to access a system or device, the user provides a biometric sample, for example touches the scanner or looks at the camera.
Matching: the system extracts features from the new sample and compares them with the stored template.
Decision: if the similarity is above a set limit, identity is confirmed and access is granted; otherwise access is refused or another method (PIN) is asked for.

Benefits

Convenience: no passwords or PINs to remember or type.
Hard to fake: traits are unique and difficult to copy, guess or share.
Speed: identity is checked in a second, useful for phones, offices and airports.
Accountability: an action can be linked to a real person (for example biometric attendance or SIM verification by NADRA data).
Stronger security when combined with a password in 2FA.

Privacy concerns

Biometric data is highly sensitive and permanent; if a database is breached, a person cannot change a fingerprint as a password can be changed.
Users may not know how it is stored and used; data could be shared or used for tracking and surveillance without consent.
Face recognition can identify people in public without their knowledge.
Errors (false rejection or false acceptance) and injuries can lock out genuine users.

Conclusion

Biometric verification is convenient and strong, but organizations must store biometric data in encrypted form, collect it only with consent and use it only for the stated purpose.

55 marks

Describe how cryptography ensures the safe transmission of data, detailing the difference between symmetric and asymmetric encryption.

Solution

Cryptography and safe transmission

Safe data transmission means securing information as it moves between locations. Cryptography makes this possible by transforming readable plaintext into unreadable ciphertext using a key (encryption). Only an authorized receiver with the right key can convert it back (decryption). If a hacker intercepts the data on the way, only meaningless ciphertext is seen.

Confidentiality: data stays private in transit.
Integrity: hashes and digital signatures show if data was changed.
Authentication: digital signatures and certificates prove who sent the data.
Protocols such as SSL/TLS, HTTPS, IPsec and SFTP apply cryptography automatically.

Symmetric encryption

Uses the same secret key to encrypt and decrypt. It is fast and efficient, so it is ideal for large volumes of data, but the key must be shared securely, because anyone who has it can read the data. Examples: AES, DES.

Asymmetric encryption

Also called public-key cryptography. It uses two keys: a public key (shared with everyone) for encryption and a private key (kept secret by the owner) for decryption. It allows secure communication without sharing a secret key and gives digital signatures, but it is slower. Examples: RSA, ECC.

Symmetric and asymmetric encryption

Point	Symmetric	Asymmetric
Number of keys	One shared key	Two keys (public, private)
Key used	Same key encrypts and decrypts	Public key encrypts, private key decrypts
Speed	Fast	Slower
Key distribution	Difficult: secret key must be sent safely	Easy: public key can be published
Extra feature	None	Digital signatures for authentication
Use	Bulk data, disk and file encryption	Key exchange, e-mail, signatures

Both together

HTTPS/TLS uses asymmetric encryption at the start to agree on a secret session key safely, then uses fast symmetric encryption for the rest of the session. This gives both security and speed.

65 marks

Compare and contrast the different types of cryptographic methods mentioned, including their use cases and efficiency.

Solution

The unit mentions two types of cryptography (symmetric and asymmetric) and four classical cipher methods (Caesar, substitution, transposition and Vigenère).

Symmetric and asymmetric cryptography

Feature	Symmetric	Asymmetric
Keys	One shared secret key	Public and private key pair
Efficiency	Fast and efficient; low computing power	Slower; heavier calculations
Use cases	Encrypting large data, files, disks, the data part of HTTPS	Key exchange, digital signatures, secure e-mail, certificates
Weakness	Secure key sharing is difficult	Too slow for bulk data alone

Similarity: both convert plaintext into ciphertext with keys and aim at confidentiality. Difference: symmetric trades easy key sharing for speed, asymmetric trades speed for easy key sharing and signatures. Modern systems combine them.

Classical cipher methods

Caesar cipher: shifts every letter by a fixed number (key 3: A to D). Very fast and simple; used for teaching and puzzles; extremely weak because only 25 keys exist.
Substitution cipher: each letter replaced using a fixed substitution alphabet (Caesar is a special case). Simple; weak because letter frequencies (E is most common) remain.
Transposition cipher: characters are rearranged according to a pattern; letters are not changed. Simple; hides word shapes but letter counts remain, so it is used with substitution for more strength.
Vigenère cipher: a keyword gives a different shift for each letter (ATTACK with key LEMON begins LXFOPV). Stronger than Caesar because the same letter can become different letters; still breakable with modern methods.

Cipher	Changes letters?	Changes order?	Key	Efficiency	Security
Caesar	Yes	No	Number	Very fast	Very low
Substitution	Yes	No	Alphabet	Very fast	Low
Transposition	No	Yes	Pattern	Fast	Low
Vigenère	Yes	No	Keyword	Fast	Medium (historical)

Conclusion

Classical ciphers are efficient but insecure today, so they are used for learning the ideas. Real data protection uses modern symmetric algorithms for speed and asymmetric algorithms for key exchange and authentication.

75 marks

Imagine you are developing a new mobile application that stores user data. Explain how you would ensure the security of the data during both storage and transmission.

Solution

A mobile app that stores user data (names, phone numbers, passwords, payments) must protect it at rest (in storage) and in transit (while moving between the phone and the server).

Security during storage

Encrypt stored data on the phone and in the server database using strong symmetric encryption (for example AES), with keys kept in the phone's secure key store.
Never store plain passwords: store only salted hashes of passwords.
Access control: role-based permissions on the server so staff see only what they need; least privilege for every account.
Strong authentication: 2FA (password plus OTP) and optional biometric login (fingerprint or face).
Collect only needed data with the user's permission, and state it clearly in the privacy policy (lawful collection and usage).
Regular backups stored securely, so data can be recovered after hardware failure or ransomware.

Security during transmission

Use HTTPS with TLS for every API call, so data between app and server is encrypted and cannot be read or changed.
Use digital certificates (and certificate pinning) so the app talks only to the genuine server.
Use SFTP or secure cloud APIs for file uploads, and SSH for administrators managing the server.
Add integrity checks (hashes or signed tokens) so tampered requests are rejected.

Ongoing protection

Keep the app, libraries and server patched; run vulnerability and penetration tests regularly.
Monitor logs for unusual activity, have an incident plan, and document and learn from every problem.
Educate users in the app about phishing and strong passwords.

With encryption at rest and in transit, strong authentication, access control and regular testing, users' data stays confidential, correct and available.

85 marks

You are working with a diverse team to develop a new educational website. Describe how you would use online collaborative tools and communication strategies to ensure all team members can contribute equally.

Solution

A diverse team (designers, programmers, teachers, students, members in different cities, some with disabilities or weak internet) produces a better, more user-friendly website, but only if everyone can take part equally.

Collaborative tools

Tool	How the team would use it
Google Drive	Store the requirements, content and designs in shared folders; co-edit documents in real time; version history shows every contribution
Slack or Microsoft Teams	Channels for design, content and coding; direct messages; quick file sharing so no one is left out of discussions
Trello	A board with cards for each task, owners and due dates; everyone sees who is doing what, and work is shared fairly
Zoom or Microsoft Teams meetings	Weekly video meetings with screen sharing; meetings recorded for those who cannot attend live

Communication strategies for equal contribution

Clear roles and turn-taking: rotate the meeting leader; every member gives an update, so quiet members are heard.
Asynchronous work: written updates and recorded meetings let people in different time zones or with weak connections contribute.
Accessibility: turn on captions, share documents that work with screen readers, allow Urdu and English, and send agendas early.
Equal access to technology: make sure everyone has the needed device, internet and training on the tools.
Respectful feedback: comments on shared documents and a rule that ideas are judged on merit.
User-centric design: invite teachers and students to test prototypes and collect their feedback.

Safe collaboration

Enable 2FA on all tool accounts; give edit rights only to team members and view rights to others.
Protect meetings with passcodes; do not post private data in channels; remove access when members leave.

By combining the right tools, inclusive communication and safe practices, every member can contribute equally and the website will meet the needs of a wide audience.

Important exam questions (not in the exercise)

Likely FBISE short and long questions from this unit that are not in the book's exercise, fully answered.

13 marks

What is data integrity? How do security protocols maintain it?

Solution

Data integrity means that information remains accurate, consistent and unaltered during storage, transmission and processing. Wrong or changed data (for example a changed bank amount) can be as harmful as stolen data.

Security protocols maintain integrity by:

hashing: a fingerprint of the data is checked at the receiving end; any change gives a different hash;
digital signatures, which detect changes and prove the sender;
encryption and access control, which prevent unauthorized changes and fraud.

23 marks

What is access control? Give an example.

Solution

Access control is a security mechanism that decides who can access, change or send data, and which systems or places they can reach. It ensures that only authorized users get access, protecting information and privacy from misuse.

It works through user accounts, permissions, roles and access control lists (lists of users and what each is allowed to do).

Example: in a school system, a student can only view his own result, a teacher can enter marks for her class, and only the administrator can change the database settings.

33 marks

Define plaintext, ciphertext, encryption, decryption and key.

Solution

Plaintext: the original, readable message, for example HELLO.
Ciphertext: the encrypted, unreadable form of the message, for example KHOOR.
Encryption: the process of converting plaintext into ciphertext using a cipher and a key.
Decryption: the process of converting ciphertext back into plaintext.
Key: a secret value (parameter) that controls encryption and decryption; without the correct key the ciphertext cannot be read.

Together these are the basic terms of cryptography, the practice of protecting data so only authorized parties can read it.

43 marks

Differentiate between substitution cipher and transposition cipher with one example each.

Solution

Substitution cipher	Transposition cipher
Replaces each letter with another letter	Rearranges the positions of letters
Letters change, order stays the same	Letters stay the same, order changes
Key is a substitution alphabet (or a shift)	Key is the rearranging pattern
Example: ROT13 changes HELLO to URYYB	Example: 2-rail fence changes HELLOWORLD to HLOOLELWRD

Both are classical ciphers; the Caesar cipher is a special case of substitution.

53 marks

Encrypt the message ATTACKATDAWN using the Vigenère cipher with keyword LEMON.

Solution

In the Vigenère cipher each letter is shifted by the value of the matching keyword letter (A = 0, B = 1, ..., Z = 25). The keyword is repeated to the length of the message: LEMONLEMONLE.

P	A	T	T	A	C	K	A	T	D	A	W	N
K	L	E	M	O	N	L	E	M	O	N	L	E
C	L	X	F	O	P	V	E	F	R	N	H	R

Rule: $C = (P + K) mod 26$ . For example A(0) + L(11) = 11 = L, and W(22) + L(11) = 33, $33 mod 26 = 7$ = H.

Ciphertext: LXFOPVEFRNHR

63 marks

Differentiate between a virus and malware.

Solution

Malware	Virus
General name for all harmful (malicious) software	One specific type of malware
Includes viruses, worms, Trojans, spyware, ransomware and adware	A program that copies itself and infects files or software
May spread in many ways or not spread at all (for example spyware hides quietly)	Spreads to other systems when infected files are shared
Can damage systems or steal information	Corrupts data or crashes the system

So every virus is malware, but not all malware is a virus.

73 marks

What is SSH? Write its use.

Solution

SSH (Secure Shell) is a security protocol for secure remote access to servers and network devices. It provides strong authentication (passwords or SSH keys) and encrypted communication, so commands and passwords cannot be read by anyone watching the network. It normally uses port 22.

Administrators log in to web servers and routers from far away to manage them (secure system administration).
It is the basis of SFTP, which transfers files through an encrypted SSH connection.
It replaced insecure remote login protocols such as Telnet.

83 marks

Differentiate between HTTP and HTTPS.

Solution

HTTP	HTTPS
Hypertext Transfer Protocol	Hypertext Transfer Protocol Secure, an extension of HTTP
Sends data as plain text	Encrypts data with SSL/TLS
Passwords and payment details can be read or changed	Protects data from eavesdropping and tampering
No proof of website identity	Digital certificate proves the website is genuine (padlock shown)
Uses port 80	Uses port 443

HTTPS should be used for all logins, online banking and shopping.

93 marks

What is IPsec? How is it used in VPNs?

Solution

IPsec (Internet Protocol Security) is a set of protocols that secures Internet Protocol (IP) communication by authenticating and encrypting each IP packet. Because it works at the network layer, it protects all traffic, not just one application.

Use in VPNs: a Virtual Private Network creates an encrypted tunnel over the public internet. IPsec provides that tunnel, so a remote employee, a branch office and the head office gateway can exchange data as if they were on one private network, while outsiders see only encrypted packets.

103 marks

Differentiate between SFTP and FTPS.

Solution

Both are secure file transfer protocols that protect files during transmission, unlike plain FTP, which sends files and passwords as plain text.

SFTP	FTPS
SSH File Transfer Protocol	FTP over SSL (FTP Secure)
Works through an encrypted SSH connection	Adds SSL/TLS encryption to ordinary FTP
Uses one connection, normally port 22	Uses separate control and data connections (like FTP)
Common for server administration	Common where FTP systems already exist

113 marks

What is the role of 'document and learn' and 'regular backups' in troubleshooting security problems?

Solution

Document and learn: after a security problem, write down what happened, how it was found and what was done to fix it. This written record helps the team respond faster next time, stops similar problems from happening again and improves security policies.

Regular backups: back up data regularly and check that it can actually be restored. If data is lost or locked by an attack such as ransomware, or by hardware failure, the organization can recover it without paying attackers or losing work.

123 marks

What are computational perspectives? Why are they significant for students?

Solution

Computational perspectives mean using computers to solve problems by breaking complex tasks into simple steps, which helps create efficient solutions and innovate.

Significance for students:

they build problem-solving and critical thinking skills;
they encourage innovation and adaptability to new technology;
they prepare students for future careers, since most jobs now use computing, and keep them competitive in a digital world.

133 marks

What are Open Educational Resources (OER)? How do they support equal access to information?

Solution

Open Educational Resources (OER) are free teaching and learning materials (books, lessons, videos, tests) that anyone can use, change and share.

They are free, so poor students and schools can use good material without buying books.
Teachers can adapt them to local needs, for example translate them into Urdu or simplify them.
They can be shared widely online and in community centers, so more people get knowledge wherever they live.

143 marks

How do digital libraries and community information centers reduce the digital divide?

Solution

The digital divide is the gap between people who have access to digital technology and information and those who do not.

Digital libraries give free online access to textbooks and articles to anyone with internet, so students who cannot afford books or live far from a library can still learn, and lifelong learning is encouraged.
Community information centers provide computers, internet and learning materials in underserved communities. They give access to information, skill development and social connection, so people can take part fully in the digital era.

153 marks

Differentiate between Slack and Trello.

Solution

Both are collaborative tools, but they serve different purposes.

Slack	Trello
Messaging app for team communication	Project management tool
Organizes talk into channels by topic or project	Organizes work into boards, lists and cards
Direct messages, file sharing, links with other tools	Cards moved as tasks progress; comments, attachments, due dates
Answers: what are we discussing?	Answers: who is doing which task and when?

163 marks

Compare Microsoft Teams and Zoom as collaborative tools.

Solution

Microsoft Teams	Zoom
Complete collaboration platform	Mainly a video conferencing platform
Integrates chat, video meetings, file storage and other applications	Virtual meetings, webinars and conference calls
Team members share files and work together on projects in real time	Screen sharing, chat and recording of meetings
Suited to ongoing teamwork in an organization or class	Suited to remote meetings, lectures and large webinars

Both help remote collaboration; Teams keeps the whole project in one place, while Zoom focuses on meetings.

173 marks

What are the main rules for collecting and using information? Give two uses of collected data.

Solution

The main rules for data collection (gathering data through surveys, interviews, sensors or software) and usage are:

Be clear (transparent): explain why data is collected;
Get permission (consent) when needed;
Follow the law and protect the data well.

Breaking these rules leads to legal problems and loss of trust. Uses of collected data: understanding customer preferences to improve products, and tracking student performance to improve learning methods.

15 marks

Explain the steps for troubleshooting security problems.

Solution

Troubleshooting security problems means finding and fixing security issues to protect an organization's systems, applications and data. It involves understanding the setup, checking logs and running vulnerability tests. Security is an ongoing process, so the steps are repeated.

Troubleshooting security problems

Identify the issue: define the problem clearly; gather information about symptoms (pop-ups, slow system, unknown logins) and the systems involved.
Understand the environment: learn how the systems and apps are set up, what they need and how they are connected in the network, to find weak points attackers may use.
Access control and permissions: check access control lists, user permissions and roles; remove unnecessary rights so only authorized users reach sensitive data.
User education: teach users not to click strange emails or websites, to use strong passwords and to report problems quickly.
Regular backups: back up data and test restoring it, which is vital after ransomware or hardware failure.
Document and learn: record what happened and how it was fixed, to prevent it happening again.
Regular testing and assessment: keep testing security measures (vulnerability scans, audits) to find and reduce new threats.

Good practices

Keep software updated, check logs, educate users and plan for incidents. Following these steps lowers risk and improves overall security.

25 marks

What is a phishing attack? Explain the strategies used for identifying cybersecurity threats.

Solution

Phishing attack

A phishing attack is a common cybersecurity threat in which attackers trick people into giving away sensitive information such as passwords or personal data through fake emails, websites or messages that appear to come from a trusted source. Signs: urgent language, a sender or link that does not match the real organization, requests for PINs or OTPs, and unexpected attachments.

Strategies for identifying cybersecurity threats

Employee training and awareness: regular training helps staff spot phishing attempts and be careful with unexpected emails asking for sensitive information or containing suspicious links or attachments.
Email filtering and anti-phishing software: strong filters catch and block phishing emails, and anti-phishing software scans messages before they reach inboxes.
Secure communication protocols: use HTTPS websites and encrypted email; check that websites and senders are genuine before sharing information.
Web content filtering: web filters block access to known phishing sites and harmful content.
Security updates and patch management: update all software, operating systems and applications with the latest patches so known weaknesses cannot be used.

Conclusion

These strategies lower the risk of phishing and improve overall cybersecurity. Organizations should stay informed about new threats and adjust their measures as needed.

35 marks

Explain the following security protocols: TLS/SSL, IPsec, SSH, secure file transfer protocols and HTTPS.

Solution

Security protocols are rules and procedures that protect data and communication on networks: they keep information private, verify identities and ensure data is not changed in transit.

TLS/SSL

Transport Layer Security and its predecessor Secure Sockets Layer are cryptographic protocols that secure internet communication. They provide encryption and authentication so data between a client and server is confidential and unaltered. Used in web browsers, e-mail clients and many online services.

IPsec

Internet Protocol Security is a set of protocols that secures IP communication by authenticating and encrypting each packet. It is used for VPNs and secure channels between networks, remote clients and gateways.

SSH

Secure Shell provides secure remote access to servers and network devices with strong authentication and encrypted communication; essential for secure system administration.

Secure file transfer protocols

SFTP (SSH File Transfer Protocol) encrypts file transfers through SSH; FTPS (FTP over SSL) adds SSL/TLS encryption to FTP. Both make interception or alteration of files difficult.

HTTPS

Hypertext Transfer Protocol Secure is HTTP with TLS encryption. It encrypts data between a browser and website, protecting passwords and payment details from eavesdropping and tampering.

Protocol	Main use
TLS/SSL	Secure client-server internet communication
IPsec	VPNs; securing every IP packet
SSH	Secure remote access and administration
SFTP / FTPS	Secure file transfer
HTTPS	Secure web browsing, banking, shopping

45 marks

Explain the resources that can be created to provide equal information accessibility to everyone.

Solution

Equal information accessibility means everyone can access information regardless of who they are, where they live, their income or disability. Creating the following resources reduces the digital gap:

Digital libraries: online libraries with free textbooks and articles, available to anyone with internet; they reduce the digital gap and encourage lifelong learning.
Accessible learning platforms: e-learning platforms for people with disabilities, with screen readers, captions and alternative content formats, meeting different learning needs.
Community information centers: centers with computers, internet and learning materials in underserved communities, giving access, skill development and social connections.
Mobile applications: easy phone apps for services like healthcare or job help, respectful of cultures and available in many languages.
Open Educational Resources (OER): free resources that anyone can use, change and share, so teachers and learners can adapt content.
Digital literacy programs: teach people to use the internet wisely: find reliable information, use tools safely and protect privacy.
Partnerships and collaborations: government, schools, non-profits and businesses working together on access problems so everyone gets the information needed for school and work.

Conclusion

Together these resources give people equal opportunity to learn, work and take part in the digital world.

55 marks

What are collaborative tools? Explain any five collaborative tools with their features.

Solution

Collaborative tools are software applications designed to make teamwork and communication easy for people who may be working remotely or in different places. They let members work together on projects, share information and communicate effectively.

Google Drive

A cloud service for storing and sharing files. Documents, spreadsheets and presentations are saved online, and several people can edit them together in real time, seeing changes as they happen.

Slack

A messaging app in which teams communicate in channels based on topics or projects. It supports direct messages, file sharing and connections with other tools and services.

Trello

A project management tool using boards, lists and cards. Each task is a card that is moved as it progresses; team members add comments, attachments and due dates.

Microsoft Teams

A collaboration platform that integrates chat, video meetings, file storage and application integration, so users communicate and work together on projects in real time.

Zoom

A video conferencing platform for virtual meetings, webinars and conference calls, with screen sharing, chat and recording.

Tool	Category
Google Drive	File storage and co-editing
Slack	Messaging
Trello	Task management
Microsoft Teams	All-in-one collaboration
Zoom	Video conferencing

65 marks

Explain computational perspectives and the importance of collaboration in improving the design of computing applications.

Solution

Computational perspectives

Computational perspectives involve using computers to solve problems by breaking complex tasks into simple steps. This approach creates efficient solutions and supports innovation.

They help students solve complex problems efficiently as technology advances.
They promote innovation, critical thinking and adaptability, which are valued in today's job market.
They prepare students to excel in many fields and stay competitive in a digital world.

Collaboration in computing application design

When diverse teams work together they combine skills, experiences and perspectives, producing more innovative and user-friendly software that meets the needs of a wider audience.

Diverse perspectives: people from different backgrounds give a wider range of ideas and more creative designs.
Enhanced innovation: combining technologies and methods from different fields leads to new solutions.
User-centric design: involving end-users and stakeholders ensures the product meets their needs; feedback improves usability and accessibility.
Resource sharing: sharing knowledge, tools and money makes work faster and the product better.
Problem solving: different ideas and skills make the team better at solving hard problems.

Example: a health app built by doctors, programmers, designers and patients is safer and easier to use than one built by programmers alone.

FBISE 2026 questions

Questions from the FBISE HSSC-II 2026 (1st Annual) papers that belong to this unit, answered the way an examiner expects.

112026 Annual I, Set B, MCQ 111 mark

Which security method is best described as 'something you are' (or your part) for authentication?

ASecurity Question
BPassword
CBiometricAnswer
DOTP Code

Why

'Something you are' is a physical or behavioral trait of the person, such as a fingerprint or face, which is biometric verification. A password and a security question are something you know; an OTP code comes from something you have (the phone).

2 (ii) OR2026 Annual I, Set B, Q.2 (ii) OR2+1 = 3 marks

Why are security protocols important in today's digital world? Give an example.

Solution

Importance (2 marks)

Security protocols are sets of rules and procedures that protect data and communication from unauthorized access, tampering and interception. They are important because:

they keep data confidential by encryption and maintain its integrity (data is not changed);
they authenticate users and devices and control access, so only authorized people use the data;
they secure transmission over the internet, protect against malware and support backup and recovery, which reduces risk and builds trust in online banking, shopping and learning.

Example (1 mark)

HTTPS (HTTP with SSL/TLS) encrypts a student's password and card details between the browser and a university fee-payment website, so a hacker on the network cannot read them.

2 (v)2026 Annual I, Set B, Q.2 (v)1.5+1.5 = 3 marks

Write down the difference between spyware and phishing.

Solution

Spyware (1.5 marks) is harmful software that secretly installs on a device and collects information about the user without their knowledge: it can record keystrokes, take screenshots and watch online activity, then send the data to a remote attacker.

Phishing (1.5 marks) is a trick (social engineering attack) in which fake emails, websites or messages pretend to come from a reliable source and deceive the user into giving away passwords or credit card numbers personally.

Spyware	Phishing
A type of malicious software (malware)	A deception technique, not necessarily software
Works silently without the user's action	Needs the user to click and type the information
Stops with anti-malware tools	Stopped mainly by awareness and email filters
Example: a keylogger hidden in a free game	Example: fake bank SMS with a login link

2 (v) OR2026 Annual I, Set B, Q.2 (v) OR1.5+1.5 = 3 marks

Differentiate between Symmetric and Asymmetric cryptography.

Solution

Symmetric cryptography (1.5 marks) uses one shared secret key for both encryption and decryption. It is fast and efficient, so it suits large volumes of data, but the key must be shared securely because anyone who has it can read the data. Example: AES.

Asymmetric cryptography (1.5 marks), or public-key cryptography, uses a pair of keys: a public key to encrypt and a private key to decrypt. No secret key has to be shared, and it provides digital signatures, but it is slower. Example: RSA.

Symmetric	Asymmetric
One key	Two keys (public and private)
Same key encrypts and decrypts	Public key encrypts, private key decrypts
Fast; good for bulk data	Slower; good for key exchange and signatures
Key distribution is a problem	Easy key distribution

2 (vii)2026 Annual I, Set B, Q.2 (vii)1.5+1.5 = 3 marks

How two-factor authentication (2FA) enhances privacy and security for users? Briefly discuss

Solution

Two-factor authentication (2FA) requires two separate forms of identification from different categories: something you know (password, PIN), something you have (phone OTP, token, smart card) or something you are (fingerprint, face).

Security (1.5 marks)

A password alone can be guessed, phished or leaked in a data breach. With 2FA, if one factor is compromised the attacker still needs the second factor, for example the OTP on the user's own phone, so account takeover and fraud are blocked.

Privacy (1.5 marks)

Because only the real owner can log in, personal e-mails, photos, messages and bank details in the account stay private. Many services also alert the user when a login attempt fails the second step, so the user can change the password quickly.

2 (x)2026 Annual I, Set B, Q.2 (x)2+1 = 3 marks

What is identity theft? Why is it harmful?

Solution

Identity theft (2 marks)

Identity theft happens when someone uses your personal details, such as your name, CNIC number, bank account or credit card information, without permission to commit fraud. Thieves get these details through phishing, data breaches, lost or stolen items and online scams.

Why it is harmful (1 mark)

The thief can withdraw money, shop, take loans or open accounts and SIMs in the victim's name. This causes financial loss, harms the victim's reputation and credit record, and can take a long time and legal effort to correct.

2 (xi)2026 Annual I, Set B, Q.2 (xi)2+1 = 3 marks

Briefly discuss any one cipher method used in cryptography. Give an example.

Solution

Caesar cipher (2 marks)

The Caesar cipher is a simple and very old substitution cipher. Each letter of the plaintext is shifted by a fixed number of positions (the key) in the alphabet, wrapping round after Z. To decrypt, the letters are shifted back by the same number.

C = (P + k) mod 26

Example (1 mark)

With key $k = 3$ : A becomes D, B becomes E, so HELLO is encrypted as KHOOR. It is easy to break because there are only 25 possible shifts.

5 OR2026 Annual I, Set B, Q.5 OR2.5+2.5 = 5 marks

Explain Distributed Denial of Service (DDoS) and Ransomware cyberattacks that threaten the security and privacy of individuals and organizations.

Solution

DDoS attack (2.5 marks)

In a Distributed Denial of Service (DDoS) attack, the attacker takes control of many infected computers (a botnet) and makes them all send a flood of traffic or requests to one website or system at the same time. The target's bandwidth and processing power are used up, so it becomes very slow or completely unavailable to regular users.

DDoS: a botnet floods a target server

Threat to organizations: online banking, shopping or government portals go offline; the organization loses money, customers and reputation.
Threat to individuals: users cannot reach services they need; the infected home computers used in the botnet are themselves compromised.
Protection: firewalls and traffic filtering, extra server capacity and DDoS protection services.

Ransomware (2.5 marks)

Ransomware is malicious software that locks or encrypts the victim's files so they cannot be opened, and then the attackers demand money (a ransom), often in cryptocurrency, to unlock or decrypt them. It usually enters through phishing e-mail attachments, infected downloads or unpatched software.

Threat to security: important files and whole systems become unusable; hospitals, businesses and schools stop working.
Threat to privacy: many attackers also steal the data and threaten to publish it.
Paying the ransom does not guarantee the files will be returned.
Protection: regular offline backups, updates and patches, anti-malware tools, and not opening unknown attachments.

102026 Annual I, Set D, MCQ 101 mark

What is the purpose of security protocol?

ATo store large data
BTo compress files
CTo secure communicationAnswer
DTo build websites

Why

Security protocols are rules and procedures that protect data and communication on networks from unauthorized access, tampering and interception, so their purpose is to secure communication.

2 (ii) OR2026 Annual I, Set D, Q.2 (ii) OR1.5+1.5 = 3 marks

Write down the difference between Symmetric and Asymmetric cryptography.

Solution

Symmetric	Asymmetric
One key	Two keys (public and private)
Same key encrypts and decrypts	Public key encrypts, private key decrypts
Fast; good for bulk data	Slower; good for key exchange and signatures
Key distribution is a problem	Easy key distribution

2 (iv) OR2026 Annual I, Set D, Q.2 (iv) OR1x3 = 3 marks

Write any three primary risks associated with sharing private information online.

Solution

Sharing private information online makes identity theft (misuse of personal details for fraud) more likely. Three primary risks (1 mark each):

Phishing: scammers send fraudulent emails, texts or messages that look as if they come from trusted organizations and ask for passwords or financial details, which are then misused.
Data breaches: when an organization or website we shared data with is attacked, our personal data is leaked with its customer records and can be used by identity thieves.
Online scams: fake websites or advertisements fool people into giving personal information or paying money to the wrong places.

(Lost or stolen devices and documents containing personal information are a further risk.)

2 (v) OR2026 Annual I, Set D, Q.2 (v) OR2+1 = 3 marks

What are security protocols? Give one example.

Solution

Definition (2 marks)

Security protocols are sets of rules and procedures used to protect data and communication on networks. They keep sensitive information, such as passwords, private and safe from unauthorized access, verify user identities (authentication) and make sure data remains unchanged during transmission (integrity), mainly by using encryption.

Example (1 mark)

HTTPS (Hypertext Transfer Protocol Secure) encrypts data between a web browser and a website using SSL/TLS, for example when logging in to online banking. (Other examples: SSL/TLS, SSH, IPsec, SFTP.)

2 (x)2026 Annual I, Set D, Q.2 (x)1.5+1.5 = 3 marks

Differentiate between ransomware and spyware.

Solution

Ransomware (1.5 marks) is malicious software that locks or encrypts the victim's files so they cannot be accessed, and then demands money (a ransom) to unlock them. It announces itself with a ransom message.

Spyware (1.5 marks) is harmful software that secretly collects information about the user without their knowledge, such as keystrokes, screenshots and browsing activity, and sends it to a remote attacker. It tries to stay hidden.

Ransomware	Spyware
Aim: extort money	Aim: steal information
Visible: shows a ransom demand	Hidden: user is unaware
Mainly harms availability of data	Mainly harms privacy
Defence: offline backups, updates	Defence: anti-malware scans, trusted apps only

5 OR2026 Annual I, Set D, Q.5 OR2.5+2.5 = 5 marks

How do Two-Factor Authentication (2FA) and Biometric Verification improve cybersecurity?

Solution

Two-factor authentication (2.5 marks)

2FA requires two separate forms of identification, from two different categories, before access to a system, account or app is given:

something you know (password or PIN);
something you have (smartphone OTP, token or smart card);
something you are (fingerprint or face).

Authentication factors used in 2FA

How it improves cybersecurity: passwords can be guessed, phished or leaked. With 2FA, if one factor is compromised the attacker still needs the second factor, so stolen passwords alone are useless. This blocks account takeover, identity theft and fraud, and alerts the user to login attempts. Example: bank login with password plus SMS code.

Biometric verification (2.5 marks)

Biometric verification confirms identity using unique physical or behavioral traits such as fingerprints, facial features, iris patterns, voice, or typing and walking patterns. The user gives a sample (fingerprint or face scan), and the system compares it with stored data; access is given only if they match.

Hard to fake or share: traits are unique, so they cannot easily be guessed or stolen by phishing.
Convenient: no password to remember, so users do not write passwords down or reuse weak ones.
Strong second factor: combined with a password, it gives very strong 2FA.
Limitation: it raises privacy concerns, because biometric data is sensitive and must be stored securely.

Using both methods together provides strong protection for accessing systems and data.

Exam focus

Differentiate between symmetric and asymmetric cryptography. (short)
Asked in both new-syllabus sets of 2026 (Set B Q.2 (v) OR, Set D Q.2 (ii) OR).
Go to answer
Explain DDoS and ransomware attacks (with spyware, virus and phishing). (long)
5-mark Section C question in 2026 Set B; also book ERQ 3.
Go to answer
How do 2FA and biometric verification improve cybersecurity? (long)
5-mark Section C question in 2026 Set D; 2FA was also a Set B short question.
Go to answer
Difference between spyware and phishing, and between ransomware and spyware. (short)
Both asked in 2026 (Set B Q.2 (v), Set D Q.2 (x)); learn the attack comparison table.
Go to answer
What are security protocols? Why are they important? Give an example. (short)
Asked in both 2026 sets and as an MCQ; the seven needs of protocols are a favourite.
Go to answer
What is identity theft? Risks of sharing private information and how to prevent it. (short)
2026 Set B Q.2 (x) and Set D Q.2 (iv) OR; book ERQ 2.
Go to answer
Describe any one cipher (Caesar) with an example; encrypt a word. (short)
2026 Set B Q.2 (xi); easy full marks with a worked example.
Go to answer
Types of security protocols: TLS/SSL, IPsec, SSH, SFTP/FTPS, HTTPS. (long)
Protocol names appear in MCQs (SSH for remote access, TLS for internet communication) and short questions.
Go to answer
Steps to troubleshoot security problems. (long)
A clear seven-step list that suits a 5-mark question.
Go to answer
Resources for equal information accessibility and collaborative tools. (long)
Covers SLO 3; likely in short or long form (OER, digital libraries, Google Drive, Trello).
Go to answer