.webp)
The Growing Importance of Cybersecurity
As governments, businesses, and educational institutes increasingly digitize their operations, protecting sensitive information and critical digital infrastructure has become paramount. Unit 13 of the A/L ICT curriculum examines information security principles, threats, and ethical responsibilities.
1. The CIA Triad: Core Security Pillars
- Confidentiality: Ensuring information is accessible only to authorized individuals, entities, or processes (Techniques: Encryption, access control lists, multi-factor authentication).
- Integrity: Safeguarding the accuracy, completeness, and authenticity of data against unauthorized alteration (Techniques: Cryptographic hashes, digital signatures, checksums).
- Availability: Ensuring authorized users have uninterrupted access to information and resources whenever needed (Techniques: Redundancy, regular backups, DDoS mitigation).
2. Common Cyber Threats and Malware Types
- Virus: Malicious code that attaches itself to legitimate programs and replicates when the host program is executed.
- Worm: Self-replicating malware that spreads across networks without needing a host file, consuming bandwidth and system resources.
- Trojan Horse: Disguised as legitimate, useful software (e.g., a free game or utility) but carries a hidden malicious payload.
- Ransomware: Encrypts the victim's critical files and demands ransom payment for the decryption key.
- Phishing: Deceptive emails, messages, or cloned websites designed to trick users into divulging passwords, credit card details, or personal data.
3. Encryption and Cryptography
Encryption transforms readable plaintext into unreadable ciphertext:
- Symmetric Encryption: The same secret key is used for both encryption and decryption (e.g., AES). Extremely fast, but secure key distribution is challenging.
- Asymmetric Encryption: Uses a mathematically linked pair of keys—a Public Key for encryption and a Private Key for decryption (e.g., RSA). Powers HTTPS (SSL/TLS) secure internet browsing.
4. Legal and Ethical Frameworks in Sri Lanka
In Sri Lanka, computing activities are regulated by legislative acts to deter unauthorized access and protect intellectual property:
- Computer Crimes Act No. 24 of 2007: Criminalizes unauthorized access to computer systems, intentional damage to data, hacking, and introducing malware.
- Intellectual Property Act No. 36 of 2003: Protects computer software, databases, and digital creative works under copyright law.
- Electronic Transactions Act: Provides legal recognition for electronic signatures, digital contracts, and e-commerce records.
