Security measures and protecting data
| English | Chinese | Pinyin |
|---|---|---|
| encryption | 加密 | jiā mì |
| antivirus | 杀毒软件 | shā dú ruǎn jiàn |
| firewall | 防火墙 | fáng huǒ qiáng |
| VPN | 虚拟专用网 | xū nǐ zhuān yòng wǎng |
| least-privilege | 最小权限 | zuì xiǎo quán xiàn |
| symmetric | 对称 | duì chèn |
| asymmetric | 非对称 | fēi duì chèn |
| public key | 公钥 | gōng yào |
| private key | 私钥 | sī yào |
| two-factor authentication | 双因素认证 | shuāng yīn sù rèn zhèng |
Defending data
- Knowing the threats, we now build the defences.
- The right measure depends on the threat — encryption 加密 for interception, authentication for access.
- At the core sits encryption: turning readable data into a locked form.
Security measures
- Standalone PC — strong password, up-to-date antivirus 杀毒软件, prompt software updates, backups, full-disk encryption, locked screen.
- Networked PC — all of the above, plus a firewall 防火墙, per-user permissions (admin rights only for admins), and audit logs.
- Across the internet — a VPN 虚拟专用网 (encrypts traffic to the gateway), HTTPS/TLS for web traffic, and intrusion detection.
A firewall sits between a computer and the internet, blocking unwanted incoming traffic.
A firewall mainly:
A firewall controls which network traffic is allowed in or out, by a set of rules.
Matching the measure to the threat
- Interception in transit → encrypt the data (HTTPS, VPN) — intercepted ciphertext is useless without the key.
- Unauthorised access → strong authentication (long passwords, two-factor), authorisation, lock-out after failed logins.
- Malware → antivirus + patching; phishing → user training + email filtering.
- Internal threats → the least-privilege 最小权限 principle (give each user only what they need) + auditing.
Match each threat to the security measure that best counters it.
Each threat has a best-fit defence — encrypt against interception, authenticate against intruders, patch against malware, limit privilege against insiders.
The best defence against data being intercepted in transit is to:
Encrypted data intercepted in transit is useless without the key. Authentication and antivirus address different threats.
Encryption
- Encryption turns plaintext into ciphertext using a key.
- Symmetric 对称 (AES) uses one shared key for both encrypting and decrypting — fast, but the key must be shared safely.
- Asymmetric 非对称 (RSA) uses a public key 公钥 (to encrypt) and a private key 私钥 (to decrypt) — solves key sharing.
- It protects data at rest and in transit.
Encryption turns plaintext into ciphertext with a key — symmetric uses one shared key, asymmetric a public/private pair
Encrypt with a Caesar cipher
Change the shift — that is the key. Each letter slides that many places along the alphabet to make the ciphertext, and the same key slides it back. That shared key is symmetric encryption in miniature.
Asymmetric encryption (e.g. RSA) differs from symmetric (e.g. AES) because it:
Asymmetric uses a public/private key pair (solving key sharing); symmetric uses one shared key (fast).
Put symmetric encryption in order, from sender to receiver.
Symmetric encryption uses one shared key both to lock (encrypt) and unlock (decrypt) — anyone intercepting the ciphertext can't read it without that key.
Symmetric encryption uses one shared key, while asymmetric encryption uses a public key to encrypt and a private key to decrypt.
That public/private split is what lets asymmetric encryption solve the problem of sharing a key safely.
Authentication
- Verify the user by something they know (password), have (token, phone), or are (fingerprint).
- Two-factor authentication 双因素认证 (2FA) combines two of these — much stronger than a password alone.
- Combine with access control (file permissions) and backups for defence in depth.
A code from a phone app is an example of which authentication factor?
A token/phone code is "something you have". Two-factor combines it with a password ("know") or biometric ("are").
You've got it
- layer defences: password/antivirus/updates/backup/encryption → + firewall/permissions/audit → + VPN/HTTPS
- match measure to threat: interception → encrypt, unauthorised access → authentication/2FA, internal → least privilege
- symmetric = one shared key (AES); asymmetric = public + private key (RSA)
- authentication = something you know / have / are; 2FA combines two