Review: security

Security is the second-largest Tech+ domain, about 18 or 19 in every 100 points, roughly thirteen questions, and Lorna asks Hana Petrovic, the library's security and accounts lead, to run the review. Hana holds Security+ and CySA+ and spends much of her week on exactly the topics Tech+ covers: passwords, multifactor authentication, phishing reports, device updates and backups. She tells Noor that Tech+ security questions are rarely about technical attacks. They are about good habits and the reasons behind them, which is why the domain matters so much for everyone who uses a computer at work, not only for security staff.

What domain 6 covers

The domain has six main areas. The first is the basic goals of security: confidentiality, integrity and availability. The second is privacy and the handling of personal information. The third is authentication, authorization and accounting, including multifactor authentication. The fourth is password practices and password managers. The fifth is device and browsing security: updates, antivirus, firewalls, safe browsing and secure use of wireless networks. The sixth is threats and protection: malware, social engineering, encryption and backups. COMP-111 lessons 8 to 11 taught these in detail. Questions here usually present a short situation and ask for the best protective action or the name of the threat.

Confidentiality, integrity and availability

Confidentiality means only authorized people can see information. Integrity means information is accurate and has not been changed without authorization. Availability means information and systems are there when authorized people need them. Together they are often called the CIA triad. Exam questions describe an incident and ask which goal it affects. A stolen laptop with unencrypted patron data is a confidentiality problem. A changed fine amount in a record is an integrity problem. A server outage that stops checkouts is an availability problem. Encryption mainly protects confidentiality, hashing and digital signatures help prove integrity, and backups, redundancy and power protection support availability.

Privacy and personal information

Privacy is about the proper handling of personal information. Personally identifiable information (PII) is any data that identifies a person, such as a name with an address, a card number, a date of birth or an email address. Organizations should collect only what they need, use it only for the stated purpose, keep it only as long as needed, protect it while they have it and dispose of it securely. Laws in both Canada and the United States set rules for how organizations handle personal information, and libraries add their own strict policies about borrowing records. Questions may ask what counts as PII, or which action best protects a person's privacy, such as shredding printed lists or not sending personal data over unencrypted email.

Authentication, authorization and accounting

Authentication proves who someone is, authorization decides what they are allowed to do, and accounting records what they did. The three together are called AAA. A staff member signing in to the circulation system is authenticating; the system then authorizes her to check out items but not to change fine policies; and the system's logs account for each action she takes. Questions often describe one of these and ask for its name. A log of who opened a file is accounting; being denied access to a folder after signing in successfully is authorization at work.

Authentication factors fall into categories: something you know (a password or PIN), something you have (a phone app, a security key or a smart card), something you are (a fingerprint or face), and sometimes somewhere you are (location). Multifactor authentication (MFA) requires factors from two or more different categories. A password plus a code from an authenticator app is MFA; a password plus a security question is not, because both are things you know. Single sign-on (SSO) lets one authentication give access to several systems, which reduces the number of passwords people manage but makes that one sign-in especially important to protect.

Passwords

Current password advice favours length over complexity. A long passphrase of several unrelated words is far harder to guess than a short password with symbols, and easier to remember. Every account should have a unique password, because criminals take passwords leaked from one website and try them on others. A password manager stores strong, unique passwords for every account behind one strong master password, ideally protected by MFA, and many browsers include one. Passwords should never be shared, written on sticky notes on the monitor, or reused. Changing passwords on a fixed schedule is less useful than changing them immediately when a breach is suspected, and many organizations now follow that approach.

Device and browsing security

Device security starts with updates. Operating system and application updates close known vulnerabilities, so devices should update automatically or on a managed schedule. Antivirus or anti-malware software detects and removes malicious programs. A host firewall controls which network connections the device accepts. Screens should lock automatically after a short idle time, and devices should be encrypted so that a lost laptop does not expose its data. On mobile devices, apps should come from official stores and receive only the permissions they need.

Safe browsing means checking the domain name before entering credentials, being wary of unexpected downloads and pop-ups, keeping the browser and its extensions updated and few in number, and treating certificate warnings seriously. Public Wi-Fi, such as the library's own patron network, should be treated as untrusted: use HTTPS sites, avoid sensitive tasks when possible, and consider a virtual private network (VPN), which encrypts traffic between the device and the VPN provider.

Threats and protection

Malware is software designed to harm. A virus attaches to files and spreads when they are run; a worm spreads across networks by itself; a Trojan pretends to be useful software; ransomware encrypts files and demands payment; spyware secretly collects information; adware pushes unwanted advertising; and a keylogger records keystrokes. Social engineering tricks people instead of computers. Phishing uses fraudulent emails, smishing uses text messages, and vishing uses phone calls. Impersonation pretends to be someone trusted, such as an IT technician or a manager. Shoulder surfing is watching someone type a password; dumpster diving is searching discarded paper for useful information; tailgating is following an authorized person through a secure door.

Encryption converts readable data into a form that only someone with the key can read. Data at rest, stored on a drive or in the cloud, is protected by drive or file encryption. Data in transit, moving across a network, is protected by HTTPS, VPNs and encrypted Wi-Fi. Backups protect availability and integrity against hardware failure, mistakes and ransomware. A common guideline is the 3-2-1 rule: keep at least three copies of important data, on two different kinds of storage, with one copy off site. Backups only count if they can be restored, so they must be tested.

Physical security and disposal

Not every security question is about software. Physical security protects devices and paper from being stolen, seen or tampered with: locked server rooms, cable locks on public laptops, badge access to staff areas, privacy screens on computers that face the public, and a clear-desk habit so that printed patron lists are not left on the counter. Secure disposal matters as much as secure storage. Paper with personal information should be shredded, not thrown in the recycling. Drives from retired computers should be wiped with a proper data-erasure tool or physically destroyed, because deleting files or even reformatting a drive often leaves the data recoverable. The library's retired lab computers go to a certified recycler only after their drives have been erased and the erasure has been logged.

How security questions are built

Hana shares the pattern she sees in entry-level security questions. Many offer several answers that would all improve security a little, and ask for the best one. The best answer is usually the one that addresses the specific risk in the scenario most directly and most reliably. If a scenario is about stolen passwords, MFA is usually stronger than a longer password policy, because it protects even when the password is known. If it is about losing a laptop, encryption beats a strong screen lock, because the data stays protected even if the drive is removed. If it is about ransomware, a tested offline backup beats everything else for recovery, while updates and careful email habits are the best prevention.

A second pattern is the reporting question. When a user notices something suspicious, such as an odd email, an unknown USB stick left in the lab or a stranger asking for a password over the phone, the best answer is almost always to report it through the organization's process rather than to investigate alone. Reporting lets the security team see patterns across many users and act quickly. Organizations support this with an acceptable use policy, which sets out what staff may and may not do with technology, and with regular awareness training. A question that asks what a user should do after clicking a phishing link has the same answer: report it immediately, because speed limits the damage.