Security and Social/Ethical Issues
What the domain tests
Security and Social/Ethical Issues tests threat models, controls, cryptography, authentication, and the legal/ethical responsibilities of computing professionals. Expect phishing/malware, access control, encryption vs hashing, digital signatures, privacy, copyright and acceptable-use reasoning.
Core rules
- Confidentiality, integrity and availability (CIA) guide controls. Authentication proves identity; authorisation grants permissions; accounting/auditing records actions.
- Symmetric encryption uses one shared key (fast, key-distribution problem). Asymmetric encryption uses a public/private key pair (slower, solves key exchange).
- Hashing is one-way and detects change; salting prevents precomputed rainbow-table attacks. Encryption is reversible; hashing is not.
- Digital signature: sign with sender’s private key; verify with sender’s public key. For confidentiality: encrypt with receiver’s public key; receiver decrypts with private key.
- Ethical/legal issues include data protection, consent, intellectual property, accessibility and professional codes.
Worked example
Alice must send Bob a confidential message that Bob can prove came from Alice. She encrypts the message with Bob’s public key, then signs the ciphertext (or signs a hash of the message) with her private key. Bob decrypts with his private key and verifies the signature with Alice’s public key. Reasoning: Bob’s public key ensures only Bob can decrypt; Alice’s private key ensures only Alice could have produced the signature. This combines confidentiality and authenticity.
Traps
Do not say hashing encrypts data. Do not use the receiver’s private key to encrypt. Do not confuse authentication with authorisation. HTTPS protects data in transit, not data at rest. A strong password is not a substitute for MFA. Public keys are public; private keys must remain secret. Ethical questions require stakeholder reasoning, not just saying it is illegal.