Computer Security
Computer security is the practice of protecting computers, networks, programs, and data from unauthorized access, damage, or attack. As computers handle more of our personal, financial, and professional lives, securing them becomes increasingly important for every user — not just IT professionals.
The CIA Triad: The Three Goals of Security
Every security principle in computing comes back to three goals, often called the CIA Triad:
┌────────────────────────────────────────────────────┐ │ CIA TRIAD │ │ │ │ ┌───────────────┐ │ │ │Confidentiality│ Only authorised people │ │ │ │ can see the data │ │ └───────────────┘ │ │ │ │ ┌───────────────┐ │ │ │ Integrity │ Data is accurate and │ │ │ │ has not been altered │ │ └───────────────┘ │ │ │ │ ┌───────────────┐ │ │ │ Availability │ Systems and data are │ │ │ │ accessible when needed │ │ └───────────────┘ │ └────────────────────────────────────────────────────┘
An attacker might break confidentiality (reading your private messages), integrity (changing a bank balance), or availability (crashing a website so users cannot access it). Security measures defend against all three types of attack.
Common Threats
Malware
Malware is malicious software designed to damage, disrupt, or gain unauthorized access to a computer system.
Type of Malware │ How It Works ─────────────────┼────────────────────────────────────────────────── Virus │ Attaches itself to files; spreads when files are shared Worm │ Self-replicates across networks without user action Trojan │ Disguises as legitimate software; runs hidden harmful code Ransomware │ Encrypts your files; demands payment for the decryption key Spyware │ Secretly collects personal data (passwords, browsing habits) Adware │ Forces unwanted advertisements; may also collect data Keylogger │ Records every keystroke to steal passwords and messages Rootkit │ Hides deep in the OS; gives attackers persistent access
Phishing
Phishing is a social engineering attack where criminals send fake emails, messages, or create fake websites that appear to be from a trusted source (a bank, a popular website, a government agency). The goal is to trick you into revealing passwords, credit card numbers, or other sensitive information.
Phishing Email Example: ───────────────────────────────────────────────────────────── From: security@yourbank-alert.com ← Note: fake domain Subject: Urgent! Your account has been suspended Dear Customer, Click here to verify your account immediately or it will be closed. [Click Here] → takes you to a fake login page that steals your password ───────────────────────────────────────────────────────────── Warning signs: urgency, misspelled domain, generic greeting
Man-in-the-Middle Attack (MitM)
In a MitM attack, an attacker secretly intercepts and possibly alters communication between two parties. Using unencrypted public Wi-Fi exposes you to this type of attack. The attacker sits invisibly between your device and the server, reading or modifying data that passes through.
DDoS Attack (Distributed Denial of Service)
A DDoS attack floods a server or network with enormous amounts of traffic from many compromised computers, making the service unavailable to legitimate users. Major websites, banks, and government services are frequent targets.
SQL Injection
SQL injection is an attack against databases. Attackers enter specially crafted text into input fields on websites (like login forms) to manipulate the database behind the site. A vulnerable login form might accept ' OR '1'='1 as a password and grant access to all accounts.
Security Measures
Strong Passwords and Multi-Factor Authentication
A strong password is long (12+ characters), uses a mix of uppercase, lowercase, numbers, and symbols, and is unique for every account.
Weak password: password123 Strong password: Tr$mK9!bLp2@vQ Time to crack by brute force: password123 → under 1 second Tr$mK9!bLp2@vQ → billions of years
Multi-factor authentication (MFA) adds a second verification step beyond the password — a one-time code sent to your phone, a fingerprint scan, or a physical security key. Even if an attacker steals your password, MFA stops them from logging in.
Encryption
Encryption converts readable data (plaintext) into an unreadable scrambled form (ciphertext) using a mathematical algorithm and a key. Only someone with the correct key can decrypt it back to readable form.
Plaintext: Hello + Key applied = Ciphertext: Xu8#kLm (meaningless without the key)
HTTPS encrypts web traffic. WhatsApp uses end-to-end encryption (only sender and receiver can read messages). Full-disk encryption protects data on a stolen laptop.
Firewall
A firewall monitors and controls incoming and outgoing network traffic based on security rules. It acts as a gatekeeper — blocking unauthorized connections while allowing legitimate traffic through.
Internet → [Firewall] → Your Network
│
├── Allows: Port 443 (HTTPS), Port 80 (HTTP)
└── Blocks: Unknown ports, suspicious IP addresses
Firewalls can be hardware (a physical device) or software (like Windows Defender Firewall). Organizations use both layers.
Antivirus and Anti-Malware Software
Antivirus software scans files and programs for known malware signatures and suspicious behaviour. It runs in the background, checking new files as they arrive and periodically scanning the entire system. Modern antivirus uses behavioural analysis — identifying threats by what they do, not just matching known signatures.
Software Updates and Patches
Most successful attacks exploit known vulnerabilities in outdated software. When developers discover a vulnerability, they release a security patch. Users who do not update remain exposed to attacks that use that vulnerability. Running updates promptly is one of the most effective security habits.
Backups
Regular backups protect against ransomware, hardware failure, and accidental deletion. The 3-2-1 backup rule is a reliable standard:
3 copies of your data 2 on different storage media (e.g., internal drive + external drive) 1 stored off-site or in the cloud
Safe Online Habits
- Always check for HTTPS before entering passwords or payment details.
- Do not click links in unsolicited emails — go directly to the website instead.
- Use a password manager to generate and store unique passwords for every account.
- Enable MFA on all accounts that support it.
- Avoid using public Wi-Fi for banking or sensitive tasks without a VPN.
- Do not download software from unofficial or untrustworthy sources.
- Lock your screen when you leave your computer unattended.
Privacy vs Security
Security protects data from unauthorized access. Privacy controls who collects your data and how it is used. Both matter. A system can be secure (no outsiders can access your data) but still violate your privacy (the company itself uses your data in ways you did not consent to). Understanding both helps you make better choices about the software and services you use.