A Data Rich World: Fourth level

Know

• DRW-4-CY-K1

  UK GDPR requires organisations to think about data security and protection at every stage of handling data.

  Learn card: Protecting data at every stage

  UK GDPR requires organisations to think about security and protection at every stage of handling personal data: when it is collected, stored, used, shared and finally deleted.

  That means collecting only what is needed, keeping it secure (for example with encryption and access controls), not keeping it longer than necessary, and disposing of it safely.

  Thinking about this when a system is first designed, not added at the end, is called data protection by design.

  UK GDPR expects organisations to protect personal data...

  only when it is stored at every stage: collecting, storing, using, sharing and deleting only when it is sent by email only on paper

  Building data protection into a new system from the start is called...

  data protection by design data poisoning brute force phishing

  Check my answers
• DRW-4-CY-K2

  End-to-end encryption locks data on the sender's device and unlocks it only on the recipient's, so no third party can read or alter it on the way.

  Learn card: End-to-end encryption

  End-to-end encryption (E2EE) locks a message on the sender's device and unlocks it only on the recipient's device. In between, including on the messaging company's servers, it stays scrambled.

  That means no third party, not even the company running the service, can read or secretly alter the message.

  E2EE protects privacy, but it also means the company can't scan messages for harmful content, and messages may be lost if a device is lost without a backup. People disagree about how to balance these.

  With end-to-end encryption, who can read the message?

  Anyone on the same wi-fi Only the sender and the recipient The messaging company The phone shop

  Where is the message locked and unlocked?

  On the company's server On the sender's and recipient's own devices In the router Nowhere

  Check my answers
• DRW-4-CY-K3

  A digital certificate is an electronic proof of identity for a person or organisation on a network, used to build trust and secure connections.

  Learn card: Digital certificates

  A digital certificate is an electronic proof of identity for a website, person or organisation on a network. It is issued by a certificate authority that browsers trust, after checking who is asking for it.

  When you visit an https website, your browser checks the certificate: is it for this exact website, is it in date, and was it issued by a trusted authority? If all is well it sets up an encrypted connection and shows a padlock.

  A valid certificate means you're connected privately to the named site, not that the site itself is trustworthy.

  What does a website's digital certificate prove?

  That the site is honest That the site really is the one named in the address That the site is fast That the site is free

  Who issues trusted certificates?

  Anyone at all Certificate authorities that browsers trust The user The wi-fi router

  Check my answers
• DRW-4-CY-K4

  Data poisoning attacks AI systems by deliberately adding false or malicious data to the training set.

  Learn card: Data poisoning

  Machine learning systems learn patterns from their training data. In a data-poisoning attack, someone deliberately adds false, misleading or malicious examples to that data.

  The system then learns the wrong thing. A spam filter might let certain spam through, or an image recogniser might misread a road sign.

  Defences include checking where training data comes from, validating it before use, and testing the model on trusted test data.

  What does a data-poisoning attack target?

  The data used to train an AI system A computer's power supply A website's colours Printer ink

  Which is a good defence against data poisoning?

  Checking and validating training data Using more colours Training on any data you can find Turning off updates

  Check my answers

  Builds on: DRW-4 Computing Science: training and test data, validation, data quality (p.26)

Do

• DRW-4-CY-D1

  Explore the advantages and disadvantages of end-to-end encryption.

  Message Path

• DRW-4-CY-D2

  Explore how to identify a digital certificate.

  Certificate Inspector

• DRW-4-CY-D3

  Identify real-world contexts where a data-poisoning attack could cause serious harm.

  Poison the Model

  Builds on: DRW-4 Computing Science: training and test data, validation, data quality (p.26); PP-4 Computing Science: social bias in AI training data (p.23)

Reflect