In modules one and two, we've covered user accounts and passwords. Remember, we use accounts and passwords to authenticate with systems to prove who we are. Once the system knows who we are, it can then decide what we can access and what we're allowed to do. You might recall this is known as authorisation, and one important part of authorisation is controlling access to data and files, and that's the subject of our next module. So, by the end of this module you'll be able to understand the concepts of user profiles and home folders, you'll be able to identify common file systems and their uses, understand file permissions and folder sharing, and understand different types of encryption and their uses for protecting data at rest.

When we looked at user accounts, it was recommended that each person that uses a computer has got a separate account. This not only helps to keep our accounts secure, but it also allows each user to have their own personal settings and an area for data storage. On operating systems such as Windows, macOS and Linux, each person that logs in will have a personal storage area on the computer where their individual settings and files are stored. On Windows this is called a user profile, and on other operating systems it's usually known as a home folder. If you look on the hard disc of the computer there'll be a folder called 'Users' and in there, there's a separate folder for each person that has an account. By having a separate user profile or home folder, each user can personalise many of the settings such as the wallpaper, app preferences and also security settings, and there's also a folder for that user's documents, pictures and music. But if you've got multiple people sharing the same computer, how does the operating system make sure that they can't access each other's information? Well, this is where file systems come into play.

So, what exactly do we mean by file system? Well, when we store information on storage devices such as hard discs, memory cards and USB sticks, a file system controls the way that information is stored. So basically, a file system is a way of standardising how information is stored and retrieved from the storage devices. The file system keeps track of what folders there are, what files are stored in each folder, and where in the space on the storage device each of the file’s lives. In the slide, we've a list of some of the common file systems used by different operating systems. It's important to know that each operating system will only understand certain file systems without adding extra software. In each operating system there's a default, preferred file system that it uses. For example, Windows computers use the NTFS file system by default and Macs use APFS. NTFS is short for New Technology File System, and APFS stands for Apple File System. And can you spot a file system in that list that's got a major difference to the others?

Well, the answer is File Allocation Table, or FAT. FAT has no security, which means there's no way to control access to the individual files when they're stored, whereas all the others provide some sort of file system security. So, why would we wanna use FAT if it can't provide any security for the stored files? Well, the thing that FAT has as an advantage is that it's understood by all operating systems, meaning it's a great choice for portable storage, such as USB sticks and flash cards, that might be used on lots of different devices. When you buy removable storage devices, they usually come pre-formatted with FAT. That means you can plug them into almost anything such as a computer, a camera or a TV, and the device will be able to read and write the files on the storage.

Windows computers use NTFS, which provides security for every file and folder. Likewise, macOS and Linux have file system security, and that operates in a similar way. If we were to right-click a folder or a file in Windows and look at its properties, there's a Security tab, and you can see an example of this on the slide. Security's controlled using permissions, which can be set differently for different users. So, to stop other people from accessing our user profiles, Windows sets the permissions on the files and folders so only the individual users have got access. The files that make up the Windows operating system are also secured with permissions to protect them from accidental deletion or being replaced with unauthorised versions, and each time a file's created there are some default permissions applied. The defaults depend on where the file is created. It'll be different for different types of users.

The common permissions that are used include 'Read', which allows someone to open the file in the app and read its contents, 'Write', which allows them to make changes to contents of the file but they can't delete or rename the file. If a file's an app or a program, you'll need 'Read and Execute' to be able to run it. 'Modify' gives you everything you get with 'Read' and 'Write', and it also gives the ability to rename the file and delete it. And 'Full Control', well that gives you everything including the ability to change the file security. As well as the default permissions, it's also possible to add more, or even take some permissions away. This is something that needs to be done very carefully because giving too much access might make the file insecure, and not enough access could stop things from working properly. Managing access to things is something that needs to be a fine balance, so we can give people just enough access to do what they need to do.

Most operating systems will also allow us to share files and folders with other users. File and folder sharing is the process of making a folder and its contents accessible from the network, so it's basically a means of sharing over the network. Sharing isn't needed if people share the same computer as they won't need to use the network. Sharing folders and files, it's a great feature if you've got multiple computers at home and you just want to transfer the files over your home network. An account with administrator privilege is needed to enable file sharing, and it's not usually enabled by default on newer versions of Windows and macOS. You should think very carefully about the security implications of sharing folders on a network, particularly if it's a public network. So, make sure you know not only how to share a folder, but also how to enable and disable the feature in your operating system. In Windows, sharing can be enabled or disabled for different types of networks, so you could enable sharing on your home network but disable it when using public networks. But if you're not using file sharing at all, it's better to turn it off.

Permissions provide a great way to protect individual files and folders, but we need to understand that the permissions are being enforced by the operating system. Now, that means that they're only being applied while the operating system is running. If someone was able to get physical access to the device, they might be able to bypass the operating system and therefore bypass the file system security. We can add an extra layer of protection to data when it's stored by using encryption, and this'll protect the files even when the operating system isn't running. Before we get into this, let's just review the basic concepts of encryption.

The idea of encryption is to scramble information in a way that makes it unreadable to unauthorised people. When we encrypt information, we use an encryption algorithm and an encryption key. The encryption algorithm is a mathematical formula which takes the original information, known as the plaintext, and uses the encryption key to create a scrambled representation of that information, which we call a ciphertext. The ciphertext can only be unscrambled using a decryption algorithm and a decryption key, and there are many different algorithms used for this but one of the most popular ones is the Advanced Encryption Standard, or AES, and the algorithms can make use of symmetrical or asymmetrical keys.

With symmetrical key encryption, the same key is used to both encrypt and decrypt the data. Symmetrical key encryption is fast, but it's got challenges with key management. For example, imagine if I encrypted some data using symmetrical key encryption. Only someone with the key would be able to decrypt the ciphertext. But if I want one of my friends to be able to decrypt, how do I get a copy of that key to them safely? If I send the key to them via the internet for example, what happens if someone intercepts the key? And also, because there's only one key to encrypt and decrypt, I'd need to make sure I use a different key every time I wanted to keep encrypted data secure when I'm sharing it with different people.

With asymmetrical encryption, there are two different keys. The keys are mathematically related but in way where one key can't be used to work out the other. With asymmetrical encryption, when information's encrypted with one key, it can only be decrypted with the other corresponding key. Asymmetrical keys are usually known as public and private keys. The private key is kept secret to an individual or a system, and it's never exposed to anyone else. But the public key can be made freely available to anyone that needs it. Now, if someone encrypts some information with my public key, the only thing that can be used to decrypt that information is my private key, and if only I have my private key then only I can decrypt the ciphertext.

Asymmetrical key encryption is slow compared to symmetrical, so it's not usually used for protecting large amounts of data. However, where it is widely used is a way to securely send a symmetrical key. So, if I encrypt some data with a symmetrical key, I can now send that symmetrical key to my friend securely by encrypting it as the plaintext with their public key. If I send the encrypted ciphertext to my friend, nobody can access it because it can only be decrypted with their private key. To decrypt the message, my friend uses their private key, and that gives them the symmetrical key I used to encrypt the data, so my friend can decrypt the data with the symmetrical key, and this is how most encryption systems work.

We can also use public and private keys the other way around. If I encrypt something with my private key, then only my public key can decrypt it. Now, remember that my public key is available to everyone, which means that anyone could decrypt the message. So, you might think, 'Well, what's the point of that?' Well, only I have my private key, so if something can be decrypted with my public key, it must've been encrypted with my private key and therefore it must've been encrypted by me, and we call this a digital signature, and it's used to prove where something came from, and we'll talk more about this later.

When we use asymmetrical encryption, we need a way to store and distribute public keys, and this is the purpose of digital certificates. A digital certificate is an electronic document which can be used to store and securely transfer a public key. And as well as containing the public key, the digital certificate also confirms the owner of the key, what it can be used for, and its validity period. Digital certificates are issued by online systems called certificate authorities.

We use encryption in many different ways to keep information and technology safe, and here are some examples. Confidentiality, which makes sure that only certain people can access the information. Authentication, which is proving that something is what it says it is or prove that something came from a certain personal system. Integrity, which proves the information hasn't been modified in any way. And non-repudiation, which is proof that an action or event took place and can't be denied.

So, coming back to data security. When we encrypt data when it's stored, this is known as encrypting data at rest. This means that it's encrypted while it's physically stored, but it'll be decrypted when it's accessed and used. Protecting data at rest can be done for individual files, or it can also be done for an entire hard disc. Operating systems such as Windows and macOS have built-in technologies for encrypting data at rest. For example, in Windows, there's the encrypting file system which protects individual files, and BitLocker, which is a full-disc encryption system. The BitLocker's only available on the business additions, but if you've got the home addition it uses something called device encryption which is actually very similar to BitLocker.

macOS has FileVault, which can protect individual files, but it's typically enabled for all files on a disc. The latest versions of Windows and macOS, as well as mobile phones, they'll usually encrypt the storage by default. This is a useful step to making sure the data's kept safe. Say, for example, if the device gets stolen. But it's important to make sure you know how to look after encryption systems used by your operation systems. If something goes wrong, you'll need access to the recovery keys, otherwise there's a chance that you could lose access to some of your data, or possibly even the entire system. So, make sure you investigate this and find out how to look after recovery keys, just in case something does go wrong.

It's now time for us to do another lab. So far, we've seen how operating systems use authentication to prove the identity of each user. Login's required these days, and it can't be disabled. Even if you've got a blank password, you're still being logged on. Remember, the security controls which restrict access to the computer are enforced by the operating system. If an attacker can get physical access to the computer, it might be possible to bypass the operating system and all of its security. In Lab 9, you're going to use a different computer called Victim, so make sure you follow the lab instructions carefully to switch over. You're going to boot the Victim computer with the Windows installation DVD. When you boot with the Windows DVD, you'll be running something called Windows PE, and Windows PE is basically a cut-down version of Windows used to install Windows or run its recovery tools.

In the lab, you're going to access the Windows recovery tools, which are usually used for troubleshooting boots and other technical problems with the Windows computers, but you're going to use the recovery environment to bypass the Windows operating system and all of its security systems. With the operating system's security bypassed, you're going to be able to access and change all of the operating system files. Now, although the recovery tools can access the files on the computer, it doesn't enforce any of the NTFS permissions, so you'll have full access to every file, including the operating system files. You'll use the command prompt in the recovery tools to change one of the system files.

The file that you're going to change normally displays accessibility options, and it's available before anyone logs in. You'll replace this with the command prompt programme, which means when Windows boots up you'll have a command prompt without even having to log in, and you're then going to use that command prompt to change a user's password without ever having to log in as that user or anybody else. So, make sure you follow the instructions carefully, and notice using the different lab computer called Victim. The instructions will tell you to switch to the Victim computer using the home tab on the instruction panel. And also, to unlock this section of the labs, you'll need to enter the access code 43868.

Module 3: Data security

About