Firewalls, Antivirus, Encryption, Access Control and IDS in Secure Environments

Posted on Nov 5, 2026 in Computers

Discuss Firewalls, Antivirus, Encryption, Access Control, and IDS in a Secure Environment (10 Marks)

A secure information environment protects data, devices, networks, and applications from unauthorised access, malware, theft, and disruption. Multiple layers of security are used because no single control can prevent every attack.

1. Firewalls

A firewall filters network traffic using security rules. It can restrict unauthorised connections, inspect connection state, support network segmentation, and log events. Example: block direct external connections to an internal database.

2. Antivirus/Anti-Malware

Security software scans files and applications, detects known malicious patterns or suspicious behaviour, and may quarantine or remove threats. Example: quarantine a malicious email attachment. Its detection is not perfect, so updates and other controls remain necessary.

3. Encryption

Encryption transforms plaintext into ciphertext using a cryptographic algorithm and key. Symmetric encryption uses the same secret key for encryption and decryption; asymmetric cryptography uses a related public/private key pair. AES is an example of symmetric encryption and RSA an example of an asymmetric algorithm. Encryption helps protect stored and transmitted data.

4. Access Control

Access control determines who may access a resource and which actions they may perform. RBAC assigns permissions by role; DAC lets resource owners grant access under system rules; MAC enforces centrally defined policy labels. Example: students view their own records while authorised staff update assigned records.

5. IDS

An IDS monitors network or host activity to identify suspicious behaviour and generate alerts. NIDS monitors network traffic; HIDS monitors an individual system. IDS logs help investigate incidents. It generally detects and alerts, whereas an IPS can take blocking action.

6. How They Work Together

A firewall restricts network paths; antivirus detects malware on endpoints; encryption protects data if storage or communication is exposed; access control limits what accounts can do; IDS detects suspicious activity. Together they provide layered protection.

Cyber Security • Complete Answers Study Guide

7. Limitations and Supporting Measures

A firewall may allow malicious traffic over permitted connections; antivirus may miss novel threats; encryption does not prevent misuse after data is decrypted; access controls cannot eliminate every compromised-account risk; IDS alerts need investigation. Add backups, patching, user education, monitoring, and incident response.

Conclusion

These mechanisms are complementary. When configured and maintained together, they reduce risk and improve the confidentiality, integrity, and availability of information.

2(b). Differentiate Between Viruses, Worms, Trojan Horses, and Spyware (5 Marks)

These are different types of malware, distinguished by how they spread and what they are designed to do.

Virus

Attaches to a host file or program and usually spreads when that host is executed. It may damage or corrupt files.

Worm

Can replicate and spread independently, often by exploiting network vulnerabilities. It may consume bandwidth and system resources.

Trojan Horse

Disguises itself as legitimate software and tricks a user into installing it. It may create unauthorised access or install other malware.

Spyware

Secretly monitors activity or collects information, such as browsing history or credentials.

3(a). Explain the CIA Triad in Detail and How It Protects Sensitive Information (10 Marks)

Information security protects information and systems against unauthorised access, disclosure, modification, destruction, or disruption. The CIA Triad is a fundamental model based on confidentiality, integrity, and availability.

1. Confidentiality

Confidentiality ensures that information is available only to authorised people, systems, or processes. It protects privacy and prevents unauthorised disclosure. Measures include authentication, access control, encryption, and multifactor authentication. Example: only authorised faculty members can access particular student records.

2. Integrity

Integrity ensures that information remains accurate, complete, and protected against unauthorised or improper modification. Measures include hashing, digital signatures, access permissions, input validation, and audit logs. Example: permissions restrict who can change examination marks, while audit logs record changes.

3. Availability

Availability ensures that information and services can be accessed by authorised users when required. Measures include backups, redundant servers, disaster recovery, system maintenance, and DDoS protection. Example: a university portal remains accessible during registration and results periods.

Diagram to Draw

Draw a triangle and label its three corners Confidentiality, Integrity, and Availability. Under each label write: prevents unauthorised disclosure; prevents unauthorised modification; ensures access when needed.

4. Applications

In banking, confidentiality protects account details, integrity maintains accurate balances, and availability keeps banking services accessible. In healthcare, confidentiality protects patient records, integrity preserves correct medical information, and availability ensures clinicians can access records when needed. In education, the principles protect student records, examination marks, and portal access.

5. If a Principle Is Violated

A confidentiality breach may expose personal data; an integrity breach may alter marks or balances; an availability failure may make a website or database inaccessible. A single incident can affect more than one principle.

Conclusion

The CIA Triad helps organisations protect sensitive information by keeping it private, accurate, and available to authorised users.

2(d). What Is an IDS? Explain Its Main Functions (5 Marks)

Intrusion Detection System (IDS) monitors network traffic or host activity to identify suspicious behaviour and possible security violations.

Main Functions

• Monitors network or system activity.
• Detects known attack patterns and unusual behaviour.
• Generates alerts for administrators.
• Records events and supports log analysis.
• Helps investigate incidents and policy violations.

Types and Methods

A Network-based IDS (NIDS) monitors network traffic; a Host-based IDS (HIDS) monitors an individual device. Signature-based detection looks for known patterns, while anomaly-based detection looks for deviations from normal behaviour.

Example

An IDS detects repeated login attempts against a server and alerts the administrator.

Conclusion

An IDS improves threat visibility; unlike an IPS, it generally detects and alerts rather than automatically blocking traffic.

2(e). Explain Firewall Functions and How It Prevents Unauthorised Access (5 Marks)

A firewall monitors

1(a). Define an Information System and State Its Main Purpose (3 Marks)

An Information System (IS) is an organised combination of people, hardware, software, data, and procedures that collects, processes, stores, and distributes information.

Main Components

• Hardware: Physical devices such as computers and servers.
• Software: Programs that process data.
• Data: Facts that can be processed into meaningful information.
• People and procedures: Users, administrators, and the rules used to operate the system.

Purpose and Example

Its main purpose is to provide accurate and timely information for decision-making, communication, and efficient operations. For example, a university information system manages student records, attendance, and examination results.

1(b). State the Three Fundamental Principles of the CIA Triad (3 Marks)

The CIA Triad is a basic information-security model containing three principles:

• Confidentiality: Information should be accessible only to authorised users. Example: password-protected student records.
• Integrity: Information should remain accurate, complete, and protected from unauthorised changes. Example: preventing unauthorised alteration of marks.
• Availability: Information and services should be accessible to authorised users when needed. Example: a university portal being available when students check results.

Conclusion

The three principles protect the privacy, accuracy, and accessibility of information.

1(c). What Is Malware? Give Any Two Examples (3 Marks)

Malware means malicious software intentionally designed to damage systems, disrupt operations, steal information, or obtain unauthorised access.

Examples

• Virus: Malicious code that attaches to a file or program and spreads when the infected host is executed.
• Ransomware: Malware that encrypts files or otherwise blocks access and demands payment.

Prevention

Use updated security software, keep systems patched, and avoid suspicious links and attachments.

1(d). What Is a Firewall, and How Does It Protect a Network? (3 Marks)

A firewall is hardware, software, or a combination of both that monitors and controls incoming and outgoing network traffic according to security rules.

How It Helps

• Blocks traffic that violates configured rules.
• Allows legitimate connections and restricts unauthorised access.
• Can filter traffic using IP addresses, ports, protocols, and connection state.

Example

A firewall may allow access to a public university website while blocking unauthorised connections to its internal database.

1(e). Define Phishing and Mention One Method to Prevent It (3 Marks)

Phishing is a cyberattack in which an attacker impersonates a trusted person or organisation to trick a user into revealing information such as passwords, bank details, or OTPs.

Example

A fake university email asks a student to click a link and enter their login credentials.

Prevention

Verify the sender and website address before clicking links or entering sensitive information. Never share passwords or OTPs in response to suspicious messages.