Explain and apply data security techniques including encryption (symmetric and asymmetric), hashing, authentication and secure transmission to protect data confidentiality, integrity and availability

What this dot point is asking

QCAA wants you to explain how data is protected, both at rest and in transit, and to apply appropriate security techniques in a solution. You must understand encryption (symmetric and asymmetric), hashing, authentication, and secure transmission, and relate them to the confidentiality, integrity and availability of data. Because Unit 4 solutions exchange data over networks, security is a core design concern, not an afterthought.

The CIA triad

Security goals are summarised as three properties:

• Confidentiality: only authorised parties can read the data (achieved by encryption and access control).
• Integrity: data is not altered without detection (achieved by hashing and checksums).
• Availability: authorised users can access the data when needed (achieved by backups and resilient systems).

Every security technique maps to one or more of these, so naming the property is how you justify a design choice.

Encryption

Encryption transforms readable plaintext into unreadable ciphertext using a key. Only someone with the correct key can reverse it.

• Symmetric encryption uses the same key to encrypt and decrypt (for example AES). It is fast, good for bulk data, but both parties must already share the secret key, which is itself a distribution problem.
• Asymmetric encryption uses a key pair: a public key encrypts and a matching private key decrypts (for example RSA). Anyone can encrypt with your public key, but only you can decrypt with your private key, so no shared secret is needed up front.

In practice systems combine both: asymmetric encryption securely exchanges a symmetric session key, then fast symmetric encryption protects the actual data. This is exactly what HTTPS does.

Hashing

A hash function maps any input to a fixed-length fingerprint. A good cryptographic hash (such as SHA-256) is deterministic, fast to compute, and infeasible to reverse, and changing one bit of input changes the whole output.

import hashlib

password = "Sunshine2026!"
digest = hashlib.sha256(password.encode()).hexdigest()
print(digest)   # 64-character hex fingerprint

Two uses dominate:

• Password storage: store the hash, not the password. At login, hash the entered password and compare digests, so the real password is never stored. A per-user random salt is added before hashing to defeat precomputed-table attacks.
• Integrity checks: hash a file or message; if the recomputed hash differs, the data was altered.

Authentication and secure transmission

Authentication verifies who a user is before granting access. Techniques range from passwords (something you know) to tokens and multi-factor authentication (adding something you have or are). Authorisation then controls what an authenticated user may do.

Secure transmission protects data in transit. HTTPS uses TLS to authenticate the server with a certificate and encrypt the connection, so data exchanged over the network cannot be read or tampered with by an eavesdropper. Any data exchange in a Unit 4 solution should use HTTPS rather than plain HTTP.

How this appears in IA3

IA3 solutions exchange data, so markers expect you to identify the security risks, apply appropriate techniques (encrypted transmission, hashed passwords, validated input, access control) and justify each against confidentiality, integrity or availability. Name the technique, name the property it protects, and explain the threat it mitigates; a vague claim that the solution is "secure" earns nothing without that reasoning.