Grade by Grade
C. Computer Environments and Systems · Computer Environments and Systems

Building a System Protection Plan

C2.2About 70 minutes
Learning goals
  • I can describe procedures that protect data and programs from malware: updates, anti-malware software, firewalls, strong passwords, multi-factor authentication, standard user accounts and safe habits.
  • I can calculate how password length and character choice change the time needed to guess a password.
  • I can devise a thorough, written system protection plan for a real computer, including what to do if malware gets in.

Words to know

patch (security update)
A software update that fixes a security hole.
anti-malware (antivirus) software
A program that scans files and activity for malware, blocks it and removes it.
firewall
Software or hardware that checks network traffic and blocks connections that are not allowed.
multi-factor authentication (MFA)
Signing in with two or more different kinds of proof, such as a password plus a code from your phone.
password manager
A program that creates and stores a different strong password for every account, protected by one master password.
principle of least privilege
Give each user and program only the access it needs. Use a standard account day to day, not an administrator account.
defence in depth
Using several layers of protection, so if one fails the others still protect you.
incident response
The planned steps to take when something goes wrong, such as a malware infection.

Locks, alarms and a spare key

A home in a snowy Ontario town might have locks on the doors, a smoke alarm, a neighbour who watches the house when the family is away, and insurance in case all else fails. No single protection is perfect, so there are layers.

Computers are the same. In the last lesson you met the malware threats. Now you will build a system protection plan: a written list of the layers of protection for a computer, who is responsible for each one, how often it is checked, and what to do if something gets through. Security experts call this defence in depth.

Safe habits: think before you click or downloadFirewall and a secured networkUpdates (security patches)Anti-malware with real-time scanningStrong passwords, MFA, standard user accountYour dataBackupsthe safety netif every layerfails (next lesson)
Defence in depth: each layer stops some attacks; together they stop most. Backups sit outside the layers as the safety net that lets you recover when something gets through.

The layers of protection

  1. Keep everything updated. Turn on automatic updates for the operating system, the browser and every app. Many attacks, especially worms, use security holes that a patch already fixed. Remove programs you no longer use, since unused programs still need updates.
  2. Use anti-malware software. Windows includes Microsoft Defender, and macOS has built-in protections; other trusted products exist. Keep real-time protection on, keep it updated, and run a full scan regularly. Use only one real-time antivirus program; two can conflict.
  3. Turn on the firewall. A firewall checks network traffic and blocks connections that are not allowed. Operating systems include one; home routers have one too. Change the router's default admin password and use WPA2 or WPA3 encryption on home Wi-Fi.
  4. Strong, unique passwords and MFA. Use a long password or passphrase, a different one for every account (a password manager makes this possible), and turn on multi-factor authentication for email, school and gaming accounts. Your email matters most, because it can reset all your other passwords.
  5. Least privilege. Use a standard user account for everyday work and keep the administrator account for installing software. Malware that runs in a standard account has less power to change the system.
  6. Safe habits. Download software only from official sources or app stores; never run "cracked" programs or game cheats; keep file extensions visible; check links before clicking; leave macros disabled unless you trust the document's source; be careful on public Wi-Fi; lock your screen (Windows key + L on Windows) when you step away.
  7. Backups. Keep regular backups, with one copy disconnected from the computer, so ransomware cannot reach it. The next lesson, Backing Up and Archiving Files, covers this in detail.
  8. Incident response. Decide in advance what to do if you suspect malware: disconnect from the network, tell the right person, scan, change passwords from a clean device, restore from backup.

Why long passwords win

An attacker who steals a database of scrambled passwords can try billions of guesses per second on their own computers. The number of possible passwords is

(number of possible characters) ^ (length)

so every extra character multiplies the work. Length matters more than odd symbols. A passphrase of several random words is long and easy to remember. The program below assumes an attacker can test 10 billion guesses per second and works out how long it would take to try every possibility (on average they would find it in about half that time).

def time_to_try_all(alphabet_size, length, guesses_per_second=10_000_000_000):
seconds = alphabet_size ** length / guesses_per_second
if seconds < 3600:
return str(round(seconds, 1)) + " seconds"
days = seconds / 86400
if days < 365:
return str(round(days, 1)) + " days"
return f"{round(days / 365.25):,} years"
print("8 lowercase letters:", time_to_try_all(26, 8))
print("8 mixed characters: ", time_to_try_all(94, 8))
print("12 mixed characters:", time_to_try_all(94, 12))
print("5 random words: ", time_to_try_all(7776, 5))

94 is the number of keyboard characters: 26 lowercase, 26 uppercase, 10 digits and 32 symbols. 7776 is the number of words in a common word list used for random passphrases. A password made from real names or common words falls much faster, because attackers try those first. Output (one line each): 8 lowercase letters: 20.9 seconds / 8 mixed characters: 7.1 days / 12 mixed characters: 1,508,100 years / 5 random words: 90 years

🔑Something you KNOWpasswordPIN+📱Something you HAVEphone app codesecurity key+👆Something you AREfingerprintface scanMFA = two or more DIFFERENT kinds. A stolen password alone is not enough.
Multi-factor authentication combines different kinds of proof. Two passwords would not count as MFA, because both are "something you know".
Worked example

Example 1: Compare two passwords

Which is stronger against guessing: Tr0ub!e7 (8 characters chosen from 94) or maple hockey lantern river (4 random words from a 7776-word list)? Use 10 billion guesses per second.

  1. 8 characters from 94: 94⁸ ≈ 6.10 × 10¹⁵ possibilities. ÷ 10¹⁰ ≈ 610 000 s ≈ 7.1 days to try them all.
  2. 4 random words from 7776: 7776⁴ ≈ 3.66 × 10¹⁵ possibilities. ÷ 10¹⁰ ≈ 366 000 s ≈ 4.2 days.
  3. They are close, and the 8-character password is slightly stronger. But adding just one more word multiplies the passphrase by 7776: 5 words take about 90 years. The passphrase is also much easier to remember and type.
  4. Both are only strong if they are random. Password1! is 10 characters but is one of the first guesses attackers try.

About 7.1 days versus 4.2 days: similar. A 5-word passphrase (about 90 years) beats both and is easier to remember. Turn on MFA as well.

Worked example

Example 2: Devise a protection plan

Write a system protection plan for the Patel family's shared Windows laptop. Two parents use it for banking and work; a Grade 11 student uses it for school and gaming; a Grade 6 student plays games.

  1. Accounts and least privilege: each person gets their own account; only the parents' accounts are administrators. Kids' accounts are standard users, so installing software needs a parent.
  2. Updates: automatic Windows and app updates on; a parent checks Settings → Windows Update on the first Saturday of each month and restarts if needed. Uninstall games no one plays.
  3. Anti-malware and firewall: Microsoft Defender real-time protection and firewall on; full scan monthly; router admin password changed from the default; Wi-Fi uses WPA2 or WPA3.
  4. Passwords and MFA: a password manager for the parents; MFA on email, banking, school and gaming accounts; no shared passwords between accounts.
  5. Safe habits (posted beside the laptop): games only from the official store; no cheats or "free" paid software; never click Enable Content on unexpected documents; lock the screen when leaving.
  6. Backups: weekly backup to an external drive that is unplugged and stored away afterwards, plus cloud sync for school files.
  7. Incident response: if anything looks wrong, turn off Wi-Fi, tell a parent, run a full scan, change passwords from a phone, restore files from the backup.

A plan that covers accounts, updates, anti-malware, firewall, passwords and MFA, habits, backups and incident response, each with who does it and how often.

Just for fun

Lists of leaked passwords published by security researchers have had 123456 at or near the top for years. If your password could also be the combination on a suitcase, it might be time for a change.

Hands-on activity

Write a protection plan for a computer in your home

You need: a computer you use, a grown-up's permission to look at its security settings, and a computer with Python.

  1. Audit the computer. Without changing anything yet, check: Are updates on and current? Is anti-malware real-time protection on? Is the firewall on? Is your account an administrator or a standard user? When was the last backup? (Windows: Settings → Privacy & security → Windows Security, and Settings → Windows Update. macOS: System Settings → General → Software Update, and Network → Firewall.)
  2. Run the password program with your own length and alphabet ideas. (Never type your real password into any program.) What length of random passphrase would take more than 1000 years?
  3. Write your plan as a table with columns Layer, Action, Who and How often, covering all eight layers in this lesson.
  4. With a grown-up, fix one thing you found in the audit (for example, turn on automatic updates or MFA on your email).

What to look for: every layer included, each with a person and a schedule; an incident-response section; a sensible fix. For step 2: 5 random words (about 90 years) is not enough at this guessing rate, but 6 random words (about 700 000 years) is.

Your turn

1

Why do security updates (patches) protect against worms?

2

What does a firewall do?

3

Give an example of multi-factor authentication.

4

Why should you use a standard user account for everyday work?

5

How many possible passwords are there with 6 digits (0 to 9)?

6

Why is it risky to use the same password for many accounts?

7

Why is your email account the most important one to protect?

More practice: warm-up

1

What does MFA stand for?

2

What is a patch?

3

Name the anti-malware program built into Windows.

4

What does a password manager do?

5

Should macros be enabled in documents from unknown senders?

More practice: on your own

1

How many times more possible passwords does a 9-character password have than an 8-character password, if both use the same 94 characters?

2

Explain why "defence in depth" is better than relying on antivirus software alone.

3

A student's gaming account password was stolen, but the attacker could not log in. What protection probably stopped them?

4

Write the incident-response steps for: "My laptop's files suddenly all end in .locked and there is a ransom note."

5

Using the program's function, what does time_to_try_all(10, 4) return?

Challenge

1

How many characters long must a random password from 94 characters be so that trying every possibility at 10 billion guesses per second takes more than 1000 years? Show your reasoning.

2

A school wants students to change their passwords every 30 days and include a symbol. Some experts argue that long passphrases plus MFA, changed only after a breach, are better. Give one argument for the experts' view.

3

Design a protection plan for a school computer lab of 30 computers in a few bullet points. What is different from a home plan?

Check your understanding

Quiz

1.

Which is the best example of defence in depth?

2.

Which combination is true multi-factor authentication?

3.

A random password uses 26 lowercase letters. How many possibilities does a 3-letter password have?

4.

Why should everyday work be done in a standard (not administrator) account?

5.

Which protection best defends against losing files to ransomware?

6.

Using the lesson's program, which password would take the longest to brute-force?

For parents and teachers

Big idea: Expectation C2.2 ends with "devise a thorough system protection plan." A plan names layers of protection, who is responsible, how often each is checked, and what to do when something goes wrong.

How to help: Let your teen audit the family computer with you, and agree on a plan together. This is a real service your teen can do for the family. Consider turning on multi-factor authentication for important family accounts and using a password manager.

Common difficulties:

  • Thinking antivirus alone is enough.
  • Believing symbols matter more than length. Length multiplies the possibilities much faster.
  • Calling two passwords "two-factor" (both are something you know).
  • Writing a plan without who and how often, which means nobody actually does it.

Remind your teen never to type a real password into a practice program or website to "test" it.