Back to Topics
Term 4 PS10-1, PS10-2

Privacy & Security

Learning Objectives

  • Understand the Australian Privacy Principles (APPs)
  • Identify common security vulnerabilities and threats
  • Apply security measures to protect data
  • Evaluate ethical considerations in digital systems

What is Privacy?

Privacy is the right to control your personal information - who can access it, how it's used, and when it's shared. In the digital world, privacy involves protecting data about individuals from unauthorized access or misuse.

Australian Privacy Principles (APPs)

The Privacy Act 1988 contains 13 Australian Privacy Principles that govern how organisations handle personal information.

APP Principle What it means
1 Open and transparent management Have a clear privacy policy
2 Anonymity and pseudonymity Allow people to remain anonymous when possible
3 Collection of solicited information Only collect information you actually need
4 Dealing with unsolicited information Destroy information you didn't ask for (if appropriate)
5 Notification of collection Tell people when you collect their data
6 Use or disclosure Only use data for its intended purpose
7 Direct marketing Get consent before marketing to individuals
8 Cross-border disclosure Ensure overseas recipients protect data too
9 Adoption, use of government identifiers Don't use government IDs as your own identifiers
10 Quality of personal information Keep data accurate and up-to-date
11 Security of personal information Protect data from misuse and unauthorised access
12 Access to personal information Let individuals access their own data
13 Correction of personal information Let individuals correct inaccurate data

What is Security?

Security involves protecting digital systems and data from unauthorized access, damage, or theft. It encompasses both technical measures (like encryption) and human factors (like training users).

The CIA Triad

Security aims to protect three key properties:

Confidentiality

Only authorized people can access the data. Achieved through encryption, access controls, and authentication.

Integrity

Data remains accurate and unaltered. Achieved through checksums, version control, and audit trails.

Availability

Data is accessible when needed. Achieved through backups, redundancy, and disaster recovery plans.

Common Security Threats

Malware

Malicious software designed to harm or exploit systems:

  • Virus - Attaches to files and spreads when files are shared
  • Worm - Self-replicating, spreads across networks automatically
  • Trojan - Disguised as legitimate software
  • Ransomware - Encrypts files and demands payment
  • Spyware - Secretly monitors user activity

Social Engineering

Manipulating people to gain access or information:

  • Phishing - Fake emails or websites that trick users into revealing passwords
  • Pretexting - Creating a fake scenario to extract information
  • Baiting - Leaving infected USB drives for people to find
  • Tailgating - Following someone into a secure area

Network Attacks

  • Man-in-the-middle - Intercepting communication between two parties
  • Denial of Service (DoS) - Overwhelming a system to make it unavailable
  • SQL Injection - Inserting malicious code into database queries

Security Measures

Authentication Methods

Something you know

Passwords, PINs, security questions

Something you have

Phone, security key, ID card

Something you are

Fingerprint, face recognition, iris scan

Multi-factor authentication (MFA) combines two or more of these methods for stronger security.

Encryption

Encryption converts readable data (plaintext) into scrambled data (ciphertext) that can only be read with the correct key.

  • HTTPS - Encrypts web traffic between browser and server
  • End-to-end encryption - Only sender and receiver can read messages
  • Full disk encryption - Protects all data on a device

Best Practices

  • Use strong, unique passwords for each account
  • Enable multi-factor authentication
  • Keep software and systems updated
  • Back up important data regularly
  • Be cautious of suspicious emails and links
  • Use secure Wi-Fi connections
  • Lock devices when not in use

Ethics in Digital Systems

Ethical considerations help guide responsible behavior when dealing with data and technology.

Key Ethical Principles

  • Informed consent - Users should understand and agree to data collection
  • Data minimisation - Only collect what's necessary
  • Transparency - Be open about how data is used
  • Accountability - Take responsibility for data protection
  • Fairness - Don't use data to discriminate

Ethical Dilemmas

Consider these scenarios:

  • A company wants to use facial recognition to improve security. What privacy concerns arise?
  • A health app collects location data "to improve services." Is this ethical?
  • Should employers be allowed to monitor employee computer activity?

Data Breaches

A data breach occurs when personal information is accessed, disclosed, or lost without authorization.

Responding to a Data Breach

  1. Contain - Stop the breach from continuing
  2. Assess - Determine what data was affected
  3. Notify - Inform affected individuals and authorities
  4. Review - Identify how it happened and prevent future breaches

Notifiable Data Breaches: In Australia, organisations must notify the Office of the Australian Information Commissioner (OAIC) and affected individuals if a data breach is likely to cause serious harm.

Key Terminology

  • Privacy - Right to control personal information
  • APPs - Australian Privacy Principles (13 principles)
  • CIA Triad - Confidentiality, Integrity, Availability
  • Malware - Malicious software (viruses, worms, trojans)
  • Phishing - Fake communications to steal information
  • Encryption - Scrambling data so only authorized users can read it
  • MFA - Multi-factor authentication using 2+ verification methods
  • Data breach - Unauthorized access to personal information
🏠

Project Connection

In Simpson's House...

The classroom Simpson's House has almost no security — and that's intentional. Once you've built it, you can see exactly where the vulnerabilities are. Every privacy and security concept you learn here maps onto a real weakness (or fix) in the system.

No Authentication

Anyone on the school WiFi can control the house

The Mosquitto broker accepts connections from any client on the LAN — no username, no password. In a real smart home, this would mean anyone nearby could unlock your door. The fix: MQTT username/password authentication.

No Encryption

MQTT traffic is sent in plaintext over the network

Commands like "OPEN" travel unencrypted — anyone sniffing the WiFi can read them. Production IoT systems use TLS (the same encryption as HTTPS) to protect messages in transit.

Australian Privacy Principles

Smart homes collect data about people in their home

APP 3 (collection) and APP 11 (security): if your smart home logs when you're home, when you sleep, and who enters — that's sensitive personal data. Who stores it? Who can access it? How is it secured? APPs apply directly.

IoT Attack Surface

Every connected device is a potential entry point

The Raspberry Pi runs SSH on port 22 with a default password, an MQTT broker on port 1883, and a WebSocket server on port 9001 — three open ports. Each one is an attack surface if not properly secured.

Explore the full Simpson's House project →