Data Protection
Senior 2 · ICT
Data Protection
Lesson 5 of 5
18 min
Let's begin
Two days before the deadline, Umutoni's laptop stops starting. Her whole S2 ICT project was on it, and she has no other copy. Preventing malware is one half of data protection. The other half is making sure that, whatever happens, you can get your data back.
Antivirus software (or anti-malware software) finds, blocks and removes harmful programs. Microsoft Defender Antivirus is built into Windows, and there are many others. It works in two main ways:
Real-time protection (also called on-access scanning) checks each file the moment it is opened, downloaded or copied. Keep it switched on.
A scan is a search of storage for malware.
When a threat is found, the antivirus usually puts it in quarantine: it moves the file to a locked, isolated area where it cannot run. You can then delete it or, if it was a false alarm, restore it.
A backup is a copy of data stored somewhere else so that the original can be recovered after it is lost. Getting the data back from the backup is called restoring. Backups protect against things antivirus cannot stop: a broken hard disk, a stolen laptop, a file deleted by mistake, or files locked by ransomware.
A widely used rule is the 3-2-1 rule: keep at least 3 copies of your data, on 2 different types of storage, with 1 copy kept off-site (in another place, or in online "cloud" storage).
| Backup type | What it copies | To restore you need |
|---|---|---|
| Full | All the selected data, every time. | Just the latest full backup. |
| Incremental | Only what changed since the last backup of any type. | The last full backup plus every incremental backup made after it. |
| Differential | Only what changed since the last full backup. | The last full backup plus the latest differential backup. |
A school office makes a full backup every Sunday. The hard disk fails on Friday morning.
Incremental backups are smaller and quicker to make. Differential backups are quicker to restore. Always test a restore now and then: a backup you cannot restore is useless.
Tip
Prevent, detect, recover. Updates and careful habits prevent; antivirus scans detect; backups recover. You need all three.
For the 3-2-1 rule, count down: 3 copies, 2 kinds of storage, 1 somewhere else.
Mugisha borrows a flash drive from a friend. List, in order, what he should do before opening the files.
Solution: Make sure the antivirus is up to date, insert the drive, run a custom scan of the drive, quarantine or delete anything found, and only then open the files.
Umutoni keeps her project on her laptop and on a flash drive that stays in her laptop bag. Does this meet the 3-2-1 rule? What should she change?
Solution: No. She has only 2 copies, and both are in the same bag, so a theft loses both. She should add a third copy, for example in cloud storage or on a disk kept at home, so that one copy is off-site.
An office makes a full backup on the 1st of each month and a differential backup every day. Its disk fails on the evening of the 10th, after that day's backup. Which backups does it restore?
Solution: The full backup from the 1st, then the differential from the 10th. Each differential already holds every change since the full backup.
Why should antivirus definitions be updated often?
Solution: New malware appears every day. Signature scanning can only recognise malware that is already in the database, so an old database misses new threats.
Remember
Sources and credits
This lesson adapts CC BY-SA material and is shared under CC BY-SA 4.0.
