Exercises: Distributed databases and cybersecurity

Explain what a distributed database is and give two advantages compared to a centralised database (availability, scalability) and one complication it introduces (consistency between copies).

Define each of these common threats in one sentence: phishing, ransomware, denial-of-service (DoS) attack, and data breach. State which one primarily targets the human factor.

The figure shows a service with its data replicated across three nodes; one of them has failed and is marked with a question mark. Explain what happens to the service while the node is down, what the system must do upon recovering it, and what property of distributed systems is being taken advantage of.

Explain the '3-2-1' backup rule: how many copies, on how many different types of media, and where at least one of them must be located. Why does a backup on the same constantly connected external hard drive fail to protect against ransomware?

Explain what a password manager does and why it allows using a long, distinct password for each service. What risk does it concentrate (the master password) and how is it mitigated?

Explain the basic concept of encryption: transforming readable data into unreadable data without the key. Distinguish between encrypting stored data (at rest) and encrypting communication (in transit, as HTTPS does), and explain what each one protects.

Security updates patch known vulnerabilities. Explain what a 'zero-day' vulnerability is, why the time between patch release and installation is critical, and what update policy you would recommend for a secondary school.

Explain what a firewall does: what rules it applies to incoming and outgoing traffic, the difference between a router firewall and a host firewall, and why 'everything open for convenience' defeats its purpose.

Explain what data replication is and how it differs from a backup: what problem each one solves (hot failover vs loss or corruption of data) and why a reliable service needs both.

You receive an email that appears to be from your bank: it urgently asks you to 'verify your account' via a link. Detail at least four red flags that would betray a phishing attempt (sender, actual link, urgency, spelling errors, attachments) and what you should do step by step.

Explain the principle of defence in depth: why a single security measure is never enough and how layers are combined (perimeter firewall, two-factor authentication, data encryption, backups, staff training) against a ransomware attack.

Compare phishing (email), smishing (SMS), and vishing (voice call): what channel each one uses, what typical pretext they employ (held parcel, unexpected payment, urgent technical support), and what common behavioural rule neutralises all three.

Compare authentication factors: something you know (password), something you have (phone, card), and something you are (fingerprint). Explain why two factors of the same type do not constitute true multi-factor authentication and why SMS codes are the weakest second factor (SIM swapping), yet still better than nothing.

A 'maintenance technician' calls reception saying they need the management Wi-Fi password to repair the printer. Explain what pretexting (social engineering) is, what red flags betray the call, and what verification protocol should be in place (never share credentials over the phone, verify identity through an official channel).

Explain the risks of open public Wi-Fi networks (interception, rogue access point with a similar name) and how a VPN mitigates them (encrypted tunnel to the VPN server). What does a VPN not protect against (an infected device itself, phishing)?

Describe the typical chain of a ransomware attack: initial access (email with attachment or exposed remote access), execution and file encryption, ransom note. Identify at which links the chain can be broken and with what specific measure at each one.

An online shop replicates its database across two distant data centres. Following a network outage between them, each centre continues to accept orders. Analyse the consistency issue that arises (the CAP theorem: consistency, availability, and partition tolerance), which option you would choose for product stock and which for customer reviews, justifying the difference.

A regional hospital suffers a ransomware cyberattack on a Friday afternoon: operating room monitors lose communication with the central servers, and digital medical records appear encrypted with a ransom note demanding 2,5 BTC within 48 hours. The medical director proposes paying the ransom immediately "to save lives", while the head of maintenance suggests abruptly cutting off the electrical power to the server room. Critically evaluate both proposals, justifying their technical, ethical, and forensic risks. Next, design the containment, continuity of care, and recovery protocol that the technical team must execute, prioritizing patient safety and ensuring a complete restoration without reinfection.

A banking institution implements a strict security measure: for any action in its mobile application (including simply checking the balance), the customer must enter a 16-character password, pass facial recognition, and type a code sent via SMS. Three months later, customer cancellations increase by 28% and incidents due to locked accounts skyrocket, while it is also detected that many users store their passwords in unencrypted notes on their phones. Analyze why this policy has caused a paradoxical degradation of security and design a risk-based adaptive authentication strategy. Justify which authentication factors (something you know, have, or are) you would require in three different cases: checking routine transactions, issuing an international transfer of €5.000 from a new device, and changing the phone number associated with the account.

The management of your high school approves the following security policy for teacher and student accounts: "Passwords must have exactly 8 characters, must mandatorily combine uppercase letters, lowercase letters, numbers, and rare symbols, will expire without extension every 30 days, and the use of password managers is strictly prohibited." Refute this policy technically and psychologically, predicting what behavioral patterns users will adopt and which attack vectors the school will be exposed to. Then, design an alternative and updated password policy in line with cybersecurity agency guidelines (analyzing entropy, length versus complexity, risk-based expiration, and multi-factor authentication), justifying how each change mitigates real vulnerabilities.

A local e-commerce business with five employees stores personal and banking data of 12.000 customers on an unsegmented local server connected to the internet. During an audit, the following problems are recorded over the past year: two temporary connection losses during sales campaigns (estimated losses of €800 per hour), daily automated SQL injection attempts on the database, administration credentials shared in a spreadsheet accessible to the entire staff, and an absence of offline backups disconnected from the network. Develop a semi-quantitative risk management matrix: assign a justified likelihood score (1 to 5) and impact score (1 to 5) to each of these threats, calculate the resulting inherent risk, and design the priority technical and organizational measures to address the two most critical risks with a limited budget of €2.500.

A global platform combining a social network and a microtransaction gateway replicates its databases across nodes located in Europe, the Americas, and Asia. An unexpected cut in submarine communication cables temporarily isolates the European region from the rest of the continents. Apply the CAP theorem to predict the operational consequences if the system attempts to prioritize availability (AP systems) versus strict consistency (CP systems). Justify technically and economically why an eventual consistency model should be adopted for a video's view counter, whereas for users' digital wallet balances it is imperative to block unsynchronized transactions, analyzing the risk of double-spending.

The support department of an e-commerce company discovers on a Monday at 08:00 that, due to a security breach in its web gateway, an attacker has exfiltrated a database containing names, home addresses, national ID numbers (DNI), and credit card numbers belonging to 25.000 customers. The commercial director proposes not to disclose the leak publicly in order to prevent a reputation crisis and the financial losses resulting from customer churn, arguing that the technical flaw has already been resolved by 11:00. Assess the director's proposal from both a legal and security perspective: determine the mandatory and non-extendable deadlines established by the GDPR regarding the supervisory authority and the affected individuals, classify the risk level to the users' rights, and predict the sanctions and legal liabilities the company faces if it deliberately conceals the incident.

A wastewater treatment plant manages its pumps and chemical dosers using legacy programmable logic controllers (PLCs) whose operating systems no longer receive manufacturer patches and do not support reboots without interrupting supply. To allow technical staff to monitor alarms from home over the weekend, the company installed a 4G modem connected directly to the same switch where the PLCs and the corporate billing computers are located. Contrast the priorities of industrial cybersecurity (AIC triad: Availability, Integrity, and Confidentiality) with those of a corporate office environment, predict which critical attack vectors the current configuration introduces, and design a secure architecture based on zones and conduits segmentation (Purdue model / ISA-95), specifying the necessary protection elements to enable secure remote access without exposing the controllers to the internet.

Unit challenge. Imagine that you are advising a local energy community to modernise and shield its smart grid. You will design an integrative technical proposal in three phases:

1. Data Capture and Big Data: Access the Red Eléctrica de España (REE) portal and download the hourly peninsular actual demand data for the last $7$ days. Import them into LibreOffice Calc, calculate the average, and plot a graph identifying the maximum peak consumption (e.g., $> 32,4\text{ GW}$).

2. AI Forecasting: Explain in a reasoned manner which supervised learning algorithm you would use to train a model with these data and weather variables, in order to anticipate demand and balance loads.

3. Distributed Network and Cybersecurity: Propose an architecture based on blockchain with smart contracts that enables neighbours to register secure transactions of photovoltaic surpluses without intermediaries. Analyse two attack vectors (such as IoT meter spoofing or DDoS attacks) and prescribe mitigation measures based on asymmetric encryption and network segmentation.

Produce a two-page executive report including the graph and your technical justifications.

Evaluation criteria:

• Rigorous extraction of data from REE and its analytical processing in LibreOffice.

• Technical consistency when selecting the AI model and the distributed consensus mechanism.

• Realistic diagnosis of cyber threats and robustness of the proposed defences.