Exercises: Distributed databases and cybersecurity

Explain what a distributed database is and give two advantages compared to a centralized database (availability, scalability) and one complication it introduces (consistency between copies).

Define each of these common threats in one sentence: phishing, ransomware, denial-of-service (DoS) attack, and data breach. State which one primarily targets the human factor.

The figure shows a service with its data replicated across three nodes; one of them has failed and is marked with a question mark. Explain what happens to the service while the node is down, what the system must do upon recovering it, and what property of distributed systems is being taken advantage of.

Explain the '3-2-1' backup rule: how many copies, on how many different types of media, and where at least one of them must be located. Why does a backup on the same constantly connected external hard drive fail to protect against ransomware?

Explain what a password manager does and why it allows using a long, distinct password for each service. What risk does it concentrate (the master password) and how is it mitigated?

Explain the basic concept of encryption: transforming readable data into unreadable data without the key. Distinguish between encrypting stored data (at rest) and encrypting communication (in transit, as HTTPS does), and explain what each one protects.

Security updates patch known vulnerabilities. Explain what a 'zero-day' vulnerability is, why the time between patch release and installation is critical, and what update policy you would recommend for a high school.

Explain what a firewall does: what rules it applies to incoming and outgoing traffic, the difference between a router firewall and a host firewall, and why 'everything open for convenience' defeats its purpose.

Explain what data replication is and how it differs from a backup: what problem each one solves (hot failover vs. loss or corruption of data) and why a reliable service needs both.

You receive an email that appears to be from your bank: it urgently asks you to "verify your account" via a link. Detail at least four red flags that would betray a phishing attempt (sender, actual link, urgency, spelling errors, attachments) and what you should do step by step.

Explain the principle of defense in depth: why a single security measure is never enough and how layers are combined (perimeter firewall, two-factor authentication, data encryption, backups, staff training) against a ransomware attack.

Compare phishing (email), smishing (SMS), and vishing (voice call): what channel each one uses, what typical pretext they employ (held package, unexpected payment, urgent technical support), and what common behavioral rule neutralizes all three.

Compare authentication factors: something you know (password), something you have (cell phone, card), and something you are (fingerprint). Explain why two factors of the same type do not constitute true multi-factor authentication and why SMS codes are the weakest second factor (SIM swapping), yet still better than nothing.

A "maintenance technician" calls the front desk saying they need the management Wi-Fi password to repair the printer. Explain what pretexting (social engineering) is, what red flags give away the call, and what verification protocol should be in place (never share credentials over the phone, verify identity through an official channel).

Explain the risks of open public Wi-Fi networks (interception, rogue access point with a similar name) and how a VPN mitigates them (encrypted tunnel to the VPN server). What does a VPN not protect against (an infected device itself, phishing)?

Describe the typical chain of a ransomware attack: initial access (email with attachment or exposed remote access), execution and file encryption, ransom note. Identify at which links the chain can be broken and with what specific measure at each one.

A regional hospital suffers a ransomware cyberattack on a Friday afternoon: operating room monitors lose communication with the central servers, and digital medical records appear encrypted with a ransom note demanding 2.5 BTC within 48 hours. The medical director proposes paying the ransom immediately "to save lives", while the head of maintenance suggests abruptly cutting off the electrical power to the server room. Critically evaluate both proposals, justifying their technical, ethical, and forensic risks. Next, design the containment, continuity of care, and recovery protocol that the technical team must execute, prioritizing patient safety and ensuring a complete restoration without reinfection.

A bank implements a strict security measure: for any action in its mobile app (including simply checking the balance), the customer must enter a 16-character password, pass facial recognition, and type a code sent via SMS. Three months later, customer cancellations increase by 28% and incidents due to locked accounts skyrocket, while it is also detected that many users store their passwords in unencrypted notes on their phones. Analyze why this policy has caused a paradoxical degradation of security and design a risk-based adaptive authentication strategy. Justify which authentication factors (something you know, have, or are) you would require in three different cases: checking routine transactions, issuing an international transfer of 5,000 dollars from a new device, and changing the phone number associated with the account.

The management of your high school approves the following security policy for teacher and student accounts: "Passwords must have exactly 8 characters, must mandatorily combine uppercase letters, lowercase letters, numbers, and rare symbols, will expire without extension every 30 days, and the use of password managers is strictly prohibited." Refute this policy technically and psychologically, predicting what behavioral patterns users will adopt and which attack vectors the school will be exposed to. Then, design an alternative and updated password policy in line with cybersecurity agency guidelines (such as those from NIST and CISA), analyzing entropy, length versus complexity, risk-based expiration, and multi-factor authentication, and justifying how each change mitigates real vulnerabilities.