Unit 8 Course guide

How this unit is assessed

Content area 8 (Security) is part of the T Level Digital core. It is assessed in a written exam alongside other core content areas (Paper 2 in your college’s plan), not by coursework. Your teacher will confirm the paper, date and format.

Short-answer questions check that you know and can explain the content (state, identify, describe, explain).
Scenario questions ask you to apply it to a business or client, e.g. identify the threats a business faces and recommend and justify security controls.
Extended questions ask you to discuss or evaluate: weigh up benefits and drawbacks and reach a supported conclusion.

Use the Exam practice page to rehearse all three, and the Quizzes for quick checks.

My specification checklist

For each point, choose how you feel. Your choices save on this device. Revisit the red and amber points first.

Spec	You need to understand…	How confident am I?
8.1 Security risks
8.1.1 lesson S1	Know the type of confidential information held by organisations human resources: salaries and benefits, staff personal details commercially sensitive information: client details, stakeholder details, intellectual property, sales numbers, contracts access information: usernames, passwords, MFA details, PINs, access codes, passphrases, biometric data
8.1.2 lesson S1	Understand why information must be kept confidential by organisations salaries and benefits staff details intellectual property client details sales numbers access information: prevent unauthorised access
8.1.3 lesson S1	Understand the potential impact to an organisation of failing to maintain privacy and confidentiality non-compliance with regulations: loss of licence to practise loss of trust damage to organisation’s image financial loss: fines, refunds, loss of earnings/termination of contracts legal action reduced security
8.2 Types of threats and vulnerabilities
8.2.1 lesson T1	Understand potential technical threats and their impacts on organisations and individuals, including prevention and mitigation methods botnets DoS/DDoS malicious hacking: hacktivists, nation states, organised crime, individuals; password cracking/brute force; cross-site scripting; SQL injection; buffer overflow malware: viruses, worms, key loggers, ransomware, spyware, remote access trojans social engineering: phishing, spear phishing, smishing, vishing, pharming, watering hole attacks, USB baiting DNS attack/redirection of traffic insecure APIs man-in-the-middle attacks open/unsecured Wi-Fi networks
8.2.2 lesson V1	Understand potential technical vulnerabilities to systems and data inadequate security processes: weak encryption, inadequate password policy, failure to use MFA out-of-date components: hardware; software (lack of support, legacy compatibility, zero-day bugs); firmware
8.2.3 lesson V2	Understand potential human threats, including prevention and mitigation methods human error: file properties, confirmation boxes, staff training malicious employee: immediate removal from premises, suspend user accounts immediately disguised criminal: accompany all visitors, check identification poor cyber hygiene: lock unattended machines, do not write down passwords, poor password management
8.2.4 lesson V3	Understand potential physical vulnerabilities, including prevention and mitigation methods lack of access control: entry control systems poor access control: no tailgating, complex access codes, change codes regularly, monitor access areas, audit staff access nature of location: shoulder surfing, environment, vandalism poor system robustness: rugged machines natural disasters
8.2.5 lesson V3	Understand the potential impact to an organisation of threats and vulnerabilities loss/leaking of sensitive data unauthorised access to digital systems data corruption disruption of service unauthorised access to restricted physical areas
8.3 Threat mitigation
8.3.1 lesson M1	Understand the purposes, processes, benefits and drawbacks of common threat mitigation techniques security settings (hardware, software); anti-malware (function, actions); intrusion detection encryption: hashing, symmetric, asymmetric user access policies; staff vetting; staff training; software-based access control device hardening; backups (full, incremental, differential; safe storage); software updates; firmware/driver updates; air gaps certification of APIs; VPNs; multi-factor authentication; password managers port scanning; penetration testing (ethical and unethical hacking)
8.3.2 lesson M5	Understand the processes and procedures that assure internet security and the reasons why they are used firewall configuration: inbound and outbound rules, traffic type rules, application rules, IP address rules network segregation: virtual, physical, offline network network monitoring port scanning
8.4 Interrelationship of components required for effective security
8.4.1 lesson C1	Understand how the relationships in the CIA triad interrelate confidentiality: controlling who has access integrity: data not tampered with; supported by confidentiality availability: data available and useful; supported by integrity
8.4.2 lesson C2	Understand the elements of the IAAA model, including techniques and their benefits and drawbacks identification: knowledge-, possession- and biometric-based authentication: MFA, passwords and passphrases, biometrics authorisation: role-based, access control lists accountability: audit logs, user activity