T Level Digital core content area 8: security risks, threats and vulnerabilities, threat mitigation, the CIA triad and the IAAA model.
Read the lesson, study the diagrams, watch the video, then open the matching workbook section.
8.1 Security risks T Level core · 8.1.1 – 8.1.3
Confidential information and why it must be protected
By the end you can: identify the confidential information organisations hold, explain why each type must be kept confidential, and describe the impact of failing to do so.
Every organisation holds information that would cause harm if the wrong people saw it. Security starts with knowing what you are protecting and why.
Three kinds of confidential information. Access information is the key to all the rest: if it leaks, attackers can reach everything else.
8.1.2 Reasons for confidentiality
Information
Why keep it confidential?
Salaries and benefits
stops competitors offering higher wages to poach staff; stops staff comparing pay and demanding the same
Staff personal details
protects their privacy (a legal duty); stops competitors contacting them directly
Intellectual property
stops competitors copying designs, code, recipes or processes
competitors could undercut prices or target weak areas
Access information
prevents unauthorised access to systems, buildings and all the other data
One leak can trigger several impacts at once: regulatory, reputational, financial and legal.
Impacts of failing to keep information confidential
Impact (8.1.3)
Example
Non-compliance with regulations
a data protection breach leads to a regulator’s fine; a solicitor or pharmacy could lose its licence to practise
Loss of trust and damaged image
customers read about the leak and move to a competitor
Financial loss
fines, refunds to customers, lost earnings, contracts terminated
Legal action
customers or partners sue for damages
Reduced security
leaked passwords let attackers back in, or are reused on other systems
In the real world: a leaked customer database
An online retailer stores customer names, addresses and card details. An attacker copies the database. The retailer must tell the regulator and its customers, pays refunds and a fine, loses customers who no longer trust it, and faces legal claims. The leaked passwords are tried on other websites, where many customers reused them.
Key terms
Confidential
information only authorised people should see.
Intellectual property
original designs, code, inventions and ideas owned by the organisation.
Biometric data
physical characteristics used for identification, e.g. fingerprints or face.
Data breach
confidential data being accessed, leaked or stolen.
Exam focus
Link each type of information to a specific reason and impact. “Client details must be confidential so competitors cannot contact the clients and so the firm complies with data protection law” scores more than “it’s private”.
Think it through
Why is access information described as the ‘key’ to other confidential information?
Usernames, passwords, PINs and MFA details let someone log in or enter a building, so leaking them exposes every system and file those accounts can reach.
A marketing agency’s client list leaks. Give two impacts.
Competitors can approach the clients and win their business (financial loss); clients lose trust in the agency; possible fines for breaching data protection.
Watch
Why attackers target organisations, and what they are after.
Watch and think:
Which kinds of confidential information would each attacker want?
A ransomware worm spread worldwide through an unpatched weakness in older Windows systems. It encrypted files in organisations including hospitals, where appointments and operations had to be cancelled. Patching and good backups would have limited the damage.
Key terms
Malware
malicious software designed to damage, disrupt or gain access.
Payload
the harmful action malware carries out.
Botnet
a network of infected devices controlled by an attacker.
DDoS
a denial of service attack from many devices at once.
Exam focus
For each threat, learn three things: what it is, its impact, and how to prevent and mitigate it. Prevention stops it happening; mitigation reduces the damage when it does (e.g. backups for ransomware).
Think it through
Why is a DDoS attack harder to stop than a DoS attack?
The traffic comes from thousands of different IP addresses, so blocking one source does not help and it is hard to tell attack traffic from real users.
How do backups mitigate ransomware?
If clean copies are stored offline or offsite, the organisation can restore its files without paying, reducing downtime and data loss.
Watch
Viruses, worms, trojans, ransomware and spyware compared.
Watch and think:
How does a worm spread without anyone opening a file?
8.2 Types of threats and vulnerabilities T Level core · 8.2.1
Malicious hacking
By the end you can: explain who malicious hackers are and how password cracking, brute force, cross-site scripting, SQL injection and buffer overflow attacks work and are prevented.
Who hacks, and why
Hacker
Usual motive
Hacktivists
a political or social cause: defacing websites, leaking data to make a point
Nation states
spying, disrupting another country’s infrastructure, stealing research
Organised crime
money: ransomware, stolen card data, fraud
Individuals
curiosity, challenge, revenge (e.g. a sacked employee) or money
Password cracking and brute force
Brute force tries every combination. Length adds far more protection than complexity alone, which is why long passphrases are recommended.
Brute force tries every possible combination. Dictionary attacks try common words and leaked passwords first. Prevention: long passphrases, account lockout after failed attempts, MFA, and storing passwords as salted hashes.
SQL injection
SQL injection: the website pastes user input straight into a database command, so the attacker’s input becomes part of the command.
Cross-site scripting (XSS)
The attacker gets a website to include their script in a page other people view, e.g. in a comment or search box. The script runs in victims’ browsers and can steal session cookies or redirect them. Prevention: validate input and encode output so text is displayed, never run; content security policies.
Buffer overflow
If a program does not check input length, extra data spills into neighbouring memory. Attackers use this to crash the program or run their own code.
Key terms
Brute force
trying every possible password until one works.
SQL injection
entering SQL code into an input to change a database query.
Cross-site scripting
injecting a script into a web page that runs in other users’ browsers.
Buffer overflow
writing more data than a memory area holds so it overwrites nearby memory.
Exam focus
Say how each attack works and give a matching prevention. SQL injection → parameterised queries and input validation; XSS → output encoding; buffer overflow → bounds checking and patches; brute force → length, lockout and MFA.
Think it through
Why does account lockout defeat online brute-force attacks?
After a few wrong guesses the account locks or slows down, so the attacker cannot try millions of combinations.
A website search box shows whatever you type back on the page. Which attack could this allow and how is it prevented?
Cross-site scripting: if the text is not encoded, a script typed in could run in visitors’ browsers. Encode output and validate input.
Watch
How brute-force password attacks work.
Watch and think:
Why does a longer password take so much longer to crack?
8.2 Types of threats and vulnerabilities T Level core · 8.2.1
Social engineering
By the end you can: explain phishing, spear phishing, smishing, vishing, pharming, watering hole attacks and USB baiting, and how to prevent them.
Social engineering tricks people, rather than computers, into giving away information or access. It works because it exploits trust, fear, curiosity and urgency.
Red flags in a phishing email. Real organisations do not ask you to confirm your password through a link.
Types of social engineering
Attack
How it works
Prevention
Phishing
mass emails pretending to be a trusted organisation, linking to fake login pages
a targeted email using personal details (name, manager, project) to look genuine
training, verify unusual requests by another channel
Smishing
phishing by SMS text message, e.g. a fake parcel delivery link
do not click links in texts; go to the official app or site
Vishing
phone calls pretending to be the bank, IT support or police
call back on a known number; never give passwords or PINs
Pharming
redirects a correct web address to a fake site (malware or DNS changes)
check for HTTPS and the correct address, anti-malware, secure DNS
Watering hole
infects a website the target group often visits
patching, browser security, anti-malware
USB baiting
leaves infected USB sticks for people to find and plug in
policy: never plug in unknown devices; disable USB auto-run
In the real world: the fake invoice
A finance assistant receives an email that appears to come from the managing director, asking for an urgent payment to a new supplier. The address is one letter different. Because the college’s policy says all new bank details must be confirmed by phone, the assistant calls the director and the fraud is stopped.
Key terms
Social engineering
manipulating people into revealing information or giving access.
Spear phishing
phishing aimed at a specific person or organisation.
Pharming
redirecting users from a real website to a fake one.
Watering hole attack
compromising a website that the targets are known to visit.
Exam focus
Staff training is the main defence against social engineering, but the best answers pair it with a technical control, e.g. training and MFA, so a stolen password alone is useless.
Think it through
Why is spear phishing more successful than ordinary phishing?
It uses personal, accurate details, so the message looks genuine and the victim is less suspicious.
How does pharming differ from phishing?
Phishing tricks you into clicking a fake link; pharming sends you to a fake site even when you type the correct address.
Watch
The main social engineering attacks and how to spot them.
Watch and think:
What is the difference between phishing and pharming?
8.2 Types of threats and vulnerabilities T Level core · 8.2.1
DNS attacks, insecure APIs, man-in-the-middle and open Wi-Fi
By the end you can: explain DNS attacks and traffic redirection, insecure APIs, man-in-the-middle attacks and open Wi-Fi, with prevention and mitigation.
In a man-in-the-middle attack, traffic passes through the attacker, who can read or change it. Open Wi-Fi and fake access points make this easy.
Network and web threats
Threat
How it works
Impact
Prevention and mitigation
DNS attack / redirection
the attacker changes DNS records or poisons a DNS cache so a real name points to a fake IP address
users land on fake sites and type their passwords (pharming)
secure DNS (DNSSEC), patch DNS servers, protect registrar accounts with MFA, HTTPS certificate checks
Insecure API
an application programming interface with weak authentication, no rate limits or too much data returned
attackers pull or change data directly, bypassing the app
authentication tokens, access control, rate limiting, input validation, API testing and certification
Man-in-the-middle
the attacker sits between two parties and intercepts or alters traffic
no encryption, or a fake hotspot set up by an attacker
traffic can be read; devices can be attacked
use a VPN, only HTTPS sites, WPA2/WPA3 on your own networks, turn off auto-connect
Key terms
DNS
the system that turns domain names into IP addresses.
API
a set of rules that lets one program request data or services from another.
Man-in-the-middle
an attacker secretly relaying and possibly altering communication.
Rate limiting
restricting how many requests a user can make in a period.
Exam focus
These threats all attack data in transit. Encryption (HTTPS/TLS, VPN) is the common defence; add a specific one for each (DNSSEC for DNS, authentication and rate limits for APIs).
Think it through
Why does a VPN protect you on public Wi-Fi?
It encrypts all traffic between your device and the VPN server, so anyone intercepting it on the Wi-Fi network sees only scrambled data.
An app’s API returns every customer record if you change a number in the request. What is the weakness?
Missing authorisation/access control: the API does not check that the user may see that record. Fix with proper access checks and testing.
Watch
How an attacker sits between you and a website, and a real case where laptops shipped with the problem.
8.2 Types of threats and vulnerabilities T Level core · 8.2.2
Technical vulnerabilities
By the end you can: explain how inadequate security processes and out-of-date hardware, software and firmware make systems vulnerable.
A threat is something that could cause harm. A vulnerability is a weakness a threat can exploit. Attackers look for the easiest weakness.
8.2.2 Technical vulnerabilities
Vulnerability
Why it is a weakness
Weak encryption
old or short-key algorithms can be broken, so ‘protected’ data can be read
Inadequate password policy
short, reused or default passwords are guessed or cracked quickly
Failure to use MFA
one stolen password is enough to log in
Out-of-date hardware
no longer supported; may not run current security software or updates
Out-of-date software
lack of support means no patches; legacy systems may be kept for compatibility; zero-day bugs are exploited before a fix exists
Out-of-date firmware
routers, cameras and printers with old firmware have well-known weaknesses and default logins
Out-of-date components leave the window of risk open. Updating quickly shortens it.
In the real world: the forgotten camera
An office installs an internet-connected camera and never changes its default password or updates its firmware. Attackers scanning the internet find it, log in, and use it as a way into the office network.
Key terms
Vulnerability
a weakness that could be exploited.
Zero-day
a vulnerability attackers exploit before a patch exists.
Legacy system
old software or hardware still in use, often because other systems depend on it.
Firmware
software stored in a device’s hardware that controls it.
Exam focus
Explain the chain: vulnerability → how a threat exploits it → impact → fix. For legacy systems, recognise the trade-off: replacing them costs money and may break compatibility, so isolate them if they must stay.
Think it through
Why might an organisation keep using unsupported software, and how can it reduce the risk?
Other systems depend on it or replacement is expensive. Reduce risk by isolating it on a separate network segment, restricting access and planning a replacement.
What is a zero-day vulnerability?
A weakness unknown to the vendor, or with no patch yet, that attackers exploit immediately.
Watch
Technical and human vulnerabilities in organisations.
Watch and think:
Which vulnerabilities are caused by out-of-date components?
8.2 Types of threats and vulnerabilities T Level core · 8.2.3
Human threats
By the end you can: explain human error, malicious employees, disguised criminals and poor cyber hygiene, with prevention and mitigation methods.
Many incidents start with a person, not a piece of technology. Some are accidents; some are deliberate.
8.2.3 Human threats
Human threat
Example
Prevention and mitigation
Human error
emailing a spreadsheet to the wrong person; deleting a shared folder
file properties (read-only, permissions), confirmation boxes before deleting or sending, staff training
Malicious employee
a sacked employee copies client data or deletes files
immediate removal from the premises, suspend user accounts immediately, least privilege, audit logs
Disguised criminal
someone in a hi-vis jacket claims to be ‘from IT’ and walks to the server room
accompany all visitors, check identification, visitor badges and sign-in
Poor cyber hygiene
unlocked PCs, passwords on sticky notes, the same password everywhere
lock all unattended machines, do not write passwords down, password managers, training
In the real world: the unlocked screen
A receptionist leaves the desk without locking the PC. A visitor opens the customer booking system and photographs a screen of personal details. A short lock-screen timeout and the habit of pressing Windows+L would have prevented it.
Key terms
Insider threat
a risk from someone inside the organisation.
Cyber hygiene
everyday habits that keep systems secure.
Least privilege
giving users only the access they need for their job.
Tailgating
following an authorised person through a secure door.
Exam focus
Match the control to the threat: a malicious employee is stopped by removing access at once; human error by confirmation boxes and file properties; a disguised criminal by ID checks and escorts.
Think it through
Why must a dismissed employee’s account be suspended immediately?
Until it is disabled they could still log in remotely and copy, change or delete data.
Give two good cyber hygiene habits.
Lock the screen when leaving the desk; use unique passphrases stored in a password manager rather than written down.
Watch
Accidental and deliberate threats from inside an organisation.
Watch and think:
How should an organisation respond when a malicious employee is dismissed?
8.2 Types of threats and vulnerabilities T Level core · 8.2.4 · 8.2.5
Physical vulnerabilities and the impact of threats
By the end you can: explain physical vulnerabilities and their prevention, and the potential impact of threats and vulnerabilities on an organisation.
Physical security in layers, from the site boundary to the server room.
8.2.4 Physical vulnerabilities
Physical vulnerability
Prevention and mitigation
Lack of access control
entry control systems: swipe cards, key fobs, keypads, biometric locks
Poor access control
do not allow tailgating; use complex access codes and change them regularly; monitor access areas (CCTV, guards); audit staff access to secure areas
Nature of location
protect against shoulder surfing (privacy screens, screen position); protect against the environment (flood, heat, dust: raised floors, air conditioning); protect against vandalism (locked cabinets, alarms)
Poor system robustness
rugged machines for harsh environments such as building sites, factories and vehicles
Natural disasters
offsite backups and a disaster recovery site; choose locations away from flood risk
Impact of threats and vulnerabilities
Impact (8.2.5)
Example
Loss or leaking of sensitive data
a stolen laptop holds unencrypted client files
Unauthorised access to digital systems
a tailgater plugs a device into an office network port
Data corruption
a power cut or flood damages a server and its data
Disruption of service
ransomware or a fire stops the business trading
Unauthorised access to restricted areas
an intruder reaches the server room or stock room
Practical: perimeter security proposal
You are the design architect for a warehouse with a customer entrance, staff door and loading bays.
Define its outer perimeter, inner perimeter and interior areas, and one key vulnerability for each.
Recommend access-control and monitoring devices (barriers, swipe entry, CCTV, lighting) with approximate costs.
Present your solution in no more than five slides.
Based on your teacher’s Perimeter Security activity worksheet.
Key terms
Tailgating
following an authorised person through a door without using your own access.
Shoulder surfing
watching someone type a PIN or password.
Entry control system
technology that decides who may enter an area, e.g. swipe cards.
Rugged machine
a device built to survive drops, dust, water and extremes.
Exam focus
Physical security questions often give a floor plan or scenario. Work from the outside in (site, building, room, device) and give one vulnerability and one control for each layer.
Think it through
Why should door access codes be changed regularly?
Codes get shared or observed over time; changing them removes access for people who should no longer have it.
A delivery driver follows staff through a secure door. Name the vulnerability and two controls.
Tailgating (poor access control). Controls: staff training and a no-tailgating policy, turnstiles or airlock doors, CCTV monitoring.
Technical defences: settings, anti-malware, detection, hardening and updates
By the end you can: explain the purpose, process, benefits and drawbacks of security settings, anti-malware, intrusion detection, device hardening, updates and air gaps.
Defence in depth: a firewall at the edge, an intrusion detection system watching traffic, and hardened, updated, protected devices inside.
8.3.1 Technical mitigation techniques
Technique
Purpose and process
Benefits
Drawbacks
Security settings (hardware and software)
configure devices and software securely: BIOS/UEFI passwords, disable unused ports, browser and OS privacy settings
cheap; closes easy gaps
needs knowledge; settings can be changed back or forgotten
Anti-malware software
function: scans files, emails and downloads against signatures and suspicious behaviour; actions: quarantine, delete, alert
stops most known malware automatically
must be updated; may miss new malware; can slow the device; false positives
Intrusion detection (IDS)
monitors network or device activity for suspicious patterns and raises alerts (an IPS also blocks)
spots attacks in progress; evidence for investigation
false alarms; someone must respond; cost
Device hardening
remove unneeded software, services, ports, accounts and default passwords
smaller attack surface
takes time; may break features if done carelessly
Software updates
install patches that fix security bugs, ideally automatically
closes known vulnerabilities quickly
updates can fail or cause compatibility issues; need testing and restarts
Firmware / driver updates
update the low-level code in routers, BIOS, printers and devices
fixes hardware-level weaknesses
risky if interrupted; often forgotten
Air gaps
keep a critical system physically disconnected from other networks
cannot be attacked over the network
inconvenient data transfer; still vulnerable to USB and insiders
Key terms
Signature
a pattern that identifies known malware.
Quarantine
isolating a suspicious file so it cannot run.
IDS
intrusion detection system: monitors and alerts on suspicious activity.
Air gap
physical separation of a system from any network.
Exam focus
‘Benefits and drawbacks’ is in the specification for every mitigation technique. Learn at least one of each: e.g. air gaps are very secure but make updating and sharing data slow.
Think it through
Why does anti-malware need regular updates?
New malware appears constantly; without updated signatures and detection rules the software will not recognise it.
Give an example of a system that might use an air gap, and one weakness.
A power station’s control system or a military network; it can still be infected by a USB stick or an insider.
Watch
Anti-malware, updates and other defences.
Watch and think:
What actions can anti-malware take when it finds a threat?
By the end you can: explain the purpose, process, benefits and drawbacks of hashing, symmetric encryption and asymmetric encryption.
Encryption scrambles data with a key so only someone with the right key can read it. It protects data at rest (on disks and backups) and in transit (across networks).
A hash is a fixed-length fingerprint of data. Systems store password hashes (with a random salt), then hash what you type and compare.Symmetric encryption is fast but needs a shared key. Asymmetric encryption solves key sharing, so HTTPS uses asymmetric methods to agree a symmetric session key.Two people agree a secret key over a public channel without ever sending it. Real systems use numbers hundreds of digits long.
Comparing the three methods
Method
Benefits
Drawbacks
Used for
Hashing
one-way; passwords are never stored in readable form; detects any change to data (integrity)
cannot be reversed to recover data; weak or unsalted hashes can be cracked with precomputed tables
password storage, file integrity checks, digital signatures
Symmetric
fast and efficient for large amounts of data
the key must be shared securely; if it leaks, all data is exposed
disk encryption, Wi-Fi (WPA2/3), bulk data in HTTPS
Asymmetric
no need to share a secret key; enables digital signatures and certificates
much slower; needs key management and trusted certificates
HTTPS handshakes, secure email, digital signatures
Practical: Diffie-Hellman by hand
Work through the example above with a partner: choose your own secret numbers with P = 23 and G = 5.
Calculate your public values, swap them, and calculate the shared key. Check you both get the same answer.
Explain why an eavesdropper who sees P, G and both public values still cannot easily find the key.
Based on your teacher’s Diffie-Hellman spreadsheet.
Key terms
Plaintext / ciphertext
readable data / encrypted data.
Hash
a fixed-length, one-way fingerprint of data.
Salt
random data added to a password before hashing so identical passwords get different hashes.
Public / private key
the pair used in asymmetric encryption: share the public one, never the private one.
Exam focus
Hashing is not encryption: it cannot be reversed. Say which method fits the purpose: hashing for stored passwords and integrity, symmetric for speed, asymmetric for sharing keys and signatures.
Think it through
Why do websites store password hashes rather than encrypted passwords?
A hash cannot be reversed, so even if the database is stolen the passwords are not directly readable; the site only needs to compare hashes.
Why does HTTPS use both asymmetric and symmetric encryption?
Asymmetric encryption safely agrees a session key; the faster symmetric encryption then protects the rest of the data.
Watch
One key or a key pair: how each works.
Watch and think:
Why is asymmetric encryption used to share a symmetric key?
People and access: policies, vetting, training, MFA, VPNs and APIs
By the end you can: explain user access policies, staff vetting and training, software-based access control, MFA, password managers, VPNs and API certification, with benefits and drawbacks.
Multi-factor authentication means a stolen password alone is not enough to log in.
8.3.1 People and access controls
Technique
Purpose and process
Benefits
Drawbacks
User access policies
written rules for who gets which access, how passwords work and how accounts are created and removed
consistent, least-privilege access
must be enforced and reviewed
Staff vetting
checks before employment: references, identity, criminal record (e.g. DBS) for sensitive roles
reduces insider risk
takes time and money; people can change after joining
Staff training
teach staff to spot phishing, use strong passwords, lock screens and report incidents
tackles the biggest risk: people
needs repeating; some staff ignore it
Software-based access control
permissions on files, folders, apps and databases by user or role
users see only what they need
complex to manage; mistakes grant too much access
Multi-factor authentication
combine two or more factor types at login
stolen passwords alone are useless
slower login; lost phone or token needs a recovery process
Password managers
generate, store and fill unique strong passwords in an encrypted vault
one strong master password; no reuse
the vault is a single target; needs MFA and trust in the provider
VPNs
encrypt traffic between a device and the organisation’s network
safe remote working on any Wi-Fi
can slow connections; the VPN itself must be patched
Certification of APIs
APIs are tested and certified to meet security standards before use
trusted integrations; fewer insecure APIs
cost and time; certification can go out of date
In the real world: MFA stops a phishing attack
An employee enters their password on a fake login page. The attacker tries it, but the account requires a code from the employee’s authenticator app, so the login fails and the security team is alerted.
Key terms
MFA
multi-factor authentication: at least two different factor types.
Vetting
background checks on staff before they are given access.
Password manager
software that stores and creates strong passwords.
VPN
an encrypted tunnel across an untrusted network.
Exam focus
When asked to recommend controls, combine a people control with a technical one, and state a drawback. That shows balance, which ‘evaluate’ and ‘discuss’ questions reward.
Think it through
Why is a password plus a security question not true multi-factor authentication?
Both are ‘something you know’, so they are the same factor; an attacker who phishes one can phish the other.
Give one benefit and one drawback of password managers.
Benefit: every account can have a unique, long password. Drawback: if the master password is weak or stolen, all passwords are exposed.
Watch
How two-factor authentication works and why it helps.
By the end you can: explain backup types and safe storage, port scanning and penetration testing (ethical and unethical hacking), with benefits and drawbacks.
Backup strategies. The choice trades time and space for making backups against the time and effort to restore.
Backup types
Backup type
Benefit
Drawback
Full
everything in one set: simplest, fastest restore
slowest to make; most storage
Incremental
only changes since the last backup of any kind: quickest, least storage
restore needs the full plus every incremental in order
Differential
changes since the last full backup
grows each day; restore needs the full plus the latest differential
Safe storage: keep at least one copy offsite or in the cloud and one offline (so ransomware cannot reach it), encrypt backups, and test restoring regularly. A common rule is 3-2-1: three copies, on two kinds of media, one offsite.
Port scanning
A port scan checks which network ports on a device are open and which services are listening. Defenders scan their own systems to find services that should be closed; attackers scan to find a way in.
nmap -sn 10.6.6.0/24 # which hosts are up?
nmap -sV 10.6.6.23 # open ports and service versions
nmap -p 1-1000 10.6.6.23 # scan a range of ports
nmap -O 10.6.6.23 # guess the operating system
Nmap commands used in the lab network practical.
Penetration testing finds weaknesses before criminals do.
Ethical vs unethical hacking
Ethical hacking (penetration testing)
Unethical hacking
Permission
written permission and an agreed scope
none: illegal under computer misuse law
Purpose
find and fix weaknesses
steal, damage, extort or show off
Outcome
a report to the owner with recommendations
harm to the organisation and its clients
Stay legal and ethical. Only scan or test systems you own or have written permission to test. Scanning other networks can be a criminal offence. Use the college lab or a virtual lab only.
Key terms
Port
a numbered endpoint for a network service, e.g. 443 for HTTPS.
Port scan
checking which ports on a host are open.
Penetration test
an authorised simulated attack to find weaknesses.
Scope
the systems a tester is allowed to test.
Exam focus
Benefits of penetration testing: finds real weaknesses before criminals, tests staff responses. Drawbacks: costly, only a snapshot in time, may disrupt services, testers must be trusted.
Think it through
Why is a restore test as important as the backup itself?
A backup that cannot be restored is useless; testing proves the data and the process work before a real disaster.
What makes a penetration tester’s work legal when an attacker’s identical actions are not?
The tester has the owner’s written permission and works within an agreed scope.
Watch
Full, incremental and differential backups and where to keep them.
By the end you can: explain firewall configuration, network segregation, network monitoring and port scanning, and why they are used.
A firewall applies rules to inbound and outbound traffic by type, application and IP address. Segregation keeps public servers away from the internal network.
8.3.2 Firewall configuration
Firewall rule type
Example
Why
Rules for traffic (inbound and outbound)
block all inbound except web traffic to the web server; allow outbound web browsing
stops unrequested connections in, and malware calling out
Traffic type rules
allow HTTPS (443) and DNS (53); block Telnet (23)
only needed, secure protocols are used
Application rules
block file-sharing or remote-control apps
stops risky software even on allowed ports
IP address rules
block known malicious addresses; allow the admin VPN only from office IPs
limits who can connect at all
Other internet security processes
Process
What it is
Why it is used
Virtual segregation
VLANs and subnets split one physical network into separate logical networks
a breach in one segment (e.g. guest Wi-Fi) cannot reach another (finance)
Physical segregation
separate cabling and switches for sensitive systems
strongest separation for critical systems
Offline network
a network with no connection to the internet
protects the most critical systems, e.g. industrial control
Network monitoring
tools watch traffic, logs, bandwidth and alerts continuously
spot attacks, faults and unusual use early
Port scanning
regularly scan your own network for open ports
find unexpected services before attackers do
Practical: configure a firewall in Packet Tracer
Build a network with three PCs, a switch and a server (addresses 1.0.0.1–1.0.0.4, mask 255.0.0.0).
Check that every PC can ping the server and open its web page.
On the server, open Services → Firewall and turn it on.
Add a rule to deny ICMP from one PC and allow it from the others. Test with ping.
Add a rule to allow only HTTP. Explain what changed and why a default-deny rule is safer.
Based on your teacher’s ‘Basic firewall configuration in Cisco Packet Tracer’ practical.
Key terms
Firewall
hardware or software that filters traffic using rules.
DMZ
a separate network zone for public-facing servers.
Network segregation
dividing a network into separate zones.
Default deny
blocking everything not explicitly allowed.
Exam focus
Say what each firewall rule type controls and give a realistic example. For segregation, explain the benefit (containing a breach) and a drawback (more complex to manage).
Think it through
Why should a firewall filter outbound traffic as well as inbound?
Malware already inside may try to send data out or contact its controller; outbound rules can block this.
Why put a public web server in a DMZ rather than on the internal LAN?
If the web server is hacked, the attacker is still separated from the internal network by the firewall.
Watch
How firewalls filter traffic with rules.
Watch and think:
Give one inbound and one outbound rule for a school.
By the end you can: explain confidentiality, integrity and availability and how they interrelate.
Confidentiality, integrity and availability depend on each other.
8.4.1 The three elements
Element
Meaning
Controls
Example of failure
Confidentiality
data is kept private by controlling who has access
access control, encryption, MFA
a leaked customer list
Integrity
data has not been tampered with; maintained partly by keeping it confidential (fewer people can change it)
hashing, permissions, audit logs, validation
an attacker changes bank details on invoices
Availability
data is available and useful when needed; useful only if its integrity is intact
backups, redundancy, DDoS protection, patching
ransomware or a DDoS takes a service offline
The elements interrelate: controlling access (confidentiality) protects integrity, because fewer people can alter the data. Integrity supports availability, because data that is available but wrong is not useful. Too much confidentiality can harm availability, e.g. so many locks that staff cannot reach what they need, so security is always a balance.
Key terms
Confidentiality
only authorised users can access data.
Integrity
data is accurate and unaltered.
Availability
authorised users can access data when needed.
Trade-off
strengthening one element may weaken another.
Exam focus
When given an incident, name which element(s) of CIA were affected. Ransomware hits availability (and integrity); a leak hits confidentiality; altered records hit integrity.
Think it through
Explain how maintaining confidentiality helps integrity.
If only authorised people can access the data, fewer people are able to change it, so it is less likely to be tampered with.
A hospital locks down its records so tightly that doctors cannot open them in an emergency. Which element suffers?
Availability: the data is not available to authorised users when needed.
Watch
Confidentiality, integrity and availability explained by a security architect.
Identification, authentication, authorisation and accountability (IAAA)
By the end you can: explain the elements of the IAAA model and the techniques used, with their benefits and drawbacks.
Identification, authentication, authorisation and accountability work in order every time someone uses a system.
8.4.2 The IAAA model
Element
Techniques
Benefits
Drawbacks
Identification: recognising the individual
knowledge-based (username); possession-based (ID card, key fob); biometric (face, fingerprint)
simple and quick
a username alone proves nothing; cards can be lost or stolen
Authentication: verifying the claimed identity
passwords and passphrases; MFA; biometric authentication
MFA and biometrics are hard to fake
passwords are forgotten or guessed; biometrics cannot be changed if stolen; cost of readers
Authorisation: only permitted resources and actions
role-based access control (RBAC); access control lists (ACLs)
least privilege; easy to manage by role
roles must be kept up to date; ACL mistakes grant too much
Accountability: actions traced to a user
audit logs; monitoring user activity
deters misuse; evidence for investigations
logs need storage and review; privacy concerns
$ ls -l /srv/hr
-rw-r----- 1 jsmith hr 4096 salaries.xlsx
$ sudo usermod -aG hr akhan # authorise: add a user to the hr group
$ sudo last -n 5 # accountability: recent logins
Linux permissions (authorisation) and login history (accountability), from the Linux commands practical.
In the real world: shared logins
A shop’s staff all use one shared till login. When money goes missing there is no way to know who processed which refund. Individual accounts (identification), PINs (authentication), refund rights for managers only (authorisation) and a transaction log (accountability) fix every stage.
Key terms
Identification
claiming an identity, e.g. entering a username.
Authentication
proving the identity claimed.
Authorisation
granting the permissions that identity is allowed.
Accountability
tracing actions back to the user responsible.
Exam focus
Do not mix up authentication (proving who you are) and authorisation (what you may do). Shared accounts break accountability, which is a common exam scenario.
Think it through
Why are shared user accounts a problem for accountability?
Audit logs can only record the shared account, so actions cannot be traced to one person.
Give one benefit and one drawback of role-based access control.
Benefit: permissions are set once per role and applied to everyone in it. Drawback: if someone changes job and their role is not updated, they keep access they no longer need.
Watch
Stretch: how identity, authentication, authorisation and accounting work in real networks.