Content Area 8: Security

Rate each point. Be honest: 'Secure' means you could answer an exam question on it now without notes.

8.1.1	Identify the confidential information organisations hold: HR, commercially sensitive, access information
8.1.2	Explain why each type of information must be kept confidential
8.1.3	Explain the impact of failing to maintain privacy and confidentiality
8.2.1	Explain technical threats (botnets, DoS/DDoS, malicious hacking, malware, social engineering, DNS attacks, insecure APIs, man-in-the-middle, open Wi-Fi), their impact, prevention and mitigation
8.2.2	Explain technical vulnerabilities: inadequate security processes and out-of-date components
8.2.3	Explain human threats and their prevention: human error, malicious employees, disguised criminals, poor cyber hygiene
8.2.4	Explain physical vulnerabilities and their prevention: access control, location, robustness, natural disasters
8.2.5	Explain the potential impact of threats and vulnerabilities
8.3.1	Explain the purpose, process, benefits and drawbacks of threat mitigation techniques
8.3.2	Explain firewall configuration, network segregation, network monitoring and port scanning
8.4.1	Explain how confidentiality, integrity and availability (CIA triad) interrelate
8.4.2	Explain identification, authentication, authorisation and accountability (IAAA), with techniques, benefits and drawbacks

Confidential information held by organisations (8.1.1) and why it must be protected (8.1.2)

Category	Information	Why it must be kept confidential
Human Resources	Salaries and benefits	Prevent competitors offering higher wages to poach staff; prevent employees comparing salaries and demanding comparable pay
Human Resources	Staff personal details	Protect staff privacy (and comply with data protection law); prevent competitors contacting staff directly
Commercially sensitive	Client details	Prevent competitors contacting clients; protect client privacy
Commercially sensitive	Stakeholder details	Protect relationships with suppliers, investors and partners
Commercially sensitive	Intellectual property	Prevent competitors copying designs, code or inventions
Commercially sensitive	Sales numbers	Competitors could use them to undercut prices or target weak areas; could affect share price
Commercially sensitive	Contracts	Terms and prices are commercially sensitive
Access information	Usernames, passwords, MFA details, PINs, access codes, passphrases, biometric data	Prevent unauthorised access to systems, data and buildings

Impact of failing to maintain privacy and confidentiality (8.1.3)

Impact	Explanation
Non-compliance with regulations	Breaches data protection law; regulated businesses (finance, health, legal) can lose their licence to practise.
Loss of trust	Customers, staff and partners no longer trust the organisation with their data.
Damage to the organisation's image	Negative media coverage; brand associated with the breach.
Financial loss	Fines (ICO up to £17.5m or 4% of global turnover); refunds and compensation to customers; loss of earnings and termination of contracts.
Legal action	Customers or staff sue; regulators prosecute.
Reduced security	Leaked access information gives attackers a route into systems for further attacks.

Threat

Something that could cause harm to a system or data, e.g. a hacker or malware.

Vulnerability

A weakness that a threat could exploit, e.g. unpatched software or a weak password policy.

For each threat, know what it is, its impact and how to prevent or mitigate it.

Threat	What it is	Impact	Prevention / mitigation
Botnets	Many infected devices (often IoT) controlled by an attacker to send spam, run DDoS attacks or mine cryptocurrency.	Devices slowed; organisation's network used in crimes; DDoS on targets	Anti-malware; patching; change default passwords on IoT devices; network monitoring
DoS / DDoS	Flooding a server or network with requests so genuine users can't get through. DDoS uses thousands of devices.	Website or service offline; lost sales; reputational damage	DDoS protection services; firewalls and rate limiting; extra capacity / cloud elasticity; traffic filtering
Malicious hacking: who	Hacktivists (political or social cause), nation states (espionage, disruption), organised crime (money), individuals (curiosity, revenge, reputation).	Depends on motive: data theft, defacement, disruption, ransom	Layered security; threat intelligence; staff awareness
Password cracking / brute force	Trying many passwords automatically, or using lists of common and leaked passwords.	Account takeover; data theft	Strong password policy; lock account after failed attempts; MFA; CAPTCHA; salted hashing of stored passwords
Cross-site scripting (XSS)	Attacker injects malicious script into a web page (e.g. in a comment) that then runs in other users' browsers.	Stolen session cookies; account hijacking; redirection to fake sites	Validate and sanitise input; encode output; content security policy
SQL injection	SQL code typed into an input field is run by the database.	Data read, changed or deleted; whole database stolen	Parameterised queries; input validation; least-privilege database accounts
Buffer overflow	Input longer than the memory buffer overwrites adjacent memory, crashing the program or running attacker code.	Crash; attacker takes control	Check input length; memory-safe languages; patching

Worked example: SQL injection

This login check builds the SQL query by joining strings. Entering ' OR '1'='1 as the password makes the condition always true, so the attacker logs in without knowing the password.

import sqlite3

db = sqlite3.connect(":memory:")
db.execute("CREATE TABLE users (name TEXT, password TEXT)")
db.execute("INSERT INTO users VALUES ('admin', 'S3cret!')")

name = "admin"
password = "' OR '1'='1"

# Vulnerable: user input joined straight into the SQL
query = ("SELECT * FROM users WHERE name = '" + name +
         "' AND password = '" + password + "'")
print("Vulnerable login:", db.execute(query).fetchone() is not None)

# Safe: parameterised query treats the input as data, not code
safe = "SELECT * FROM users WHERE name = ? AND password = ?"
result = db.execute(safe, (name, password)).fetchone()
print("Safe login:", result is not None)

Vulnerable login: True
Safe login: False

See the query the attacker builds

Malware

Type	How it works	Impact
Virus	Attaches to a file or program; spreads when the infected file is run or shared.	Corrupts or deletes files; slows systems
Worm	Self-replicating; spreads across networks by exploiting vulnerabilities, without user action.	Spreads very fast; uses bandwidth; can deliver other malware
Key logger	Records keystrokes and sends them to the attacker.	Passwords and card numbers stolen
Ransomware	Encrypts files and demands payment (often cryptocurrency) for the key.	Data unavailable; operations stop; ransom cost; data may also be leaked
Spyware	Secretly monitors activity (browsing, location, messages) and sends data to a third party.	Privacy breach; stolen credentials
Remote access trojan (RAT)	Disguised as legitimate software; gives the attacker remote control of the device.	Full control: files, webcam, use as part of a botnet

Prevention for all malware: anti-malware software kept up to date; patching; firewalls; don't open unexpected attachments; restrict admin rights so users can't install software; email filtering; regular, offline backups (essential for recovering from ransomware without paying).

Social engineering

Attack	How it works	Example
Phishing	Mass emails pretending to be from a trusted organisation, with links to fake sites or malicious attachments.	'Your Microsoft 365 password expires today: click here'
Spear phishing	Targeted at a specific person, using researched details to seem genuine.	Email to the finance team appearing to come from the CEO asking for an urgent payment
Smishing	Phishing by SMS.	'Royal Mail: your parcel is held. Pay £1.45 redelivery fee here'
Vishing	Phishing by phone call.	Caller claiming to be from the bank's fraud team asking for a card PIN
Pharming	Redirects users to a fake website even if they type the correct address, e.g. by poisoning DNS or changing the hosts file.	User types their bank's address but lands on a copy that steals login details
Watering hole	Attacker infects a website that the target group regularly visits.	Compromising an industry forum used by engineers at a target company
USB baiting	Infected USB sticks left where staff will find and plug them in.	USB labelled 'Salaries 2026' left in the car park

Prevention: staff training and phishing simulations; email filtering; MFA (stolen passwords alone aren't enough); verify requests by a second channel (call back on a known number); policy that the bank or IT will never ask for passwords; disable USB ports or autorun; check URLs and HTTPS certificates.

Practise: name the attack

Other technical threats

Threat	What it is	Prevention / mitigation
Domain name server attack / redirection of traffic	DNS records are poisoned or hijacked so users are sent to malicious sites.	Secure DNS (DNSSEC); patch DNS servers; monitor DNS records; HTTPS certificates
Insecure APIs	APIs without proper authentication, encryption or input validation expose data or functions.	Authentication (API keys, tokens); encryption (HTTPS); validation; rate limiting; certification and security testing of APIs
Man-in-the-middle	Attacker intercepts communication between two parties to read or alter it, e.g. on public Wi-Fi.	Encryption (HTTPS, VPN); certificate checks; avoid untrusted networks
Open / unsecured Wi-Fi	Networks with no password or weak encryption let attackers capture traffic or set up fake 'evil twin' hotspots.	Use a VPN; WPA3 encryption on company Wi-Fi; avoid sensitive tasks on public Wi-Fi

Botnet

A network of malware-infected devices (bots) controlled remotely by an attacker.

DoS / DDoS

Denial of service: flooding a system with traffic so legitimate users can't access it. Distributed DoS uses many devices at once.

Brute force

Trying every possible password combination until the right one is found.

Cross-site scripting (XSS)

Injecting malicious script into a website so it runs in other users' browsers.

SQL injection

Entering SQL code into an input field so it is run by the database, to read, change or delete data.

Buffer overflow

Sending more data than a memory buffer can hold, so it overwrites nearby memory, possibly running attacker code.

Malware

Malicious software, e.g. viruses, worms, ransomware, spyware.

Virus

Malware that attaches to a file or program and spreads when that file is run or shared.

Worm

Malware that replicates itself and spreads across networks without user action.

Ransomware

Malware that encrypts files and demands payment for the key.

Remote access trojan (RAT)

Malware disguised as legitimate software that gives an attacker remote control of a device.

Social engineering

Manipulating people into giving away information or access.

Phishing

Fake emails pretending to be from a trusted source, to steal details or spread malware.

Spear phishing

Phishing targeted at a specific person or organisation, using personal details to seem genuine.

Smishing

Phishing by SMS text message.

Vishing

Phishing by voice call.

Pharming

Redirecting users from a genuine website to a fake one, e.g. by tampering with DNS.

Watering hole attack

Infecting a website that a target group is known to visit.

Man-in-the-middle (MitM)

Secretly intercepting and possibly altering communication between two parties.

Technical vulnerabilities (8.2.2)

Vulnerability	Why it is a risk
Weak encryption	Old or weak algorithms (or short keys) can be broken, exposing data in storage or transfer.
Inadequate password policy	Short, common or reused passwords are easily guessed or cracked.
Failure to use multi-factor authentication	A single stolen password gives full access.
Out-of-date hardware	Older devices may not support modern security features or receive firmware updates.
Out-of-date software	No longer supported, so vulnerabilities are never patched; may only work with legacy systems; zero-day bugs may be exploited before a patch exists.
Out-of-date firmware	Firmware flaws in routers, IoT devices and BIOS can give attackers deep, hard-to-detect access.

Human threats and prevention (8.2.3)

Threat	Example	Prevention / mitigation (from the spec)
Human error	Deleting a file; sending data to the wrong email address	File properties (e.g. read-only); confirmation boxes ('Are you sure you want to delete?'); staff training
Malicious employee	Disgruntled staff member steals client list before leaving	Immediate removal from premises; suspend user accounts immediately; least-privilege access
Disguised criminal	Person posing as a delivery driver or engineer to get into the building	Accompany all visitors; check identification of visitors
Poor cyber hygiene	Leaving a PC unlocked; passwords on sticky notes; reusing passwords	Lock all unattended machines; don't write down passwords; good password management (password managers)

Physical vulnerabilities and prevention (8.2.4)

Vulnerability	Prevention / mitigation
Lack of access control	Entry control systems: key cards, keypads, biometric locks, reception desks.
Poor access control	Do not allow tailgating; use complex access codes; change codes regularly; monitor access areas (CCTV); audit staff access to secure areas.
Nature of location: shoulder surfing	Privacy screens; position screens away from windows and public areas; shield keypads.
Nature of location: environment	Protect against heat, water, dust and power problems: air conditioning, raised floors, fire suppression, UPS.
Nature of location: vandalism	Locked server rooms and cabinets; CCTV; security staff; secure building.
Poor system robustness	Rugged machines for harsh environments (warehouses, outdoor work, construction sites).
Natural disasters	Floods, fire, storms: offsite/cloud backups, disaster recovery plan, alternative sites, don't put server rooms in basements in flood areas.

Impact of threats and vulnerabilities (8.2.5)

• Loss or leaking of sensitive data
• Unauthorised access to digital systems
• Data corruption
• Disruption of service
• Unauthorised access to restricted physical areas

Zero-day

A vulnerability unknown to the vendor, with no patch available.

Firmware

Software stored on hardware that controls the device at a low level.

Tailgating

Following an authorised person through a secure door without using your own access.

Shoulder surfing

Watching someone enter a password or PIN, or read their screen.

Technique	Purpose and process	Benefits	Drawbacks
Security settings: hardware	BIOS/UEFI passwords, secure boot, disabling USB ports, TPM chips.	Protects devices even before the OS loads	Must be configured on every device; can inconvenience users
Security settings: software	OS and application settings: screen locks, permissions, automatic updates, privacy settings.	Cheap; centrally managed via group policy	Default settings are often insecure; must be maintained
Anti-malware software	Function: detects, blocks and removes malware. Actions: scans files against signatures and suspicious behaviour (heuristics); quarantines or deletes threats; real-time protection.	Stops most known malware automatically	Needs constant updates; may miss new (zero-day) malware; can slow systems; false positives
Intrusion detection	Monitors network traffic or system activity for suspicious patterns and alerts administrators.	Early warning of attacks; evidence for investigation	Detects but doesn't stop (unless it is an IPS); false alarms; needs staff to respond
Encryption: hashing	One-way function producing a fixed-length value. Used to store passwords (with a salt) and check files haven't changed.	Cannot be reversed; stolen hashes don't reveal passwords directly	Weak or unsalted hashes can be cracked by guessing; not for data that must be read back
Encryption: symmetric	The same key encrypts and decrypts (e.g. AES).	Fast; good for large amounts of data and disk encryption	The key must be shared securely; if intercepted, all data is exposed
Encryption: asymmetric	Public key encrypts; only the matching private key decrypts (e.g. RSA). Used in HTTPS to exchange keys and for digital signatures.	No need to share a secret key; supports digital signatures	Slower; usually used to exchange a symmetric key rather than encrypt all data
User access policies	Rules for who can access what: least privilege, password rules, account reviews.	Limits damage from compromised accounts	Needs regular review; can slow down work
Staff vetting	Background and reference checks (e.g. DBS, previous employers) before giving access to sensitive systems.	Reduces insider risk	Costs time and money; doesn't predict future behaviour
Staff training	Regular training on phishing, passwords, policies and reporting incidents.	Tackles the most common cause of breaches: people	Must be repeated; effect fades; takes staff time
Software-based access control	Permissions, role-based access, ACLs control what each user can do.	Fine control; auditable	Complex to manage in large organisations
Device hardening	Remove unneeded ports, apps, services and accounts; change defaults.	Reduces attack surface	Takes time; may remove features someone needs
Backups	Full: copies everything. Incremental: copies changes since the last backup of any type. Differential: copies changes since the last full backup. Safe storage: offsite, cloud, offline/air-gapped, encrypted.	Recover from ransomware, deletion and disasters	Storage cost; must be tested; restoring takes time
Software updates	Install patches that fix vulnerabilities.	Closes known holes quickly	Updates can break compatibility; need testing; downtime
Firmware / driver updates	Update the low-level software on devices and hardware.	Fixes deep vulnerabilities	Risk of 'bricking' if an update fails; often forgotten
Air gaps	Physically separate a system from all networks.	Very hard to attack remotely	Inconvenient; data transfer by removable media brings its own risk
Certification of APIs	APIs are tested and certified against security standards before use; strong authentication.	Trusted, secure integrations	Time and cost to certify
VPNs	Encrypted tunnel over the internet to the organisation's network.	Secure remote working; protects on public Wi-Fi	Can slow connection; VPN itself must be patched
Multi-factor authentication	Two or more factors: something you know, have, are.	Stolen password alone is not enough	Extra step for users; lost phone can lock users out
Password managers	Generate and store strong, unique passwords in an encrypted vault.	No reuse; users only remember one master password	Master password becomes a single point of failure
Port scanning	Check which ports are open on your own systems.	Finds unnecessary open services to close	Attackers use it too; must have permission
Penetration testing	Ethical hacking: authorised testers simulate attacks to find weaknesses, with a written scope. Unethical hacking: the same techniques used without permission, which is illegal under the CMA.	Finds vulnerabilities before criminals do; tests defences realistically	Expensive; only a snapshot in time; could disrupt systems

Backup types compared

Type	Backup time and storage	Restore needs	Restore speed
Full	Slowest, most storage	Just the last full backup	Fastest
Incremental	Fastest, least storage	Last full + every incremental since	Slowest
Differential	Grows each day until next full	Last full + latest differential	Medium

Try it: what do you need to restore?

A full backup runs every Sunday. Pick the other backups and the day the server fails.

Worked example: salted hashing

import hashlib
import os

def hash_password(password, salt):
    return hashlib.sha256(salt + password.encode()).hexdigest()

salt = os.urandom(16)                  # random salt, stored with the hash
stored = hash_password("Summer2026!", salt)

print(len(stored))                                    # always 64 characters
print(hash_password("Summer2026!", salt) == stored)   # correct
print(hash_password("summer2026!", salt) == stored)   # one letter wrong

64
True
False

The system never stores the password, only the salt and hash. At login it hashes what the user typed and compares. A random salt means two users with the same password get different hashes, which defeats pre-computed tables of common password hashes. (Real systems use slow hashing algorithms designed for passwords, such as bcrypt or Argon2.)

Try it: SHA-256 in your browser

Change one letter of the password and watch the whole hash change. Same password, new salt: a completely different hash.

Encryption

Scrambling data with a key so only someone with the correct key can read it.

Hashing

A one-way function that turns data into a fixed-length value. It cannot be reversed.

Symmetric encryption

Uses the same key to encrypt and decrypt.

Asymmetric encryption

Uses a public key to encrypt and a matching private key to decrypt.

Intrusion detection system (IDS)

Monitors network or system activity and alerts on suspicious behaviour.

Air gap

Physically isolating a computer or network from all other networks, including the internet.

Port scanning

Checking which network ports on a device are open and what services are listening.

Penetration testing

An authorised, simulated attack to find vulnerabilities before real attackers do.

Firewall configuration

A firewall checks traffic against rules and allows or blocks it.

Rule type	Example
Rules for traffic: inbound and outbound	Block all inbound traffic except to the web server; block outbound traffic to known malicious sites.
Traffic type rules	Allow HTTPS (port 443); block Telnet (port 23) and FTP.
Application rules	Allow Teams; block peer-to-peer file sharing apps.
IP address rules	Allow admin access only from the office IP range; block IP addresses from known attackers.

Network segregation

Type	Meaning	Example
Virtual	One physical network divided into separate logical networks (VLANs).	Guest Wi-Fi kept separate from staff network; card payment systems on their own VLAN
Physical	Completely separate hardware and cabling.	Factory control systems on their own network
Offline network	Not connected to the internet at all (air-gapped).	Classified government systems; backup storage

Why: if one segment is compromised, the attacker can't easily reach the others; sensitive systems get stronger controls; traffic is easier to monitor.

Network monitoring and port scanning

• Network monitoring: tools watch traffic levels, devices and logs in real time. Unusual activity (a spike in traffic at 3am, logins from abroad, large uploads) is flagged so staff can respond before damage spreads.
• Port scanning: regularly scanning your own network finds open ports and services that should not be there, so they can be closed before an attacker finds them.

Firewall

Hardware or software that controls network traffic in and out using rules.

The CIA triad (8.4.1)

Element	Meaning	How it is achieved	Example of failure
Confidentiality	Data is kept private by controlling who has access to it.	Encryption, access control, authentication	Hacker reads customer records
Integrity	Data has not been tampered with and is accurate. Maintaining confidentiality helps protect integrity.	Hashing, access control, validation, audit logs, backups	Malware changes prices in a database
Availability	Data and systems are available and useful when needed. Maintaining integrity helps ensure availability.	Redundancy, backups, DDoS protection, patching	Ransomware locks files; DDoS takes site offline

How they interrelate: if confidentiality fails (an attacker gets in), integrity is at risk (they can change data); if integrity fails (data is corrupted), the data is no longer useful, so in practice it is not available. Measures can also conflict: very strict access controls protect confidentiality but can reduce availability for genuine users.

The IAAA model (8.4.2)

Stage	Purpose	Techniques	Benefits	Drawbacks
Identification	Recognising the individual within a digital system: who do you claim to be?	Knowledge-based (username, email); possession-based (ID card, key fob); biometric (fingerprint, face)	Every user has a unique identity	Usernames are often easy to guess or find
Authentication	Verifying the identity claimed during identification: prove it.	Passwords and passphrases; multi-factor authentication; biometric authentication	MFA greatly reduces account takeover; biometrics can't be forgotten	Passwords forgotten, reused or stolen; biometrics can't be changed if compromised and raise privacy concerns
Authorisation	Ensuring authenticated users can only access resources and perform actions they are permitted to.	Role-based access control (permissions by job role); access control lists	Least privilege limits damage; easy to manage by role	Roles must be kept up to date when people change jobs; complex in large organisations
Accountability	Ensuring any action can be traced back to the responsible user.	Audit logs; monitoring user activity	Deters misuse; evidence for investigations; meets regulations	Logs need storage and someone to review them; privacy concerns about monitoring

Practise: which IAAA stage?

CIA triad

Confidentiality, integrity and availability: the three goals of information security.

IAAA

Identification, authentication, authorisation, accountability: the stages of controlling access to a system.

Access control list (ACL)

A list that states which users or groups can access a resource and what they can do with it.

Audit log

A record of who did what, and when, in a system.

Flashcards

Every Quick recall definition on this page. Click the card to flip it; use the arrow keys to move.

Random questions on CA8 from the course question bank. Pick a topic or question type, answer in your head or on paper, then check. Your score is saved on this device.

Allow about 95 minutes.

My corrections: what I need to go back over