AQA 8525 · Section 3.6 · Cyber Security

Cyber Security
Measures

Passwords · Anti-malware · Encryption · Access Control · Software Updates

CSZoneAQA GCSE Computer Science 8525

Technical Measures

Protecting Systems with Technology

Strong passwords — long, complex, unique per account. Password managers help. Multi-factor authentication adds another layer.

Encryption — scrambles data in storage (AES) and transmission (TLS/SSL) so attackers cannot read intercepted data

Anti-malware/antivirus — scans for malicious software. Must be kept up to date to detect new threats.

Software updates/patches — fix known security vulnerabilities. Unpatched software is a major attack vector.

Firewall — monitors network traffic, blocks unauthorised connections

Access Control and Authentication

Limiting Who Can Access What

Access levels — different users get different permissions. Students read files, teachers edit, admin has full access. Principle of least privilege: give users only the access they need.

Two-factor authentication (2FA) — requires something you know (password) AND something you have (phone code) or something you are (fingerprint). Much harder to bypass.

Biometrics — fingerprint, face recognition, iris scan. Unique to each person, can't be forgotten or stolen easily.

Physical and Procedural Measures

Non-Technical Protection

Physical security — locked doors, CCTV, keycard access, cable locks for hardware

Staff training — teach all employees to recognise threats, handle data properly, follow security policies

Acceptable Use Policy (AUP) — rules for how company systems may be used; signed by all staff

Regular backups — 3-2-1 rule: 3 copies, 2 different media, 1 offsite. Protects against ransomware and hardware failure.

Exam Practice

Have a go at this question

AQA-style question

Explain how using two-factor authentication (2FA) is more secure than using a password alone.

2 marks

2FA requires a second form of verification in addition to the password [1], so even if an attacker obtains the password, they cannot access the account without also having the user's phone or biometric data [1].

Key Takeaways

What to Remember

Technical: passwords, encryption, anti-malware, firewall, patches, 2FA

Access control: least privilege — users get only the permissions they need

Physical: locked doors, cable locks, keycard access

Regular updates + backups are essential — patch vulnerabilities and protect data