CAIE 9618 · Paper 3 · Topic 3.5.3

Cybersecurity
Ethics & Digital
Forensics

Penetration Testing · Ethical Hacking · Forensic Investigation · Chain of Custody · Cybersecurity Legislation

CSZone Cambridge International AS & A Level Computer Science 9618

Penetration Testing

Ethical, Authorised Security Testing

Penetration testing (pen testing) is an authorised simulated attack on a system to find vulnerabilities before malicious actors do. Unlike criminal hacking, it requires explicit written permission from the system owner.

PHASES OF PEN TESTING

1. Reconnaissance — gather information (OSINT: DNS records, WHOIS, social media, employee names)

2. Scanning — port scanning, vulnerability scanning (e.g. Nmap, Nessus)

3. Exploitation — attempt to exploit found vulnerabilities (SQL injection, buffer overflow)

4. Post-exploitation — assess what an attacker could access; privilege escalation

5. Reporting — document all findings, severity ratings, and remediation recommendations

TYPES OF PEN TEST

Black-box — tester has no prior knowledge of the system; simulates external attacker

White-box — tester has full knowledge (source code, architecture); thorough but not realistic

Grey-box — partial knowledge; simulates insider threat or compromised credentials

WHY PEN TEST?

Identifies real exploitable vulnerabilities, not just theoretical ones

Required for compliance (PCI-DSS, ISO 27001)

Cost of a test vs cost of a real breach (data breach avg £3.8M)

Ethical Hacking & Responsible Disclosure

The Legal & Ethical Framework

ETHICAL vs UNETHICAL HACKING

Ethical (White Hat) — written authorisation obtained; findings reported to owner; no data stolen; operates within agreed scope

Criminal (Black Hat) — no permission; exploits for personal gain; theft, damage, extortion

Grey Hat — finds vulnerabilities without permission; discloses (sometimes publicly) without exploiting — still illegal in most jurisdictions

UK COMPUTER MISUSE ACT 1990

Section 1: Unauthorised access to computer material — up to 2 years prison

Section 2: Unauthorised access with intent to commit further offence

Section 3: Unauthorised modification (e.g. installing malware) — up to 10 years

RESPONSIBLE DISCLOSURE

Researcher finds vulnerability and privately notifies the organisation

Organisation given reasonable time to patch (typically 90 days — Google Project Zero standard)

If no fix, researcher may disclose publicly ("full disclosure") to create pressure

Bug bounty programmes: organisations pay researchers for responsible disclosure (HackerOne, Bugcrowd)

CVE (Common Vulnerabilities and Exposures) database publicly lists all known vulnerabilities

Digital Forensics

Investigating Digital Evidence

Digital forensics is the process of identifying, preserving, analysing, and presenting digital evidence in a legally admissible manner. Used in criminal investigations, corporate investigations, and incident response.

FORENSIC PROCESS

Identification — identify devices and potential sources of evidence (HDDs, phones, cloud accounts, logs)

Preservation — create a bit-for-bit forensic image (write-blocker used to prevent modification); hash the image (MD5/SHA-256) to prove integrity

Analysis — examine image for deleted files (recover from unallocated sectors), browser history, email, metadata, timestamps

Reporting — produce impartial, factual report suitable for court; findings must be repeatable

CHAIN OF CUSTODY

A chronological, documented record of who collected, handled, transferred, analysed, or stored evidence

Every person who touched the evidence must be recorded — any gap breaks the chain

Broken chain = evidence may be inadmissible in court (defence can claim tampering)

Original device must not be modified — work only on verified forensic copies

Write-blocker: hardware/software device that allows reading a storage device without writing to it — prevents accidental modification of evidence.

Exam Practice

Cambridge-style questions

Question 1

A company suspects an employee has committed fraud using a company computer. Describe the steps a digital forensics investigator should take to ensure the evidence obtained is legally admissible in court. [5]

1

Use a write-blocker to connect to the suspect device — this allows the device to be read without any data being written to it, preserving the original state.

1

Create a forensic image (bit-for-bit copy) of the storage device rather than working on the original.

1

Generate a hash value (e.g. SHA-256) of both the original device and the forensic image — if the hashes match, the copy is proven identical to the original.

1

Maintain a detailed chain of custody record — document every person who handles the evidence, with date, time, location, and purpose of access.

1

Produce an impartial, repeatable report — another forensic examiner should be able to independently perform the same analysis and reach the same conclusion from the forensic image.

Common Mistakes

Don't lose easy marks

1

Saying "pen testing is hacking" without distinguishing it from criminal activity — the key difference is written authorisation. Without explicit permission from the system owner, even well-intentioned security testing is illegal under the Computer Misuse Act.

2

Saying "forensic investigators work on the original hard drive" — they NEVER modify the original. A forensic image (bit-for-bit copy) is taken first using a write-blocker. All analysis is done on the image. Hashes prove the copy is identical to the original.

3

Forgetting that "chain of custody" is a legal concept, not just a tracking system — a broken chain means the defence can argue the evidence was tampered with, making it inadmissible in court. Always link chain of custody to its legal consequence in an exam answer.

Topic Summary — 3.5.3

What You Need to Know

PEN TESTING

Authorised simulated attack. Phases: Reconnaissance → Scanning → Exploitation → Post-exploitation → Reporting. Black-box (no knowledge), White-box (full knowledge), Grey-box (partial).

ETHICAL HACKING

White-hat = authorised. Black-hat = criminal. UK Computer Misuse Act 1990 (s1/s2/s3). Responsible disclosure: notify privately, 90-day patch window, then disclose. Bug bounty programmes.

DIGITAL FORENSICS

Identify → Preserve (write-blocker + forensic image + hash) → Analyse → Report. Chain of custody: document every handler — broken chain = inadmissible evidence. Never work on original device.

CSZone

Paper 3 Complete!

Section 3.5 — Security · 3 topics covered

4.1.1

Recursion

Paper 4 begins · Base case · Call stack · Trace

Head to CSZone.co.uk for the complete worksheet, quiz, and interactive tools