SLIDE 1
CSZone.co.uk
Click to reveal · Arrow keys also work
OCR J277 · Component 1 · Topic 1.4.2

Identifying & Preventing Vulnerabilities

Penetration Testing · Anti-Malware · Firewalls · User Access Levels · Passwords · Encryption · Physical Security

CSZone OCR GCSE Computer Science J277
Learning Objectives

By the end of this video you will be able to...

Describe penetration testing — what it is, how it is carried out, and why organisations use it to identify vulnerabilities
Explain how anti-malware software and firewalls protect computer systems and networks from attack
Describe the use of user access levels to control what different users can see and do within a system
Explain the characteristics of a strong password and why passwords are a key method of protecting access to systems and data
Describe how encryption and physical security measures protect systems and data from unauthorised access
⚡ Topic 1.4.2 — seven prevention methods, each requiring you to know what it is, how it works, and what it protects against.
Network Security

From threats to defences

THE LINK TO 1.4.1
In 1.4.1 we covered the main threats — malware, phishing, brute-force, DoS, data interception, and SQL injection. Now in 1.4.2 we look at how organisations identify vulnerabilities before attackers do, and the technical and physical measures used to prevent those attacks succeeding.
🔍
IDENTIFY
Find weaknesses before attackers do — penetration testing
🛡️
PREVENT
Technical controls — anti-malware, firewalls, encryption
🔒
CONTROL
Access controls — user levels, passwords, physical security
SEVEN PREVENTION METHODS
Penetration Testing Anti-Malware Firewalls User Access Levels Passwords Encryption Physical Security
⚡ For each method: know what it is, how it works, and what attack or risk it protects against. These map directly to exam marking schemes.
Prevention Method

Penetration testing

DEFINITION
Penetration testing — often called "pen testing" — is an authorised, simulated cyber attack on a computer system. Security professionals attempt to exploit vulnerabilities in the same way a real attacker would, in order to identify and fix weaknesses before malicious hackers can find them.
HOW IT IS CARRIED OUT
1
Plan: define the scope and goals — which systems to test, what methods are permitted, and what is out of scope
2
Scan & probe: testers examine the system to understand how it responds to intrusion attempts — identifying open ports, software versions, and potential entry points
3
Exploit: testers attempt to exploit discovered vulnerabilities — trying SQL injection, weak passwords, misconfigured servers — to access systems or data
4
Report: a detailed report is produced documenting vulnerabilities found, data accessed, and recommendations to fix each weakness
WHY ORGANISATIONS USE IT
Identifies real vulnerabilities before attackers do. Tests how well existing defences actually work in practice. Meets legal or regulatory requirements. Provides evidence for management and stakeholders.
WHAT IT TESTS AGAINST
SQL injection vulnerabilities. Weak or default passwords. Misconfigured servers or network devices. Unpatched software. Social engineering susceptibility of staff.
⚡ Penetration testing is about finding vulnerabilities, not preventing attacks directly. The value is in the report — fixing what was found is what provides the protection.
Prevention Method

Anti-malware software

DEFINITION
Anti-malware software (also called antivirus software) is a program that detects, prevents, and removes malicious software from a computer system. It protects against viruses, worms, trojans, ransomware, spyware and other forms of malware.
HOW IT WORKS
Signature-based detection: the software maintains a database of known malware signatures — unique patterns of code. Files on the system are scanned and compared against this database. If a match is found, the file is flagged as malware. This requires the database to be kept up to date to catch new malware.
Heuristic analysis: identifies suspicious behaviour or code patterns that may indicate previously unknown malware — even if the specific signature is not in the database. Monitors what programs actually do, not just what they look like.
WHAT IT PROTECTS AGAINST
Viruses and worms entering the system. Trojans disguised as legitimate software. Ransomware encrypting files. Spyware monitoring user activity. Malicious email attachments and downloads.
KEY REQUIREMENT
Anti-malware software must be kept up to date. New malware is created every day — an outdated database will not recognise newly created threats. Regular updates are as important as having the software installed.
⚡ Anti-malware software detects known threats via a signature database and unknown threats via heuristic analysis. Keeping it updated is essential — stale databases miss new malware entirely.
Prevention Method

Firewalls

DEFINITION
A firewall monitors and controls incoming and outgoing network traffic based on a set of security rules. It acts as a barrier between a trusted internal network and an untrusted external network (such as the internet), blocking unauthorised access while allowing legitimate traffic through.
HOW IT WORKS
The firewall examines each data packet entering or leaving the network and checks it against its rule set — a list of permitted and blocked sources, destinations, ports, and protocols.
Packets that match an allow rule are passed through. Packets that match a block rule — or that don't match any allow rule — are dropped.
TYPES OF FIREWALL
SOFTWARE FIREWALL
A program installed on an individual device. Protects that one device. Common on personal computers and laptops — e.g. Windows Defender Firewall.
HARDWARE FIREWALL
A dedicated physical device placed between the network and the internet. Protects all devices on the network. Common in businesses and organisations.
⚡ A firewall protects against unauthorised network access and can block DoS attacks, suspicious incoming connections, and traffic from known malicious IP addresses. It does not scan for malware already on the device — that is anti-malware's job.
Prevention Method

User access levels

DEFINITION
User access levels — also called user permissions or access control — restrict what different users can see, read, write, or execute within a system. Each user is given only the level of access they actually need to perform their job: the principle of least privilege.
HOW IT WORKS — EXAMPLE
👤
STANDARD USER
Can read and edit their own files. Cannot install software or change system settings.
👔
MANAGER
Can access team files and generate reports. Cannot access other departments' data.
🛠️
ADMINISTRATOR
Full access — install software, manage users, change system settings, access all files.
WHY IT MATTERS
Limits damage from breaches: if an attacker compromises a standard user account, they only gain access to what that user can access — not the entire system.
Prevents insider threats: employees can only access data relevant to their role — accidental or deliberate misuse of other data is prevented.
⚡ Key principle: least privilege — users are given only the minimum access they need to do their job. This limits what an attacker can do even if they successfully compromise an account.
Prevention Method

Passwords

DEFINITION
A password is a secret string of characters used to authenticate a user — verifying that they are who they claim to be. Passwords are the most widely used method of controlling access to systems, accounts, and data.
CHARACTERISTICS OF A STRONG PASSWORD
🔡
Length: the longer the password, the more combinations an attacker must try in a brute-force attack. A 12-character password is vastly harder to crack than a 6-character one.
🔤
Complexity: mixing upper and lower case letters, numbers, and special symbols (e.g. !, @, #) increases the number of possible combinations exponentially.
❓
Unpredictability: avoid names, dates, dictionary words, or common passwords such as "password123." Attackers use dictionaries and known patterns first.
🔁
Uniqueness: using the same password on multiple sites means one breach compromises all accounts.
ADDITIONAL MEASURES
🔐 Account lockout — locks an account after a set number of failed login attempts, directly defeating brute-force attacks
📱 Two-factor authentication (2FA) — requires a second piece of evidence (e.g. a code sent to a phone) alongside the password
⚡ A strong password directly defeats brute-force attacks. Account lockout is the second line of defence — even a short simple password becomes much harder to crack if the account locks after a few attempts.
Prevention Method

Encryption

DEFINITION
Encryption converts data into an unreadable, scrambled format — called ciphertext — using a mathematical algorithm and an encryption key. Only someone with the correct decryption key can convert it back into readable plaintext. Without the key, intercepted or stolen data is meaningless.
WHERE ENCRYPTION IS USED
Data in transit: HTTPS encrypts web traffic so data sent between browser and server cannot be read if intercepted. WPA2/WPA3 encrypt data on wireless networks.
Data at rest: files and databases can be encrypted so that even if a device is stolen or a server is breached, the data stored on it cannot be read without the key.
Communications: messaging apps, email, and VPNs use encryption to protect the content of communications from interception.
WHAT IT PROTECTS AGAINST
🕵️ Data interception — even if a packet sniffer captures data in transit, it reads only unbreakable ciphertext
💻 Physical theft — a stolen encrypted laptop or hard drive reveals nothing without the decryption key
⚡ You do not need to know specific encryption algorithms for the exam — just the principle: encryption makes data unreadable without the correct key, protecting both data in transit and data at rest.
Prevention Method

Physical security

DEFINITION
Physical security refers to measures that prevent unauthorised physical access to computer systems, devices, and the buildings in which they are housed. Technical security is useless if an attacker can simply walk up to a server and remove it.
PHYSICAL SECURITY MEASURES — ACCESS CONTROLS
🏢
Locked server rooms: servers and network equipment are kept in dedicated locked rooms that only authorised personnel can enter
🎫
Key card / badge access: electronic locks on doors require staff to swipe an ID card — access can be logged and revoked instantly
📹
CCTV surveillance: cameras deter theft and record unauthorised access attempts for review
PHYSICAL SECURITY MEASURES — DEVICE & DATA PROTECTION
💼
Cable locks: physical locks secure laptops and desktop computers to desks, preventing opportunistic theft
🚧
Biometric access: fingerprint or retina scanners provide strong, unforgeable access control for sensitive areas
🗑️
Secure disposal: physically destroying hard drives and shredding documents prevents data recovery from discarded equipment
⚡ Physical security protects against data theft from stolen devices, unauthorised physical access to servers, and social engineering attacks where an attacker attempts to gain physical entry to a building. Technical controls and physical controls must work together.
Putting It Together

Identifying & Preventing Vulnerabilities — the big picture

PENETRATION TESTING
Authorised simulated attack to find vulnerabilities. Plan → scan → exploit → report. Identifies weaknesses before attackers do.
ANTI-MALWARE
Detects and removes malware. Signature database for known threats; heuristic analysis for new ones. Must be kept up to date.
FIREWALLS
Monitor and filter network traffic using rules. Software (single device) or hardware (whole network). Blocks unauthorised access and suspicious traffic.
USER ACCESS LEVELS
Principle of least privilege — users get only the access they need. Limits damage from breaches and prevents insider threats.
PASSWORDS & ENCRYPTION
Strong passwords (long, complex, unique) defeat brute-force. Encryption protects data in transit and at rest — meaningless without the key.
PHYSICAL SECURITY
Locked rooms, key cards, CCTV, cable locks, biometrics. Prevents physical access to devices and data. Works alongside technical controls.
Exam-Style Questions

Identifying and Preventing Vulnerabilities

Question 1
Describe what is meant by penetration testing and explain one reason why an organisation might carry it out.
3 marks
1
Penetration testing is an authorised, simulated cyber attack on a system carried out by security professionals. (1 mark)
1
The testers attempt to exploit vulnerabilities in the same way a real attacker would. (1 mark)
1
Reason: to identify weaknesses / vulnerabilities in the system before a real attacker finds them, so they can be fixed. (1 mark)
Question 2
Explain the difference between a software firewall and a hardware firewall.
2 marks
1
A software firewall is a program installed on an individual device and only protects that one device. (1 mark)
1
A hardware firewall is a dedicated physical device placed between the network and the internet, protecting all devices on the network. (1 mark)
Question 3
A company stores sensitive customer data on its servers. Describe two technical methods the company could use to protect this data from unauthorised access, and for each explain how it provides protection.
4 marks
Common Mistakes

Four mistakes that cost marks in the exam

1
Confusing anti-malware and firewalls. A firewall monitors and filters network traffic — it decides what comes in and goes out. Anti-malware detects and removes malicious software already on or trying to enter the device. They do different jobs: a firewall is a barrier at the network boundary; anti-malware is a scanner on the device itself.
2
Describing penetration testing as "hacking." Penetration testing is an authorised, legal activity carried out by security professionals with permission from the organisation. It is not the same as a malicious attack. In exam answers, always include the word "authorised" or "simulated" — these distinctions earn marks.
3
Saying encryption "stops" data from being intercepted. Encryption does not prevent data from being intercepted — a packet sniffer can still capture packets. What encryption does is make the captured data unreadable without the decryption key. Say "ensures intercepted data cannot be read" not "prevents data from being intercepted."
4
Forgetting physical security in "protect the data" questions. Many students only think of software solutions. Physical security — locked rooms, key card access, CCTV — is a valid and expected answer in the spec. If a question asks for methods of protecting a computer system or data, physical measures count and are often required for full marks.
Summary

1.4.2 — Identifying and Preventing Vulnerabilities

PENETRATION TESTING
Authorised simulated attack. Four phases: plan, scan, exploit, report. Finds vulnerabilities before attackers do.
ANTI-MALWARE & FIREWALLS
Anti-malware: signature database + heuristic analysis. Must be kept updated. Firewall: monitors & filters network traffic by rules. Software (device) or hardware (network).
USER ACCESS LEVELS
Principle of least privilege. Users get only the access they need. Limits damage from breaches; prevents insider misuse.
PASSWORDS
Strong = long, complex (upper/lower/numbers/symbols), unpredictable, unique. Account lockout defeats brute-force. 2FA adds a second factor.
EXAM TIP
For every method: state what it is, how it works, and what it protects against. In "describe two methods" questions, give a different method each time and fully explain each one — don't just name it. Physical security counts.
1.4.2 Complete

That's 1.4.2 done!

Next up: 1.5.1 — Operating Systems

📝
MARKED WORKSHEET
CSZone.co.uk
🎯
QUIZ
CSZone.co.uk
📊
SLIDES
CSZone.co.uk