No single security measure is sufficient. Defence in depth (layered security) means using multiple overlapping security controls so that if one fails, others are still in place. Think of it like a castle: a moat, then a wall, then guards, then locked doors inside.
Hardware or software that monitors and filters network traffic. Inspects packets by source/destination IP, port, protocol. Packet filtering: checks individual packets. Stateful inspection: tracks connection state. Proxy firewall: intermediary between internal/external. DMZ (Demilitarised Zone): a buffer network between internal and external networks for public-facing servers.
Encryption scrambles data so it cannot be read without the key. At rest: protects stored data (full disk encryption, encrypted databases). In transit: protects data moving across networks (HTTPS/TLS). Symmetric encryption: same key to encrypt and decrypt (fast, AES). Asymmetric encryption: public key encrypts, private key decrypts (RSA, used in TLS handshake).
Username + password: most basic. Two-factor authentication (2FA): password + something you have (phone/token) — dramatically improves security. Biometrics: fingerprint, face recognition — something you are. Authentication should be mandatory for all system access.
After authentication, authorisation controls WHAT a user can access. Principle of least privilege: users only have permissions they need for their role. Access control lists (ACLs): define permissions per user/group per resource. Separate admin accounts from standard user accounts.
Detects and removes malware using: Signature detection (database of known malware) and heuristic analysis (detects suspicious behaviour patterns). Must be kept up to date — new malware emerges daily. Real-time scanning monitors files as they are accessed.
Software vendors release security patches to close known vulnerabilities. Unpatched systems are a major vulnerability — many major breaches exploit known, patched vulnerabilities that organisations failed to update. Enable automatic updates; prioritise critical security patches.
TLS/HTTPS process: (1) Client connects; (2) Server sends public key certificate; (3) Client verifies certificate; (4) Symmetric session key exchanged securely using asymmetric encryption; (5) All data encrypted with session key.
| Measure | Description |
|---|---|
| Security policies | Clear written rules: acceptable use, password requirements, BYOD policy, clean desk policy |
| Staff training | Regular awareness training — phishing simulations, recognising social engineering |
| Backups | Regular backups (3-2-1 rule: 3 copies, 2 media types, 1 offsite) — recover from ransomware without paying |
| Incident response plan | Pre-defined procedures for when a breach occurs — contain, investigate, recover, notify |
| Audit logs | Records of all access and actions — detect suspicious activity, support forensic investigation |
Physical security prevents unauthorised physical access to hardware. A person with physical access can bypass many software controls.
| Measure | What it prevents |
|---|---|
| Locked server rooms with key fob access | Tailgating, hardware theft, booting from external media |
| CCTV and security guards | Unauthorised entry, physical tampering |
| Cable locks (Kensington locks) on devices | Device theft |
| Screen privacy filters | Shoulder surfing |
| Visitor sign-in and escort procedures | Tailgating, pretexting by visitors |
8 questions · 22 marks
| Term | Definition |
|---|
Timed exam conditions.