3.5.3 Cybersecurity Ethics, Penetration Testing & Digital Forensics
Cambridge 9618 · International A Level Computer Science · ~17 min read
Notes
Video
Slides
Quiz
Worksheet
Penetration Testing (Ethical Hacking)
Penetration testing (pen testing) is an authorised, simulated cyber-attack carried out to find vulnerabilities in a system before malicious hackers do. The key word is authorised — without explicit written permission, the same activities would be illegal under the Computer Misuse Act.
Types of Pen Test — Knowledge levels
⬛ Black-Box
Tester has NO knowledge of the internal system — simulates an external attacker. Most realistic; most time-consuming. Tests what an outsider could discover and exploit.
▪ Grey-Box
Tester has PARTIAL knowledge (e.g. user account credentials, some architecture diagrams). Balances realism and efficiency. Common in practice.
⬜ White-Box
Tester has FULL knowledge — source code, network diagrams, credentials, architecture. Most thorough; tests internal security. Also called crystal-box or glass-box testing.
Five phases of penetration testing
1
Reconnaissance
Gather information: domain names, IP addresses, employee names, tech stack. OSINT, whois, social media scanning.
2
Scanning & Enumeration
Port scanning, service discovery, OS fingerprinting. Identify open ports, running services, vulnerabilities.
3
Exploitation
Attempt to exploit discovered vulnerabilities to gain access. This is the "attack" phase — done with authorisation.
4
Post-Exploitation
Assess impact: what could an attacker do with access? Escalate privileges, move laterally, exfiltrate data.
5
Reporting
Document findings, severity ratings, evidence, and recommended fixes. Delivered to the client as a confidential report.
Intrusion Detection Systems (IDS)
An IDS monitors network traffic or system activity to detect signs of malicious activity or policy violations.
📋 Signature-Based IDS
Compares traffic against a database of known attack patterns (signatures)
Very effective against known threats
Cannot detect zero-day attacks — new attacks with no signature yet
Signatures must be regularly updated
📈 Anomaly-Based IDS
Establishes a baseline of normal behaviour; flags deviations
Can detect zero-day / novel attacks (unusual patterns)
Higher false positive rate — legitimate activity may be flagged
Requires training period to establish baseline
A Honeypot is a decoy system designed to attract attackers. It appears to be a valuable target but is isolated and monitored — no real data is stored there. Attackers waste time on the honeypot while their actions are logged for analysis.
Responsible vs Full Disclosure
When a security researcher discovers a vulnerability, they face an ethical decision about how to disclose it:
✅ Responsible Disclosure (Coordinated)
Researcher notifies the vendor/organisation privately
Gives the vendor time (usually 90 days) to patch the vulnerability
Public disclosure only after a fix is available
Protects users while giving vendors time to respond
⚠️ Full Disclosure
Researcher publishes all vulnerability details publicly immediately
Argument: transparency forces vendors to act; public has right to know
Risk: malicious actors can exploit the vulnerability before a patch exists
Often considered unethical without giving vendor a chance to respond
Bug bounty programmes: organisations (e.g. Google, Microsoft, HackerOne) offer financial rewards to researchers who responsibly disclose vulnerabilities. This incentivises ethical behaviour — researchers are paid to find and report vulnerabilities rather than selling them to attackers.
Legal Frameworks
⚖️ Computer Misuse Act 1990 (UK)
Created three criminal offences related to unauthorised computer access:
Section 1 — Unauthorised access: accessing a computer system without permission (e.g. guessing someone's password to access their account). Up to 2 years imprisonment.
Section 2 — Unauthorised access with intent: accessing a computer with intent to commit or facilitate further crimes (e.g. logging in to steal data). Up to 5 years.
Section 3 — Unauthorised modification: deliberately impairing computer operation — deleting files, installing malware, modifying data. Up to 10 years.
Amended in 2006 to add Section 3A: making, supplying, or obtaining hacking tools with intent to commit offences.
Key point for pen testing: written authorisation makes the difference between legal pen testing and criminal offence under Section 1/3.
🔒 GDPR / Data Protection Act 2018 (UK)
Six lawful bases for processing personal data: consent, contract, legal obligation, vital interests, public task, legitimate interest
Data subject rights: right of access, right to rectification, right to erasure ("right to be forgotten"), right to data portability
Data minimisation: only collect data that is necessary for the stated purpose
Storage limitation: do not retain data longer than necessary
Security requirement: organisations must implement "appropriate technical and organisational measures" to protect personal data
Fines: up to €20 million or 4% of global annual turnover (whichever higher) for serious breaches
Breach notification: must notify the ICO within 72 hours of becoming aware of a data breach that poses a risk to individuals
Digital Forensics
Digital forensics is the process of collecting, preserving, analysing, and presenting digital evidence for legal proceedings. The goal is to recover evidence in a way that is admissible in court — this requires following strict procedures.
Digital forensics process
🔍
1. Identification: determine what devices and data sources may contain relevant evidence (computers, phones, cloud accounts, logs)
🔒
2. Preservation: secure the scene; prevent tampering; create a bit-for-bit forensic copy (disk image) of storage media; hash the original and copy to prove they are identical
🧪
3. Analysis: examine the forensic copy (never the original); recover deleted files, examine logs, analyse metadata, timeline reconstruction
📄
4. Documentation & Reporting: record every action taken, tool used, and finding; produce a forensic report suitable for use in legal proceedings
⚖️
5. Presentation: expert witness testimony; presenting findings to investigators, legal teams, or a court in clear, understandable language
Chain of custody
The chain of custody is a documented record of who handled evidence, when, how, and what was done with it at every stage. Breaking the chain of custody can make evidence inadmissible in court — defence lawyers could argue that the evidence was tampered with or contaminated. Every transfer of custody must be documented and signed.
Key forensic principles
Never work on the original: always create a forensic image (bit-for-bit copy) and analyse that
Hashing for integrity: compute MD5/SHA-256 hash of the original before and after imaging — matching hashes prove the image is identical to the original and has not been modified
Write blockers: hardware or software tools that prevent any data from being written to the original device during imaging
Volatile data first: RAM contents are lost when a machine is powered off — if the machine is running, capture RAM first before shutting down
Metadata analysis: file creation/modification/access times, author names embedded in documents, GPS coordinates in photo EXIF data
Steganography
Steganography is the technique of hiding data within other data so that the existence of the hidden message is concealed. Unlike encryption (which makes data unreadable), steganography hides the fact that data exists at all.
Steganography example — hiding text in image pixels
Normal pixel: R=11001010 G=10110011 B=01100101
Modified pixel: R=11001011 G=10110010 B=01100101 ↑ Least significant bits changed to embed hidden data — visually imperceptible
Common carrier files: images (JPEG, PNG), audio (MP3), video, text files
LSB (Least Significant Bit) insertion — changing the last bit of each pixel has minimal visual impact
Used by: criminal networks to hide communications, digital watermarking (protect copyright), covert channels
Forensic tools can detect steganography by statistical analysis of file data — known as steganalysis
Cambridge 9618 exam tip: Key distinctions — pen testing vs hacking: pen testing requires written authorisation. Black/white/grey box: how much knowledge the tester has. CMA 1990: Section 1 (access), Section 2 (access + intent), Section 3 (modification/damage). GDPR: data minimisation, 72-hour breach notification, subject rights (access, erasure, rectification). Forensics: always work on an image copy, never original; hash to prove integrity; chain of custody must be maintained. IDS: signature-based detects known attacks but misses zero-days; anomaly-based detects new patterns but has false positives. Steganography: hides the existence of data (not just its content) — completely different from encryption.
⚠️ Common Mistakes
Confusing steganography with encryption — steganography HIDES that data exists; encryption CONCEALS the content. They are different techniques, though they can be combined for extra security.
Saying pen testing is illegal — it is legal if there is written authorisation from the system owner. Without authorisation, the same activities would breach the Computer Misuse Act.
Confusing IDS with firewalls — a firewall filters/blocks traffic based on rules; an IDS only detects and raises alerts (it does not block by itself). An IPS (Intrusion Prevention System) detects and blocks.
In digital forensics, forgetting that you must work on an IMAGE COPY, not the original — analysing the original could alter data (file access times change, data could be accidentally written)
Confusing responsible disclosure with no disclosure — responsible disclosure DOES release vulnerability details publicly, but only AFTER the vendor has had time to release a patch
Thinking GDPR only applies to EU companies — GDPR applies to any organisation that processes data of EU residents, regardless of where the organisation is based
Q1Distinguish between black-box, grey-box, and white-box penetration testing.[3]
✅ Mark scheme
Black-box: the tester has no prior knowledge of the target system — simulates an external attacker with no insider information [1]; grey-box: the tester has partial knowledge — some internal information such as user credentials or partial architecture diagrams [1]; white-box (crystal-box): the tester has full knowledge of the system — source code, network diagrams, all credentials and architecture details — most thorough testing approach [1].
Q2Explain the difference between a signature-based IDS and an anomaly-based IDS. State one advantage and one disadvantage of each.[4]
✅ Mark scheme
Signature-based IDS: compares network traffic against a database of known attack signatures [1]; advantage: very accurate for known attacks — low false positive rate; disadvantage: cannot detect zero-day attacks (attacks with no existing signature) — the signature database must be kept up to date [1]; anomaly-based IDS: establishes a baseline of normal behaviour and flags deviations from it [1]; advantage: can detect novel/zero-day attacks that don't match known signatures; disadvantage: higher false positive rate — legitimate but unusual activity may be flagged as suspicious [1].
Q3Describe what is meant by the "chain of custody" in digital forensics. Explain why it is important.[3]
✅ Mark scheme
The chain of custody is a documented record of who handled digital evidence, at what time, how it was handled, and what was done with it at each stage [1]; every transfer of the evidence between individuals must be documented and signed; it must remain unbroken from the point of collection to presentation in court [1]; it is important because if the chain of custody is broken, the defence could argue the evidence was tampered with or contaminated, making it inadmissible in court — the integrity and admissibility of evidence depends on maintaining the chain [1].
Q4State three offences under the Computer Misuse Act 1990 (UK).[3]
✅ Mark scheme
Section 1 — Unauthorised access to computer material: accessing a computer system without permission (1 mark); Section 2 — Unauthorised access with intent to commit or facilitate further offences: e.g. accessing a system to steal data (1 mark); Section 3 — Unauthorised modification of computer material: deliberately altering, deleting, or impairing computer operation — e.g. installing malware, deleting files (1 mark). Accept also: Section 3A (2006 amendment) — making, supplying, or obtaining tools for committing offences.
Q5Explain what steganography is and how it differs from encryption. Give one use of steganography.[3]
✅ Mark scheme
Steganography is the technique of hiding data within another file (such as an image, audio file, or video) so that the existence of the hidden data is concealed — the carrier file appears normal to casual inspection [1]; unlike encryption, which makes data unreadable but acknowledges that a secret message exists, steganography hides the fact that any secret message exists at all — it aims for concealment rather than confidentiality of the message [1]; uses: covert communication (criminals hiding messages within innocent-looking image files), digital watermarking to prove copyright ownership [1].
Q6Explain what "responsible disclosure" means and why it is considered more ethical than full disclosure of a security vulnerability.[3]
✅ Mark scheme
Responsible disclosure means the security researcher notifies the affected vendor or organisation about the vulnerability privately, before any public disclosure [1]; a reasonable time period (typically 90 days) is given for the vendor to develop and release a patch before the details are made public [1]; it is more ethical than full disclosure because full immediate publication means attackers can exploit the vulnerability before users are protected; responsible disclosure balances the public's need for transparency with the need to protect users from exploitation while a fix is being prepared [1].
Q7Explain what steganography is and how it differs from encryption. Give one example of how steganography can be used to hide data in a digital image, and state one reason why steganography alone is considered weaker than encryption for securing sensitive information.[4]
✅ Mark scheme
Steganography: conceals the existence of data by hiding it within another file, making it undetectable [1]; encryption: transforms data into an unreadable form but the existence of a message is visible [1]; example: modifying the least-significant bit (LSB) of each pixel's colour value to encode one bit of secret data — the image appears unchanged to human perception [1]; weakness: if the use of steganography is discovered, the hidden data can be extracted without any key; encryption requires the key to be broken even when its existence is known [1].
Q8Describe three challenges a digital forensics investigator faces when examining a suspect's computer. For each challenge, state one technique or tool used to address it. Your answer should consider issues with data integrity, deleted files, and encrypted content.[6]
✅ Mark scheme
Challenge 1: data integrity — any examination must not alter evidence, as modified data could be inadmissible in court [1]; technique: create a forensic bit-for-bit image of the drive and compute a hash (e.g. MD5/SHA256) before and after to verify no data was changed [1]; Challenge 2: deleted files — deleting a file typically only removes its directory entry; the actual data may still be present on disk [1]; technique: file carving tools (e.g. Autopsy, Recuva) scan raw disk sectors for file signatures to recover deleted content [1]; Challenge 3: encrypted content — files protected with strong encryption cannot be read without the key [1]; technique: attempt password dictionary/brute-force attacks, or seek a court order requiring the suspect to provide the decryption key [1].
Topic Quiz
Question 1 of 10
You scored
out of 10
Card 1 of 10
Click to reveal definition
🎉
All cards reviewed!
Term
Definition
🎯
Mini Test — 3.5.3 Cybersecurity Ethics
10 questions · 10 marks · 10 minutes
⏱ 10:00
Section A — Multiple Choice [5 marks]
Q1A penetration tester is given full access to source code, network diagrams, and all login credentials. This is an example of:
Q2Which section of the Computer Misuse Act 1990 covers deliberately installing malware on a computer system?
Q3An anomaly-based IDS will most likely generate more false positives than a signature-based IDS. Why?
Q4In digital forensics, why is a hash (e.g. SHA-256) of the original evidence computed?
Q5What is the key difference between steganography and encryption?
Section B — Short Answer [5 marks]
Q6Explain why authorisation is the key factor distinguishing ethical (legal) penetration testing from criminal hacking.
Mark schemePenetration testing involves the same techniques, tools, and methods as malicious hacking — port scanning, exploitation, privilege escalation [1]; the distinguishing factor is written authorisation from the owner of the system being tested; with authorisation, the activities are legal and serve a security improvement purpose [1]; without authorisation, the same actions constitute criminal offences under the Computer Misuse Act 1990 (Sections 1, 2, and/or 3) [1].
Q7State two rights that data subjects have under GDPR.
Mark schemeAny two from [1 each]: Right of access — data subjects can request a copy of all personal data held about them; Right to rectification — data subjects can request correction of inaccurate personal data; Right to erasure ("right to be forgotten") — data subjects can request deletion of their data in certain circumstances; Right to data portability — receive personal data in a machine-readable format to transfer to another provider; Right to object — object to processing based on legitimate interest; Right to restrict processing.
Q8Explain what a honeypot is and how it benefits an organisation's security.
Mark schemeA honeypot is a decoy computer system designed to appear as a valuable or legitimate target to attract attackers [1]; it is isolated from real systems so contains no genuine data — attackers waste time and resources attacking the honeypot rather than real systems [1]; all activity on the honeypot is logged and monitored, giving the organisation intelligence about attacker methods, tools, and techniques [1].
Q9In digital forensics, why should investigators always work on a forensic image copy rather than the original evidence?
Mark schemeWorking on the original could alter the evidence — simply reading files changes access timestamps; writing any data to the device could overwrite deleted files that may be recoverable [1]; a forensic image (bit-for-bit copy) preserves the original in its exact state; if the image is damaged during analysis, a new copy can be made from the untouched original [1]; the hash of the original proves the image is identical, maintaining evidential integrity and ensuring findings are admissible in court [1].
Q10Describe what a bug bounty programme is and explain how it encourages ethical behaviour from security researchers.
Mark schemeA bug bounty programme is a scheme run by organisations where they offer financial rewards to security researchers who discover and responsibly disclose vulnerabilities in their systems/products [1]; it encourages ethical behaviour because researchers are financially compensated for reporting vulnerabilities to the organisation rather than selling them to malicious actors (e.g. criminal groups who pay for zero-day exploits) [1]; it creates a legitimate, authorised channel for researchers to test systems and be rewarded — making ethical disclosure more attractive than exploitation [1].