A firewall monitors incoming and outgoing network traffic and blocks traffic that does not meet defined security rules. It acts as a barrier between a trusted internal network and untrusted external networks (like the internet). Can be hardware or software.
Scans files, downloads, and email attachments for known malware signatures. Regular updates to the virus definition database are essential to detect new threats. Should be combined with other measures — it cannot stop unknown/new malware.
Converting data into an unreadable form using an algorithm and key. Even if data is intercepted, it cannot be read without the decryption key.
Requires two different types of verification before granting access: something you know (password), something you have (phone/authenticator app), or something you are (biometric). Even if a password is stolen, the attacker cannot log in without the second factor.
Limiting access so users can only view or modify data they need for their role (principle of least privilege). Prevents insider threats and limits damage if an account is compromised.
Regular updates fix security vulnerabilities in operating systems and applications. Unpatched software is a common attack vector — many major breaches exploit known but unpatched vulnerabilities.
| Measure | How it helps |
|---|---|
| Staff training and awareness | Helps users recognise phishing emails and social engineering attacks |
| Strong password policies | Requires long, complex, unique passwords; reduces brute force risk |
| Regular backups | Enables recovery from ransomware attacks or data loss |
| Physical security | Locks, CCTV, ID badges prevent unauthorised physical access to systems |
| Acceptable use policy (AUP) | Sets rules for how users may use organisational systems |
| Threat | Best protection |
|---|---|
| Malware/virus | Antivirus software, regular updates |
| Phishing | Staff training, email filtering, 2FA |
| Brute force | Strong passwords, account lockout, 2FA |
| Man-in-the-middle | Encryption (HTTPS/TLS), avoid public Wi-Fi |
| DoS/DDoS | Firewall, traffic filtering, rate limiting |
| Ransomware | Regular backups, antivirus, patching |
| SQL injection | Input validation, parameterised queries |
When data is stored in the cloud (on remote servers), additional security considerations apply:
Penetration testing (pen testing) involves authorised security professionals attempting to break into an organisation's systems to find vulnerabilities before malicious attackers do.
An audit trail (or log) is a record of all significant system events — who logged in, what data was accessed or modified, and when. Audit trails help detect suspicious activity, investigate breaches after the fact, and demonstrate compliance with regulations.