Security measures protect systems, networks, and data against the threats covered in 1.4.1. OCR J277 requires knowledge of both technical and non-technical (human) security measures.
Penetration Testing
Penetration testing (pen testing) involves authorised simulation of attacks on a system to identify security vulnerabilities before real attackers do. Organisations hire ethical hackers ("white hat") to attempt to break into their systems.
Finds weaknesses before malicious hackers exploit them
Allows the organisation to fix vulnerabilities proactively
Required for compliance in some industries (banking, healthcare)
Network Forensics
Network forensics is the capture, recording, and analysis of network traffic to investigate security incidents. It helps identify how an attack occurred, what data was accessed, and who was responsible.
Anti-Malware Software
Anti-malware software (including antivirus) detects, prevents, and removes malicious software. It works by:
Signature-based detection: comparing files against a database of known malware signatures (patterns)
Heuristic detection: analysing behaviour to detect new/unknown malware based on suspicious activity
Must be kept up to date so it recognises the latest threats
Firewalls
A firewall monitors and controls incoming and outgoing network traffic based on security rules. It acts as a barrier between a trusted internal network and untrusted external networks (e.g. the internet).
Type
Description
Hardware firewall
A physical device, often built into a router. Protects the whole network. Cannot protect against threats from inside the network.
Software firewall
Installed on individual devices. Provides per-device protection. Can protect against threats from within the network.
Packet filtering
Inspects packet headers (source/destination IP, port). Allows or blocks based on rules.
Stateful inspection
Tracks the state of connections. More secure than packet filtering — understands context.
Passwords and Authentication
Strong Passwords
At least 12 characters; mix of uppercase, lowercase, numbers, symbols; no dictionary words; different for each account. Defeats brute force and dictionary attacks.
Multi-Factor Authentication (MFA)
Requires two or more verification factors: something you KNOW (password), something you HAVE (phone/token), something you ARE (biometric). Even if a password is stolen, the account is still protected.
Biometrics
Authentication using unique biological characteristics: fingerprints, facial recognition, iris scans, voice recognition. Very difficult to replicate — used in smartphones, border control, banking.
CAPTCHA
Completely Automated Public Turing test to tell Computers and Humans Apart. Challenges users to complete a task only a human can perform easily (e.g. identify images, read distorted text). Prevents automated brute force attacks.
Encryption
Encryption converts plaintext into ciphertext using an algorithm and a key, making data unreadable to anyone without the decryption key.
Type
Description
Example
Symmetric
Same key for encryption and decryption. Fast but key must be shared securely.
AES (Advanced Encryption Standard)
Asymmetric
Public key encrypts, private key decrypts. Key does not need to be shared. Slower.
RSA — used in HTTPS
End-to-end
Only the communicating parties can read messages. Server cannot decrypt.
WhatsApp, Signal
SSL/TLS uses asymmetric encryption to establish a secure connection, then switches to faster symmetric encryption for data transfer. This is what HTTPS uses.
Access Levels and Principle of Least Privilege
Not all users need access to all data. Access levels (user accounts with different permissions) limit what each user can see or do. The principle of least privilege states that users should only have the minimum access rights needed for their role.
Administrator accounts: full access — only given to those who need it
Standard user accounts: limited access
Read-only access: can view but not modify data
Physical Security
Locked server rooms with key card/biometric access
CCTV monitoring
Cable locks for laptops
Visitor sign-in procedures
User Education and Training
Human error is the leading cause of security breaches. Training helps employees:
Recognise phishing emails
Use strong, unique passwords
Follow data handling policies
Report suspicious activity
Regular Software Updates and Patches
Software vulnerabilities are constantly discovered. Patches fix known security flaws. Keeping software (OS, browsers, applications) up to date closes known vulnerabilities that attackers exploit.
Exam tip: Know the difference between hardware and software firewalls. For encryption: symmetric (same key), asymmetric (public/private key pair). MFA — know the three factors: know/have/are. CAPTCHA defeats automated attacks (brute force bots). Penetration testing is authorised ethical hacking to find vulnerabilities. Patches fix software vulnerabilities. The most common exam question: "Suggest two security measures to protect against [specific threat]" — match the measure to the threat.
⚠️ Common Mistakes
Saying anti-malware prevents all attacks — it only helps; human behaviour is often the weakest link
Confusing encryption with hashing — encryption is reversible with a key; hashing is one-way (used for passwords)
Saying a firewall stops malware — firewalls filter network traffic; they don't scan for malware (that's anti-malware software)
Forgetting that MFA requires 2+ different TYPES of factor — two passwords don't count as MFA
Not stating WHY a measure is effective — "passwords protect accounts" needs to say "because they prevent unauthorised access"
✅ Notes completed!
▶
Video coming soon
Click slide or press arrow keys to navigate
Worksheet — 1.4.2 Security Measures
8 questions · 22 marks
Q1What is penetration testing and why is it carried out?[2]
✅ Mark scheme
Penetration testing is an authorised simulation of a cyber attack on a system [1]; it is carried out to identify security vulnerabilities before malicious attackers can exploit them [1].
Q2Explain the difference between a hardware firewall and a software firewall.[2]
✅ Mark scheme
A hardware firewall is a physical device (often in a router) that protects the whole network [1]; a software firewall is installed on individual devices and provides per-device protection, including against threats from within the network [1].
Q3What is multi-factor authentication (MFA)? State the three types of authentication factor.[4]
✅ Mark scheme
MFA requires two or more verification factors from different categories [1]; something you KNOW (password/PIN) [1]; something you HAVE (phone/hardware token) [1]; something you ARE (biometric — fingerprint/face) [1].
Q4Explain what encryption is and why it is used.[3]
✅ Mark scheme
Encryption converts plaintext data into an unreadable format (ciphertext) using an algorithm and key [1]; only someone with the decryption key can read the data [1]; it is used to protect data in transit and at rest from interception or unauthorised access [1].
Q5State three characteristics of a strong password.[3]
✅ Mark scheme
Any three: at least 12 characters long [1]; mix of uppercase and lowercase letters [1]; includes numbers and symbols [1]; does not contain dictionary words [1]; unique to each account [1].
Q6What is the principle of least privilege? Why is it important?[2]
✅ Mark scheme
Users should only have the minimum access rights needed for their role [1]; this limits the damage if an account is compromised — the attacker can only access what that user can access [1].
Q7Why is it important to keep software and operating systems updated with the latest patches?[2]
✅ Mark scheme
Patches fix known security vulnerabilities in software [1]; keeping software updated prevents attackers from exploiting these known flaws to gain access [1].
Q8A company is concerned about employees accidentally installing malware and sharing passwords. Suggest two security measures and explain how each would help.[4]
✅ Mark scheme
Anti-malware software [1] — scans downloads and files for malicious code before it can execute, preventing installation [1]; User training/education [1] — employees learn to recognise phishing emails, use strong passwords, and follow secure data handling procedures [1]. Accept other valid measures with correct justification.
?
out of 22 — self-mark above
Topic Quiz
Question 1 of 15
You scored
out of 15
Card 1 of 15
Click to reveal definition
🎉
Complete!
Term
Definition
🎯
Mini Test — 1.4.2 Security Measures
10 questions · 10 marks · 10 minutes
⏱ 10:00
10 marks
Section A — Multiple Choice [5 marks]
Q1What is penetration testing?
Q2Which type of encryption uses the same key for both encryption and decryption?
Q3MFA stands for Multi-Factor Authentication. Which of the following represents two valid MFA factors?
Q4What does a firewall do?
Q5What is CAPTCHA designed to prevent?
Section B — Short Answer [5 marks]
Q6State two characteristics of a strong password.
Mark schemeAny two: at least 12 characters; mix of upper/lowercase; includes numbers and symbols; no dictionary words; unique per account. [1]
Q7Explain why software patches are important for security.
Mark schemePatches fix known security vulnerabilities; keeping software updated prevents attackers from exploiting these known flaws to gain unauthorised access. [1]
Q8What is the principle of least privilege?
Mark schemeUsers should only have the minimum access rights needed for their job role, limiting damage if their account is compromised. [1]
Q9State one difference between symmetric and asymmetric encryption.
Mark schemeSymmetric uses the same key for encryption and decryption; asymmetric uses a public key to encrypt and a private key to decrypt (different keys). [1]
Q10Why is user education an important security measure?
Mark schemeHuman error is the leading cause of security breaches; training helps employees recognise phishing attempts, use strong passwords, and follow secure data handling procedures. [1]