Understand the methods used to detect and prevent cyber security threats, including penetration testing, anti-malware, firewalls, user access levels, passwords and encryption.

What this dot point is asking

AQA wants you to describe the methods used to detect and prevent cyber security threats, including penetration testing, anti-malware software, firewalls, user access levels, strong passwords and encryption, and explain how each helps.

Penetration testing

Anti-malware and firewalls

These two defend different layers: the firewall guards the boundary by filtering network traffic, while anti-malware deals with malicious software that reaches a device. Used together they stop both unauthorised connections and harmful programs.

User access levels and passwords

Encryption and user training

Detection versus prevention

It helps to separate methods that prevent attacks from those that detect them. Prevention reduces the chance of a successful attack: firewalls block unwanted connections, strong passwords and access levels make accounts hard to break and limit their reach, encryption protects data even if stolen, and patching removes vulnerabilities. Detection finds problems so they can be dealt with: anti-malware scanning detects malicious software, monitoring spots unusual activity such as repeated failed logins, and penetration testing detects weaknesses before attackers do. A complete strategy needs both, because some attacks will get past prevention and must be caught, and prevention alone cannot find weaknesses you do not know about.

Try this

Q1. State the purpose of penetration testing. [2 marks]

• Cue. To deliberately attack a system with permission to find vulnerabilities before real attackers do, so they can be fixed.

Q2. Explain how user access levels improve security. [2 marks]

• Cue. They limit what each user can see and do, so a compromised account can do less damage.