8.3 Security of data
Cambridge IGCSE ICT 0417 · Topic 8: Safety and security · Paper 1
4.2 Network issues and communication
Cambridge IGCSE ICT 0417 · Topic 4: Networks and the effects of using them · Paper 1
Say each word, then read what it means. Every one is in the glossary too.
Read it here, or open the study page below to go one step at a time with things to try.
Hacking is getting into a computer system without permission.
A hacker may steal data, delete or change data, or lock the system. This can lead to identity theft or fraud.
Prevention: firewalls, strong passwords and user IDs, two-factor authentication, keeping software up to date, and encryption so stolen data is unreadable.
Encryption does not stop hacking. It stops the hacker understanding the data they steal. Say this clearly in exam answers.
Phishing: a fake email that looks like it is from a real company, such as a bank. A link takes the user to a fake website that steals their login or card details.
Smishing (SMS phishing): the same trick by text message. Example: 'Correos: your parcel is held, pay 1.99 EUR at this link.'
Vishing (voice phishing): the same trick by phone call or voicemail. The caller pretends to be the bank or the police.
Prevention: do not click links in unexpected messages; type the company's address yourself; check the sender's address; never give passwords or PINs by phone; use spam filters; report it.
These attacks trick people, not computers. Spotting the red flags is the best defence, because the message itself contains no virus.
There is something to try for this step in the IGCSE library.
Pharming: malicious code is installed on the user's computer or on a DNS server. It sends the user to a fake website even when they type the correct address.
The fake site looks real and collects login and bank details.
Prevention: anti-malware software that scans for pharming code; check the web address and the padlock (HTTPS) before typing details; check the website's digital certificate; do not open unknown attachments.
| Phishing | Pharming | |
|---|---|---|
| How the user reaches the fake site | Clicks a link in an email | Types the correct address but is redirected |
| Needs the user to act | Yes, must click the link | No action needed after the code is installed |
| Where the trick is | In the message | In code on the computer or DNS server |
The key difference: in phishing the user clicks a link; in pharming the user types the real address and is still sent to the fake site.
Malware means malicious software: any program written to cause harm.
A virus is a program that copies itself and attaches to other files. It can delete or damage data and make the computer crash or run slowly.
Other malware: worms spread across networks on their own. Trojan horses pretend to be useful software. Spyware secretly records what the user does.
Ransomware encrypts files and demands payment to unlock them. Adware shows unwanted adverts.
Prevention: anti-virus/anti-malware software, kept up to date, with regular scans. Do not open unknown attachments or download from untrusted sites. Keep backups so data can be restored.
Anti-virus works by comparing files with a list of known viruses. New viruses appear every day, so an out-of-date list misses them.
Card fraud means stealing card details to use someone else's money.
Shoulder surfing: watching someone type their PIN at an ATM or shop, either by looking over their shoulder, using binoculars or a hidden camera.
Card cloning (skimming): a device fitted over an ATM card slot copies the magnetic stripe. The criminal writes the data onto a blank card. Chip and contactless cards are harder to clone.
Key logging: software or a small device records every key pressed, including passwords and card numbers, and sends them to the criminal.
| Threat | Prevention |
|---|---|
| Shoulder surfing | Cover the keypad with your hand. Stand close to the ATM. Use contactless or mobile payment so no PIN is typed. Be aware of who is around. |
| Card cloning | Check the ATM for loose or odd parts on the card slot. Use chip and PIN or contactless rather than the stripe. Check bank statements regularly. |
| Key logging | Anti-spyware software. Use drop-down menus or on-screen keyboards to enter parts of a password. Two-factor authentication. Change passwords often. |
A user ID says who you are. A password proves it. Only someone who knows both can log in.
A strong password is long (at least 8 characters, better 12+) and mixes upper case, lower case, digits and symbols. It is not a real word or your name or birthday.
Two-factor authentication (2FA) asks for two different types of proof: something you know (a password) and something you have (your phone) or are (a fingerprint).
Example: you type your password, then the bank sends a 6-digit code to your phone. A thief with only your password cannot log in.
Passwords can be guessed, stolen by key loggers or phished. 2FA means a stolen password alone is not enough.
A password plus a security question is not 2FA. Both are 'something you know'.
Biometrics identify a person by a unique body feature: fingerprint, face, iris or retina, voice or hand shape.
The feature is scanned and compared with a stored copy.
| Advantages | Disadvantages |
|---|---|
| Cannot be forgotten, unlike a password | Expensive equipment |
| Very hard to copy or share | Can fail: a cut finger, a cold changes your voice, poor light for face scans |
| Fast to use, no typing | Privacy worries: stored body data is sensitive data |
| Unique to each person | If biometric data is stolen, you cannot change your fingerprint like a password |
Encryption scrambles data using a key, so only someone with the right key can read it. Stolen encrypted data is useless to a thief.
SSL (Secure Sockets Layer) is a protocol (a set of rules) that encrypts data sent between a web browser and a web server. Today its newer version, TLS, does the same job.
When a site uses SSL, the address starts https:// and the browser shows a padlock.
A digital certificate is an electronic document that proves a website is who it says it is. It is issued by a trusted certificate authority and contains the owner's name, the public key, the issuer, a serial number and an expiry date.
Encryption protects the data on the way. The certificate makes sure you are sending it to the real company, not a fake one.
A firewall is software or hardware that sits between a computer (or network) and the internet. It checks all data coming in and going out.
It blocks traffic that does not meet set rules, such as data from blocked addresses or unknown programs trying to connect.
It can log traffic, warn the user about suspicious activity and block access to certain websites.
A firewall does not stop a user who chooses to open an infected attachment, and it does not remove viruses already on the computer.
A firewall is not anti-virus. A firewall controls traffic; anti-virus finds and removes infected files.
Each protection blocks a particular route. Match the protection to how the threat works.
Exam questions often describe a scenario and ask for the threat and the best protection. Ask two things: how did the criminal get in or trick the user? Which protection blocks exactly that route?
| Threat | Best protection |
|---|---|
| Hacking | Firewall, strong passwords, 2FA, encryption (to make stolen data unreadable) |
| Phishing / smishing / vishing | Do not click links or give details; spam filters; check sender |
| Pharming | Anti-malware; check the URL, padlock and digital certificate |
| Viruses and malware | Up-to-date anti-virus/anti-malware; no unknown attachments; backups |
| Shoulder surfing | Cover the keypad; contactless payment |
| Card cloning | Chip and PIN or contactless; check the ATM; check statements |
| Key logging | Anti-spyware; drop-down password entry; 2FA |
There is something to try for this step in the IGCSE library.
Data on a network can be intercepted, changed or stolen. Networks also spread malware quickly.
Authentication means proving that a user is who they say they are, before they get access.
Common protections: user IDs and passwords, firewalls, encryption of data being sent, and anti-malware software.
A weak password is short or easy to guess: a name, a birthday, a word from the dictionary, `123456` or `password`.
A strong password is long and mixes upper-case letters, lower-case letters, numbers and symbols. It is not a real word and is not linked to the user.
Each extra character multiplies the number of possible passwords. So length matters most. Type passwords into the checker and watch the time to crack change.
A strong password is still unsafe if it is reused on many sites, written on a sticky note, or never changed after a data breach.
There is something to try for this step in the IGCSE library.
Passwords are the most common method. They are cheap and easy, but can be guessed, forgotten, seen by shoulder surfing or stolen by spyware.
Biometrics use a unique part of a person's body or behaviour: fingerprint, face, iris or retina, voice or handwriting.
| Biometric | Advantage | Disadvantage |
|---|---|---|
| Fingerprint | Quick and cheap; unique to each person | Dirty or cut fingers may not be recognised |
| Face recognition | No contact needed | Lighting, glasses, beards or ageing can cause errors |
| Iris / retina scan | Very accurate and very hard to fake | Expensive; retina scanning is intrusive |
| Voice recognition | Works over the phone; no extra hardware on a phone | Colds and background noise cause errors; can be recorded and replayed |
Biometrics are more secure than passwords because a body feature cannot be forgotten, shared or easily guessed.
A magnetic stripe card holds data such as a staff ID on its stripe. It is swiped to open doors. Cheap, but easy to copy and damaged by magnets.
A smart card has a chip that stores and processes data, often with an RFID antenna. It is harder to copy and can hold more data. Often used with a PIN.
A physical token is a small device that shows a one-time password (OTP). Some need the user's PIN first. Banks use them for online banking.
An electronic token is software, usually an app on a phone, that creates a one-time code or approves a log-in. Codes change every 30 to 60 seconds, so a stolen code is soon useless.
A token's code is a one-time password. Say why it helps: even if it is intercepted, it cannot be used again.
Zero login is a way of authenticating without typing anything. The system recognises the user from biometrics and behaviour, such as how they hold the phone, how they type and where they usually are.
Advantage: very convenient, and nothing to forget.
Disadvantage: the system collects lots of personal data, users may not know they are being tracked, and it is harder to tell how secure it is.
Malware is software designed to harm a computer or steal data, such as viruses, spyware and ransomware.
Anti-malware software (including anti-virus) scans files and emails, compares them with a database of known malware signatures, and watches for suspicious behaviour.
Infected files are quarantined (isolated so they cannot run) or deleted. The software must be updated regularly so it knows about new malware.
On a network, one infected computer can infect all the others, so every device needs up-to-date anti-malware.
Video conferencing uses webcams, microphones, speakers and screens so people in different places can see and hear each other live.
Audio conferencing uses only sound: a phone call with three or more people, or an internet call with no video. Participants often dial a number and type a PIN.
Web conferencing (webinars) runs in a browser or app. As well as video and audio, users can share screens, chat by text, use a whiteboard and vote.
| Advantages (all types) | Disadvantages (all types) |
|---|---|
| No travel, so saves time, money and fuel | Needs a reliable, fast internet connection; lag and dropped calls |
| Meetings can be set up at short notice | Time zones make scheduling hard for international meetings |
| People can join from anywhere, including when ill or abroad | Less personal: body language is harder to read |
| Safer: no travel risks | Equipment costs (webcams, headsets, software licences); security risk if calls are hacked |
Open the study page and go one step at a time.
Step by step, with exam questions and a quiz.
ICT topic 9Step by step, with exam questions and a quiz.
ICT topic 10Step by step, with exam questions and a quiz.
ICT topic 15Step by step, with exam questions and a quiz.
Topic 17 · Year 9Cybersecurity protects computers and data. Most attacks trick people or exploit weak systems, so defences cover both.
One question at a time. The reason shows after each answer.