Why One Defence Is Never Enough
In Part 1 you met the threats: phishing, pharming and malware. Each one works in a different way, so each one needs a different defence.
Think about how a school protects its building. There is a gate that decides who can enter. Visitors show ID at reception. Some rooms are staff-only. Broken windows are repaired quickly. And important records are copied and kept somewhere safe in case of a fire.
No single one of those measures keeps the school safe on its own. A locked gate does nothing about a broken window. ID checks do nothing about a fire. Computer security works the same way.
| School building | Computer system |
|---|---|
| Gate that checks who comes in and out | Firewall |
| Security checks on bags brought inside | Anti-malware |
| Showing ID at reception | Authentication |
| Staff-only rooms | Access levels |
| Repairing broken windows quickly | Software updates |
| Copies of records stored off site | Backups |
Where This Fits in the Syllabus
Cambridge IGCSE Computer Science (0478, 2026–2028) section 5.3 Cyber security asks you to explain how a range of solutions help keep data safe. The named solutions are:
- access levels
- anti-malware, including anti-virus and anti-spyware
- authentication: username and password, biometrics, two-step verification
- automating software updates
- checking the spelling and tone of communications
- checking the URL attached to a link
- firewalls
- privacy settings
- proxy-servers
- secure socket layer (SSL) security protocol
In this lesson, sections marked Syllabus cover these named solutions. Sections marked Extension are useful real-world knowledge that is not on the named list, such as backups. SSL is covered in Part 3.
The command word is explain. Naming a defence is not enough: say how it works and what threat it helps against.
Check Your Understanding 1
A student writes: "Use a firewall." Why would this earn very little in an "explain" question?
Check the answer
It only names the defence. An explanation must say how it works — for example, that a firewall checks incoming and outgoing traffic against set rules and blocks traffic that does not meet them — and what it protects against.
Firewalls — Checking Traffic at the Boundary Syllabus
A firewall sits between a computer or network and the outside world, such as the internet. It can be hardware, software, or both.
Its job is to examine incoming and outgoing traffic and compare it against a set of rules, or criteria. Traffic that meets the rules is allowed through. Traffic that does not is blocked.
↓
Firewall compares it with the rules
↓
Allowed ✓ or Blocked ✗
The rules can be based on things such as:
- IP addresses — block traffic from addresses known to be harmful
- Ports — close ports that are not needed, so those routes into the network cannot be used
- Applications or websites — stop certain programs or sites from sending or receiving data
Because it checks outgoing traffic too, a firewall can also stop a program on the inside from sending data out without permission — for example, spyware trying to send stolen data to an attacker.
Helps against: hacking (unauthorised access from outside), worms spreading in across the network, and some malware communicating with attackers.
A firewall controls traffic. It does not scan files stored on the computer, and it cannot remove malware that is already installed. That is the job of anti-malware.
Check Your Understanding 2
A user unknowingly visits a phishing website and types in their password. The firewall allows this. Why?
Reveal the answer
The traffic looks like normal web browsing, so it meets the firewall's rules. A firewall cannot tell that the user is being deceived. That gap is covered by user checks (spelling, tone, URL) and two-step verification.
Proxy servers Syllabus
A proxy server acts as an intermediary between users and the internet. Web requests go to the proxy first, and the proxy passes them on. This means:
- the user's own IP address is hidden from the web server, making the network less directly exposed
- requests can be filtered, so unsafe or unsuitable websites can be blocked
- frequently visited pages can be cached (stored) and returned more quickly
How it helps: hiding the user's IP address means the network is less directly exposed, so it is harder for an attacker to target a particular device. Filtering can stop users reaching many known harmful websites. A proxy placed in front of a web server can also filter out some suspicious traffic before it reaches the server.
These reduce the risk; they do not prevent attacks on their own. Hiding an IP address does not stop phishing or malware, and a large DDoS attack can still overwhelm a proxy. That is why a proxy is one layer among several.
Anti-Malware — Finding and Removing Harmful Software Syllabus
Anti-malware software detects and removes malicious software. The syllabus specifically names two kinds: anti-virus and anti-spyware.
Here is how it works:
- It scans files — those already stored, and new files as they are downloaded or opened.
- It compares them against a database of known malware.
- If a match is found, the file is quarantined (isolated so it cannot run) or deleted, and the user is alerted.
- Many products also watch for suspicious behaviour, such as a program suddenly trying to encrypt hundreds of files. Extension
New malware is created all the time, so the database of known malware must be updated regularly. An out-of-date anti-malware program may miss a new threat.
Helps against: viruses, worms, Trojan horses, spyware, adware and ransomware — including the malicious code that makes pharming possible.
Anti-spyware focuses on software that secretly monitors the user, such as keyloggers. It detects and removes it, and some products warn when a program tries to record key presses or send personal data out.
Check Your Understanding 3
Why must anti-malware software be updated regularly?
Reveal the answer
It detects malware by comparing files with a database of known malware. New malware appears constantly, so without updates the database will not include the latest threats and they may not be detected.
Authentication — Proving Who You Are Syllabus
Authentication means checking that a user really is who they claim to be before giving them access. The syllabus names three methods: username and password, biometrics and two-step verification.
1. Username and password
The username says who you claim to be. The password proves it. The weakness is that anyone who learns or guesses the password can pretend to be you.
One way attackers find passwords is a brute-force attack: software automatically tries combination after combination until the correct password is found. This is why password strength matters so much.
| Password | Possible combinations |
|---|---|
| 4 lowercase letters | 264 = 456,976 |
| 8 characters using upper case, lower case, digits and symbols (94 options per character) | 948 ≈ 6,100,000,000,000,000 |
Every extra character, and every extra type of character, multiplies the number of combinations. A strong password is therefore:
- long
- a mix of upper case, lower case, numbers and symbols
- not predictable — not a name, birthday, common word or "password123"
- not reused across different accounts
Systems add a second protection against brute force by limiting login attempts: after several wrong passwords, the account is locked for a time, which greatly slows the attacker down.
2. Biometrics
Biometric authentication uses a unique physical characteristic of the user, such as a fingerprint, face, iris or voice. The scan is compared with the version stored when the user enrolled.
| Advantages | Limitations |
|---|---|
| Unique to the user, so hard to guess and difficult — though not impossible — to fake; cannot easily be shared or lent to someone else | Can be affected by injury, dirt or poor lighting, causing false rejections |
| Cannot be forgotten | If biometric data is stolen, it cannot be changed like a password |
| Cannot be captured by watching over someone's shoulder | Requires extra hardware such as a scanner |
| The user carries it with them at all times | Some systems can be fooled by a good-quality fake, such as a copied fingerprint or a photo of a face |
3. Two-step verification
Two-step verification requires the user to pass two separate checks before access is granted. You may also see a closely related term, two-factor authentication (2FA), where the two checks are different types — something you know (a password) and something you have (a phone). In Cambridge exam answers, use the syllabus term two-step verification.
↓
Step 2: enter a one-time code sent to your phone or app
↓
Access granted
The second step usually depends on something the user has, such as their phone. So if an attacker steals the password through phishing, spyware or brute force, the password alone is not enough to log in: they would also need to pass the second step.
Two-step verification greatly improves security, but it does not guarantee protection. A convincing phishing site may also ask the user to type in their one-time code, and an attacker who gets hold of the user's phone may be able to receive codes. It makes an attack much harder, not impossible.
Two passwords are both things the user knows — steal one and you could steal the other the same way. Two-step verification adds a separate check, usually a code sent to a device the user owns.
Check Your Understanding 4
An attacker uses phishing to obtain a user's password, but still cannot access the account. Which authentication method is most likely to have stopped them, and why?
Reveal the answer
Two-step verification. After the password, a one-time code is sent to the user's phone. The attacker has the password but not the phone, so they cannot complete the second step.
Automating Software Updates — Fixing Weaknesses Fast Syllabus
Most large programs contain mistakes. Some of those mistakes are vulnerabilities: weaknesses that an attacker or a piece of malware can exploit to get into a system. Worms in particular often spread by exploiting a known vulnerability.
When a software company discovers a vulnerability, it releases an update (often called a patch) that fixes it. Once the patch is installed, that route into the system is closed.
The danger is the gap between the patch being released and the user installing it. Releasing a patch tells everyone the weakness exists, so attackers target computers that have not yet installed it. Automating updates closes that gap: they are downloaded and installed without relying on the user to remember.
Helps against: malware and hacking that exploit known vulnerabilities. Automatic updates also keep anti-malware databases current.
Check Your Understanding 5
Explain why automating software updates is better than relying on users to install them.
Reveal the answer
Users may delay or forget to install updates, leaving known vulnerabilities open for attackers to exploit. Automated updates are downloaded and installed automatically, usually soon after release, so the weakness is fixed quickly without depending on the user.
Access Levels — Limiting Who Can Do What Syllabus
Authentication checks who you are. Access levels decide what you are allowed to do once you are in.
Different users are given different permissions, depending on what their role requires. Typical permissions are no access, read-only (can view but not change), and read and write (can view and change).
| School system user | Student marks | System settings |
|---|---|---|
| Student | Read-only — own marks only | No access |
| Teacher | Read and write — own classes | No access |
| Network administrator | Only as needed for their role | Read and write |
This protects data in two ways. First, users cannot see or change data they have no reason to touch. Second, if an account is compromised — by phishing, for example — the attacker is limited to what that account was allowed to do. A stolen student login cannot be used to change everyone's marks.
A password is part of authentication — proving identity. Access levels are permissions — what an authenticated user is allowed to view or change.
The Human Defences Syllabus
Technology cannot stop every attack that relies on deceiving people. Three syllabus solutions depend on the user:
- Checking the spelling and tone of communications — poor spelling, an unusual tone or urgent threats are signs of phishing.
- Checking the URL attached to a link — hovering over a link reveals the real address; if the domain does not belong to the organisation, do not click.
- Privacy settings — controls on social media, apps and browsers that limit who can see your personal information. The less an attacker can find out about you, the harder it is to write a convincing, personalised phishing message.
Part 1 showed how to apply the first two checks to a real phishing email.
Everything so far tries to stop an attack happening. Backups are different: they help you recover afterwards.
Backups — Recovering After an Attack Extension
A backup is a copy of data stored separately from the original, so the data can be restored if the original is lost, damaged or encrypted.
Backups are not on the syllabus list of security solutions, but they matter because they answer a different question. Firewalls, anti-malware and authentication ask: how do we stop an attack? Backups ask: if an attack succeeds, how do we get our data back?
| Prevention | Recovery |
|---|---|
| Firewall, anti-malware, authentication, updates, access levels | Backups |
| Stops the attack, or reduces the chance it succeeds | Reduces the damage after the attack has happened |
| Works before and during the attack | Works after the attack |
Backups are especially valuable against ransomware. If files are encrypted, they can be restored from the backup without paying the attacker. For this to work, backups should be:
- made regularly, so little recent work is lost
- stored separately — ideally offline or off site — so ransomware cannot encrypt the backup too
- tested, to make sure the data can actually be restored
The ransomware still runs and still encrypts the files. A backup only means the data can be recovered afterwards.
Check Your Understanding 6
Why should a backup be stored separately from the computer it protects?
Reveal the answer
If the backup is connected to the same computer or network, ransomware or another attack could encrypt or delete the backup as well, leaving nothing to restore from.
Matching Threats to Defences
This is the skill exam questions test most: given a threat, choose a suitable defence and explain why it helps. Use the mechanism of the threat to guide you.
| Threat | Suitable defences | Why they help |
|---|---|---|
| Phishing | Checking spelling, tone and URLs; two-step verification; privacy settings | Users spot the fake message; a stolen password alone is not enough to log in |
| Pharming | Anti-malware; automated updates; SSL / certificate warnings | Removes the code that changes address information (when pharming uses malware on the device); warns when a site is not genuine |
| Virus / worm | Anti-malware; automated updates; firewall | Detects known malware; closes the vulnerabilities worms exploit; blocks unwanted traffic |
| Trojan horse | Anti-malware; access levels; downloading only from trusted sources (good practice) | Detects disguised malware; limits what it can change |
| Spyware | Anti-spyware; firewall checking outgoing traffic; two-step verification | Finds monitoring software; blocks data being sent out; stolen passwords become less useful |
| Adware | Anti-malware | Detects and removes the unwanted advertising software |
| Ransomware | Anti-malware; automated updates; backups (for recovery) | Stops known ransomware; files can be restored without paying |
| Brute-force attack | Strong passwords; limiting login attempts; two-step verification; biometrics | Too many combinations to try; repeated attempts are blocked; a password alone is not enough |
| Hacking | Firewall; strong authentication; access levels | Blocks unauthorised traffic; makes logging in harder; limits the damage if an account is accessed |
| Social engineering | Checking spelling, tone and URLs; privacy settings; staff awareness | Users recognise manipulation; attackers have less personal information to work with |
| DDoS attack | Firewall; proxy server | Can filter or block some traffic from suspicious sources. They reduce the impact of smaller attacks; large DDoS attacks usually need specialist protection from the internet provider |
| Data interception | Encryption; SSL | Intercepted data cannot be understood without the key — see Part 3 |
Worked Scenarios
For each scenario, decide what went wrong and which defences would have helped. Then reveal the analysis.
Scenario A — "football1"
A student's account is broken into. Investigators find that software tried thousands of passwords against it in a few minutes until "football1" worked.
Reveal the analysis
This was a brute-force attack. A longer, unpredictable password with mixed character types would have far more combinations to try. Limiting login attempts would have locked the account after a few failures, and two-step verification would have stopped the attacker even after the password was found.
Scenario B — The unpatched office
A worm spreads through a small company's network overnight. It exploited a vulnerability that the operating system supplier had fixed two months earlier, but the company had switched off updates.
Reveal the analysis
Automated software updates would have installed the patch and closed the vulnerability before the worm arrived. Up-to-date anti-malware could detect the worm, and a firewall could block the unwanted network traffic it used to spread.
Scenario C — The clinic that didn't pay
Ransomware encrypts every patient file on a clinic's server. The clinic refuses to pay and restores the files from last night's offline backup.
Reveal the analysis
The backup allowed recovery, but it did not prevent the attack. To prevent it, the clinic needed anti-malware to detect the ransomware, automated updates to close vulnerabilities, and staff trained to spot phishing emails that might deliver it.
Scenario D — The phish that failed
A teacher enters their password on a phishing website. The attacker tries to log in, but is asked for a code sent to the teacher's phone. Later, the attacker finds a different stolen login — a student's — but it only allows them to see that student's own marks.
Reveal the analysis
Two-step verification stopped the stolen teacher password from being enough on its own. Access levels limited the damage from the student account: it only had read-only access to its own data. Two layers, two different jobs.
Exam Focus — Explain How It Works
These are original FutureLogic practice questions in the Cambridge style. Try each one before revealing the model answer. The marks shown are only a guide: a model answer shows the kind of points examiners look for, but it cannot guarantee marks. Real mark schemes decide, and they accept a range of correct points.
Question 1 (3 marks)
Explain how a firewall helps to keep a network secure.
Reveal the model answer
Syllabus link: 5.3.2 — how firewalls help keep data safe.
A firewall examines incoming and outgoing network traffic. It compares the traffic against a set of rules or criteria, such as blocked IP addresses or closed ports. Traffic that does not meet the criteria is blocked, which helps prevent unauthorised access to the network.
Why this is a strong answer: it makes three linked points — what the firewall examines, how it decides, and what it does with traffic that fails. "It blocks hackers" on its own does not explain how.
Question 2 (2 marks)
Explain why two-step verification is more secure than using a password alone.
Reveal the model answer
Syllabus link: 5.3.2 — authentication: two-step verification.
The user must complete a second check, such as entering a code sent to their phone, after entering the password. If an attacker steals the password, it is not enough on its own: they would also need to pass the second step, which makes unauthorised access much harder.
Why this is a strong answer: it describes the second step and explains the benefit in terms of a stolen password, without claiming the account becomes impossible to break into.
Question 3 (6 marks)
A doctor's surgery stores patient records on its network. Suggest three security methods the surgery could use and explain how each one helps protect the records.
Reveal the model answer
Syllabus link: 5.3.2 — explain how a range of solutions keep data safe, applied to a given context.
Access levels: receptionists could be given access to appointment details only, while doctors can read and edit medical records. This stops staff viewing or changing data they do not need.
Two-step verification: staff enter a password and then a code sent to their phone. If a password is stolen, the attacker would also need the phone, so it is much harder to log in.
Anti-malware: it scans files and compares them with known malware, then quarantines or deletes anything harmful. This helps stop spyware or ransomware from stealing or encrypting the records.
Why this is a strong answer: each method is named and explained in the context of the surgery. Other valid choices include a firewall, automated updates or strong passwords, each with its own explanation.
Question 4 (2 marks)
A student says, "Our school is safe from ransomware because we back up all our files." Explain why the student is not correct.
Reveal the model answer
Extension: backups are not on the 5.3.2 list. This question practises telling prevention apart from recovery.
A backup does not stop the ransomware from running or encrypting the files. It only allows the files to be restored after the attack, and only if the backup itself has not also been encrypted.
Why this is a strong answer: it separates prevention from recovery and adds the condition about where the backup is stored.
Common Cambridge Exam Mistakes
"Use anti-virus" names it. "Anti-virus scans files, compares them with known viruses and quarantines any matches" explains it.
A firewall controls network traffic. Anti-malware detects and removes malicious software.
A firewall checks traffic against rules. A proxy server is an intermediary that can hide IP addresses, filter requests and cache pages.
The second step is a separate check, usually a code sent to a device the user has.
Authentication proves who you are. Access levels decide what you can do once you are in.
Backups support recovery. They do not stop an attack happening.
Quick Quiz
- What does a firewall compare traffic against?
- Give one thing a proxy server can do that a firewall does not.
- How does anti-malware decide that a file is malicious?
- Name the three authentication methods in the syllabus.
- What is a brute-force attack, and how does limiting login attempts help against it?
- Give two features of a strong password.
- Why does two-step verification protect an account even if the password is stolen?
- What is a patch, and why should updates be automated?
- What is the difference between authentication and access levels?
- Do backups prevent cyber attacks? Explain.
Quick Quiz Answers
Reveal all answers
- A set of rules or criteria, such as allowed or blocked IP addresses, ports or applications.
- Any one of: hide the user's IP address; cache frequently used web pages; act as an intermediary for web requests.
- It scans the file and compares it with a database of known malware; many products also look for suspicious behaviour.
- Username and password; biometrics; two-step verification.
- Software repeatedly tries password combinations until one works. Locking the account after a few wrong attempts greatly slows the attacker down.
- Any two of: long; a mix of upper case, lower case, numbers and symbols; not predictable; not reused.
- The attacker also needs to pass a second check, such as a code sent to the user's phone, which they do not have.
- A patch is an update that fixes a vulnerability. Automating updates means patches are installed quickly without relying on the user to remember.
- Authentication checks who the user is; access levels control what that user is allowed to view or change.
- No. They allow data to be restored after an attack, which reduces the damage, but they do not stop the attack happening.
Final Summary
Firewall
Checks incoming and outgoing traffic against rules; allows or blocks it.
Anti-Malware
Scans files, compares them with known malware, then quarantines or deletes.
Authentication
Username and password, biometrics and two-step verification prove identity.
Software Updates
Patches close vulnerabilities; automation installs them quickly.
Access Levels
Give each user only the permissions their role needs.
Backups
Do not prevent attacks, but allow data to be restored afterwards.