Preventing Cyber Attacks
Preventing Cyber Attacks
This note covers the methods and technologies used to protect computer systems, networks, and data from cyber threats. You need to know both technical and procedural measures for the AQA exam.
---
Technical Prevention Methods
Firewalls
A firewall monitors and controls incoming and outgoing network traffic based on predetermined security rules.
How it works:
- Examines each packet of data entering or leaving the network
- Checks against a set of rules (e.g. block traffic from certain IP addresses or ports)
- Can allow, block, or flag suspicious traffic
- Can be hardware (a physical device between the network and the Internet) or software (installed on individual computers)
Limitations:
- Cannot detect all threats (e.g. encrypted malware)
- Must be properly configured — poor rules leave gaps
- Cannot prevent attacks from within the network
- Does not protect against social engineering
Encryption
Encryption converts readable data (plaintext) into an unreadable format (ciphertext) using a mathematical algorithm and a key. Only someone with the correct key can decrypt it.
Types:
- Symmetric encryption — same key to encrypt and decrypt (faster, but key must be shared securely)
- Asymmetric encryption — public key to encrypt, private key to decrypt (slower, but more secure for key exchange)
Where it is used:
- HTTPS — encrypts web traffic between browser and server
- Email encryption — protects email content
- Full disk encryption — protects all data if a device is stolen
- Wi-Fi encryption — WPA2/WPA3 encrypts wireless traffic
Why it matters:
- Even if data is intercepted, it cannot be read without the key
- Protects data in transit (being sent) and at rest (stored)
Anti-Malware Software
- Scans files and programs for known malware signatures (patterns)
- Uses heuristic analysis to detect new, unknown threats by suspicious behaviour
- Can quarantine infected files to prevent them spreading
- Must be regularly updated to recognise new threats
- Includes antivirus, anti-spyware, and anti-ransomware tools
Penetration Testing
Penetration testing (pen testing) is an authorised simulated attack on a system to identify vulnerabilities before real attackers exploit them.
Types:
| Type | Description |
|---|---|
| Black box | Tester has no knowledge of the system (simulates external attacker) |
| White box | Tester has full knowledge of the system (source code, network diagrams) |
| Grey box | Tester has partial knowledge (e.g. user-level access) |
Process:
1. Planning — define scope and goals
2. Reconnaissance — gather information about the target
3. Attack — attempt to exploit vulnerabilities
4. Reporting — document findings and recommend fixes
5. Remediation — the organisation fixes the vulnerabilities
Network Security Measures
| Measure | Purpose |
|---|---|
| MAC address filtering | Only allows devices with approved MAC addresses to connect |
| Access control lists (ACLs) | Define which users/devices can access which resources |
| Network segmentation | Divides the network into sections to contain breaches |
| VPN (Virtual Private Network) | Creates an encrypted "tunnel" over a public network for secure remote access |
| Intrusion Detection System (IDS) | Monitors network traffic for suspicious activity and alerts administrators |
---
Procedural (Human) Prevention Methods
Strong Passwords
A strong password policy is one of the simplest and most effective defences:
- Minimum 8 characters (longer is better — 12+ recommended)
- Mix of uppercase, lowercase, numbers, and symbols
- No dictionary words or personal information (names, birthdays)
- Unique for each account — never reuse passwords
- Changed regularly (e.g. every 90 days)
- Use a password manager to generate and store complex passwords
Two-Factor Authentication (2FA)
Requires two different types of evidence to verify identity:
| Factor | Type | Example |
|---|---|---|
| Something you know | Knowledge | Password, PIN |
| Something you have | Possession | Phone (SMS code), security key |
| Something you are | Biometric | Fingerprint, face recognition |
2FA means that even if a password is stolen, the attacker still needs the second factor.
User Access Levels
- Principle of least privilege — users should only have access to the resources they need for their role
- Admin accounts should be separate from everyday user accounts
- Temporary access for contractors or visitors should be time-limited
- Regular audits of who has access to what
Staff Training
- Security awareness training teaches employees to recognise phishing, social engineering, and other threats
- Regular updates as threats evolve
- Simulated phishing tests to check if staff can spot fake emails
- Clear reporting procedures for suspicious activity
Physical Security
| Measure | Purpose |
|---|---|
| Locks and access cards | Prevent unauthorised physical entry |
| CCTV | Deter and record intrusions |
| Biometric scanners | Restrict access to authorised personnel |
| Security guards | Monitor and control entry points |
| Cable locks | Prevent theft of laptops and equipment |
Backups
- Regular backups ensure data can be restored after an attack (especially ransomware)
- Follow the 3-2-1 rule: 3 copies, on 2 different media types, with 1 stored offsite
- Test backups regularly to ensure they work
- Automated backups reduce human error
Software Updates and Patches
- Patches fix known vulnerabilities in software and operating systems
- Attackers exploit unpatched systems — the WannaCry ransomware spread through an unpatched Windows vulnerability
- Enable automatic updates where possible
- Regularly update firmware on routers and network devices
---
Matching Threats to Prevention
| Threat | Best Prevention |
|---|---|
| Phishing | Staff training, email filters, 2FA |
| Malware | Anti-malware software, updates, firewalls |
| Data interception | Encryption, VPN, HTTPS |
| Brute force attack | Strong passwords, 2FA, account lockout |
| SQL injection | Input sanitisation, penetration testing |
| Ransomware | Backups, anti-malware, staff training |
| Insider threat | Access levels, audit logs, least privilege |
| Physical theft | Locks, CCTV, encryption |
---
Exam Tips
- Questions often describe a scenario and ask which prevention method is most appropriate — match the defence to the specific threat
- Know the difference between symmetric and asymmetric encryption
- Penetration testing is authorised — stress this in your answer (otherwise it would be hacking)
- Firewalls and anti-malware are not enough alone — a good answer discusses multiple layers of defence
- For 6-mark questions, discuss a combination of technical AND procedural measures
- Remember that no system is 100% secure — the goal is to make attacks as difficult as possible