Lock It Down

A defence is a defence against something

You already met the organising idea for this on the threats side of 1.4: attacks are not interchangeable, because they are after different things. Some want access, a way in. Some want the data itself. Some want availability, making a service unusable without taking anything. Defences sort the same way, and that is the whole of this topic. A measure aimed at one of those targets does nothing about another. A lock on the door does not help if the attacker is already inside. Scrambling a file does not stop somebody copying it. So the question this paper asks is never "list seven measures". It is always which threat does this one counter, and how. Learn them paired and the answers write themselves.

The seven measures this paper names

Each one comes with the thing it is for. That pairing is not decoration; it is what the mark is given for.

Three jobs a measure can do

Sorting the seven this way is what stops an answer becoming a list. Notice that the third column does not stop anything happening at all.

How to answer a which-one question

These questions look like recall and are marked like reasoning. There is a shape that gets the marks every time. Start with the threat, not with the measure. Say what the attacker is after. Then name the measure that addresses that specific target, and say how it does it, in one clause. A weak answer produces a list and hopes one item is relevant. A strong answer says which threat each item counters and why that follows. And watch for the trap this topic is built on: a measure that sounds protective but addresses a completely different target, or one that does not prevent anything at all and only tells you something. Both earn nothing if you claim more for them than they do.

Match each measure to what it actually stops

What a penetration test produces

A company pays testers to attack its own systems under agreement. At the end of that work, what does the company actually have?

• A list of weaknesses to act on, since the test itself protects nothing until they are fixed
• A barrier that now blocks attackers at the network boundary
• An encrypted copy of the company data
• Automatic removal of any malicious software present

True about encryption

You met encryption on this course as the difference between HTTP and HTTPS. Select the TWO statements that are true of it.

• It makes intercepted data unreadable to whoever intercepted it
• It protects the data itself rather than stopping anyone reaching it
• It prevents an attacker from intercepting the traffic in the first place
• It removes malicious software already present on a machine

Accounts that cannot open payroll

A company has 40 staff accounts. User access levels are set so that only the 6 accounts belonging to the finance team can open the payroll files. Subtract to find how many accounts cannot open them.

How a weakness actually gets closed

Put these stages into the order they happen. Notice how much of the work comes after the test.

• Testers are given permission to attack the company systems
• The test finds a weakness in the way one service is set up
• The weakness is reported to the company
• The company changes the setup so the weakness is gone
• A later test confirms the weakness can no longer be used

Complete the prevention paragraph

A device that checks traffic crossing the boundary of a network and blocks what is not permitted is a _____. Software that detects and removes malicious programs already on a machine is _____. Converting data so that anyone who intercepts it cannot read it is _____. Setting each account so it can only reach what its owner needs is called using _____.

Two answers that lose the mark

These two come up constantly, and they are the same error twice: claiming a measure prevents the event when it only limits the harm, or only reports on it. Question: how does encryption protect data sent across a network? A weak answer says "it stops hackers intercepting it". That is wrong, and it is the version most people write. A strong answer says: it does not stop interception at all. It converts the data so that anyone who does intercept it cannot read it without the key. The protection is that what they take is worthless, not that they cannot take it. Question: how does penetration testing protect a system? A weak answer says "it blocks attackers". A strong answer says: it blocks nothing. It is a deliberate attack on your own system, under agreement, to find weaknesses, and the protection comes entirely from fixing what it finds. A test nobody acts on has protected nothing whatsoever. ⚠️ The habit worth taking from both: before you write that a measure protects something, say out loud what it stops happening. If you cannot finish that sentence, you are claiming too much.

Spot the true prevention facts

Tap the TWO statements that are true.

• A firewall checks traffic entering and leaving a network and blocks what is not permitted
• User access levels limit how much a stolen account can reach
• Encryption prevents data from being intercepted
• Penetration testing removes the weaknesses it finds automatically

Three prevention calls

Three companies, three different worries. Choose the measure that addresses the worry in front of you.

• A firm is worried that if one member of staff has their login stolen, whoever holds it will be able to open every file in the business. Which measure addresses that specific worry?
• Staff take laptops off site and one is occasionally lost or stolen. What limits the damage once a laptop is gone?
• A company has bought firewalls, anti-malware, encryption and a password policy, and asks what it has still not covered. What should you raise?

Write the prevention advice

A small company has asked you which security measures it needs and why. It has been told to "just buy a firewall". Write the advice you would give.

• Name two measures that stop an attacker getting in at all, and say how each one does it
• Explain what user access levels change once an attacker is already inside
• Explain what encryption protects, and state clearly what it does not prevent
• Explain why penetration testing protects nothing on its own
• Finish with the measure on this list that no software can provide