CS34: Detecting & Preventing Cyber Threats
Methods to detect and prevent cyber security threats including biometrics, password policies, CAPTCHA, penetration testing, anti-malware, and defence in depth.
📋 Overview of Detection and Prevention
Key Concept: Effective cyber security requires both detection (identifying threats) and prevention (stopping threats). No single method is sufficient - multiple layers of defence are needed.
The best approach to cyber security combines technical measures (software and hardware), physical measures (controlling access to equipment), and procedural measures (policies and training for users). This multi-layered approach is called defence in depth.
- Technical measures: firewalls, encryption, anti-malware, access controls
- Physical measures: locked doors, CCTV, security guards
- Procedural measures: security policies, staff training, incident response plans
🔐 Biometric Measures
Definition: Biometric security uses unique biological characteristics to identify and authenticate users. Biometrics are very difficult to forge or steal.
| Biometric Type | How It Works | Advantages | Disadvantages |
|---|---|---|---|
| Fingerprint | Scans unique ridge patterns on fingertips | Quick, reliable, widely available | Dirt/wet fingers can affect reading |
| Facial recognition | Maps facial features and proportions | Contactless, convenient | Can be fooled by photos; lighting affects accuracy |
| Iris/retina | Scans unique patterns in the eye | Extremely accurate, very hard to fake | Expensive equipment, intrusive |
| Voice recognition | Analyses unique vocal characteristics | Can be used over phone, convenient | Background noise, illness affect accuracy |
Why biometrics are strong: They are something you ARE, not something you KNOW (password) or HAVE (token). You cannot forget, lose, or easily share a biometric. However, if biometric data is stolen, it cannot be changed like a password can.
🔑 Password Systems and Policies
Definition: A password policy is a set of rules that govern how passwords are created, used, and managed within an organisation. Strong password policies significantly reduce the risk of unauthorised access.
Password Complexity Requirements
- Minimum length (typically 8+ characters, preferably 12+)
- Mix of character types: uppercase, lowercase, numbers, symbols
- Cannot be a common password or dictionary word
- Cannot be the same as previous passwords
- Cannot contain the username or real name
Password Change Policies
- Regular forced changes (e.g. every 90 days)
- Must change immediately if a breach is suspected
- Cannot reuse recent passwords
- Account lockout after multiple failed attempts
Strong vs Weak Passwords
Weak: password123, 12345678, letmein, admin, Qwerty123
Strong: T7#kM9$pL2@wQ4, MyD0g-Lik3s!Bark1ng, C0rr3ct-Hors3-Batt3ry-Stapl
Strong passwords use length, variety of characters, and avoid common words or patterns.
Password Best Practices: Use different passwords for each account. Use a password manager to store complex passwords securely. Never share passwords. Never write passwords on sticky notes. Enable two-factor authentication wherever possible.
🤖 CAPTCHA
Definition: CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge designed to determine whether the user is a human or a computer (bot). It prevents automated programs from abusing online services.
- Prevents bots from creating fake accounts
- Prevents automated brute force password attacks
- Prevents bots from spamming forms or buying tickets in bulk
- Common types: distorted text recognition, image selection, checkbox ("I'm not a robot")
- Modern reCAPTCHA analyses user behaviour (mouse movement, browsing patterns)
Example
When creating a new email account, you may be asked to select all images containing traffic lights, or type the distorted text shown in an image. This is easy for a human but very difficult for a computer program, proving you are human.
📧 Email Confirmations and Verification
Purpose: Email confirmation verifies that the person registering an account owns the email address they provided. It also enables account recovery if the password is forgotten.
- When registering, a confirmation link is sent to the provided email
- The user must click the link to verify they own the email address
- Prevents people from registering with someone else's email
- Used for password resets - a reset link is sent to the registered email
- Can detect suspicious login attempts by sending a verification email
🔄 Automatic Updates
Purpose: Automatic updates ensure that software is always running the latest version with all security patches applied. This closes known vulnerabilities that attackers could exploit.
- Operating systems, browsers, and applications release security patches regularly
- Automatic updates apply these patches without requiring user action
- Many attacks exploit vulnerabilities that already have patches available
- Users who delay updates leave their systems vulnerable
- Automatic updates should be enabled for OS, browsers, and all security software
Why This Matters
The WannaCry ransomware attack in 2017 exploited a vulnerability in Windows that Microsoft had already patched two months earlier. Organisations that had applied the update were protected; those that hadn't were infected. Automatic updates would have prevented this.
🔍 Penetration Testing
Definition: Penetration testing (pen testing) is an authorised simulated cyber attack on a computer system, performed to identify security weaknesses. A professional "ethical hacker" tries to find and exploit vulnerabilities before real attackers do.
- Authorised and legal - conducted with the organisation's permission
- Simulates the methods that real attackers would use
- Identifies vulnerabilities in systems, networks, and applications
- Tests both technical and social engineering defences
- Results are reported so the organisation can fix the vulnerabilities
- Should be conducted regularly, especially after significant system changes
What Pen Testers Do
A penetration tester might: attempt to break into the network from outside (like a real hacker), try social engineering attacks on employees (phishing, blagging), test whether firewalls and access controls can be bypassed, check for unpatched software, and attempt to escalate privileges once inside the system. They then report all vulnerabilities found so they can be fixed before real attackers discover them.
🛡️ Anti-Malware Software
Definition: Anti-malware software (also called antivirus software) detects, prevents, and removes malicious software from a computer system. It protects against viruses, Trojans, spyware, ransomware, and other threats.
How Anti-Malware Works
- Signature-based detection: Compares files against a database of known malware signatures (unique patterns). Must be updated regularly with new signatures.
- Heuristic analysis: Monitors program behaviour for suspicious activity, detecting new or unknown malware that doesn't match any signature.
- Quarantine: Isolates suspicious files so they cannot cause harm, allowing the user to review and decide whether to delete them.
- Real-time protection: Scans files as they are accessed, opened, or downloaded to catch malware before it executes.
How It Works
When you download a file, anti-malware scans it: first checking its signature against the known malware database, then analysing its behaviour if no signature match is found. If malware is detected, the file is quarantined and the user is alerted. Regular scans also check all files on the system.
Limitations of Anti-Malware
- Cannot detect brand new malware not yet in the signature database (zero-day)
- Must be updated frequently with new malware definitions
- Can be bypassed by sophisticated malware
- Does not protect against social engineering attacks
- Can slow down system performance during scans
🏗️ Defence in Depth
Definition: Defence in depth is a security strategy that uses multiple layers of protection. If one layer fails, other layers still provide security. No single measure is completely effective on its own.
Defence in depth combines technical, physical, and procedural measures:
| Layer | Measures | What It Protects Against |
|---|---|---|
| Technical | Firewalls, encryption, anti-malware, access controls, automatic updates | Network attacks, malware, data interception |
| Physical | Locked doors, CCTV, security guards, biometric building access | Physical theft, unauthorised access, shoulder surfing |
| Procedural | Security policies, staff training, password policies, pen testing | Social engineering, weak passwords, insider threats |
Defence in Depth in Practice
A school network might use: firewall (technical), encryption on Wi-Fi (technical), anti-malware on all computers (technical), staff training on phishing (procedural), strong password policy (procedural), locked server room (physical), regular pen testing (procedural), automatic updates enabled (technical). If an attacker gets through the firewall, anti-malware still catches malware. If anti-malware misses a threat, staff training helps users avoid clicking suspicious links.
Defence in Depth Principle:
Multiple layers of different security types
If one layer is breached, others still protect
Combine: Technical + Physical + Procedural measures
Every layer must be maintained and regularly reviewed
Multiple layers of different security types
If one layer is breached, others still protect
Combine: Technical + Physical + Procedural measures
Every layer must be maintained and regularly reviewed
⚠️ Common Mistakes to Avoid
| Mistake | Why It's Wrong | How to Fix It |
|---|---|---|
| Saying "anti-malware stops all threats" | It cannot detect zero-day or very new malware | Anti-malware is one layer, not complete protection |
| Confusing CAPTCHA with authentication | CAPTCHA verifies human vs bot, not identity | CAPTCHA = bot prevention; Authentication = identity verification |
| Saying "penetration testing is hacking" | Pen testing is authorised and legal; hacking is not | Pen testing = authorised ethical testing with permission |
| Listing only technical measures for defence in depth | Defence in depth includes physical and procedural measures too | Always mention all three: technical, physical, procedural |
❓ Practice Questions
Q1: Describe two biometric security measures and explain their advantages over passwords.
Q2: What is the purpose of CAPTCHA? Give an example of how it works.
Q3: Explain how anti-malware software detects threats, including its limitations.
Q4: What is penetration testing and why is it important?
Q5: Explain the principle of defence in depth, giving examples of technical, physical, and procedural measures.
✅ Answers
- Fingerprint scanning: reads unique ridge patterns on fingertips. Facial recognition: maps facial features. Advantages over passwords: cannot be forgotten, lost, or easily shared; very difficult to forge; the user always has their biometric with them.
- CAPTCHA determines whether the user is human or a computer program (bot). It prevents automated attacks like fake account creation, brute force attacks, and ticket scalping. Example: asking the user to select all images containing traffic lights - easy for humans, difficult for bots.
- Anti-malware detects threats using: signature-based detection (comparing files to known malware patterns), heuristic analysis (monitoring behaviour for suspicious activity), and real-time scanning of files as they are accessed. Limitations: cannot detect brand new malware not in the signature database (zero-day), requires regular updates, can be bypassed by sophisticated threats, and does not protect against social engineering.
- Penetration testing is an authorised simulated cyber attack performed by ethical hackers to identify security vulnerabilities before real attackers can exploit them. It is important because it finds weaknesses that can then be fixed proactively, tests both technical and human defences, and provides a realistic assessment of security posture.
- Defence in depth uses multiple layers of security so that if one layer fails, others still provide protection. Technical measures: firewalls, encryption, anti-malware, automatic updates. Physical measures: locked doors, CCTV, biometric building access. Procedural measures: security policies, staff training, password policies, pen testing. No single measure is sufficient; the combination of all three types provides robust security.
🎯 Exam Tips
- Know all detection and prevention methods with how they work
- Be able to explain biometrics as "something you ARE" vs passwords "something you KNOW"
- CAPTCHA = human vs bot test, NOT authentication
- Anti-malware: know both how it works AND its limitations
- Defence in depth: always mention technical, physical, AND procedural
- When asked "how to protect a network," combine multiple methods
⚠️ Common Errors
✗ Thinking penetration testing and antivirus scanning are the same ✓ Penetration testing simulates real attacks to find vulnerabilities in a system. Antivirus scanning detects known malware signatures. They test different aspects of security.
✗ Believing updating software is optional if you have antivirus ✓ Software updates often patch security vulnerabilities that antivirus cannot protect against. Antivirus detects known malware but cannot prevent exploitation of unpatched vulnerabilities.
✗ Confusing penetration testing with a real cyber attack ✓ Penetration testing is authorised and controlled — it is carried out with permission to identify weaknesses. A real attack is unauthorised and malicious. Pen testing findings are reported to improve security.
✗ Thinking network monitoring only detects threats after damage is done ✓ Network monitoring can detect unusual patterns (anomaly detection) in real time, allowing early intervention before significant damage occurs. It identifies suspicious activity like unusual data transfers or login patterns.
✍️ Model Answer
Full-Mark Response
Explain four methods used to detect and prevent cyber threats, describing how each method works and its limitations. [6 marks]
1. Penetration testing: Authorised security experts simulate cyber attacks to find vulnerabilities before real attackers do. Limitation: It is a snapshot in time — new vulnerabilities may appear after the test, and it cannot guarantee finding every weakness. 2. Antivirus software: Scans files and programs against a database of known malware signatures and monitors for suspicious behaviour. Limitation: Cannot detect zero-day threats (new malware not yet in the database) and requires regular signature updates. 3. Firewall: Filters network traffic based on predefined rules, blocking unauthorised access and suspicious connections. Limitation: Cannot prevent threats from within the network or attacks that use authorised connections (e.g. phishing). 4. User education/training: Teaching users to recognise threats like phishing emails, weak passwords, and social engineering. Limitation: Users can still make mistakes or ignore training, and sophisticated attacks may still deceive well-trained users.
📊 AO Deep Dive
Assessment Objective Analysis
AO1 (Computational Thinking — 40%): Demonstrate knowledge and understanding of the principles and concepts of computer science, including detecting and preventing cyber threats: penetration testing for AQA 8525, OCR J277 & Edexcel 1CP2.
AO2 (Application — 40%): Apply knowledge and understanding of computer science, including detecting and preventing cyber threats: penetration testing to analyse problems in computational terms and to design, write and evaluate solutions.
AO3 (Evaluation — 20%): Evaluate the effectiveness, correctness and efficiency of computational solutions, including detecting and preventing cyber threats: penetration testing, and make reasoned judgements about trade-offs.
📝 Exam Technique
GCSE Computer Science Exam Tips:
Detection: penetration testing, network monitoring, intrusion detection systems, audit logs. Prevention: firewalls, antivirus, access control, encryption, user education, software updates, MFA. For each method, explain HOW it works and its LIMITATION. No single method is sufficient — always use defence in depth (multiple layers). Pen testing ≠ real attack. Updates patch vulnerabilities that antivirus cannot address.
Detection: penetration testing, network monitoring, intrusion detection systems, audit logs. Prevention: firewalls, antivirus, access control, encryption, user education, software updates, MFA. For each method, explain HOW it works and its LIMITATION. No single method is sufficient — always use defence in depth (multiple layers). Pen testing ≠ real attack. Updates patch vulnerabilities that antivirus cannot address.
📝 Exam Questions by Topic
- AQA Past Papers - Topic Questions -- AQA
- Edexcel Past Papers - Topic Questions -- Edexcel
- OCR Past Papers - Topic Questions -- OCR
- Eduqas Past Papers - Topic Questions -- Eduqas
🎬 Video Resources
Ready to ace your GCSE Computer Science exams?
Get the best revision books and guides to boost your grades.