Learn about network forensics, penetration tests and methods of protection including anti-malware, firewalls, encryption and two-factor authentication. Based on the 2020 Eduqas (WJEC) GCSE specification. 3.9: Protection Against Threats Exam Board: Eduqas Specification: 2020 Network Forensics & Penetration Testing What is network forensics? Network forensics is the monitoring of a network to identify unauthorised intrusions . Network forensics is used to record and analyse attacks on a network and to gather other information about how the network is performing. It is important for organisations to identify weaknesses in their networks so that they can fix them and be prepared for any type of attack or malware. Footprinting - Footprinting is one method of evaluating a network’s security . This is when a security team puts itself in the attacker’s shoes by obtaining all publicly available information about the organisation and its network . Footprinting allows the company to discover how much detail a potential attacker could find out about a system. The company can then limit the technical information about its systems that is publicly available . Penetration Tests Penetration tests are carried out as part of ethical hacking. Ethical hacking is when an organisation gives permission to specific 'good ' hackers to try and attack a system so that the weak points can be highlighted and then fixed. The purpose of a penetration test is to review the system's security to find any risks or weaknesses and to fix them . There are four main types of penetration tests : Internal tests are to see how much damage could be done by somebody within the company with a registered account. External tests are for white hat hackers to try and infiltrate a system from outside the company . Blind tests are done with no inside information , to simulate what a real attacker would have to do to infiltrate the system. + Targeted tests are conducted by the company's IT department and the penetration team cooperating together to find faults in the system. Anti-Malware & Firewalls Anti-Malware Software Anti-malware software is used to locate and delete malware, like viruses, on a computer system. The software scans each file on the computer and compares it against a database of known malware . Files with similar features to malware in the database are identified and deleted . There are thousands of known malware, but new forms are created each day by attackers, so anti-malware software must be regularly updated to keep systems secure. Other roles of anti-malware software: Checking all incoming and outgoing emails and their attachments . Checking files as they are downloaded . Scanning the hard drive for viruses and deleting them . Firewall A firewall manages incoming and outgoing network traffic . Each data packet is processed to check whether it should be given access to the network by examining the source and destination address . Unexpected data packets will be filtered out and not accepted to the network. Other roles of a firewall include: Blocking access to insecure / malicious web sites . Blocking certain programs from accessing the internet . Blocking unexpected / unauthorised downloads . Preventing specific users on a network accessing certain files . Other Methods of Protection Double Authentication Also known as two-factor authentication (2FA ), this is a method of confirming someone's identity by requiring two forms of authorisation , such as a password and a pin code sent to a mobile. 4392 Secure Passwords Usernames must be matched with a secure password to minimise the chances of unauthorised users accessing a system. Passwords should contain a mix of uppercase and lowercase letters , punctuation and numbers . Passwords should be of a substantial length (at least 8 characters) and should be regularly changed . ******** User Access Levels Access levels are used to only allow certain users to access and edit particular files. ' Read-Only ' access is when a user can only view a file and is not allowed to change any data . For example, a teacher might set homework instructions as read-only for students to view. ' Read and Write ' access allows a user to read and edit the data in a file. For example, a teacher might set an online workbook as read and write access for students to fill in. It is important to set access levels so that only authorised users can view and change data. The more users who have access to a file, the more likely it is to be compromised. Certain users may also have no access to a file - when they can't view or edit it. Encryption Encryption is the process of scrambling data into an unreadable format so that attackers cannot understand it if intercepted during transmission. The original data (known as plaintext ) is converted to scrambled ciphertext using an encryption key . Only at the correct destination will the encryption key be used to convert the ciphertext back into plaintext to be understood by the receiving computer. A very simple method of encryption is to use the XOR logical operator . XOR is used on the plaintext and key together to create the ciphertext . Using XOR again on the ciphertext and key will reverse the encryption to reveal the plaintext . Encryption using XOR Plaintext = 00110100 Key = 10100110 XOR Ciphertext = 10010010 Decryption using XOR Ciphertext = 10010010 / Key = 10100110 XOR Plaintext = 00110100 Q uesto's Q uestions 3.9 - Protection Against Threats: 1a. What is network forensics ? Why is it important ? [ 3 ] 1b. Explain what is meant by footprinting and why companies do it . [ 2 ] 2. What is an ethical hacker ? [2 ] 3a. Describe the purpose of penetration tests . [2 ] 3b. Describe each type of penetration test . [ 8 ] 4. Describe the purpose of anti-malware software and its different roles . [ 4 ] 5. Describe the purpose of a firewall and its different roles . [ 4 ] 6a. Describe double authentication . [2 ] 6b. State three rules for choosing a strong password . [ 3 ] 7. Describe the three types of access level . [6 ] 8a. Describe the purpose of encryption . [ 2 ] 8b. Explain how encryption works, using the terms plaintext , key and ciphertext . [ 4 ] 3.8 - Cyber Threats Theory Topics 4.1 - Number Systems

Learn about the differences between wired and wireless networks. Based on the J277 OCR GCSE Computer Science specification (first taught from 2020 onwards). 3.2a: Wired & Wireless Networks Exam Board: OCR Specification: J277 Watch on YouTube : Wired Networks Wireless Networks Encryption Wired Connections Wireless Connections Wireless connections, such as WiFi or Bluetooth , use no cables but require a wireless network interface card (WNIC ). Wireless connections generally have a slower speed and can be affected by the computer's distance from the wireless router as well as obstacles like walls or bad weather. Wired connections use physical cables , such as copper or fibre optic wires , and require a network interface card (NIC ) to connect to a network. These wired connections use a wired connection protocol - most commonly Ethernet . Restricted Movement Faster More Secure NIC Required Freedom of Movement Slower Less Secure WNIC Required Encryption Wireless connections are less secure and require encryption . Encryption is the process of scrambling data into an unreadable format so that attackers cannot understand it if intercepted during transmission. The original data (known as plaintext ) is converted to scrambled ciphertext using an encryption key . Only at the correct destination will the encryption key be used to convert the ciphertext back into plaintext to be understood by the receiving computer. Q uesto's Q uestions 3.2a - Wired & Wireless Networks: 1. Briefly compare wired and wireless networks in terms of movement , transmission speed , security and required hardware . You could answer this in the form of a table. [ 8 ] 3.1b - Network Hardware & Internet Theory Topics 3.2b - Protocols & Layers

Learn about the benefits and drawbacks of virtualization, as well as about cloud storage and virtual clients. Based on the 2016 OCR Cambridge Technicals Level 3 IT specification. 3.2 - Virtualisation Exam Board: OCR Specification: 2016 - Unit 1 What is virtualisation? Virtualisation is the creation of a virtual version of a device , software , operating system or server . These virtual versions can then be run on a different physical computer system , such as a powerful server . There are many different types of virtualisation . Storage virtualisation combines multiple separate storage devices into acting and appearing like a single , central storage system . Using storage virtualisation improves scalability as further devices can join the storage system if more space is required . It also simplifies the management of storage across the network. Server virtualisation allows one physical server to be divided into and host multiple virtual servers , each running separately . Each virtual server operates independently , handling its own operating system and applications . This allows for resources to be used more effectively and improves the scalability and versatility of the physical server . Client Virtualisation (Virtual Clients) Client virtualisation is when several virtual desktops are run on a single server - think back to the hypervisor from 3.1 . A virtual client is a full desktop environment where the processing happens remotely . For example, where an operating system is managed and hosted centrally but displayed locally on a different computer. These are often known as 'dumb clients ' because the server does the processing for it , meaning it can have minimal resources like a slow processor and little memory / storage . General Benefits & Drawbacks of Virtualisation Benefits of virtualisation: Costs are cheaper in the long-term because money is saved by not purchasing multiple physical devices . Money is also saved due to less cabling and lower power consumption . If set up efficiently, it can be used for higher performance at a lower cost - "Do more with less" . Programs can be tested in a secure environment before main-system deployment. Simplified response to recover after a disaster because only the server needs to be fixed. Drawbacks of virtualisation: If not set up efficiently, users could face serious performance issues , as fewer servers do more work. If a single physical system fails , the impact will be greater . Initial set up is complex , requires technical knowledge and can cost a lot. Easier for hackers to take more information at once as the data is stored in the same place. Benefits of client virtualisation: All data is stored in one central location , making backup and disaster planning easier to manage . The whole system can be managed , secured and updated from the server , rather than from each individual system. Hardware costs will be reduced because the virtual clients do not store or process their own data , meaning they can be of a low spec . Users can have multiple virtual machines and log in remotely (from anywhere with internet access ). Drawbacks of client virtualisation: Users will be unable to work if network connectivity is lost . There is a high strain on the server as the virtual clients do not store or process data themselves . An increased load on the server might result in poor performance for each client, especially with multiple connections . As the data is stored in one location , there are security risks of unauthorised access if the server is not adequately protected . Server Virtual Clients Cloud Technology 'The cloud ' is storage that is accessed through a network , primarily the internet. A cloud server is an example of storage virtualisation as data may be stored across multiple physical devices . There are three different types of cloud storage: Private cloud is where a business will have its own data centre that employees can access. This allows for flexible and convenient data storage and gives the business control over data management and security . Users of the private cloud will not usually have to pay individually for access - but the company will need to spend a lot of money on set up and maintenance . Public cloud uses third-party service providers such as Google Drive or DropBox to provide storage over the internet . Public cloud is usually a pay-for-use service , where businesses will pay for specific amounts that they need. Data management and data security is maintained by the cloud provider and the business is dependent on them providing constant access and deploying effective security measures. Hybrid cloud uses a mix of on-site storage (private cloud) and third-party (public cloud) services . Organisations can move workloads between private and public clouds as their specific needs and costs change . A benefit of hybrid cloud is that it gives an organisation greater flexibility and data storage options. As an example, a company could use on-site or private cloud storage to hold sensitive information and third-party, public cloud services to hold less important data . Q uesto's Q uestions 3.2 - Virtualisation: 1. What is the difference between server and storage virtualisation ? [ 2 ] 2a. What is a virtual client ? [ 1 ] 2b. What are the advantages and disadvantages of client virtualisation ? [ 8 ] 3. Explain any further general advantages and disadvantages of using virtualisation , not covered in your answer to 2b. [4 ] 4. Describe the differences between private , public and hybrid cloud storage. [6 ] 3.1 - Server Types Topic List 3.3 - Network Characteristics

Learn about how to write algorithms, including pseudocode and the different flowchart symbols. Based on the 2020 Eduqas (WJEC) GCSE specification. 8.3: Writing Algorithms Exam Board: Eduqas Specification: 2020 Pseudocode Reminder Generally, pseudocode can be written in any way that is readable and clearly shows its purpose. However, the Eduqas exam board advises that pseudocode for the programming exam should follow the conventions below : Annotation { Write your comment in curly brackets} Define data type price is integer firstname is string Declare a variable's value set price = 100 set firstname = "Marcella" Input / output output "Please enter your first name" input firstname Selection (must have indentation) if firstname = "Steven" then output "Hello" + firstname elif firstname = "Steve" then output "Please use full name" else output "Who are you?" end if Iteration (while loop) while firstname ! = "Steven" output "Guess my name." input firstname repeat Iteration (for loop) for i in range 10 input item next i Define a subroutine Declare Sub1 [Subroutine content indented] End Sub1 Call a subroutine call Sub1 Writing Algorithms In an exam you may be asked to write an algorithm using pseudocode . Previous exams have offered up to 10 marks for a single algorithm . While this may seem daunting, it means you can still gain marks for an incomplete program , so don't leave it blank no matter what! You must decompose the problem and break it down into more manageable chunks . Here's an example question : “A teacher is marking tests. Write an algorithm that allows the teacher to input the number of tests to mark and then the mark of each test. Output the average mark, highest mark and lowest mark. The tests are marked out of 100.” This specific algorithm can be broken down into pre-code and three main parts : Part 0: Declare and assign variables. Part 1: Input the number of tests to mark. Part 2: Input the mark of each test. Part 3: Output the average, lowest and highest marks. Part 0: Variables Read the question carefully and work out the variables you will need in your algorithm. I have highlighted them in blue below: “A teacher is marking tests. Write an algorithm that allows the teacher to input the number of tests to mark and then the mark of each test . Output the average mark , highest mark and lowest mark . The tests are marked out of 100.” There is an additional variable to track as the average mark can only be worked out if we also know the total marks . number_of_tests is integer test_mark is integer average_mark is real highest_mark is integer lowest_mark is integer total is integer number_of_tests = 0 test_mark = 0 average_mark = 0 highest_mark = -1 lowest_mark = 101 total = 0 Before you write the actual program, you must declare the variables you will need and assign values to them. Firstly, declare the data type of each variable . A whole number is an integer and a decimal number is a real . The average must be a real data type because it is the result of division (total ÷ number_of_tests) and could be a decimal number . When assigning values, most numerical variables will be 0 . Most string values would be " " . However this question is a bit more complicated - the highest mark must start as a really low value and the lowest mark must start as a really high value . This is ensure the first mark entered becomes the highest and lowest mark - this will make sense later. Part 1: Input Number of Tests output “Enter the number of tests to mark: ” input number_of_tests After declaring and assigning your variables the next parts will depend on the algorithm you need to write. This example requires the user to input the number of tests . Part 2: Input Each Mark (Loop) for i = 1 to number_of_tests output “Enter the test mark: ” input test_ mark For part 2 we need the teacher to enter each test’s mark . This is best done as a loop as we do not know how many tests the teacher has to mark until they have typed it in (part 1). All code within the loop must be indented . if test_mark > highest_mark then highest_mark = test_mark endif if test_mark < lowest_mark then lowest_mark = test_mark endif We also need to work out what the highest and lowest marks are. This must be done within the loop as the test marks are entered. The test mark is compared to the current highest and lowest marks . If it is higher than the current highest mark it becomes the new highest mark . If it is lower than the current lowest mark it becomes the new lowest mark . This is why we set the highest_mark and lowest_mark to extreme values at the start - so the first mark entered becomes the new highest and lowest . total = total + test_mark next i The final steps of part 2 are to update the total marks and to close the loop . The total is increased by the test mark that has been entered. The ‘next i ’ command states that the current iteration has ended . The indentation has now stopped. Part 3: Outputs average_mark = total / number_of_tests output “The average mark is:” , average_mark output “The highest mark is:” , highest_mark output “The lowest mark is:” , lowest_mark Before the average can be output, it must be calculated by dividing the total by the number of tests . Then the average , highest and lowest marks can be output . Full Answer number_of_tests is integer test_mark is integer average_mark is real highest_mark is integer lowest_mark is integer total is integer number_of_tests = 0 test_mark = 0 average_mark = 0 highest_mark = -1 lowest_mark = 101 total = 0 output “Enter the number of tests to mark: ” input number_of_tests for i = 1 to number_of_tests output “Enter the test mark: ” input test_ mark if test_mark > highest_mark then highest_mark = test_mark endif if test_mark < lowest_mark then lowest_mark = test_mark endif total = total + test_mark next i average_mark = total / number_of_tests output “The average mark is:” , average_mark output “The highest mark is:” , highest_mark output “The lowest mark is:” , lowest_mark This example is slightly more complicated than some of the recent previous exam questions for writing algorithms. Remember to decompose the problem by identifying the variables you need first. Q uesto's Q uestions 8.3 - Writing Algorithms: 1. A violin player performs a piece of music 8 times . They record a score out of 5 how well they think they performed after each attempt. Write an algorithm using pseudocode that allows the violinist to enter the 8 scores and displays the highest score , lowest score and average score . An example score is 3.7. [10 ] 2. A cyclist wants a program to be made that allows them to enter how many laps of a circuit they have made and the time in seconds for each lap . For example they may enter 3 laps, with times of 20.3 , 23.4 and 19.8 seconds . The program should output the quickest lap time , slowest lap time , total amount of time spent cycling and the average lap time . Create an algorithm using pseudocode for this scenario. [10 ] 8.2 - Understanding Algorithms Theory Topics 8.4 - Sorting & Searching

Learn about algorithms including pseudocode and flowcharts. Based on the 2020 Eduqas (WJEC) GCSE specification. 8.2: Understanding Algorithms Exam Board: Eduqas Specification: 2020 What is an algorithm? An algorithm is a set of instructions , presented in a logical sequence . In an exam you may be asked to read and understand an algorithm that has been written. To prove your understanding you may be asked to respond by actions such as listing the outputs of the algorithm, correcting errors or identifying an error within it. Programmers create algorithm designs as a method of planning a program before writing any code. This helps them to consider the potential problems of the program and makes it easier to start creating source code. There are two main methods of defining algorithms : Defining Algorithms - Pseudocode & Flowcharts Pseudocode Pseudocode is not a specific programming language but a more general method of describing instructions . It should be unambiguous, and it should not resemble any particular kind of programming language (e.g. Python or Java), so it can theoretically be turned into working code in any language. Generally, pseudocode can be written in any way that is readable and clearly shows its purpose. However, the Eduqas exam board advises that pseudocode for the programming exam should follow the conventions below : Annotation { Write your comment in curly brackets} Define data type price is integer firstname is string Declare a variable's value set price = 100 set firstname = "Marcella" Input / output output "Please enter your first name" input firstname Selection (must have indentation) if firstname = "Steven" then output "Hello" + firstname elif firstname = "Steve" then output "Please use full name" else output "Who are you?" end if Iteration (while loop) while firstname ! = "Steven" output "Guess my name." input firstname repeat Iteration (for loop) for i in range 10 input item next i Define a subroutine Declare Sub1 [Subroutine content indented] End Sub1 Call a subroutine call Sub1 Flowcharts A flowchart can be used to visually represent an algorithm. The flowchart symbols are: Algorithm Examples Below are two different methods for representing the same algorithm - a program to encourage people to buy items cheaply at a supermarket. The program allows the price of items in a supermarket to be entered until the total reaches 100. The total price and the number of items entered are tracked as the program loops. Once the total reaches 100 or more, an if statement checks how many items have been entered and a different message is printed if there are 20 or more items, 30 or more items or less than 20 items. Pseudocode Flowchart {This is a program to see how many items you can buy in a supermarket before you spend over £100} total is integer, itemsentered is integer, itemprice is integer set total = 0 set itemsentered = 0 while total < 100 output "enter the price of the next item" input itemprice total = total + itemprice itemsentered = itemsentered + 1 repeat if itemsentered >= 20 then output "You are on your way to saving money." elif itemsentered => 30 then output "You're a real money saver." else output "Look for better deals next time." end if Reading Algorithms In an exam you may be asked to read an algorithm and prove your understanding , most commonly by listing the outputs . Start from the first line and follow the program line by line , recording the value of variables as you go . When you encounter a for loop , repeat the indented code as many times as stated in the range . Example Algorithm: Start NewProgram i is integer maxvalue is integer input maxvalue for i = 1 to maxvalue output (i * i) ??????? output 'program finished' End NewProgram Example Questions: 1. List the outputs produced by the algorithm if the 'maxvalue' input is 5 . 2. State the code that has been replaced by '???????' and what the code's purpose is. Example Answers: 1. Outputs: 1 4 9 16 25 program finished 2. Missing Code: next i Purpose: Moves the loop to the next iteration. Watch on YouTube Q uesto's Q uestions 8.2 - Understanding Algorithms: 1a. Read the algorithm shown on the left and list all outputs in the correct order if the inputs are 2 for height and 72 for weight . 1b. Give the code that is missing from line 25 . 8.1 - Programming Principles Theory Topics 8.3 - Writing Algorithms

Learn about computational methods including problem recognition, decomposition, divide and conquer, abstraction, backtracking, data mining, heuristics, performance modelling, pipelining and visualisation. Based on the OCR H446 Computer Science A-Level specification. Exam Board: OCR A-Level Specification: Computer Science H446 3.1f - Standard Algorithms Watch on YouTube : Bubble sort Merge sort Insertion sort Quick sort Linear search Binary search Djisktra's algorithm A* algorithm The OCR A-Level course requires an understanding of algorithms used for sorting , searching and pathfinding including how they can be used for traversing and how to write them in pseudocode or a high-level programming langauge . Bubble Sort Bubble sort repeatedly compares adjacent items and swaps them if they are in the wrong order . Its advantage is that it is very simple to understand and easy to implement . However, it is extremely slow for large lists , with a worst- and average-case time complexity of O(n²) . It performs slightly better (O(n)) if the list is already nearly sorted and the algorithm is optimised t o detect no swaps . Overall, it is easy but inefficient . YouTube video uploading soon Merge Sort Merge sort is a divide-and-conquer algorithm that repeatedly splits a list into smaller sublists , sorts them recursively and then merges them back together . Its major benefit is that it is consistently fast with a time complexity of O(n log n) in the best , average and worst cases , making it very efficient for large datasets . It is also stable and works well with linked lists . However, a drawback is that it requires additional memory to store the temporary sublists , making its space complexity O(n) . Merge sort is therefore reliable but not memory-efficient . YouTube video uploading soon This page is under active development. Check here for the latest progress update. Insertion Sort Insertion sort works by taking each item and inserting it into the correct position in a growing sorted portion of the list . It is efficient for small or nearly sorted datasets and has a best-case complexity of O(n) , making it useful in real-time systems or hybrid algorithms . However, for large , randomly ordered datasets it becomes slow , with average- and worst-case performance of O(n²) . It uses very little memory space - (O(1) - which is one of its key benefits compared to more complex sorts like merge or quick . YouTube video uploading soon Quick Sort Quick sort is a divide-and-conquer algorithm that chooses a pivot , partitions the list into smaller elements and larger elements , and recursively sorts the partitions . Its main advantage is speed : the average-case time complexity is O(n log n) and it is often faster in practice than merge sort due to good cache performance and in-place partitioning . However, if poor pivot choices are made (e.g., always picking the first item in an already sorted list ), the worst case becomes O(n²) . Despite this, quick sort is widely used because good pivot-selection strategies minimise this risk . YouTube video uploading soon Linear Search Linear search checks each item in a list one by one until it finds the target value or reaches the end . Its benefit is that it works on any list (sorted or unsorted ) and is extremely simple to use and implement . The drawback is inefficiency for large datasets because its best , average and worst time complexity is O(n) . This means the time taken grows directly with the size of the list , making it suitable only for small collections of data . YouTube video uploading soon Binary Search Binary search repeatedly halves a sorted list to locate a target value , making it much faster than linear search . Its key benefit is efficiency : the time complexity is O(log n) for best , average and worst cases , meaning performance scales extremely well with large datasets . However, its major limitation is that the data must be sorted beforehand , and maintaining a sorted list can itself be costly . When this condition is met , binary search is one of the most efficient searching algorithms available. YouTube video uploading soon Dijkstra's Algorithm Dijkstra’s algorithm is a pathfinding algorithm used to find the shortest path from a starting node to all other nodes in a weighted graph with non-negative edge weights . It works by gradually exploring the graph , always choosing the next closest unvisited node , updating the shortest known distances to its neighbours and marking nodes as 'visited ' once the shortest path to them is confirmed . The algorithm continues until all nodes have been processed or the destination is reached , guaranteeing the shortest path . YouTube video uploading soon A* Algorithm The A* algorithm is an informed pathfinding algorithm that also finds the shortest path in a weighted graph , but it uses a heuristic (an estimate of the distance to the goal ) to guide its search more efficiently toward the target . A* combines the actual cost from the start to a node with a heuristic estimate of the remaining distance , allowing it to prioritise exploring nodes that appear more promising . YouTube video uploading soon Q uesto's K ey T erms Sorting Algorithms: bubble sort, flag, pass, merge sort, insertion sort, quick sort, pivot Seraching Algorithms: linear search, binary search, precondition Pathfinding Algorithms: Dijsktra's algorithm, A* algorithm, heuristic D id Y ou K now? Halo: Combat Evolved released on the Xbox in 2001 and introduced groundbreakingly convincing enemy AI for the time. Pathfinding algorithms were used more realistically than older games so that enemies wouldn't just run directly at the player but behaved in different ways depending on the situation , such as cooperating , flanking or retreating by reacting dynamically to the player . 3.1e - Data Structure Algorithms A-Level Topics

Learn about the differences between open and closed information systems. Based on the 2016 OCR Cambridge Technicals Level 3 IT specification for Unit 2 (Global Information). 3.6 - Information Systems Exam Board: OCR Specification: 2016 - Unit 2 Information systems, such as structured databases , can be defined primarily as either 'open ' or 'closed '. Open Information Systems Closed Information Systems This type of system can interact with other information systems (e.g. another database) to exchange data , even from different platforms (types of computers). Because it is open it is more at risk of data loss and/or hacking. This type of system is private and cannot exchange data with other systems. Access is limited but it is much more secure than an open system. Q uesto's Q uestions 3.6 - Information Systems: 1. Compare and contrast open and closed information systems . [4 ] 3.5 - Data Analysis Tools Topic List 4.1 - UK Legislation

Learn about security threats, including botnets and DDoS attacks and both physical and digital security mitigations. Resources based on Unit F161 (Developing Application Software) for the OCR Cambridge Advanced Nationals in Computing (H029 / H129) AAQ (Alternative Academic Qualification). Qualification: Cambridge Advanced Nationals in Computing (AAQ) Certificate: Computing: Application Development (H029 / H129) Unit: F161: Developing Application Software 4.1 - Security Considerations Watch on YouTube: Security threats Physical security Digital security You need to know the risks that specific security threats pose to applications , including botnets , DDoS attacks , hacking and malware . You need to know how both physical security mitigations (e.g. biometrics , locks and RFID ) and digital security mitigations (e.g. encryption , firewalls and anti-malware ) protect application software against threats . What You Need to Know Security Threats Common threats to application software include: Botnet A botnet is a group of compromised devices that are remotely controlled by an attacker , often without their owners knowing , and used together to carry out malicious activities . DoS / DDoS Attack A Denial of Service (DoS ) attack attempts to make a system or service unavailable by overwhelming it with requests or traffic . A Distributed Denial of Service (DDoS ) attack does this using many devices at the same time , often through a botnet . Hacking Hacking is the process of gaining unauthorised access to a computer system , network or data . This potentially allows data to be viewed , changed , stolen or deleted . Lack of Supplier Support A lack of supplier support occurs when a developer no longer provides updates , security patches or technical assistance for its software , leaving newly discovered vulnerabilities potentially unfixed . Malicious Spam Malicious spam is unwanted messages sent to large numbers of users that contain harmful or deceptive content . This may include links designed to steal information or distribute malware . Malware Malware is software intentionally designed to damage , disrupt or gain unauthorised access to systems or data . Examples include viruses , worms , ransomware and spyware . Out-of-date Software Out-of-date Hardware Out-of-date Firmware Out-of-date software may contain known security vulnerabilities that newer versions have fixed , making it easier for attackers to compromise the system . Out-of-date hardware may lack modern security features , be incompatible with newer security software or no longer receive support from its manufacturer . Firmware is software built into a device that controls how its hardware operates . Out-of-date firmware may contain unpatched security vulnerabilities that attackers could exploit to access or interfere with the device . Physical Security Mitigations Physical security mitigations are measures used to prevent unauthorised physical access to systems that run application software . Biometrics Biometrics use unique physical characteristics, such as fingerprints or facial features , to verify a person's identity and prevent unauthorised users from physically accessing devices and application software . Cable Locks Cable locks physically secure devices such as laptops to a fixed object like a table , reducing the risk of equipment being stolen and the application software or data on it being accessed . Cameras Cameras like CCTV can monitor and record areas containing computer equipment , helping to deter unauthorised access or theft and providing evidence if a security incident occurs . Locks Locks restrict physical access to rooms , cabinets or equipment for unauthorised people , helping prevent devices and the application software they contain from being accessed , stolen or damaged . RFID Radio Frequency Identification (RFID ) uses radio waves to communicate wirelessly between an RFID tag or card and a reader . It can be used to identify authorised users and control physical access to restricted areas , such as server rooms . Safe A safe provides secure physical storage for devices or storage media , protecting them against unauthorised access , theft and potentially physical damage . Swipe Cards Swipe cards require users to swipe or scan an authorised card to enter restricted areas , preventing unauthorised people from physically accessing devices and systems containing application software . Digital Security Mitigations Digital security mitigations use software and technology to protect applications and data from security threats . Access Rights Access rights control what resources and actions different users are allowed to access , such as viewing , editing or deleting data . This helps prevent unauthorised access or changes . Anti-Malware Anti-malware is software that detects , blocks and removes malware , such as a virus or worm . It helps prevent malicious software from damaging applications , stealing data or gaining unauthorised access . Back-up A back-up creates a separate copy of data that can be restored if the original is lost , damaged or corrupted , for example following a malware attack or hardware failure . Cryptography Cryptography uses mathematical techniques to protect data and communications , helping keep data confidential , verify its authenticity and prevent unauthorised changes . 2FA Two-factor authentication (2FA ) requires a user to provide two different forms of authentication before gaining access , such as a password plus a code from another device . This makes unauthorised access more difficult if one factor is compromised . Encryption Encryption converts data (plaintext ) into an unreadable form (ciphertext ) that requires the correct key to decrypt . It prevents unauthorised users from understanding the data if they gain access . Encryption at rest protects stored data , such as files on a device or records in a database , if the storage is accessed or stolen . Encryption in transit protects data while it is being transferred across a network , reducing the risk of intercepted data being read . Firewall A firewall monitors and controls network traffic using security rules , helping prevent unauthorised or suspicious connections . A hardware firewall is a physical network device , often built into a router , that can protect multiple devices by filtering traffic entering or leaving a network . A software firewall is installed on a specific device that monitors and controls network traffic for that device and its applications . Q uesto's Q uestions 4.1 - Security Considerations: 1. Describe the following security threats : botnets , DoS/DDoS attacks , hacking , lack of supplier support , malicious spam and malware . [ 2 each ] 2. Explain why out-of-date software , hardware and firmware can create security risks for application software . [3 ] 3. Explain how physical security measures , including biometrics , cable locks , cameras , locks , RFID , safes and swipe cards , can protect application software and systems. [2 each ] 4. Explain how access rights , anti-malware , backups , cryptography , encryption , firewalls and 2FA can protect application software from security threats. [2 each ] 5. For an online mobile game , recommend suitable physical and digital security mitigations and justify how they would protect against specific threats . [6 ] The WannaCry ransomware attack of 2017 affected hundreds of thousands of computers worldwide , including NHS systems . It exploited a vulnerability in older or unpatched Windows systems and resulted in an estimated 19,000 NHS appointments and operations being cancelled . D id Y ou K now? 3.2 - Protocols Topic List 5.1 - Testing

The list of topics in the 2020 OCR GCSE Computer Science specifications. OCR GCSE Computer Science These pages are based on the J277 GCSE Computer Science specification from the Cambridge OCR exam board. Component One: Computer Systems OCR GCSE Key Term Generator Paper 1 Playlist on YouTube 1. Systems Architecture 1.1a - The CPU 1.1b - The Fetch-Execute Cycle 1.2 - CPU Performance 1.3 - Embedded Systems 2. Memory & Storage 2.1 - Primary Storage (Memory) 2.2 - Secondary Storage 2.3 - Units 2.4a - Number Systems 2.4b - Binary Addition & Shifts 2.4c - Character Storage 2.4d - Image Storage 2.4e - Sound Storage 2.5 - Compression 3. Networks 3.1a - Network Types & Performance 3.1b - Network Hardware & Internet 3.2a - Wired & Wireless networks 3.2b - Protocols & Layers 4. Network Security 4.1 - Network Threats 4.2 - Preventing Vulnerabilities 5. Systems Software 5.1 - Operating Systems 5.2 - Utility Software 6. Impacts 6.1a - Impacts of Technology 6.1b - Legislation Component Two: Computational Thinking, Algorithms and Programming Paper 2 Playlist on YouTube 1. Algorithms 1.1 - Computational Thinking 1.2 - Designing Algorithms 1.3 - Searching & Sorting Algorithms 2. Programming Fundamentals 2.1 - Programming Fundamentals 2.2 - Data Types 2.3 - Additional Programming Techniques 3. Producing Robust Programs 3.1 - Defensive Design 3.2 - Testing 4. Boolean Logic 4.1 - Boolean Logic 5. Languages & IDEs 5.1 - Languages & Translators 5.2 - Integrated Development Environment

Learn how to embed images into your HTML web page using the img tag. Learn how to resize an image to your desired width and height. 5. Images HTML Guide Watch on YouTube: Images can be added to your web page to make it more visual. The guide below shows you how to find a picture online, download it and place it in your web page. Find & Save the Image Firstly you can perform a Google Image search to find a picture that you like. As an ethical Computer Scientist, you should be searching for copyright free images. Click on Tools and then Usage Rights to change it to 'Labeled for reuse'. Choose an appropriate image and download it to the same folder as your html file. Save the image in the same folder as where your HTML file is saved . If you don't do this, your image won't work . If you are using a school computer and the image automatically downloads , without giving you the option to rename it and save it, click on 'Show in folder' and move it to the folder where your HTML file is . Make sure that the image is saved in the exact same folder as your HTML file and that is has a suitable name . Create the Image Tag The tag for images does not have an end tag - it is all written within one set of angle brackets. src stands for source . You must type the image exactly as it is saved , including the file type (e.g. .jpg or .png). Don't forget the speech marks either. Create the img tag, using the exact name of the image you downloaded. Change the Image Size You can directly state the width and height of the image by defining the style within the image tag. If your image is too large or too small, change the size of it yourself. Next it is time to organise the web page further so it looks more like a professional site. 4. Hyperlinks HTML Guide 6. Organisation

Learn about the negative impacts that data loss will have on an organisation including reputation loss, fines and possible bankruptcy. Based on the 2016 OCR Cambridge Technicals Level 3 IT specification for Unit 2 (Global Information). 6.3 - Impacts Exam Board: OCR Specification: 2016 - Unit 2 If a risk to data (see 6.2 ) occurs then there are a number of different impacts that may consequently negatively affect an organisation . Loss of Intellectual Property 'Intellectual property ' refers to anything that an organisation or individual has designed, developed or created themselves . For an individual, this could be a manuscript , artwork or piece of music . For an organisation, it could be primary data they have collected, blueprints for an upcoming design or a report following data analysis. The impact of having intellectual property lost depends on the property itself and how easy it would be for the victim to recreate or recollect the data . Competitors that stole intellectual property could use it at their advantage. Also, the effect of an upcoming announcement to the public would decrease if it was leaked ahead of time. In 2017 HBO suffered large property leaks when Game of Thrones episodes were stolen before air date resulting in pirated versions appearing online well before they were due to be shown on TV. Loss of Service and Access If usernames and passwords are stolen then individuals may be unable to access services that they have paid for, an example being if WiFi details were stolen so that a hacker can access the internet using someone else's account. If a hacker is permitted access to a system they can change the account settings such as the password to lock out the original owners of that account, leaving them without access. Other services can be targeted with malicious attacks like a DDOS attack so that users cannot log into a web page or online service. If users cannot access an account they may use alternative methods and providers , such as avoiding one type of cloud storage provider that has let them down and choosing another. Breach of Confidential Information Confidential information is of a highly sensitive nature and could lead to other negative impacts if it got into the hands of unauthorised people . Confidential information, such as medical histories, should be stored securely with multiple physical and logical protections in place to ensure that it keeps its integrity . If confidential information was breached then it could lead to a loss of reputation as the holder would be regarded as ineffective at protecting the data . Legal consequences would also follow as the Data Protection Act ( 2018 ) would be broken : fines, court cases and even imprisonment would be possible further impacts. An organisation would expect to see penalties from the Information Commissioner's Office (ICO) if they failed to protect personal details by breaking the DPA . Loss of Third Party Data Many organisations will store data not only for their own purposes but for other individuals and businesses too; a key example being cloud storage providers . Users can store data on public cloud services such as Google Drive or DropBox and access their information using the internet from any networked device they please. If services like cloud storage services are hacked or taken offline (e.g. because of an attack or network problems) and data is lost then customers, especially those that pay, will be furious. This will lead to a loss of reputation, trust and even legal proceedings if personal and sensitive data is lost. Larger businesses will use private cloud storage, hosted in data centres that they maintain themselves, to avoid relying on third parties . Loss of Reputation Organisations spend years to build up a reputation where customers trust them and want to use their products or services. Data loss can immediately destroy that reputation and cause once-loyal customers to look elsewhere and choose their competitors . Failing to keep data safe means that an organisation has been unable to follow their legal and moral duty of keeping information secure and could lead to a loss of trade , resulting in reduced earnings and sales . Identity Theft If an individual's personal information is stolen by attackers then one impact is identity theft - when the attacker uses the victim's data for fraud or impersonation . Identity theft can lead to financial loss to the victim if loans , products or services are purchased in their name . The victim may have to contact their bank and other organisations to cancel transactions and there is no guarantee their money will be returned. Credit checks may be affected, leading to future financial difficulty for the victim. Threat to National Security If data of a classified nature (such as military arrangements, security weak-points or upcoming government plans) is lost and falls into the hands (most probably by hacking) of those who intend to bring harm to the country then the consequences can be disastrous. Spies of foreign countries or terrorists could use classified information to target vulnerable locations or events resulting in casualties. Threats could also be economic in nature if large amounts of money are stolen or redirected to malicious bodies. Recent Examples of Security Failure Q uesto's Q uestions 6.3 - Impacts: 1. Describe how each of the impacts above could affect a bank storing large amounts of customer data including financial records. [12 ] 2. Research three recent hacking examples . For each situation describe the impacts that occurred as a result of data loss . [12 ] Click the icons to read BBC News articles about recent examples of hacks and security breaches . Virgin Media Boots Marriott Hotels Facebook Messenger 6.2 - Risks Topic List 6.4 - Protection Measures

Learn about different forms of malware including virus, worm and trojan. Learn about the different ways that malware can infect a computer system. Malware Malware is any type of harmful program that seeks to damage or gain unauthorised access to your computer system. Part 1: SiX Types of Malware Virus A virus can replicate itself and spread from system to system by attaching itself to infected files . A virus is only activated when opened by a human . Once activated, a virus can change data or corrupt a system so that it stops working . Trojan A trojan is a harmful program that looks like legitimate software so users are tricked into installing it . A trojan secretly gives the attacker backdoor access to the system . Trojans do not self replicate or infect other files. Ransomware Ransomware locks files on a computer system using encryption so that a user can no longer access them. The attacker demands money from the victim to decrypt (unlock) the data . ? ? Attackers usually use digital currencies like bitcoin which makes it hard to trace them. Spyware Spyware secretly records the activities of a user on a computer. The main aim of spyware is to record usernames, passwords and credit card information . All recorded information is secretly passed back to the attacker to use. Keylogger A keylogger secretly records the key presses of a user on a computer. Data is stored or sent back to the attacker. The main aim of a keylogger is to record usernames, passwords and credit card information . Keyloggers can be downloaded or plugged into the USB port . Worm A worm can replicate itself and spread from system to system by finding weaknesses in software . A worm does not need an infected file or human interaction to spread. A worm can spread very quickly across a network once it has infiltrated it. Part 2: Four ways malware cAN infect your system 1. A ccidentally downloading an infected file from an insecure website . 2. Phishing emails - clicking on attachments or links in spam emails . 3. Installing malware from a physical device, e.g. USB stick . 4. Self-replicating malware , such as worms , spreading across a network . Phishing & Staying Safe