A-Level Computer Science / Unit 6: Protecting Data and Ensuring Accuracy

6.1.3 Defending Systems and Controlling Access

🔒 Lesson slides are available to signed-in users. Sign in

6.1.3 Defending Systems and Controlling Access

Security measures reduce the chance that an attacker, malicious program, or unauthorised user can reach a system or misuse its data. Different measures protect different parts of the system, so effective security usually combines several layers rather than relying on one tool.

This section covers protection for both individual computers and networked systems, including user accounts, passwords, biometrics, digital signatures, access rights, firewalls, anti-virus software, anti-spyware, and encryption.

By the end of this section, you should be able to:

  • Explain why several complementary security measures are often needed.
  • Describe how user accounts, passwords, biometrics, and digital signatures support authentication.
  • Distinguish authentication from authorisation and apply suitable access rights.
  • Explain how firewalls, anti-virus software, and anti-spyware reduce particular risks.
  • Explain how encryption protects stored and transmitted data.
  • Select and justify appropriate protections for a given situation.

Building Security in Layers

No single security measure handles every threat. A firewall can control network traffic, but it cannot decide which employee should edit a confidential document. Encryption can make stolen data unreadable, but it does not stop an authorised user from accidentally deleting a file.

Layered security: using several protections together so that one measure can still reduce harm if another measure fails.
Security question Typical measure Main purpose
Who is trying to enter? Authentication Check the claimed identity.
What is that user allowed to do? Access rights Limit available files and operations.
What network traffic may pass? Firewall Apply rules to incoming and outgoing traffic.
Is harmful software present? Anti-virus or anti-spyware Detect, block, quarantine, or remove malware.
Can intercepted or stolen data be read? Encryption Convert readable data into an unreadable form without the key.
Exam tip: Match each measure to the risk it reduces. A list of security tools is weaker than an explanation of why each tool is suitable.

User Accounts and Passwords

A user account gives a system a separate identity for each authorised user. The account can be linked to login details, settings, stored activity, and access rights. On a shared computer or network, separate accounts make it possible to give different users different permissions.

User account: a system identity associated with one user or role, together with its login information and permissions.

A password is knowledge that the user supplies to prove that they are entitled to use an account. A password should be difficult for another person to guess and should not be shared. Longer, unpredictable passwords provide more possible combinations than short, obvious passwords.

Password: a secret sequence used as evidence that a user is entitled to access an account.

Original example: community media studio

A media studio has one workstation used by editors, volunteers, and visiting technicians. Giving every person the same login would make it difficult to limit access or trace changes. Separate accounts allow editors to manage project files while visitors receive only the permissions required for their temporary work.

Common misconception: A username alone does not prove identity. It identifies the account being requested; the password or another authentication factor provides evidence that the person should be allowed to use it.

Authentication: Checking Identity

Authentication checks whether a user, device, or sender is genuinely the identity being claimed. Different techniques use different forms of evidence.

Authentication: the process of checking a claimed identity.
Method Evidence used How it helps Possible limitation
Password Something the user knows Only a person who knows the secret should be able to use the account. It may be guessed, reused, observed, or disclosed.
Biometric check A physical or behavioural characteristic A fingerprint, face, or other measured feature is compared with a stored template. Special hardware is needed and a valid user may occasionally be rejected.
Digital signature Cryptographic evidence linked to the sender It can provide evidence of origin and reveal whether signed content was altered. It does not hide the contents of the message.

Digital signatures

A digital signature is created using information controlled by the signer and is checked using corresponding verification information. If the check succeeds, the receiver gains evidence that the content came from the expected source and has not been changed since it was signed.

Common misconception: A digital signature is not a scanned picture of a handwritten signature. It is cryptographic evidence attached to digital content.
Exam tip: Do not say that a digital signature provides confidentiality. Its main purposes are checking origin and detecting alteration. Encryption is used to hide content.

Authorisation and Access Rights

Authentication answers Who are you? Authorisation answers What are you allowed to do? A user may successfully log in but still be prevented from opening, changing, or deleting particular data.

Authorisation: deciding which resources and operations an authenticated user is permitted to access.
Access rights: permissions that control actions such as reading, creating, changing, or deleting data.
Role in an outdoor education centre Read participant list Edit medical notes Delete booking records
Activity instructor Allowed Not allowed Not allowed
First-aid coordinator Allowed Allowed Not allowed
System administrator Allowed Allowed where required Allowed under procedure

Limiting users to the access required for their work reduces the damage that can follow from a mistake, a stolen account, or deliberate misuse.

Exam tip: In a scenario, state the specific permission: for example, read-only access is more precise than saying “limited access”.

Firewalls: Controlling Network Traffic

A firewall examines network traffic and applies rules that determine which communications should be allowed or blocked. It may run as software on one computer or operate as a separate device that protects part of a network.

Firewall: hardware or software that monitors and controls network traffic using security rules.

Rules may consider information such as the source, destination, connection type, or service being requested. A firewall can therefore reduce exposure to unwanted connections and restrict traffic that does not match the organisation’s policy.

Original example: museum collection network

A museum allows public visitors to use guest Wi-Fi but keeps the collection database on a protected internal network. Firewall rules prevent traffic from the guest network from reaching the database service while still allowing visitors to access the Internet.

Common misconception: A firewall does not guarantee that all malware is stopped. Harmful software may arrive through allowed traffic, an infected storage device, or an action taken by an authorised user.

Anti-virus Software and Anti-spyware

Malware protection software examines files, programs, and activity for signs of harmful behaviour. Its effectiveness depends on regular use and current detection information.

Measure Main focus Possible response
Anti-virus software Viruses and other forms of malware Block execution, quarantine a file, remove malicious code, or warn the user.
Anti-spyware Software that secretly monitors activity or collects information Detect suspicious monitoring components and remove or disable them.

A scan may compare files with known patterns and may also look for suspicious behaviour. Newly created malware may not be recognised immediately, so these tools reduce risk rather than provide a complete guarantee.

Exam tip: Describe an action performed by the software, such as scanning, detecting, quarantining, removing, or blocking. Avoid the vague statement “it protects the computer”.

Encryption: Protecting Data Content

Encryption transforms readable data into an unreadable form using an encryption method and a key. A suitable key is then required to recover the original data.

Plaintext: data in its readable, original form.
Ciphertext: the unreadable result produced by encrypting plaintext.
Encryption key: a value used by the encryption process and associated with controlling decryption.
Where encryption is used What it protects against Example
Stored data A stolen device or copied storage medium being read directly An encrypted laptop containing design files.
Transmitted data Captured traffic being understood by an interceptor Login details sent through an encrypted connection.
Common misconception: Encryption does not stop data from being copied or intercepted. It reduces the usefulness of the captured data because it should be unreadable without the required key.
Exam tip: Include both stages: readable data is converted to ciphertext, and the correct key is needed to recover the plaintext.

Interactive: Security Measure Selector

Choose a scenario and then select the measure that provides the most direct protection. The feedback explains why that choice fits and which additional layers could also be useful.

Scenario: Separate identities on a shared workstation

A design workshop has one computer used by permanent staff, temporary assistants, and visitors. The manager needs each person to have a separate system identity.

Worked Scenario Analysis

Scenario

A small research laboratory stores unpublished results on laptops and a shared server. Researchers need remote access, but visiting students should only be able to read a limited set of training files.

Risk or requirement Suitable measure Reason
Only recognised researchers should log in remotely. User accounts plus password or biometric authentication The system can identify each account and check the claimed user.
Visitors should not edit research results. Access rights Their accounts can receive read-only access to approved training files.
Unwanted remote connections should be restricted. Firewall Network rules can block traffic that does not match permitted services.
A stolen laptop should not reveal stored results. Encryption The files should remain unreadable without the required key.
Downloaded tools may contain malware. Anti-virus and anti-spyware Security software can scan, block, quarantine, or remove suspicious components.
Model structure: identify the risk, select the measure, and explain the mechanism that reduces that risk.

Common Mistakes and Misconceptions

  • Using authentication and authorisation as if they mean the same thing.
  • Thinking a username by itself proves identity.
  • Saying a digital signature hides a message. It checks origin and alteration; encryption hides content.
  • Claiming that a firewall prevents every possible attack.
  • Claiming that anti-virus software guarantees that no malware is present.
  • Explaining encryption as a method that prevents interception rather than making intercepted data unreadable.
  • Giving every authenticated user full access instead of applying appropriate access rights.

Practice

Try these original questions

  1. Explain why a network may use both a firewall and anti-virus software.
  2. Describe two benefits of giving each employee a separate user account.
  3. Explain one difference between authentication and authorisation.
  4. Describe how a biometric check can be used during login.
  5. Explain how a digital signature helps a receiver decide whether to trust a software update.
  6. Give suitable access rights for a user who should view a document but must not alter it.
  7. Describe how anti-spyware differs in focus from a firewall.
  8. Explain how encryption protects data stored on a lost laptop.
  9. A student writes, “The file is encrypted, so nobody can steal it.” Improve this explanation.
  10. A sports centre stores staff records and accepts online bookings. Recommend three different security measures and justify each choice.

Review

Measure Strong recall statement
User account Provides a separate system identity that can be linked to permissions and activity.
Password Uses secret knowledge as evidence during authentication.
Biometric check Compares a measured physical or behavioural feature with a stored template.
Digital signature Provides evidence of origin and can reveal whether signed content was altered.
Access rights Control the resources and operations available to an authenticated user.
Firewall Monitors and controls network traffic according to security rules.
Anti-virus and anti-spyware Detect, block, quarantine, disable, or remove malicious software.
Encryption Converts plaintext to ciphertext so it cannot be understood without the required key.
Final exam tip: Use the pattern risk → measure → mechanism → reduced consequence.