6 Security, privacy and data integrity
Match protective controls to threats, and use validation and verification to reduce different data errors.
Mapped to Cambridge International AS & A Level Computer Science 9618, 2027–2029 Version 2. These original lessons and self-checks are independent study support; they are not Cambridge papers, official marks or grades. The course does not yet provide a timed four-paper simulation or a locked-down Paper 4 programming environment.
Before you begin
- Use the 2027–2029 syllabus for your exam year. AS candidates study Sections 1–12; A Level candidates study Sections 1–20. Paper 4 uses a programming language chosen from Python, Java or Visual Basic in console mode.
Work on paper. Try each question before revealing help, and explain why your method works.
Quick readiness check
Can a range check prove a value is factually correct?
What you will learn
- Explain the key representations, structures or processes in this syllabus section
- Apply the method to a new computer-science example
- Justify a design choice and check its limits
Security, privacy and integrity describe different goals
Security protects systems and data against unauthorised access or damage. Privacy concerns appropriate handling and access to personal information. Integrity means data remains accurate and complete. A system may meet one goal while failing another.
Threats include malware, phishing, unauthorised access, weak passwords and interception. Controls include user accounts, authentication, access rights, firewalls, anti-virus tools, anti-spyware and encryption. Each control reduces a risk; no single control guarantees safety.
Validation and verification catch different problems
Validation checks whether an input follows rules, such as type, range, format, length, presence or a check digit. It cannot prove that a plausible value is true.
Verification checks whether data was copied or entered as intended. Visual checking and double entry are entry methods; parity and checksums can detect some transfer errors. A parity bit may fail to detect an even number of bit changes.
Pause and explain
Which protection helps keep intercepted data unreadable to an unauthorised party?
Worked example
A field accepts a date between 1 January and 31 December. The entered date is in range but belongs to the wrong customer. What can validation establish?
Show the worked solution
- The range check confirms that the date is within the allowed interval.
- The rule does not compare the date with an independent source.
- The value can be valid in form but inaccurate in context.
Answer Validation establishes that the date is in range, not that it is correct for that customer.
Try a topic test
Choose Easy, Normal or Difficult. Save your answers and open worked review after finishing.
Test this topic →From guided practice to a new situation
Write your answer and reasoning first. Use a hint only if you are stuck. The model solution is for self-checking; your written work is not automatically marked.
A form accepts an age from 0 to 120. A user enters 35 for the wrong person. Explain what the range check catches and what it misses.
Give me a hint
Separate a rule-based check from checking the value against its real source.
Compare my reasoning
- The range check rejects values outside 0–120.
- 35 is within the permitted range.
- The check cannot establish that 35 belongs to the named person.
It confirms an allowed range but misses that the value may be assigned to the wrong person.
Look for these in your work
- Range rule stated
- Valid-looking value identified
- Accuracy limitation explained
A transmitted record has a checksum that does not match the receiver's calculation. What can be concluded, and what cannot be concluded?
Give me a hint
A mismatch is evidence of an error; a match is not proof against every possible error.
Compare my reasoning
- The mismatch indicates that data may have changed or been corrupted.
- The receiver should request or perform a recovery process appropriate to the system.
- A matching checksum cannot guarantee detection of every possible change.
The mismatch flags a likely transfer error; a checksum is not a guarantee that all errors are detected.
Look for these in your work
- Mismatch interpreted
- Response suggested
- Limit acknowledged
A service uses strong passwords but stores customer records in plaintext. Name two distinct risks and one additional control for each.
Give me a hint
Cover both unauthorised access and the consequences of a storage breach.
Compare my reasoning
- Stolen credentials can permit account access; multi-factor authentication and rate limits reduce some access risks.
- A database breach can expose readable records; encryption at rest and restrictive access rights limit exposure.
- Explain that encryption does not remove the need for secure keys and access management.
Add multi-factor authentication and access controls; encrypt stored records and protect the encryption keys.
Look for these in your work
- Two risks named
- Controls matched
- Control limitation recognised
Common mistakes
- Saying validation proves that data is accurate.
- Calling encryption a replacement for access control.
- Assuming a parity check detects every possible transmission error.
What can you explain now?
Which method checks whether a copied value matches its source?
Compare with the explanation
Verification
Verification checks correspondence to the source; validation checks whether a value follows defined rules.
After trying it yourself, choose your next review. This is your self-assessment.
Your review choice appears on Today. Sign in to sync it across devices.
Make it stick
How do validation, verification and data security controls differ in the errors or threats they address?
If you needed the solution, close it and solve the problem again from a blank page. A correct answer is stronger when you can explain the reason for each step.