eSecurity
Learn the core concepts and decision-making in Cambridge 9626 Topic 5, then practise recall, application and transfer with fictional scenarios.
Section 5 · eSecurity
Exam scope and assessment notes
This is original StudyForA teaching and fictional practice based on Cambridge syllabus outcomes, not copied syllabus text, an official question, a required software brand or a Cambridge mark scheme. Practical software tasks here are planning and reasoning exercises; StudyForA does not inspect files created in spreadsheet, database, graphics, audio/video or animation software, simulate the practical exam environment, award official marks or predict a grade. Follow the software and file-format requirements issued by your centre for your exam year.
Before you begin
- Check whether your route is AS Level (Topics 1–11) or full A Level (Topics 1–21).
Work on paper. Try each question before revealing help, and explain why your method works.
Quick readiness check
Before Topic 5: esecurity
What you will learn
- Identify personal data and explain confidentiality, anonymisation, aggregation, geotag removal and duty of confidence
- Explain phishing, smishing, vishing and pharming and network safeguards including hardware/software firewalls
- Distinguish trojans, worms, spyware, adware, rootkits, malicious bots and ransomware
- Evaluate software and physical malware prevention and their limitations
Protect people and information
Personal data can identify or relate to a person. Confidentiality limits disclosure to authorised purposes; aggregation combines records, while anonymisation removes identifying links as far as practical. Photos and video may contain location metadata. Security includes technical controls such as firewalls and updates, but also staff practices, physical access control, backups and clear duties of confidence.
Recognise attacks and layers of defence
Phishing uses deceptive messages or sites; smishing uses SMS; vishing uses voice calls; pharming redirects users to fraudulent destinations. Malware includes trojans disguised as legitimate programs, self-spreading worms, surveillance spyware, advertising adware, concealed rootkits, malicious bots and ransomware. Firewalls filter network traffic; anti-malware can detect known or suspicious files. No single control stops every threat.
Sources for this lesson
Pause and explain
Which approach best demonstrates secure, reliable IT practice in esecurity?
Worked example
A school plans to publish a photo of a field trip. Identify two privacy risks and two practical protections.
Show the worked solution
- Check whether people can be identified or did not consent to publication.
- Inspect image metadata for location and device details.
- Limit audience, remove unnecessary metadata and use a permission process.
Answer The image may reveal identifiable learners, their location or a routine, and metadata may expose coordinates or device information. The school should follow its consent and safeguarding rules, remove unnecessary geotags, publish only to the intended audience and avoid attaching personal names. Removing metadata does not replace consent or access control.
Try a topic test
Choose Easy, Normal or Difficult. Save your answers and open worked review after finishing.
Test this topic →From guided practice to a new situation
Write your answer and reasoning first. Use a hint only if you are stuck. The model solution is for self-checking; your written work is not automatically marked.
A staff member receives a text asking them to 'verify payroll' through a shortened link. Identify the attack type and response.
Give me a hint
Use the delivery channel and requested action as clues.
Compare my reasoning
- Classify an SMS-based deceptive link.
- Avoid opening or entering credentials.
- Report through a known channel and verify with payroll independently.
This is likely smishing: an SMS message attempting to deceive the recipient into visiting a credential-harvesting page. Do not open the link or reply. Report it using the organisation's established process and contact payroll through a previously known address or number. A firewall may not stop a user from voluntarily entering credentials, so staff awareness and account protections also matter.
Look for these in your work
- Names smishing
- Gives safe immediate action
- Explains layered defence
A business holds encrypted backups but stores them permanently connected to its network. Explain one remaining ransomware risk.
Give me a hint
Consider whether the attack can reach the backup copy.
Compare my reasoning
- Explain how malware may access connected backup storage.
- Recommend offline or immutable backup copies.
- Add regular restoration tests.
Ransomware running with sufficient network access may encrypt or delete connected backups too. Keep protected offline or immutable copies with separate access controls, and test restoration regularly. Encryption protects confidentiality but does not guarantee that a reachable backup remains available.
Look for these in your work
- Identifies availability risk
- Suggests a separated copy
- Includes restore testing
A website publishes a dataset of learner attendance. How can it reduce identification risk while preserving useful totals?
Give me a hint
Remove direct identifiers and consider combinations of fields that can identify someone.
Compare my reasoning
- Remove direct identifiers and location metadata.
- Aggregate results into suitable groups.
- Review whether small groups or unusual combinations still reveal a learner.
Remove names, IDs and geotags, and publish totals aggregated into groups large enough to reduce singling out. Check combinations such as class, date and rare absence reasons, since indirect identifiers can reveal identity. Limit access to detailed records and follow the organisation's confidentiality rules; pseudonyms alone are not full anonymisation.
Look for these in your work
- Distinguishes identifiers and aggregates
- Checks re-identification risk
- Includes access/confidentiality
Common mistakes
- Treating encryption alone as complete security
- Assuming antivirus prevents social engineering
- Calling any harmful program a virus
What can you explain now?
A staff member receives a text asking them to 'verify payroll' through a shortened link. Identify the attack type and response.
Compare with the explanation
This is likely smishing: an SMS message attempting to deceive the recipient into visiting a credential-harvesting page. Do not open the link or reply. Report it using the organisation's established process and contact payroll through a previously known address or number. A firewall may not stop a user from voluntarily entering credentials, so staff awareness and account protections also matter.
Use the delivery channel and requested action as clues.
After trying it yourself, choose your next review. This is your self-assessment.
Your review choice appears on Today. Sign in to sync it across devices.
Make it stick
Why is an encrypted backup still at risk if it stays writable and connected?
If you needed the solution, close it and solve the problem again from a blank page. A correct answer is stronger when you can explain the reason for each step.