Safety, eSafety and data security
Protect people and information by separating physical safety, responsible online behaviour, threats and security controls.
Section 8 · Safety and security
Exam scope and assessment notes
Cambridge IGCSE Information and Communication Technology 0983, for exams in 2026, 2027 and 2028. Examples, datasets and practice are original StudyForA material; they are not Cambridge questions, source files, mark schemes or grades. Practical lessons teach transferable operations, but learners must perform them in locally available office and web-authoring software and inspect their own files. This site does not reproduce a Cambridge practical examination or award an official grade. The separate 2029 syllabus is not mapped here. Cambridge states that IGCSE 0983 has the same subject content as IGCSE 0417, with 9–1 grading. This StudyForA pathway maps the 2026–2028 syllabus only. This 9–1 graded qualification is available only in a limited number of administrative zones. Confirm that your centre can enter you for this code and exam series with Cambridge International. Cambridge has published a separate syllabus for 2029. StudyForA has not reconciled that version yet; this page supports exams in 2026, 2027 and 2028 only.
Before you begin
- No previous ICT course is assumed. Read each scenario carefully and justify a tool or method by connecting it to the task, user and constraints.
Work on paper. Try each question before revealing help, and explain why your method works.
Quick readiness check
Which threat commonly uses a deceptive email or web page to steal credentials?
What you will learn
- Identify physical ICT hazards and choose prevention measures.
- Explain data protection, personal and sensitive data, and safe use of internet, email, social media and online gaming.
- Explain threats including hacking, phishing, pharming, smishing, vishing, malware and card fraud and how users can reduce risk.
- Describe controls including biometrics, digital certificates, SSL/TLS, encryption, firewalls, two-factor authentication and account credentials.
Keep people physically safe and protect privacy
Liquids near powered equipment can cause electrocution; overloaded sockets and overheating can cause fire; trailing cables cause trips; heavy equipment can fall. Keep drinks away, avoid overloading, ventilate equipment, secure cables and place devices safely.
Personal data can identify someone; sensitive information such as medical history needs strong protection. Data-protection principles commonly require lawful, fair, limited and secure use, but exact legal rules depend on jurisdiction. Online safety includes trusted age-appropriate sources, cautious handling of unknown messages, limiting personal details and images, blocking/reporting unwanted contacts and respecting other people's privacy.
Recognise attacks and use layered controls
Phishing uses deceptive messages or sites; pharming redirects users; smishing and vishing use SMS or voice; malware includes malicious software such as viruses; hacking accesses systems without permission. Card fraud can involve shoulder surfing, cloning or keylogging. Check a request using a trusted route rather than following a suspicious link.
Use updated software, anti-malware, safe downloads, firewalls, strong unique passwords and two-factor authentication. Encryption protects data so unauthorised parties cannot readily read it; SSL/TLS secures a connection between a client and server. A digital certificate helps identify a site or organisation. Each control addresses some risks, not all of them.
Sources for this lesson
Pause and explain
A site uses HTTPS and has a valid certificate. What does that establish most directly?
Worked example
A student receives a text asking them to confirm a bank password at a shortened link. Explain what they should do and why.
Show the worked solution
- Recognise a possible smishing attempt: an unexpected SMS requests sensitive credentials.
- Do not open the link or reply; verify through the bank's known official app or number.
- Report the message and change credentials through the trusted service if they were entered.
Answer This may be smishing because the message uses SMS to trick the student into disclosing credentials. They should not use its link, should contact the bank through a known official channel and should report the message. If credentials were entered, they should change them using the official service and tell the bank promptly.
Try a topic test
Choose Easy, Normal or Difficult. Save your answers and open worked review after finishing.
Test this topic →From guided practice to a new situation
Write your answer and reasoning first. Use a hint only if you are stuck. The model solution is for self-checking; your written work is not automatically marked.
Classify four messages: a fake bank email with a link, an SMS about a parcel, an unexpected call asking for a code, and a website that redirects to a fake sign-in page.
Give me a hint
Match the channel or redirection method to the attack name.
Compare my reasoning
- A deceptive email is likely phishing.
- A deceptive SMS is smishing; a deceptive voice call is vishing.
- A forced or deceptive redirection to a fake site can be pharming.
Fake bank email: phishing. Parcel SMS: smishing. Fraudulent call: vishing. Redirection to a fake sign-in page: pharming. Users should verify through known contact details and never disclose one-time codes to an unsolicited caller.
Look for these in your work
- Uses the threat terms correctly
- Adds a safe response
A club stores member names, addresses and medical needs online. Recommend three protections and explain each.
Give me a hint
Cover account access, the data itself and how much information is retained.
Compare my reasoning
- Use named accounts, strong authentication and access limited to staff who need the data.
- Encrypt data in transit and at rest where supported and keep systems updated.
- Collect only necessary information, set retention rules and maintain a secure recovery copy.
Use named accounts and two-factor authentication; limit access to staff who need the records. Protect transfer and stored files with encryption and updates, and collect only information required for the club's purpose. A tested backup should be secured separately; it must not become another public copy.
Look for these in your work
- Explains at least three relevant controls
- Links each control to a risk
A classroom has overloaded extension sockets, cables crossing walkways and learners placing drinks beside laptops. Give a prevention action for each hazard.
Give me a hint
Match controls to fire, trip and electrical-spill hazards.
Compare my reasoning
- Reduce socket load and remove damaged or hot equipment.
- Route cables away from walkways and secure them.
- Keep drinks away from powered devices and explain the rule.
Do not overload sockets; power down and report overheating equipment. Route and secure cables so they do not cross walkways. Keep drinks away from electrical equipment to reduce spill and electrocution risks. Regularly check the room rather than relying only on reminders.
Look for these in your work
- Addresses all three hazards
- Uses preventative controls
Common mistakes
- Treating a padlock or certificate as proof that a website is honest
- Confusing verification with encryption
- Giving online-safety advice that shifts responsibility to the target rather than the attacker
What can you explain now?
What does encryption do to data sent over a network?
Compare with the explanation
It transforms data into a form that is difficult for an unauthorised party to read without the key.
Encryption protects confidentiality of data, but does not prove the recipient is trustworthy or that a device is malware-free.
After trying it yourself, choose your next review. This is your self-assessment.
Your review choice appears on Today. Sign in to sync it across devices.
Make it stick
Explain one physical hazard, one online threat and one security control, making clear which risk each addresses.
If you needed the solution, close it and solve the problem again from a blank page. A correct answer is stronger when you can explain the reason for each step.