The prevention methods
The specification asks what each method limits or prevents, and how it does so. The most useful way to revise this sub-topic is against 1.4.1 — every method exists to counter particular attacks, and questions usually give you an attack and ask what would stop it.
Two of these are worth a closer look because they are commonly misunderstood.
User access levels do not stop an attack happening — they limit how much damage it can do. If an attacker compromises an account with restricted permissions, they reach only what that account could reach. That principle also protects against insiders: a member of staff who does not need payroll data simply cannot open it.
Penetration testing prevents nothing directly. Its value is that it finds the weaknesses first, so they can be fixed before an attacker uses them. It is the only method in the list that is about discovery rather than defence.
What makes a password strong: length above all, a mixture of upper and lower case letters, numbers and symbols, avoiding dictionary words and personal information, and not reusing the same password across sites. Systems also commonly limit the number of failed attempts, which defeats a brute-force attack directly by making it impossibly slow.
- Penetration testing
- deliberately attacking a system to find weaknesses before an attacker does
- Firewall
- hardware or software that inspects traffic entering and leaving a network and blocks anything not permitted
- User access levels
- settings controlling which files and functions each user can reach, so a person only has access to what their role requires
- Anti-malware software
- software that detects and removes malware, usually by comparing files against known signatures
Matching prevention to threat
Worked example
A company suffers a phishing attack in which an employee gives away their login details. Recommend measures to reduce the risk of this happening again.
- Identify what failed: this is social engineering, so the weak point was a person rather than the technology.
- That means anti-malware and firewalls would not have prevented it — the employee handed the details over willingly.
- Staff training is the direct answer: teaching people to recognise phishing messages and to verify requests before acting.
- User access levels limit the damage when it does happen, since a compromised account can only reach what it was permitted to.
- Add a technical measure that works even when a password is known.
Answer: Staff training first, because social engineering targets people and no firewall or anti-malware stops a user who gives their password away. User access levels then limit what a compromised account can reach. Requiring a second form of authentication would also help, since knowing the password alone would no longer be enough.
Common mistake
Anti-malware and firewalls do not stop social engineering. If the user willingly gives away their password, no technical barrier has been breached — which is why training and access levels are the right answers to that particular threat.
Before you practise
- The seven methods: penetration testing, anti-malware software, firewalls, user access levels, passwords, encryption, physical security.
- Say both what each method limits and how it does so.
- Penetration testing finds weaknesses before an attacker does — it is discovery, not defence.
- Firewalls inspect traffic entering and leaving and block what breaks the rules.
- User access levels limit the damage rather than preventing the attack.
- Encryption does not stop interception; it makes the intercepted data unreadable.
- Strong passwords and a limit on failed attempts defeat brute-force attacks.
- Social engineering is countered by training and access levels, not by anti-malware or firewalls.