To reach Achievement: 

Explain what the security method is, how it works, and how it could address a school security need.

To reach Merit: 

Explain a human factor or social impact, including who is affected and why.

To reach Excellence: 

Explain a significant problem, limitation or trade-off, including its consequences and how it could be managed.

Key concepts

• Asset: Something valuable that needs protection, such as student records, assessment data, staff accounts, payroll information, devices, or network availability.

• Threat: A person, event, or action that could cause harm, such as phishing, malware, credential theft, an insider, equipment failure, or a deliberate attack.

• Vulnerability: A weakness that a threat could exploit, such as a reused password, an unpatched device, excessive access rights, or a flat network.

• Risk: The likelihood that a threat will exploit a vulnerability, combined with the likely impact.

• Control: A technical or organisational measure used to reduce risk.

• Confidentiality: Information is available only to authorised people.

• Integrity: Information and systems remain accurate and are not changed without permission.

• Availability: Authorised users can access systems and information when needed.

• Defence in depth: Several different controls are used together so that one failure does not expose the whole system.

• Least privilege: Users receive only the access they need to complete their role.

Task 2 - Algorithms, Mechanisms, Systems, and Procedures 

Examples of use in schools and kura

• A staff member uses a password and authenticator app before accessing confidential student information.

• A school separates staff, student, guest, server, and camera or IoT devices into different VLANs.

• A teacher working from home uses a school VPN to reach an internal service that is not exposed directly to the internet.

• Endpoint protection detects suspicious behaviour and quarantines a malicious file while the IT team investigates.

• Backups are kept separately and tested so learning and administration can continue after ransomware or equipment failure.

• Staff and students know how to report a suspicious message quickly without being blamed for making a mistake.

Key issues

Security versus usability:

More steps can reduce risk but can also slow work, create frustration, or encourage unsafe workarounds.

Privacy versus monitoring: 

Logging and monitoring can help detect attacks, but excessive surveillance may reduce trust and collect unnecessary personal information.

Access versus least privilege: 

People need access to do their jobs, but broad access increases the damage caused by mistakes or compromised accounts.

Current protection versus future threats: 

Controls must be updated as attackers change methods, but schools have limited budgets, old devices, and competing priorities.

Technical controls versus human behaviour: 

A well-designed system should assume people sometimes make mistakes and should reduce the impact of those mistakes.

School control versus third-party dependence: 

Cloud platforms, contractors, and software providers may improve security, but a breach or outage outside the school can still affect it.

Human factors and social impact

Human factors are not simply a claim that “people are the weakest link”. Security is affected by the way systems, policies, training, workload, confidence, accessibility, incentives, and organisational culture shape behaviour.

• Long or confusing login processes may cause password sharing, written-down passwords, or avoidance of secure systems.

• Too many warnings can create alert fatigue, so users begin dismissing messages without reading them.

• Students or staff may hide a mistake if they expect blame, allowing an incident to grow.

• Accessible recovery and authentication options are needed for people who cannot use a particular device or biometric method.

• A breach may expose personal information, disrupt learning, affect wellbeing, damage trust, and create financial or administrative pressure.

• Security decisions can create inequity when students need newer devices, reliable internet, or a personal phone for authentication.

Cybersecurity involves identifying what needs to be protected, understanding what could cause harm, recognising weaknesses, and putting safeguards in place. Assets, threats, vulnerabilities, risks, and controls provide a framework for analysing security situations. These can then be connected to the CIA triad—confidentiality, integrity, and availability—to explain the type of harm that could occur and what aspect of information security is being protected. 

An asset is something valuable that needs protection, such as student records, passwords, school laptops, assessment files, or the school network.

A threat is something that could cause harm to an asset. Examples include a hacker, ransomware, phishing, fire, theft, or an employee accidentally deleting data.

A vulnerability is a weakness that a threat could exploit. Examples include weak passwords, outdated software, an unlocked computer, poor network configuration, or staff who have not received security training.

A risk is the possibility that a threat will exploit a vulnerability and cause harm. For example, there is a risk that an attacker could use a stolen password to access student records.

A control is a safeguard used to reduce a risk. Examples include multi-factor authentication, backups, antivirus software, firewalls, staff training, and access restrictions.

You then connect the example to one or more parts of the CIA triad:

Confidentiality means information is only seen by authorised people. A stolen password could affect confidentiality because an attacker might read private student information.

Integrity means information remains accurate, complete, and trustworthy. Malware that changes assessment grades would affect integrity.

Availability means systems and information are accessible when authorised users need them. Ransomware that locks the school’s files would affect availability.

Multifactor Authentication

Multi-factor authentication (MFA) is a security process that requires a user to provide two or more different types of evidence before access is granted.

The factors usually come from three categories:

• Something you know: a password or PIN

• Something you have: a phone, authenticator app, security key, or access card

• Something you are: a fingerprint, face scan, or other biometric

For example, a staff member may enter their password and then approve a notification on their phone. Even if an attacker steals the password, they may still be unable to log in because they do not have the staff member’s phone.

MFA is stronger when the factors come from different categories. A password followed by another security question is less secure because both are things the user knows.

MFA greatly reduces the risk of account compromise, but it is not perfect. Attackers may still use phishing, fake login pages, stolen browser sessions, or repeated approval requests to trick users. Authenticator apps and physical security keys are generally safer than codes sent by text message.

Use the information from Above to answer Task 1 and Task 2

Phishing, Malware, Passwords and cracking

VLAN'S and VPN'S

CISCO Packet Tracer website 

Putting it all together

Final Examination Preparation Task: Computer Security

Use your own example scenario to write four connected responses. Your scenario could involve a school, business, healthcare provider, community organisation, online service, or local government system.

A. Security Foundations

Explain:

• Assets

• Threats

• Vulnerabilities

• Risks

• Controls

• Confidentiality

• Integrity

• Availability

Connect each concept to specific people, information, devices, accounts, and systems in your scenario.

For example:

Student assessment records are an asset because they contain valuable and sensitive information. A stolen staff password is a threat because it could allow an attacker to access those records. Weak authentication is a vulnerability that increases the risk of unauthorised access, affecting the confidentiality and integrity of the information.

A strong response should show how the concepts connect rather than giving isolated definitions.

B. Security Mechanisms and Controls

Choose relevant security measures and explain how they work. These could include:

• Authentication and multi-factor authentication

• Password management

• Antivirus or endpoint protection

• Malware prevention and incident response

• VLANs and network segmentation

• Virtual private networks

• Backups

• Access controls and permissions

• Filtering and monitoring

• Security education and awareness

• School or organisational security procedures

Explain:

• The security problem each measure addresses

• How the mechanism, system, or procedure works

• How it would be implemented in your scenario

• Which assets it protects

• Its important limitations

A strong response should explain how the security measure operates rather than only naming it.

For example:

A VLAN separates devices into logical network groups, even when they use the same physical network equipment. In a school, staff devices, student devices, servers, guest devices, and Internet of Things devices could be placed on separate VLANs. Traffic between the VLANs would be controlled by firewall or routing rules. This could prevent a compromised student device from directly accessing assessment servers. However, VLANs do not encrypt traffic and can be ineffective if the access rules are incorrectly configured.

C. Human Factors and Social Impact

Analyse:

• How users create, store, and share passwords

• Phishing and social engineering

• Security awareness and reporting

• Access to authentication devices

• Privacy and monitoring

• Usability and accessibility

• Trust in the organisation

• Staff workload and technical support

• The consequences of a security incident

• How technical choices affect different people and communities

Students should connect the technical issue to a human or social consequence.

For example:

Requiring multi-factor authentication may reduce the chance that a stolen password can be used. However, some staff may not have access to a suitable personal phone or may be uncomfortable using a personal device for work authentication. Without an accessible alternative, the control could prevent legitimate users from accessing important systems.

Another example:

If staff are blamed or punished for clicking phishing links, they may delay reporting future mistakes. This gives malware or attackers more time to access information and spread through the network. A supportive reporting culture can therefore improve both security and incident response.

D. Perspectives, Problems, and Critical Conclusion

Compare two perspectives, such as:

• School leaders and students

• Network administrators and ordinary users

• Staff and parents

• Security teams and privacy advocates

• Employers and employees

• Government agencies and citizens

• Technology providers and affected communities

• Schools and third-party cloud-service providers

Consider important problems and trade-offs, such as:

• Security versus convenience

• Monitoring versus privacy

• Access versus confidentiality

• Cost versus level of protection

• Strong authentication versus accessibility

• Filtering versus access to legitimate information

• Centralised password storage versus the consequences of one account being compromised

• Remote access versus the risks created by unmanaged devices

• Automated security decisions versus human review

• Dependence on third-party services

Recommend improvements such as:

• Introducing multi-factor authentication

• Removing shared accounts

• Using password managers

• Separating devices with VLANs

• Applying least-privilege access

• Regularly updating and patching devices

• Testing backups

• Providing accessible authentication alternatives

• Improving phishing education

• Creating clear incident-reporting procedures

• Auditing access and security configurations

• Consulting affected users

• Providing human review of automated security decisions

• Establishing clear privacy and data-governance rules

Finish with a justified conclusion explaining:

• Which controls should be used

• Why several layers of security are needed

• Which risks cannot be removed completely

• When the system would be sufficiently secure to use

• When access or operation should be restricted or stopped

Strong Concluding Idea

Computer security is not achieved by installing one product or introducing one rule. It depends on layers of technical controls, well-designed procedures, informed users, and effective incident response.

Security measures can reduce risk, but they can also create costs, inconvenience, privacy concerns, and barriers for legitimate users. A system should therefore be judged not only by whether it blocks attackers, but also by whether it protects confidentiality, integrity, and availability in a way that is usable, fair, maintainable, and appropriate for the people affected.

Computer-security systems are most effective when their limitations are recognised, access is carefully controlled, users can report problems without fear, controls are regularly reviewed, and human judgement can respond when automated systems or procedures fail.