Protecting Systems (Years 8–11) — Computer Science

Defences that keep systems safe: firewalls, encryption, authentication and 2FA, penetration testing and backups, matched to the threats they counter.

Knowing the threats is only half the battle — the other half is building defences. No single wall keeps a system safe; real security stacks several layers, so that if an attacker slips past one, the next one stops them. This is called defence in depth, and it turns a fragile system into a hard target.

Defence in depth: each layer an attacker must beat to reach the data.

Why this matters: Every organisation that holds data has a legal and moral duty to protect it. The methods here — firewalls, encryption, authentication, testing and backups — are exactly what real IT teams deploy, and they map directly onto the threats you have just learnt.

A firewall filters traffic between the trusted LAN and the internet.

Firewalls and encryption

A firewall sits between your network and the internet, inspecting every packet and blocking anything that breaks the rules — like a security guard on the door checking who is allowed in and out. Encryption scrambles data with a key so that, even if it is stolen, it is unreadable gibberish without that key. A firewall tries to keep attackers out; encryption makes the data worthless if they get in anyway.

Authentication

2FA needs something you know and something you have — both.

Authentication proves you are who you claim to be, usually with a strong password. Even better is two-factor authentication (2FA): something you know (a password) plus something you have (a code sent to your phone). Because a thief would need both, 2FA stops most stolen-password attacks. This directly defeats brute-force attacks — especially when paired with account lockouts after a few wrong guesses.

Testing and backups

Penetration testing is hiring ethical hackers to attack your own system on purpose, to find the holes before criminals do — like a fire drill for security. Backups are regular copies of data kept separately, so that after ransomware, theft or hardware failure you can restore everything. The gold rule is to keep at least one backup off-site or offline, out of reach of an attack on the main system.

Threat	Defence that counters it
Malware / intruders	Firewall + anti-malware + updates
Stolen data	Encryption (unreadable without the key)
Brute-force / stolen passwords	Strong passwords, 2FA, lockouts
Ransomware / data loss	Regular off-site backups
Unknown weaknesses	Penetration testing

Scenario: A company is hit by ransomware that encrypts its servers and demands payment. Because it kept nightly off-site backups, it wipes the infected machines and restores yesterday's data — losing a day's work, not the whole business, and paying nothing. Backups turned a disaster into an inconvenience.

An off-site backup is out of the attack's reach, so it can restore.

Common mistake: Storing the only backup on the same network as the original. Ransomware and intruders reach anything connected, so an on-network "backup" gets encrypted too. A true backup is kept offline or off-site.

Tip: For every threat you learn, pair it with its defence. Exams love "how would you protect against X?" — a firewall, encryption, 2FA or a backup is almost always the answer, matched to the specific attack.