Detecting and Preventing Cyber Threats
Defence in Depth
No single security measure can stop every attack. The most effective approach is layered defence: stacking multiple measures so that if one fails, another is still in place. This lesson covers the five specific prevention measures from the specification: biometric measures, password systems, CAPTCHA, email confirmation, and automatic software updates. Understanding what each one does — and crucially, what it is protecting against — is more useful than simply memorising definitions.
The five security measures to know: biometric measures (authenticating by physical characteristics), password systems (verifying identity by secret credentials), CAPTCHA (distinguishing humans from automated bots), email confirmation (verifying a user’s identity or an action via their email account), and automatic software updates (patching known vulnerabilities as soon as fixes are available).
Biometric Measures
Biometric measures authenticate users using unique physical characteristics. Common examples include fingerprint scanning, facial recognition, and iris scanning. These are particularly common on mobile devices: a smartphone’s fingerprint sensor or face unlock feature uses biometric data stored securely on the device to confirm that the person picking up the phone is its owner.
Biometrics offer a significant advantage over passwords: a fingerprint cannot be forgotten and is very difficult for another person to replicate. However, biometric data is permanent — unlike a password, you cannot change your fingerprints if they are ever compromised. This is why biometric data is usually combined with another factor rather than used alone.
Password Systems
A password system is the most widely used form of authentication. A strong password is long, contains a mix of letters, numbers and symbols, and is not based on easily guessed information such as a name or date of birth. Weak or default passwords are a major vulnerability: attackers use automated tools to systematically try common passwords (a dictionary attack) or all possible combinations (a brute-force attack).
Password systems become significantly stronger when combined with a second factor. Two-factor authentication (2FA) requires the user to provide something they know (the password) and something they have (such as a one-time code sent to their phone). Even if an attacker obtains the password, they cannot log in without also having access to the second factor.
Length matters more than complexity. A short, complex password like X7!q is cracked far faster by brute force than a long passphrase like PurpleElephantRunsFast, because the number of possible combinations grows exponentially with each additional character. A strong password should be at least 12 characters long, mix upper and lower case with numbers and symbols, not be a dictionary word or a predictable modification of one, and be unique to each account (reusing passwords means that if one site is breached, all accounts sharing that password are at risk).
CAPTCHA
CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. It is the tick-box, image-selection, or distorted-text puzzle you encounter when logging in or creating an account online. Its purpose is to block automated bots from performing actions at scale — such as creating thousands of fake accounts, submitting spam through a contact form, or attempting to brute-force a login by trying thousands of password combinations rapidly.
CAPTCHA exploits the fact that certain tasks which are trivial for a human brain (identifying traffic lights in a photograph, reading slightly skewed letters) are computationally difficult for automated programs. By requiring users to complete these challenges, websites ensure that an actual human is behind the keyboard. Modern versions use behavioural analysis to assess whether a user interacts with a page in a human-like way, making them more seamless for genuine users while still blocking bots.
Email Confirmation
Email confirmation uses a person’s email account as a secondary verification channel. When a user creates a new account, the site sends a confirmation link to their email address; the account is only activated when the link is clicked. This proves the person registering actually has access to that email address — a bot or an attacker using a fake email address will not be able to complete the confirmation step.
Email confirmation is also used when security-sensitive actions are requested: resetting a password, changing an email address, or authorising a large bank transfer. Sending a one-time link or code to the registered email means an attacker who only knows a password cannot complete the action without also having access to the email inbox.
Biometrics work best on personal devices where a physical characteristic is available. Passwords are universal but weakest when short or reused. CAPTCHA stops automated bot attacks. Email confirmation proves both ownership of an email address and intent to perform an action. Automatic updates close known software vulnerabilities before attackers can exploit them. Used together, these measures create a much harder target.
Automatic Software Updates
Automatic software updates address one of the most exploited vulnerabilities in any system: outdated software. Software contains flaws — bugs in its code that, when discovered by attackers, can be exploited to gain unauthorised access, install malware, or crash a system. When a vulnerability is found, developers release a patch (a targeted fix). Unpatched software is exposed to attacks specifically designed to target that known flaw.
Enabling automatic updates means patches are applied as soon as they become available, minimising the window of vulnerability. Manually updating systems is unreliable — users often delay or ignore update prompts. Automatic updates are particularly important for operating systems and security software such as anti-malware tools, which need to know about the latest threats to protect against them.
Consider a banking app on a smartphone. To protect the account, the bank applies several layers: the phone uses biometrics (face or fingerprint) to prevent strangers using the device; a strong password or PIN is required to log in; a CAPTCHA stops automated login attempts; when logging in from a new device, an email confirmation is sent; and the app updates automatically to patch security vulnerabilities. An attacker who defeats one layer still faces the others. Removing any single layer increases risk — but no single layer is the whole defence.