Prevention Measures & IT Legislation

Why Prevention Matters

Knowing about cyber-security threats (from Lesson 5) is only half the picture. The other half is knowing how to stop them. Prevention measures fall into three categories: physical (controlling access to devices and buildings), logical (software-based controls) and secure destruction (safely disposing of data and devices). Each reduces a different kind of risk.

Physical Prevention Measures

Physical measures stop unauthorised people from reaching hardware in the first place. Biometric devices (fingerprint scanners, retina readers, facial recognition systems) grant access only to enrolled individuals — they are difficult to forge and eliminate the need for keys that can be lost or copied. Keypads require a PIN code to enter a secured area — quick to use but vulnerable if someone watches the code being entered (shoulder surfing). RFID (Radio-Frequency Identification) is used in staff ID cards that grant access by being held near a reader — cards can be cloned if not properly protected. Firewalls in hardware form are dedicated devices placed between a network and the internet, inspecting all traffic and blocking suspicious data packets. Secure backups (physical offsite copies) ensure data can be recovered if hardware is damaged, stolen or destroyed.

Logical Prevention Measures

Logical prevention measures are enforced by software. Access rights and permissions ensure users can only view, edit or delete the files their role requires — a call-centre agent should not be able to access payroll files. Anti-virus and anti-malware software scans for known malware patterns and quarantines or removes threats. Usernames and passwords are the most basic logical control: they should be complex (mixed case, numbers, symbols) and unique per account.

Two-factor authentication (2FA) adds a second layer: even if an attacker obtains a password, they also need the one-time code sent to the user’s phone. Encryption scrambles data in transit and at rest, so that intercepted data is useless without the decryption key. Secure backups in logical form means keeping encrypted digital copies in a separate location — automated cloud backups are a common approach. Software firewalls monitor incoming and outgoing traffic on a single device, blocking suspicious connections.

When a device is retired or sold, simply deleting files is not enough — data can be recovered from a “deleted” drive using widely available software. Four named methods ensure data cannot be recovered. Data erasure overwrites every storage location with random data multiple times, leaving no trace of the originals. Data sanitation is a broader process of clearing a storage medium to a certified standard, often including overwriting and verification that nothing remains. Magnetic wipe (degaussing) uses a powerful magnet to disrupt the magnetic patterns on a traditional hard drive, rendering data unreadable — it does not work on SSDs or USB drives. Physical destruction (shredding, crushing or melting the storage medium) is the most absolute method; it is typically used for drives containing highly sensitive data where recovery must be provably impossible.

Key Fact

Physical measures (biometric devices, keypads, RFID, firewalls, secure backups) prevent unauthorised physical access. Logical measures (access rights, anti-virus, 2FA, encryption, firewalls, passwords, secure backups) prevent unauthorised software access. Secure destruction (data erasure, sanitation, magnetic wipe, physical destruction) ensures data on retired devices cannot be recovered.

IT Legislation — Five Acts to Know

The exam requires knowledge of five Acts: what each one makes illegal or requires, who it protects, and its implications for data, individuals and organisations. Detailed knowledge of specific sections or clause numbers is not required. Treat each Act at the level of purpose and implications.

The Computer Misuse Act makes unauthorised access to computer systems and unauthorised acts intended to impair their operation criminal offences. It protects individuals and organisations from hackers and malware creators. The implication for organisations: they should maintain logs of access attempts to detect and prove unauthorised access.

The Copyright, Designs and Patents Act protects original creative work — including software, images, music and written content — from being copied or distributed without permission. For IT, this means you cannot legally copy software, use images from the web without a licence, or resell a software product you did not create. Organisations must ensure they have valid licences for all software they use.

The Data Protection Act governs how organisations collect, store, use and share personal data. Organisations must have a lawful reason for holding data, keep it accurate and secure, not retain it longer than necessary, and give individuals the right to access or correct their data. Failure to comply can result in regulatory fines. This Act directly supports cyber-security by requiring organisations to secure personal data against unauthorised access.

The Freedom of Information Act gives the public the right to request information held by public bodies (government departments, schools, NHS trusts, local councils). Public bodies must respond within 20 working days. For IT, this means public sector organisations must store records in accessible formats and must have systems in place to locate, retrieve and release information on request — while withholding genuinely exempt information (such as commercially sensitive or personal data).

The Health and Safety at Work Act requires employers to provide a safe working environment. In IT contexts, employers should manage risks such as unsuitable workstations, unsafe equipment and trip hazards. Employees also have a responsibility to use equipment safely.