Protecting Information
Why Protecting Information Matters
Every organisation stores sensitive information — customer records, financial data, staff details and confidential business plans. If that information is lost, stolen or tampered with, the consequences can be severe: financial penalties, damaged reputation and loss of customer trust. Protecting information is therefore one of the most important responsibilities of any ICT professional. There are three broad categories of protection: logical, physical and security policies. Each layer addresses a different type of threat, and the strongest protection combines all three.
Logical Protection
Logical protection refers to software and system-based controls that prevent unauthorised access to data. Unlike physical locks, logical controls work by verifying identity and enforcing rules within the digital environment itself. The most common logical measures are access levels, authentication, firewalls, anti-malware applications, password protection and encryption.
Access levels ensure that users can only see and edit the information they need for their role. A sales assistant, for example, might be able to view customer orders but not alter payroll records. This limits the damage a compromised account can do. Authentication is the process of confirming that someone is who they claim to be. It can be single-factor (a password alone) or multi-factor, where a second check — such as a one-time code sent to a mobile phone — is also required. Multi-factor authentication is far harder for an attacker to bypass because stealing a password is not enough on its own.
Firewalls act as gatekeepers between a trusted internal network and untrusted external networks such as the internet. They examine data packets arriving at or leaving the network and block any traffic that does not match the permitted rules. A firewall can be hardware-based (a dedicated device), software-based (installed on individual computers) or a combination of both. Anti-malware applications scan the system for harmful software — viruses, spyware, ransomware — and either quarantine or delete threats before they can cause damage. They also monitor activity in real time, flagging suspicious processes immediately.
Password protection is one of the simplest but most widely used logical controls. Strong passwords — long, combining letters, numbers and symbols — are significantly harder to crack by brute-force attacks. Organisations often enforce a password policy that sets minimum complexity requirements and forces regular changes. Encryption goes further: even if an attacker gains access to data, they cannot read it without the decryption key. Data can be encrypted at rest (stored on a server or device) and in transit (as it travels across a network). HTTPS — visible in your browser address bar — uses encryption to protect web traffic.
The six logical protection methods are: access levels (limit what users can do), authentication (verify identity), firewalls (filter network traffic), anti-malware applications (detect and remove threats), password protection (control login access) and encryption (scramble data so it cannot be read without a key).
Authentication answers the question "who are you?" — it verifies identity before granting any access at all. Access levels answer the question "what are you allowed to do?" — they define what an already-authenticated user is permitted to see or change. Both work together: authentication is the door, and access levels are the rooms within the building that each person is allowed to enter. A school network, for example, might authenticate every pupil with a username and password, but access levels ensure that pupils cannot edit teacher mark books or administrative records.
Physical Protection
Even the strongest logical controls cannot help if an unauthorised person can walk up to a server and physically remove the hard drive. Physical protection addresses this by controlling and monitoring access to the real-world spaces and hardware where data is stored. Physical measures include locks, biometrics, the location of hardware, backup systems and security staff.
Locks are the most straightforward physical control — server rooms, filing cabinets and computer cases can all be locked to prevent unauthorised access. Biometrics offer a higher level of physical access control by using unique bodily characteristics: fingerprint scanners, iris recognition and facial recognition are all examples. Unlike keys or access cards, biometric data cannot easily be passed to another person or forgotten. The location of hardware also matters: servers and network equipment should be housed in dedicated secure rooms rather than shared offices, and ideally not on ground floor or basement levels where flooding or break-in risk is higher.
Backup systems protect against the permanent loss of data due to hardware failure, fire, flood or malicious deletion. A good backup strategy follows the 3-2-1 rule: keep three copies of data, on two different types of storage, with one copy held off-site. Off-site backups ensure that a single disaster — a fire destroying an office, for example — cannot wipe all copies simultaneously. Security staff provide a human layer of protection: patrolling premises, monitoring CCTV, checking visitor identity and responding to incidents in real time. Human oversight catches threats that automated systems might miss, such as an employee behaving suspiciously or a tailgating attempt at a secure door.
The five physical protection methods are: locks (restrict physical access), biometrics (verify identity using body characteristics), location of hardware (keep servers in secure, appropriate environments), backup systems (maintain copies of data in multiple locations) and security staff (human monitoring and response). Physical and logical measures work best in combination.
Backup systems are classified as physical protection because the key decisions involved — where to store the backup media, how many copies to hold, whether to keep one off-site — all concern physical hardware and location. Even cloud backups rely on physical servers in a different location. The protection they provide is resilience against physical threats (fire, flood, hardware failure) rather than against logical threats like malware, though they do incidentally protect against ransomware too. In an exam, listing backup systems under physical protection is correct; listing it under logical would typically lose the mark.
Security Policies
Technology alone cannot protect an organisation if people do not use it correctly. Security policies are documented rules and procedures that govern how staff handle information and respond to incidents. The three main policies covered in this topic are: disaster recovery, staff responsibilities and the acceptable use policy.
A disaster recovery plan is a documented procedure that sets out exactly what an organisation will do if a major incident — a cyberattack, a fire or a flood — disrupts normal operations. It identifies which systems must be restored first, who is responsible for each action, where backup data is held and how long restoration should take. Without a disaster recovery plan, organisations often make chaotic decisions under pressure, taking far longer to recover than necessary. Staff responsibilities policies make clear what each employee is expected to do to protect information — for example, not sharing passwords, locking their computer screen when leaving their desk and reporting any suspicious emails or activity immediately.
An acceptable use policy (AUP) is a written agreement that tells users what they are and are not allowed to do with an organisation's ICT systems. It typically covers rules on personal use, prohibited websites, the installation of unauthorised software and the handling of sensitive data. Employees usually sign an AUP when they join an organisation. Staff training is essential because many security breaches are caused by human error rather than sophisticated technical attacks — clicking on a phishing link, using a weak password or accidentally emailing a file to the wrong person. Regular training keeps staff aware of current threats and reminds them of their responsibilities.