Data Security

Three words sound like the same thing, but Cambridge marks them as three different things: the security, the privacy and the integrity of data.

Aga Khan University Hospital (a large private hospital in Karachi) holds a record for every patient it has treated. One record can fail in three ways. It can be destroyed by a failed disk. It can be read by the wrong person. Or it can still be there and simply be wrong, for example a blood group typed in badly four years ago. Three words for three failures:

Integrity of data is never asked as a contrast, only what it means, for one mark. The wrong blood group has perfect security and perfect privacy, and it is the most dangerous of the three.

Note "Prevents against" is not good English, but it is exactly what the Cambridge mark scheme prints, so it is safe to copy as it stands.

Note Be careful which question you were asked. Asked for the difference, Cambridge wants loss against unauthorised access. Asked why data needs to be kept secure, it also accepts "to prevent unauthorised access", which are the words it has just called privacy. Both are right for their own question. No mark scheme points this out.

The hospital protects two different things, and Cambridge marks them separately: the data (the records themselves) and the computer system they are stored on. They fail in different ways, and a student who writes two good sentences about the data scores only one mark.

If you are asked only why data needs to be kept secure (the data, not the system), one mark comes from any of these:

Note Count the things in the question. A question that names two things is telling you where its marks are: both its data and its computer system, two threats, one similarity and one difference. Give exactly that many, one of each.

Every threat in this part is somebody getting at data that is not theirs. Malware is the family name for the software they use to do it.

Malware is malicious software, downloaded or installed without the user’s knowledge. The second half of that sentence is on the mark scheme of nearly every malware question. The syllabus names two kinds of malware that you must be able to describe: a virus and spyware.

A virus is a malicious program that copies itself (replicates), and it deletes or alters the files and data stored on the computer. Two things carry that sentence: replicates and deletes or alters. One without the other is half a definition, which on a one-mark question scores nothing.

Spyware is malware that is downloaded without the user’s knowledge. It secretly records what the user does, such as the keys they press, and sends a log of it to a third party.

When a question only says identify a threat, one word is the whole mark. Describing what nobody asked you to describe earns nothing.

Cambridge asks about these two together, and asks for the comparison itself: "Give two similarities and one difference between spyware and a virus", three marks, two of them for similarities. If you copy out the two descriptions one under the other, you have written no comparison at all. The difference mark needs one sentence with both halves in it.

Read those as sentences, not as facts. Not one of them is a description of a virus followed by a description of spyware. Each names one thing to compare and puts both on it. Copy that shape.

Note A contrast question wants one sentence carrying both halves, not two descriptions side by side.

Hacking is the one threat here that is not software at all. It is a person. Nothing is downloaded, nothing replicates, nothing runs in the background. Somebody simply gets in.

That is the whole definition, and the word unauthorised is carrying the mark. Where the question names the data, the description mark is also given for "illegal access in order to delete or damage" the records the question names.

Note The name of the threat is "hacking" (also accepted: "hacker" or "unauthorised access"). "Unauthorised access" is accepted as the name and as the description, but not as both at once in one two-mark answer.

A hacker is not a virus, and the exam knows it. Malware runs; a hacker decides. Cambridge has printed "Viruses and pharming are examples of malware": pharming belongs to the malware family, and hacking never does. So if a question asks how to stop a hacker getting in, anti-virus software is not the answer. The preventions that go with hacking are about keeping a person out: a firewall, user permissions, authentication (any check that you are who you say you are) and biometric passwords (a fingerprint or a face).

Phishing and pharming have the same target, the details that get somebody into your bank account, but they take two different routes, and the route is the answer.

Phishing is an email that pretends to be from an official body. It persuades you to disclose private information, such as bank details, often by inviting you to click a link to an unofficial website.

Pharming is, in the mark scheme’s own words, "malicious code or software installed on a computer which redirects the user to a fake website to obtain personal data". Read that again: code, on your machine, that you did not install. Pharming is malware; phishing is not. Cambridge says so in a question: "Viruses and pharming are examples of malware."

The second row follows from the first: type hbl.com yourself, spelled correctly, and the pharming code still lands you on the fake page. That is why the prevention is anti-malware for pharming and a spam filter for phishing.

Several questions (four of them, worth eighteen marks between them) give a printed table with three columns, threat, description and prevention, and you complete a row. The marks are read across the row: 1 mark for the threat, 1 mark for the corresponding description and 1 mark for the corresponding prevention. A correct prevention under the wrong threat scores nothing.

Column 3 needs only the name of a measure, such as a firewall, anti-virus software or encryption. The measures are explained in the sections that follow.

This example is the Imtiaz loyalty database (Imtiaz is a Karachi supermarket chain). Read each row across:

Row one: it replicates, so it is a virus, and anti-virus software is what you run against one. Row two records and sends, so it is spyware, and its prevention does not have to be another "anti-" program: an on-screen keyboard takes the keystrokes away. Each cell is the reason for the one beside it.

Now three true sentences that score only 2 out of 3:

The threat (1 mark) and the description (1 mark) are right: it really is a phishing email. The prevention scores 0: anti-virus software removes software, and column 1 names an email. Column 3 is the cell nobody re-reads.

Every other measure is built on this one. A firewall does not know who you are; access rights do, and they only work because there is an account to attach them to.

When you sign up on cswithzain.com, the site gives you a user account: a username, which is the identity you claim, and a password, which is the evidence that the claim is yours. The username says who; the password says prove it.

Cambridge pays for neither of those descriptions. When a question asks how this measure protects the system, it pays for the effect, and the effect has two halves worth writing even for one mark: who gets in, and what that stops.

1. Name what is protected: the resource, the file, the system.
2. Say who reaches it: only the user with the correct password. The word only does the work. Without it, the sentence says passwords let people in, which is true of no security measure.
3. Say what that stops: it prevents unauthorised access.

Note Words in brackets on a mark scheme are accepted but not required, so writing "username and strong password" costs you nothing and is never wrong.

A password decides whether you are in. Access rights decide what you may touch once you are in. K-Electric (Karachi’s electricity utility) lets hundreds of staff into one customer database, and nobody gets the whole thing.

Each account is given an access right (no access, read only, or read and write) and a view, the part of the database that account is shown at all. Rights answer "what may this account do?"; views answer "what may it see?", and the mark scheme pays for them separately. Both depend on separate logins: rights cannot differ if everyone uses the same login.

Four of these five points follow on from the one above, so one sentence naming separate logins and different rights, such as read only, collects two marks. Add the view and you have three. The view is the part students forget, and an example of a view is worth as much as the word view.

Bahria Icon Tower (in Clifton, Karachi) runs its lifts, cameras and booking portal on one network, and a firewall sits where that network meets the internet. It checks traffic in both directions, and one mark scheme gives a separate mark for the outgoing half. "Blocks incoming traffic" on its own loses that mark.

A firewall does three things, and each one is a mark:

The last two points come from the two rows of the table: the open port, and the outgoing program. Outgoing traffic is examined, not banned.

A proxy server is often offered instead of a firewall, for the same three marks, but it is not one. Bahria Icon Tower’s booking portal must answer the internet, but its web server must never be reached directly from it. A proxy server makes both true: it stands in front of that server and answers in its place.

That is where the two come apart: a firewall lets the outside reach the real machine when the criteria are met; a proxy server never lets it reach the machine at all.

Three names, one description. The mark scheme spells it out: anti-spyware is marked like the anti-virus answer with the word swapped, and anti-malware is marked as anti-virus. Learn the points once and you can answer all three.

Imtiaz (the supermarket chain with the loyalty card) keeps its loyalty database on a back-office PC. The anti-virus software on it does four things, and none of them is "protects the computer":

1. It scans the files on the hard drive for malicious software.
2. It compares each file against a stored database of known viruses. This is the sentence the mark is on.
3. It deletes or quarantines anything that matches. Quarantine means moving the file somewhere it cannot run; the mark scheme accepts either word.
4. It checks a file as it downloads and stops the download continuing. This is a separate accepted answer, and the only one that stops the malware before it arrives.

Note Where a question says identify and describe, it is 1 mark for the name and 1 for the description. Naming three kinds of software and describing none scores the naming marks only.

An HBL (Habib Bank) branch keeps its records on a server in a locked room at the back, and copies them every night to a machine somewhere else. That is two measures, and neither is software on the server.

Every other measure tries to stop something happening; a backup does not. It is the only measure here that assumes the bad thing has already happened and asks what you have left. So it is the right answer to one kind of question and the wrong answer to another.

Look at the two "No"s in the top row. A backup answers "keep the data secure" and "restrict the risk of losing it". It does not answer "restrict access": it is on the accepted list for the first two and missing from the third.

Physical security measures are a locked server room, a key card, a guard or a cable lock. There is no software anywhere, and Cambridge accepts them. Where a question asks for a physical method, or a method "on the computer" without saying software, this is a whole answer, and the easiest to describe, because the description is just the door.

Several questions (five parts so far) give you a measure in the question and then refuse it as your answer: "identify one other measure". The question is not giving you a hint; it is crossing an answer out. Underline every measure it names, usually in the sentence before the question. If it names a category, cross off everything inside it. Cross off your own earlier answers too, because each security measure must be different, and check which column of the table you are writing in.

What half the class writes: "password". The question said the files are password-protected, so the word is in their head and goes straight back down. The measure in the question is the one that scores nothing.

Note the odd one out: that second list answers a question about software-based measures and still prints key card access. Answer a software question with software.

"Explain how" is not "state". The mark scheme for a "restrict the risk" question shows the difference in its layout: its points come in pairs, a measure, then a point under it beginning "so that" or "as these". Both halves are worth 1 mark. The second half of each pair is not an explanation of the first: it is a mark of its own. A list of measures scores half.

Naming three different measures is allowed (1 mark for each point, up to 3), so three measures can reach three marks. But it is the riskier route: two of yours may turn out to be the same point (anti-virus and anti-malware are one entry here, not two), and a bare list has nothing to fall back on. A measure with its reason attached still scores if the examiner will not accept the measure.

So write the measure, then "so that", then the thing that can no longer happen. For example (these are Zain’s words, not the mark scheme’s): "Stop staff plugging their own USB drives into the checkout PCs, so that malware cannot be carried in on one." Do that twice for a 3-mark question.

Encryption does not stop anybody taking your data; it makes what they took useless to them. A K-Electric meter (K-Electric is Karachi’s electricity supplier) has to send the reading METER 4721 down a line that anyone can tap, so it sends TLALY 1498 instead: cipher text. The tap still works; the copy says nothing.

• What it does: the data is encoded (scrambled) into cipher text.
• What it is for: so that if it is intercepted, it cannot be understood.
• Who can still read it: a key or algorithm is needed to decode it.

Encryption does not stop interception. It makes the intercepted data impossible to understand. A class often writes "so nobody can open it", "so it is safe" or "so it cannot be read". Every one of these says the data is inaccessible, when the mark is for it being unintelligible, and none of them scores.

Those two sentences are the two points. The first one alone, however well written, is one mark.

Here is a toy cipher (Zain’s, not Cambridge’s) so you can watch the three points happen. The key is 7: each letter moves 7 places through the alphabet, and each digit moves 7 places through 0 to 9, wrapping round at the end.

Note No exam question asks how an encryption algorithm works. The toy cipher is only here so you can see the three points. Notice that even when you know the method, TLALY 1498 still needs the key 7.

Encryption protects data in two settings: NADRA records crossing a network (NADRA issues Pakistan’s identity cards), and an Imtiaz loyalty database backed up to a drive. A class looking for two different answers invents the second. There is only one answer, and what changes is a single verb.

For a storage question, cross out "intercepted on the way" and write "obtained from the drive": the same three sentences are full marks. There is no separate storage-only method, and inventing one costs the marks the real answer was worth.

Note The name and the description are paid separately, and neither pays twice.

Authentication proves that something is what it claims to be: that the user really is who they say they are, or that the sender really is the sender. Encryption never answers that question. Three techniques do: a digital signature, biometrics and two-factor authentication.

A password is the simplest authentication check. Two-factor authentication asks for a second piece of evidence after the password, such as a code sent to your phone.

Biometric passwords use a part of the person, such as a fingerprint or a face, which cannot be handed to somebody else. Other biometrics include an iris (eye) scan and voice recognition. Because a biometric belongs to the person, it cannot be forgotten like a password and is very hard to copy or share. A biometric check can also be the second factor in two-factor authentication.

For the exam, these sentences are all you need to name and describe either measure. Both appear on the mark scheme lists of "other" security measures, and both help keep a hacker out.

NADRA (Pakistan’s identity authority) emails a family registration certificate to HBL. HBL must be able to prove that NADRA sent it and that nobody altered it. A digital signature does both. Questions on it have been worth 10 marks across two papers.

The document is the line NADRA FRC 42101-1234567-8 ISSUED 2026-08-31. The six-character digests below are made up so you can watch step 7 happen; a real digest is far longer, and no mark scheme prints one.

1. NADRA hashes the certificate. A hashing algorithm turns any document, however long, into a short, fixed-length value...
2. ...called a digest: 14D08E.
3. NADRA encrypts the digest with its own private key: 14D08E becomes 8B47F5. It no longer looks like the digest, which is the point. This encrypted digest is the digital signature.
4. The certificate and the signature are both sent to HBL.
5. HBL decrypts the signature with NADRA’s public key: 8B47F5 becomes 14D08E. That is NADRA’s digest, recovered by a bank that has never seen NADRA’s private key. The two keys belong together, so a published public key is the proof, not a weakness.
6. HBL hashes the certificate that arrived, with the same hashing algorithm: 14D08E.
7. HBL compares the two digests: the 14D08E that came out of the signature and the 14D08E it made itself.
8. The two digests are the same, so the certificate is authentic.

Write all eight points in order and let the five-mark limit choose. A class loses marks here by stopping at "the digest is encrypted": that is only point 3 of 8, and every mark after it belongs to the receiver. The document is hashed twice, once by the sender and once by the receiver, and the two digests are compared.

Some marks are just the name, written down. What a download must include to make sure a program is authentic: "Digital signature".

Two papers set the digital signature chain almost word for word. Seven of the eight points are identical. The eighth is not, and it is not a variation the examiner allowed: it is a different mark, because the questions asked different things.

Both questions are worth 5 marks, and points 1 to 7 (hash, digest, encrypt, send, decrypt, hash again, compare) use the same words in both.

Note Neither mark scheme prints both endings and neither forbids both, so writing both is not a trap; writing only the wrong one is.