Ethics and Security
Domain focus
Ethics and Security tests the CIA triad, common threats and controls, safe behaviour, intellectual property and data protection. Scenario questions ask you to identify a threat and justify a control.
Core rules and concepts
- Confidentiality limits access; integrity keeps data accurate and unaltered; availability keeps systems accessible.
- Threats: malware including virus, worm, trojan and ransomware; phishing; social engineering; brute force; denial of service; insider misuse.
- Controls: strong unique passwords and MFA, updates, antivirus, firewall, encryption, access rights, backups and staff training.
- Authentication proves identity; authorisation decides what an authenticated user may do.
- Ethics covers acceptable behaviour; law sets legal minimums. Copyright protects expression; plagiarism is passing others’ work as your own; data protection principles limit collection, use and sharing of personal data.
- Backup is a restorable copy; archiving stores data for long-term retention.
Worked example
An email claiming to be from a bank asks you to confirm your password urgently via a link. Red flags: urgency, a password request, a mismatched or suspicious link, and a generic greeting. Do not click; verify through the bank’s official app or phone number; report the message. Reasoning: a legitimate bank does not ask for a password by email. The control is user vigilance plus reporting, supported by MFA and email filtering. If credentials were entered, change the password and notify the bank.
Traps that cost marks
Saying a firewall removes viruses; confusing authentication with authorisation; thinking encryption alone prevents deletion or ensures availability; treating backup and archiving as identical; and calling unethical behaviour illegal without checking the law.