Ethical Hacking
This unit covers ethical hacking phases, vulnerability identification, testing, and legal/ethical issues. Learners must understand how to find and fix vulnerabilities in systems and networks.
Assessment criteria
Topic Overview
The SEG Awards Level 5 Diploma in Software Engineering with Cyber Security focuses on the practical application of secure software development principles. This topic covers the entire software development lifecycle (SDLC) with a strong emphasis on integrating security measures from the outset. Students learn to design, build, test, and deploy software systems that are resilient against common cyber threats, such as SQL injection, cross-site scripting (XSS), and buffer overflows. The curriculum aligns with industry standards like OWASP Top 10 and ISO 27001, ensuring graduates are equipped to handle real-world security challenges in software engineering roles.
This topic is crucial because modern software must be secure by design, not as an afterthought. With cyber attacks becoming more sophisticated, employers demand developers who can write code that is both functional and secure. The diploma bridges the gap between traditional software engineering and cyber security, teaching students to conduct threat modelling, implement secure authentication, and perform security testing. By mastering these skills, students can pursue careers as secure software developers, penetration testers, or security architects, making them highly valuable in the job market.
Within the wider subject of Computer Science, this topic sits at the intersection of software engineering and cyber security. It builds on foundational programming concepts and introduces specialised security frameworks. Students will apply theoretical knowledge from network security and cryptography to practical software projects, ensuring they understand how to protect data at rest and in transit. This holistic approach prepares students for the CompTIA Security+ certification and other industry-recognised qualifications.
Key Concepts
Core ideas you must understand for this topic
- →Secure SDLC: Integrating security into every phase of the software development lifecycle, from requirements gathering to maintenance, using methodologies like Agile with security sprints.
- →Threat Modelling: Identifying potential threats using frameworks like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) and mitigating them early.
- →OWASP Top 10: Understanding and defending against the most critical web application security risks, including injection, broken authentication, and sensitive data exposure.
- →Secure Coding Practices: Implementing input validation, output encoding, parameterised queries, and proper error handling to prevent vulnerabilities like SQL injection and XSS.
- →Security Testing: Conducting static application security testing (SAST), dynamic application security testing (DAST), and penetration testing to identify and fix vulnerabilities.
Learning Objectives
What you need to know and understand
- 1. Understand the phases in ethical hacking and the approaches available to a cyber security professional2. Know how to identify and evaluate vulnerabilities in computer systems, networks and web applications 3. Be able to test and find solutions to vulnerabilities in computing systems, networks and web applications4. Be able to analyse legal, social, ethical and professional issues in ethical hacking
Assessment Criteria
Key criteria assessors look for in your portfolio
- Understand the phases of ethical hacking.
- Identify and evaluate vulnerabilities in systems and networks.
- Test and find solutions to vulnerabilities.
- Analyse legal, social, ethical, and professional issues.
Assessment Guidance
Guidance for achieving higher grades
- 💡Use penetration testing tools in a lab environment.
- 💡Stay updated on current cybersecurity threats and laws.
- 💡Always justify your security choices with reference to industry standards like OWASP or ISO 27001. Examiners look for evidence that you understand why a particular control is appropriate.
- 💡When answering questions about vulnerabilities, describe both the impact and the mitigation. For example, explain how SQL injection can lead to data breaches and how parameterised queries prevent it.
- 💡Use real-world examples to illustrate your points, such as the 2017 Equifax breach caused by unpatched software. This shows you can apply theory to practice.
Common Mistakes
Common errors to avoid in your coursework
- Confusing ethical hacking with malicious hacking.
- Failing to obtain proper authorisation before testing.
- Misconception: Security is only the responsibility of the security team. Correction: Every developer must adopt a security mindset; secure coding is a shared responsibility throughout the SDLC.
- Misconception: Using HTTPS alone makes an application secure. Correction: HTTPS only encrypts data in transit; vulnerabilities like SQL injection or insecure deserialisation still exist in the application layer.
- Misconception: Penetration testing after deployment is sufficient. Correction: Security should be integrated from the start; post-deployment testing may miss design flaws that are costly to fix later.
Frequently Asked Questions
Common questions students ask about this topic
Pass / Merit / Distinction Evidence Checklist
How your portfolio evidence is graded for SEG AWARDS Ethical Hacking
Every vocational unit is marked against named criteria rather than an exam percentage. Your tutor's brief lists the exact codes for this unit — here is what each band is asking you to do.
Demonstrate baseline knowledge, accurate terminology, and core practical application.
Provide detailed analysis, structured explanations, and clear workplace reasoning.
Deliver thorough evaluation, original problem solving, and fully justified recommendations.
Before You Start
Prior knowledge that will help with this topic
- •Basic programming skills in at least one language (e.g., Python, Java, or C#) to understand code-level vulnerabilities.
- •Understanding of networking fundamentals, including TCP/IP, HTTP/HTTPS, and firewalls, as many attacks exploit network protocols.
- •Familiarity with databases and SQL to grasp injection attacks and secure database design.
Coursework AI Review
Paste your assignment brief and check your draft against its P/M/D criteria
Key Terminology
Essential terms to know
- 1. Understand the phases in ethical hacking and the approaches available to a cyber security professional2. Know how to identify and evaluate vulnerabilities in computer systems, networks and web applications 3. Be able to test and find solutions to vulnerabilities in computing systems, networks and web applications4. Be able to analyse legal, social, ethical and professional issues in ethical hacking
Ready to learn?
AI-powered learning tailored to this unit