This subtopic equips learners with the fundamental knowledge and practical skills to identify, minimise, and manage common IT security risks. It focuses on
Topic Synopsis
This subtopic equips learners with the fundamental knowledge and practical skills to identify, minimise, and manage common IT security risks. It focuses on understanding threats such as malware, phishing, and social engineering, and applying appropriate safeguards like strong passwords, regular updates, and secure browsing practices to protect both personal and organisational data.
Key Concepts & Core Principles
- File management: understanding how to save, organise, and retrieve files using appropriate naming conventions and folder structures.
- Word processing: creating, formatting, and editing documents, including using styles, tables, and mail merge.
- Spreadsheets: entering data, using basic formulas (SUM, AVERAGE), and creating charts to represent information visually.
- Safe internet practice: recognising secure websites, protecting personal data, and understanding copyright and plagiarism.
- Presentation software: designing slides with consistent themes, adding multimedia elements, and delivering effective presentations.
Exam Tips & Revision Strategies
- In portfolio evidence, always annotate screenshots to explain what you did, why you did it, and how it addresses a specific security risk.
- Use real-world examples or scenarios to demonstrate understanding, such as describing a phishing email you identified and the steps taken to handle it safely.
- Show the process step-by-step, including before and after comparisons, to clearly evidence the application of security methods.
- Reference the IT Security for Users learning outcomes in your reflective accounts to ensure all criteria are explicitly met.
- Review your organisation’s IT security policy (if applicable) and relate your actions to it, demonstrating contextual understanding.
Common Misconceptions & Mistakes to Avoid
- Confusing different types of malware (e.g., virus, worm, trojan) and incorrectly attributing their effects.
- Believing that having anti-virus software alone is sufficient, neglecting other essential measures like regular updates and safe browsing habits.
- Reusing passwords across multiple accounts or using easily guessable passwords, failing to apply strong password principles.
- Clicking on links or opening attachments in unsolicited emails without verifying their legitimacy, even after training on phishing risks.
- Ignoring the importance of software updates and not recognising them as a critical security measure against vulnerabilities.
Examiner Marking Points
- Award credit for clearly identifying at least three distinct common security risks and explaining their potential impact on systems and data.
- Assess for demonstrable selection and correct application of appropriate security methods, such as creating a strong password, updating anti-virus software, or recognising a phishing email.
- Look for practical evidence, such as annotated screenshots or written accounts, showing the implementation of security controls (e.g., firewall activation, safe browsing settings).
- Credit should be given for explaining why chosen security methods are appropriate for safeguarding specific systems or data in given scenarios.