IGCSE ICT: Safety and Security — Revision Notes

Safety and security in Cambridge IGCSE ICT 0417 (Topic 8) has three separate parts: physical safety around ICT equipment, eSafety when using the internet and personal data, and the security of data against threats such as hacking and phishing. Paper 1 questions usually ask you to name a threat or hazard, explain its effect and give a matching way to prevent it.

Condensed for revision. For the full explanation, use the safety and security study guide, then try the safety and security practice questions.

Syllabus coverage

Syllabus ref	Content
8.1 Physical safety	Electrocution, fire, tripping over trailing cables, heavy equipment falling; causes and prevention
8.2 eSafety	Principles of a typical data protection act; personal and sensitive data; eSafety for internet, email, social media and online gaming
8.3 Security of data	Threats: hacking, phishing, pharming, smishing, vishing, viruses, malware, card fraud (shoulder surfing, card cloning, key logging). Protection: biometrics, digital certificate, SSL, encryption, firewall, two-factor authentication, user ID and password

8.1 How do you prevent physical safety hazards?

Every answer needs the hazard, its cause and a matching prevention.

Hazard	Cause	Prevention
Electrocution	Spilling drinks near equipment; touching live or bare cables	No drinks near computers; check and replace damaged cables; keep covers on equipment
Fire	Overloaded sockets; equipment overheating	Do not overload sockets; keep vents clear and use cooling or fans; have a CO2 fire extinguisher nearby
Tripping	Trailing cables across the floor	Use cable ducts or covers; route cables along walls; use wireless connections
Injury from falling equipment	Heavy equipment on weak desks or near edges	Use strong, stable desks; place equipment away from edges

8.2 What does eSafety cover?

Data protection

Data protection legislation is needed because organisations hold large amounts of personal data that could be misused, lost or disclosed. Principles of a typical data protection act — data must be:

1. Processed fairly and lawfully.
2. Used only for the purpose it was collected for.
3. Adequate, relevant and not excessive.
4. Accurate and kept up to date.
5. Not kept longer than necessary.
6. Processed in line with the data subject’s rights.
7. Kept secure.
8. Not transferred to another country without adequate protection.

Personal and sensitive data

Personal data identifies a living person: name, address, date of birth, a photograph in school uniform. Sensitive data such as medical history could cause more harm if disclosed. Both must be kept confidential to avoid inappropriate disclosure, which could lead to identity theft, fraud or someone being located.

Minimising danger online

Context	Safe practice named in the syllabus
Internet	Use trusted websites recommended by teachers; use a search engine that only allows age-appropriate websites
Email	Be aware of the danger of opening or replying to email from an unknown person; be aware of the risk of sending personal identifiable data or images
Social media	Block and report unwanted users; do not meet online contacts face to face; do not distribute inappropriate images or use inappropriate language; respect other people’s personal data
Online gaming	Do not use your real name; do not give out personal or financial data

8.3 What are the threats to data?

Threat	What it is	Prevention
Hacking	Unauthorised access to a computer system to view, change or delete data	Firewall; strong user IDs and passwords; two-factor authentication; encryption
Phishing	Legitimate-looking email that tricks the user into clicking a link to a fake site and entering personal details	Do not click links in unexpected emails; check the sender and URL; look for spelling errors
Pharming	Malicious code installed on a computer or server redirects the user to a fake website even when the correct address is typed	Anti-malware; check for https and a valid certificate; check the URL
Smishing	Phishing by SMS text message	Do not follow links or call numbers in unexpected texts
Vishing	Phishing by voice call or voicemail	Do not give details on the phone; call the organisation back on its official number
Virus	Program that copies itself and can delete or corrupt files or make the computer crash	Anti-virus software kept up to date; do not open files from unknown sources; scan downloads
Malware	Any malicious software (viruses, spyware, ransomware and so on)	Anti-malware; only download from trusted sites; keep software updated
Card fraud	Shoulder surfing (watching a PIN being entered), card cloning (copying card data with a skimmer), key logging (recording keystrokes)	Shield the keypad; check card readers; contactless or chip cards; anti-spyware; on-screen keyboards or drop-down menus for passwords

How is data protected?

Method	Purpose
Biometrics	Uses unique physical features (fingerprint, face, iris, voice) to identify a user; cannot be forgotten or easily shared
Digital certificate	Proves a website is genuine. Contains the owner’s name, a serial number, expiry date, the owner’s public key and the digital signature of the certificate authority
SSL	Creates an encrypted link between the server and the client computer; shown by https and a padlock
Encryption	Scrambles data so it is meaningless without the decryption key; used on hard discs, email, cloud storage and HTTPS websites
Firewall	Monitors traffic between a computer/network and the internet and blocks traffic that does not meet set criteria
Two-factor authentication	Needs two different types of proof, for example a password plus a one-time code sent to a phone
User ID and password	User ID identifies the user; the password authenticates them. Strong passwords mix upper and lower case, digits and symbols and are changed regularly

Key point: encryption does not stop data being intercepted or stolen; it makes the stolen data unreadable.

Worked example: matching threat to defence

An online shop’s customers receive an email saying their account is locked, with a link to “log in and unlock”. The link opens a copy of the shop’s login page.

• Threat: phishing (an email trick), not pharming (no redirect was caused by malicious code).
• Advice: do not click the link; type the shop’s address yourself; check for https and a valid certificate; report the email.

Common mistakes and exam traps

• Confusing phishing (user is tricked into clicking a link) with pharming (user is redirected without clicking anything suspicious).
• Writing “anti-virus” as the answer to every threat. Match each defence to the threat.
• Saying a firewall removes viruses. It filters traffic; it does not clean files.
• Stating a hazard without its cause, or a prevention that does not match the hazard (for example “take breaks” for a fire risk).
• Treating eSafety as data security. eSafety is about protecting the person; data security is about protecting the data.

Frequently asked questions

What is the difference between phishing, smishing and vishing? All three trick a person into giving personal details. Phishing uses email, smishing uses SMS text messages and vishing uses voice calls.

What does a digital certificate contain? It includes the owner’s name, a serial number, an expiry date, the owner’s public key and the digital signature of the certificate authority that issued it. It lets a browser check that a website is genuine.

Why is data protection legislation needed? Organisations hold personal and sensitive data that could be lost, misused or disclosed. The law sets principles so that data is used fairly, kept accurate and secure, and not kept longer than needed.

Does SSL stop hacking? No. SSL encrypts data travelling between the client and the server, so intercepted data cannot be read. It does not stop someone getting into the server.

Self-test

1. Give the cause and prevention of one fire hazard.
2. Name two items of personal data and one item of sensitive data.
3. State two eSafety rules for online gaming.
4. Describe card cloning.
5. Explain the purpose of two-factor authentication.

Answers: 1 overloaded socket, do not plug too many devices in (or overheating, keep vents clear); 2 any two of name, address, date of birth, photo in uniform, plus medical history; 3 do not use your real name, do not give out personal or financial data; 4 copying the data from a card’s magnetic stripe with a skimmer to make a fake card; 5 a second, different proof is needed, so a stolen password alone does not give access.

Official syllabus

Cambridge International, Cambridge IGCSE Information and Communication Technology (0417) syllabus for 2026, 2027 and 2028, Version 3, Topic 8 “Safety and security” (8.1–8.3).