Cambridge IGCSE ICT (0417): Safety and security – Study Guide

Topic 8 of Cambridge IGCSE ICT 0417 covers three related but different ideas. Physical safety (8.1) is about keeping people safe from the equipment. eSafety (8.2) is about protecting personal data and keeping people safe when they use the internet, email, social media and online games. Security of data (8.3) is about the threats to data and the methods that protect it. A common cause of lost marks is blending these together, so keep the three headings separate in your revision.

What does the 0417 syllabus require in Topic 8?

Syllabus ref	What you must know
8.1 Physical safety	Electrocution, fire, tripping over trailing cables, heavy equipment falling; the causes of each and strategies for preventing them
8.2 eSafety	The principles of a typical data protection act and why the law is needed; personal and sensitive data and why they must be kept confidential; minimising danger when using the internet, email, social media and online gaming
8.3 Security of data	Threats: hacking, phishing, pharming, smishing, vishing, viruses, malware, card fraud (shoulder surfing, card cloning, key logging). Protection: biometrics, digital certificate, secure socket layer (SSL), encryption, firewall, two-factor authentication, user ID and password

This is the full list from the 2026–2028 syllabus. The Network Issues and Communication study guide covers the network side of the same ideas.

8.1 What are the physical safety hazards and how are they prevented?

Physical safety questions ask for a hazard, its cause and a way of preventing it. Give all three for full marks.

Hazard	Cause	Prevention
Electrocution	Spilling drinks near electrical equipment; touching live or bare cables	Ban drinks and food near computers; check cables regularly and replace damaged ones; keep covers on equipment
Fire	Sockets overloaded with too many plugs; equipment overheating	Do not overload sockets; keep vents clear and use fans or cooling; keep a CO2 fire extinguisher nearby
Tripping	Trailing cables across the floor	Use cable ducts or covers; route cables along walls; use wireless connections where possible
Injury from heavy equipment falling	Heavy devices placed on weak desks or near the edge	Use strong, stable desks; place equipment away from edges

A CO2 (carbon dioxide) extinguisher is used for electrical fires because water conducts electricity. Physical safety (harm from equipment) is different from health problems such as back or eye strain, which belong with the effects of using IT.

8.2 What is eSafety and why is data protection needed?

Why is data protection legislation required?

Organisations hold large amounts of personal data. Without rules it could be collected unfairly, used for other purposes, kept out of date, lost, or disclosed to people who should not see it. A data protection act gives people rights over their data and places duties on the organisations that hold it.

What are the principles of a typical data protection act?

Data must be:

1. Processed fairly and lawfully.
2. Used only for the purpose it was collected for.
3. Adequate, relevant and not excessive.
4. Accurate and kept up to date.
5. Not kept longer than necessary.
6. Processed in line with the data subject’s rights.
7. Kept secure.
8. Not transferred to another country unless that country gives it adequate protection.

The syllabus says “a typical” act, so learn the principles rather than the name of one country’s law.

What is the difference between personal and sensitive data?

Personal data identifies a living person: for example name, address, date of birth or a photograph of a student in school uniform (the uniform reveals the school). Sensitive data is personal data that could cause greater harm if disclosed, such as medical history. Both must be kept confidential and protected to avoid inappropriate disclosure, which could lead to identity theft, fraud, discrimination or a person being located.

How do you minimise the danger of using the internet, email, social media and online gaming?

Context	Safe practice named in the syllabus
Internet	Only use trusted websites recommended by teachers; use a search engine that only allows access to age-appropriate websites
Email	Be aware of the danger of opening or replying to an email from an unknown person; be aware of the risk of sending personal identifiable data or images by email
Social media	Know how to block and report unwanted users; be aware of the danger of meeting an online contact face to face; do not distribute inappropriate images; do not use inappropriate language; respect the confidentiality of other people’s personal data
Online gaming	Do not use your real name; do not give out personal or financial data

When a question gives a scenario, choose the row that fits it. “A student plays games online” needs the gaming row, not general advice about email.

8.3 What are the threats to data?

Threat	What it is	How to help prevent it
Hacking	Gaining unauthorised access to a computer system to view, change or delete data	Firewall; strong user IDs and passwords; two-factor authentication; encryption so stolen data is unreadable
Phishing	A legitimate-looking email that tricks the user into following a link to a fake website and entering personal details	Do not click links in unexpected emails; check the sender’s address and the URL; look for spelling errors and urgent demands
Pharming	Malicious code on a computer or server redirects the user to a fake website even when the correct address is typed	Anti-malware software; check for https and a valid certificate; check the URL in the address bar
Smishing	Phishing by SMS text message	Do not follow links or call numbers in unexpected texts
Vishing	Phishing by voice call or voicemail	Do not give details on the phone; call the organisation back on its official number
Virus	A program that copies itself and can delete or corrupt files or make the computer crash	Up-to-date anti-virus software; scan downloaded files; do not open files from unknown sources
Malware	Any malicious software, of which viruses are one type	Anti-malware; only download from trusted sites; keep software updated
Card fraud	Stealing card details by shoulder surfing (watching a PIN being entered), card cloning (copying the card’s data with a skimmer to make a duplicate) or key logging (software that records keystrokes)	Shield the keypad; check card readers for skimmers; use chip or contactless payment; anti-spyware; on-screen keyboards or drop-down boxes for passwords

The syllabus asks specifically how to avoid infecting a computer from a downloaded file: download only from trusted sources, scan the file with up-to-date anti-virus before opening it, and do not run executable attachments from unknown senders.

Phishing versus pharming is the most common trap: in phishing the user is tricked into acting (clicking a link); in pharming the user is redirected without doing anything wrong.

8.3 How is data protected?

Method	Purpose and how it works
Biometrics	Identifies a user from unique physical features (fingerprint, face, iris, voice). Cannot be forgotten or easily shared, but the equipment costs more and recognition can fail, for example with a cut finger
Digital certificate	Proves that a website is genuine. Contains the owner’s name, a serial number, an expiry date, the owner’s public key and the digital signature of the certificate authority that issued it
Secure socket layer (SSL)	Sets up an encrypted link between the server and the client computer, so data sent between them cannot be read if intercepted; shown by https and a padlock
Encryption	Scrambles data so it is meaningless without the decryption key. Used to protect data on hard discs, in email, in cloud storage and on HTTPS websites
Firewall	Monitors traffic between a computer or network and the internet and blocks traffic that does not meet set criteria
Two-factor authentication	Requires two different types of proof, for example a password plus a one-time code sent to a phone, so a stolen password alone does not give access
User ID and password	The user ID identifies the user and the password authenticates them. Strong passwords mix upper and lower case, digits and symbols, are not shared and are changed regularly

Encryption does not stop data being intercepted or a system being hacked; it makes the data useless to anyone without the key. A firewall filters traffic; it does not remove viruses. Make these distinctions in “explain” questions.

Worked example: a scenario answer

A clinic stores patient records (sensitive data) on a network. A strong answer to “describe how the clinic can keep the data secure” might say: staff log in with a user ID and a strong password, plus two-factor authentication; a firewall blocks unauthorised traffic from the internet; patient files on the hard discs are encrypted so stolen data is unreadable; the clinic’s booking website uses SSL with a valid digital certificate so patients can see it is genuine; and staff are trained not to follow links in unexpected emails (phishing). Each method is linked to a purpose, which is what gains the marks.

Worked example: why longer passwords help

An 8-character password made only of lower-case letters has 26 to the power 8 = 208 827 064 576 possible combinations. Allowing upper case, lower case and digits (62 possibilities per character) gives 62 to the power 8 = 218 340 105 584 896, about 1 045 times more. This illustrates why the syllabus’s strong-password advice works: a mix of character types makes guessing far slower.

Common mistakes

• Giving “use anti-virus” for every threat without naming what threat it counters.
• Mixing up phishing (user tricked into clicking) with pharming (user redirected silently).
• Saying that a firewall removes viruses.
• Describing a hazard without its cause, or a precaution without the risk it reduces.
• Saying that encryption or SSL prevents hacking. They protect the data, not the system.
• Listing data protection principles as rules for the user (“don’t share your password”). The principles are duties on the organisation holding the data.

Exam technique

State and give need a short answer. Describe needs the feature plus what it does. Explain needs a reason. Always match the answer to the scenario and use the syllabus’s own terms: eSafety, phishing, pharming, smishing, vishing, card cloning, digital certificate, SSL, encryption, firewall.

Frequently asked questions

What is the difference between personal data and sensitive data in 0417? Personal data identifies a living person, such as a name, address, date of birth or a photo in school uniform. Sensitive data, such as medical history, could cause more serious harm if disclosed. Both must be kept confidential.

What does a digital certificate contain? The owner’s name, a serial number, an expiry date, the owner’s public key and the digital signature of the certificate authority. A browser uses it to check that a website is genuine.

Is SSL the same as encryption? SSL uses encryption to create a secure link between a client and a server. Encryption is the wider idea and is also used for data stored on hard discs, in email and in the cloud.

How do you prevent card fraud? Shield the keypad against shoulder surfing, check card readers for skimmers used in card cloning, and use anti-spyware and on-screen keyboards against key logging.

Check your understanding

1. Give the cause and prevention of one electrocution hazard. Spilling drinks near equipment; ban drinks near computers.
2. State two principles of a typical data protection act. Any two, e.g. kept accurate and up to date; not kept longer than necessary.
3. Give one item of sensitive data. Medical history.
4. State two eSafety rules for online gaming. Do not use your real name; do not give out personal or financial data.
5. Distinguish between phishing and pharming. Phishing tricks a user into following a link in a fake message; pharming redirects the user to a fake website automatically.
6. Describe card cloning. Copying the data on a card with a skimmer to make a duplicate card.
7. Why does two-factor authentication improve security? An attacker needs a second, different proof, such as the user’s phone, as well as the password.
8. Give two places where encryption protects data. Any two of hard discs, email, cloud storage, HTTPS websites.

Related pages

• Safety and Security revision notes
• Safety and Security practice questions

Official syllabus

Cambridge International, Cambridge IGCSE Information and Communication Technology (0417) syllabus for 2026, 2027 and 2028, Version 3, Topic 8 “Safety and security” (8.1–8.3).