The guide names three, and they do different jobs. Mixing them up is the easiest mark to lose in this topic.
The three methods
Encryption
Scramble the data with a key so only someone with the right key can read it. The data is still there, and it comes back exactly as it was.
Data masking
Replace real values with realistic fake ones, so a system can be tested or shown to staff without anyone seeing a real person's details.
Data erasure
Destroy the data so it cannot be recovered. Deleting a file usually just forgets where it was; erasure overwrites it.
Lock it · fake it · destroy it
Free preview
This is the free notes preview
You're reading the free notes. Aimnova Pro unlocks the full study experience — and you can try it with your first topic free to keep:
- FlashcardsLock in vocabulary and key terms with spaced repetition.
- Practice questionsAnswer exam-style questions and get instant AI marking.
- Mock exams & past-paper vaultSit full mocks and see exactly how examiners award marks.
- Personalised study planA daily plan built around your exam date and weak areas.
A blockchain is a shared record that many computers each hold a copy of, where every new entry is linked to the one before it. Changing an old entry would break every link after it, and everyone would see.
What it does protect
- Whether a record has been changed since it was written
- Whether everyone is looking at the same history
- Agreement without anyone having to be trusted
What it does not
- Whether what was written was true in the first place
- Privacy — a public chain is public
- Your key: lose it and the record stays, your access does not
The exam-friendly line: Blockchain makes a record hard to change. It does nothing about whether the record was right when it was made.
Stop wasting time on topics you know
Our AI identifies your weak areas and focuses your study time where it matters. No more overstudying easy topics.
Both of these went wrong at the same place: not clever code, but a basic control that nobody had kept up.
Real-world examples you can name
The Colonial Pipeline ransomware attack — May 2021
A ransomware group reached the company's network through a single reused password on an old VPN account. The company shut the pipeline down for several days as a precaution, causing fuel shortages along the US east coast, and paid a ransom of which US authorities later recovered part.
Who it affected: Drivers and airports across the eastern United States.
WannaCry and the NHS — May 2017
Ransomware spread through a Windows flaw for which a patch already existed, encrypting files and demanding payment. In England it disrupted around a third of hospital trusts; roughly 19,000 appointments and operations were cancelled.
Who it affected: Patients whose care was postponed, and organizations running unpatched systems.
What examiners like about these: Neither was beaten by advanced technology. One reused password and one unapplied patch \u2014 which is why “human and organizational” beats “technical” as an answer about why security fails.
How this is tested — you have to pick the right protection for the situation and say why the others would not do. It comes up two ways:
Paper 1 — structured question
- Part a: describe how encryption protects a transaction
- Part b: explain a measure an organization should take
Paper 2 — source-based question
- Q1: read security measures off a source
- Q2: explain how a source describes a breach
The trap: answering “encryption” to everything: Encryption protects data in transit and at rest. It does nothing about a developer needing realistic test data \u2014 that is masking \u2014 or about a laptop being thrown away \u2014 that is erasure.
Describe how encryption protects an online payment.
Model answer plan
See the mark-by-mark plan — for / against / judgement, with marking guidance — in study mode.
Suggest two measures a hospital could take to protect patient records.
Model answer plan
See the mark-by-mark plan — for / against / judgement, with marking guidance — in study mode.