Unit 3 - The Evolution of Threats to Digital Platforms and the Skills Required to Counter These Threats
Overview
Assessor's guide to interpreting the criteria
General Information
RQF general description for Level 2 qualifications
- Achievement at RQF level 2 (EQF Level 3) reflects the ability to select and use relevant knowledge, ideas, skills and procedures to complete well-defined tasks and address straightforward problems. It includes taking responsibility for completing tasks and procedures and exercising autonomy and judgement subject to overall direction or guidance.
-
Use understanding of facts, procedures and ideas to complete well-defined tasks and address straightforward problems. Interpret relevant information and ideas. Be aware of the types of information that are relevant to the area of study or work.
-
Complete well-defined, generally routine tasks and address straightforward problems. Select and use relevant skills and procedures. Identify, gather and use relevant information to inform actions. Identify how effective actions have been.
-
Take responsibility for completing tasks and procedures subject to direction or guidance as needed.
Requirements
-
Standards must be confirmed by a trained Gold Level Assessor or higher.
-
Assessors must at a minimum record assessment judgements as entries in the on-line mark book on the INGOTs.org certification site.
-
The work in the unit is recommended in order for candidates to have covered enough depth and breadth in the topic to successfully carry out their controlled assessment and take the external exam.
-
When the candidate has covered as much of ths material as necessary to complete the controlled assessment element, they may be introduced to the topic
-
This unit should take an average level 2 learner 25 hours of work to complete.
Assessment Method
This unit will be assessed synoptically via a controlled assessment and also through an external examination.
Expansion of the assessment criteria
1. Candidates will understand the different risks associated with online digital material
1.1 I can understand that digital material is a valuable commodity
1.2 I can appreciate that digital material can be stolen if unprotected or badly managed
into digital crimes.
1.3 I can describe the ways that digital material is threatened
the issues.
not need to go into a great deal of detail, just to show that they are aware of the way that people can get data for illegal activities.
acceptable to listen to illegally streamed music and films, or be using pirated software, knowingly or otherwise. It is also a good time to
discuss plagiarism and copyright in terms of stealing IP (Intellectual Property).
1.4 I can detail the ways that digital material can be protected
earlier.
Learners will list some of the protection mechanisms they have discovered and depending on the audience they can either present it
as a report, as a presentation or even as part of their extended project. Some areas they should show knowledge and understanding of will be:
- personal: training of workers
- software: https vs http, encryption, SSL
- hardware: firewall, IDS
- organisation: AUP, security protocols
What kind of training do people need in order to prevent fraud and crime happening to them. What knowledge of software and hardware is generally required to be safe online and are there simpleways to protect these elements. What can organisations do in order
to protect themselves.
It might be useful for students to have a talk from the network team on what is being done to protect their data and how the learners
themselves can help in that process, if it is not already covered in a school induction process.
1.5 I can explain the different types of threat currently in action
Learners will discuss their understanding of how the threats operate and their main characteristics. Many of these are in the news every
day so there should be no shortage of source material, but they will need to summarise it in a form that others can understand and
appreciate.
- Online fraud
- Scareware
- Identity Theft
- IP Theft
- Espionage
- Loss of customer data
- Online theft from companies
- Extortion
- Fiscal Fraud
It might be useful for learners to put these into a table that they can use in other presentations and documents.
Name of Threat | Main Characteristics | Prevention Techniques | Potential Damage |
---|---|---|---|
Online fraud |
Email or phone calls etc, or fake websites used to collect information such as bank details |
Check where email comes from, not clicking on links, use only trusted websites, filter phone calls | Loss of money |
Loss of customer data |
Carelessness: leaving company laptop on train |
More care Damage Auto switch off Training |
Damage to company reputation, being fired from job |
1.6 I can explain the threats to my personal safety from online activity
minimise them. This could be as a report.
2. Candidates will plan, create and deploy systems and processes to minimise threats
2.1 I can detail the processes I use to protect my digital material
also diagram how they protect themselves at home from potential attacks.
![](/community/sites/default/files/uploads/user4107/Basic%20network.jpg)
2.2 I can describe the systems I use to protect my digital material
Protocols they will have working knowledge of will include:
- Bluetooth
- SMS
- http and https
- wireless
- NFC
Learners will describe in detail the hardware they use to protect themselves from online threats. In most cases this will be some kind
of home based firewall. What are the attributes that make it work for them. What are the key features that protect their data from being
stolen and how would they know if it was?
2.3 I can describe the nature of different threats
Learners will illustrate their understanding with detailed examples and commentary. What makes something a threat rather than just
an annoyance? Do they have examples of threats that have occurred to them they can define and describe. Have they received
bogus emails asking them for money from a bank they don’t have an account with. Why would anyone respond to these? What it is about
these that make them effective? What are some of the statistics about online fraud and threat that they can use to back up their
descriptions.
2.4 I can describe a working system that protects my digital material
Learners can use the diagram they created for 2.1 and add in some detail about how each piece is protecting them or exposing them to
threats if not properly configured or maintained.
2.5 I can explore alternative methods to prevent future attacks on my digital material
of software and hardware to the ones they currently use.
unworkable because it is too secure?
2.6 I can explain how different types of online activity bring with them a variety of risks to personal data and security
presented in person or as a report. Candidates need to be aware that they may not even be aware of some threats like this.
3. Candidates will analyse and apply tools and systems to minimise threats to digital material
3.1 I can analyse the latest hardware technologies to prevent attacks on digital material
equipment.
reasoned judgements, backed by their statements, about what kinds of technologies are the most appropriate. Are we at the point where
all home require hardware based firewall appliances? With more and more of our internal lives networked with IoT (Internet of Things)
devices like smart heating monitors and smart devices, are the simplistic firewalls that are part of home broadband routers enough
to protect our privacy? How do you know when someone is logged in to your Wi-Fi system and using it for other purposes. How well do
you understand the setup and use of a DMZ (Demilitarised Zone) on your home network. What ports are vulnerable and exploitable. If
large companies and banks struggle, what chance do we have at home?
features and prices.
3.3 I can analyse the latest software technologies to prevent attacks on digital material
equipment.
As above, what systems do they have in place to protect their own environment and how good are they at what they do. How do you
know they are working as well as they should. How do you keep track of the latest updates to software patches and exploits that have
been found.
As with the hardware, learners can compile a report to compare and contrast the different offerings in terms of suitability, features and
cost. What services are in place for software and hardware from your own ISP (Internet Service Provider).
3.3 I can evaluate the current threats to my personal digital material and explain which offer the greatest risks
occurring.
Learners will comment on these findings to demonstrate their level of understanding and to inform their actions.
Operating systems have some of their own built in protection which can be used as a second way of understanding what is happening to
your network and therefore your digital material. The following is a log file from a software system on Linux called Fail2Ban which
detects unwanted attacks and bans them from trying for several minutes. When they try again later they will be ignored and
eventually go away.
This is on a home based server running a DMZ. On the router itself, most users should have some security logs which can be examined.
The following image is an attack on a web server software trying to run a script which might be there to exploit.
Learners should be able to give some examples of what threats they face from various areas, as well as threats created by bad habits
such as staying logged in on the school network, sharing passwords with friends or using public Wi-Fi systems.
3.4 I can evaluate the best methods of protection and recommend protocols to minimise the threat of attacks
Learners will develop a working protocol for their own protection or recommend one for others.
A protocol is a set of rules that need to be followed to achieve a particular goal. In this case, it would be useful if learners could create a set of rules and guidelines to be followed. This could be for their own home, their school, or for a local company.
3.5 I can recommend systems to enhance security
Learners will collect their findings in order to support these recommendations.
This material can be used as part of the presentation for 2.6. If they are working for a local company as a client, or as part of their
extended project they should have some specific details, though these may need to be anonymised to protect the company. This is a
collation of all their findings and understanding as well as practical demonstrations of what they have discovered and what constitutes
best practice.
3.6 I can provide cogent advice to other users about being safe online
and then to use this to report on improvements. They could also do this as a short video, perhaps loaded onto a video display system.
be able to help others, even if this is pointing them towards resources such as CEOP.