← Years 9–10 Digital Systems

Security controls: prevent, detect, respond

A measure that reduces risk by preventing an attack, detecting it or helping recovery. Controls can be technical, physical or procedural, and layering several works best.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 77, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 80, VCE Data Analytics - U4O1 - Development and Evaluation — Module 42, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 37, IGCSE Computer Science 0478 — 5.3 Cyber Security — Module 48, ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 34, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 82, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 48, WA Computer Science ATAR Year 11 — Cyber Security — Module 130

Understanding Security controls: prevent, detect, respond in Years 9–10 Digital Systems

What it does: An alert on repeated failed logins detects a possible password-guessing attack so someone can respond. This mixes physical, technical and recovery controls, so if one fails the others still protect the system. A firewall stops attacks before they get in, so it prevents. Recovery controls like backups help after something has gone wrong. Controls reduce risk but can never remove it completely, which is why we use several. Cameras are a physical control that detect and record. They do not encrypt anything, and a lock would be the preventive option. Procedural controls are rules and steps that people follow. Antivirus is a technical control.

Common mistakes: A lock stops people getting in, so it prevents the attack. It does not just detect it. The line should be purpose ← prevent. An audit log records what happened so problems can be spotted later. It detects attacks but does not stop them. The line should be purpose ← detect.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Security controls: prevent, detect, respond to a class →

This module's key terms are also in a printable crossword (Modules 70–79) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A firewall that blocks suspicious traffic is mainly which type of control?
Preventive controlRecovery control
Matches
Threat: phishing emails. Control: server room lock
↓
The control does not match the threat. A physical lock does not stop phishing emails. Use email filtering or staff training instead.
Applying
Meanings
Term
security control
Meaning
A measure that reduces risk by preventing an attack, detecting it or helping recovery. Controls can be technical, physical or procedural, and layering several works best.
Practice
threat ← "stolen password"
Testing
Gaps
purpose =
Check Answer
Spots
3threat ← unauthorised entry
4purpose ← detect

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Viperfish' badge — Deep Debugger, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A firewall that blocks suspicious traffic is mainly which type of control?
A. Preventive control ✓
B. Recovery control
A firewall stops attacks before they get in, so it prevents. Recovery controls like backups help after something has gone wrong.
2. Which statement about a security control is correct?
A. It is a measure that reduces risk ✓
B. It is a measure that removes all risk
Controls reduce risk but can never remove it completely, which is why we use several.
3. A school's CCTV cameras record who enters the server room. What do they mainly do?
A. Encrypt the data on the servers
B. Detect and record unauthorised entry ✓
Cameras are a physical control that detect and record. They do not encrypt anything, and a lock would be the preventive option.
4. Which of these is a procedural control?
A. Antivirus software that scans files
B. A rule that staff must report suspicious emails ✓
Procedural controls are rules and steps that people follow. Antivirus is a technical control.
5. A business keeps regular backups of its files. Which job does this control do best?
A. Help recovery after ransomware ✓
B. Stop ransomware reaching the computer
Backups do not stop an attack. They help you recover and get your data back afterwards.

Match the Pairs

Firewall blocks unknown traffic → A technical control that prevents attacks by stopping unwanted connections before they reach the network
Daily backup to offline storage → A control that helps recovery by letting you restore data after ransomware or a failure
A detective control spots an attack that is happening or has already happened → Alert on 5 failed logins
Layering controls means using several different types so one failure does not leave you exposed → Door lock + CCTV + password + backup
Threat: phishing emails. Control: server room lock → The control does not match the threat. A physical lock does not stop phishing emails. Use email filtering or staff training instead.
We installed antivirus, so no other controls are needed → Relying on one control is risky because it can fail or be bypassed. Layer several controls, such as updates, MFA and backups.

Key Term

security control
A measure that reduces risk by preventing an attack, detecting it or helping recovery. Controls can be technical, physical or procedural, and layering several works best.

Fill in the Blanks

1. control = "firewall" type = "technical" purpose = prevent
Hint: Type the purpose word for stopping an attack before it gets in.
2. control = "access log review" type = "procedural" purpose = detect
Hint: Type the purpose word for spotting that an attack is happening or has happened.
3. control = "restore from backup" type = "procedural" purpose = recover
Hint: Type the purpose word for getting systems and data back to normal after an attack.
4. control = "locked server room" type = physical purpose = "prevent"
Hint: Type the control type for protecting real-world equipment, such as locks and doors.
5. firewall = 1 mfa = 1 layers = firewall + mfa
Hint: Type the operator that adds the two controls together to count the layers.

Spot the Error

Question 1
A control ← server room lock
B type ← physical
C threat ← unauthorised entry
D purpose ← detect
Line D — A lock stops people getting in, so it prevents the attack. It does not just detect it. The line should be purpose ← prevent.
Question 2
A control ← audit log
B purpose ← prevent
C type ← technical
D threat ← account misuse
Line B — An audit log records what happened so problems can be spotted later. It detects attacks but does not stop them. The line should be purpose ← detect.
Question 3
A control ← daily backup
B type ← technical
C purpose ← prevent
D threat ← ransomware
Line C — A backup does not stop ransomware, but it lets you restore your files afterwards. It helps recovery. The line should be purpose ← recover.
Question 4
A threat ← phishing email
B control ← server room lock
C type ← procedural
Line B — A server room lock does nothing against phishing emails. The control must match the threat, so staff training is the right choice.
Question 5
A control ← security guard
B type ← technical
C purpose ← prevent
Line B — A security guard is a person controlling access to a place, so this is a physical control, not a technical one. The line should be type ← physical.

Student with a class code? Join your class →