Key Terms
- Defensive design: Writing code that anticipates and handles errors, misuse, and invalid input
- Input validation: Checking that data meets requirements before processing it
- Input sanitisation: Removing or neutralising dangerous characters from input
- Authentication: Verifying the identity of a user (e.g. username and password)
- Maintainability: Writing code that is easy for others to read, understand, and update
Must-Know Facts
- Defensive design assumes users will enter incorrect or malicious data
- Validation checks data is acceptable; sanitisation removes dangerous content
- Comments explain complex logic so other programmers can maintain the code
- Meaningful variable names (e.g.
customerAgenotx) improve readability - Indentation makes code structure clear and reduces errors
- Using subprograms and constants also improves maintainability
Key Concepts
- Memory aid: VSCAM — Validate, Sanitise, Comments, Anticipate misuse, Maintainable
- Limit login attempts to anticipate brute-force misuse
- Use constants for fixed values so they are easy to update in one place
- Sanitisation prevents SQL injection and cross-site scripting (XSS) attacks
Common Mistakes
- Confusing validation and sanitisation: Validation checks data meets rules; sanitisation removes or neutralises dangerous characters — both are needed but do different things
- Saying comments slow programs down: Comments are ignored by the compiler/interpreter and have no effect on execution speed — they only improve human readability
- Using variable names like x or temp as "defensive": Meaningful variable names (e.g.
customerAge) are a core feature of defensive design — vague names make code harder to maintain and debug - Forgetting maintainability as part of defensive design: Defensive design is not just about security — comments, indentation, and meaningful names all make code easier to maintain and update safely
- Treating authentication as only a security issue: Authentication (verifying user identity) is also part of defensive design — it prevents unauthorised access to program features
This topic summary covers Knowledge Organiser: Defensive Design within Defensive Design for GCSE Computer Science. Revise Defensive Design in 3.2 Programming for GCSE Computer Science with 15 exam-style questions and 8 flashcards. This is a high-frequency topic, so it is worth revising until the explanation feels precise and repeatable. It is section 6 of 6 in this topic. Use this topic summary to connect the idea to the wider topic before moving on to questions and flashcards.
Practice questions for Defensive Design
What is the purpose of input validation in a program?
Describe three different types of validation check, giving an example of each.
Quick recall flashcards
What is authentication?
Verifying a user's identity before granting access to a system
Why use comments?
To explain code so others can understand and maintain it