- Reading time: 3 minutes
- Price: Free download
- Published: 17th September 2026
- Word count: 829 words
- File format: Text
Why do you want to study this course or subject?
The thing that pulled me towards information security was noticing how often systems fail for reasons that have nothing to do with clever mathematics. At the supermarket where I work on Saturdays, the stockroom door code has not changed since I started, and people say it out loud to each other across the aisle. The lock is fine; the process around it is not. Reading Ross Anderson's Security Engineering in my college library confirmed that this is a serious theme rather than my own pet theory: he keeps returning to incentives, usability and who actually bears the cost when something goes wrong, not only to ciphers. That combination of technical detail and human behaviour is what I want to study properly. I am drawn to the parts of the subject that sit between the two: authentication that people will actually use, logs that someone will actually read, risk decisions made with incomplete information. I also enjoy the adversarial habit of mind it demands. In Maths I am used to proving that something works; security asks me to assume someone is trying to make it not work, and to think about what they would try first and how cheaply. I would like a degree that gives me the underlying computer science, networks, operating systems and cryptography, so that my instincts are built on something firmer than curiosity, and that treats law, ethics and organisational reality as part of the subject rather than an afterthought.
How have your qualifications and studies helped you to prepare?
My A-levels in Mathematics, Computer Science and Physics have each contributed something I expect to use. Maths has been the most demanding and the most useful: proof by contradiction and modular arithmetic made my first attempt at understanding RSA far less mysterious, and probability work has helped me think about why long random passwords resist guessing while memorable substitutions do not. In Computer Science I have worked in Python and studied networking, hashing and file structures. For my programming coursework I built a small library loan tracker with user accounts, and marking my own work honestly meant admitting that I had stored passwords in plain text; rewriting it to use a salted hash taught me more than the original build did. Physics has trained me to estimate, to question whether a number is even the right order of magnitude, and to write up what I did clearly enough for someone else to repeat it. Alongside lessons I completed a free online introduction to cyber security and worked through beginner and easy challenges on a capture-the-flag practice site, mostly web and forensics categories, keeping a notebook of techniques so I am not solving the same problem twice. My college does not have a computing society, so I asked my Computer Science teacher whether I could use a lunchtime slot to show two other students how simple packet inspection works on a home network. Three of us now meet most weeks and take turns choosing a topic.
What else have you done to prepare outside of education, and why are these experiences useful?
My practical experience is homemade rather than professional. I was given a laptop that was too slow for schoolwork, installed Linux on it and used it to build a small test setup: a basic web server on the laptop and a second machine to poke at it from. I deliberately configured a weak login page, tried common attacks against it, then fixed them one at a time and wrote down what changed. It was cheap and limited, but it turned reading into something I could see. I also rented the smallest virtual server I could afford for two months and left it running with logging enabled, which showed me a steady stream of automated login attempts against the default administrative username within hours of it going online. Reading those logs taught me that most hostile traffic is indiscriminate and automatic, not targeted.
At home I set up a password manager for my parents and my aunt, and enabled two-factor authentication on their email. The interesting part was negotiation rather than configuration: my aunt only agreed once I explained recovery codes and wrote the process down in Bengali and English. I have similar patience from helping neighbours read council and utility letters, where the skill is explaining something accurately without making the other person feel foolish.
My supermarket job has given me eighteen months of working to a rota, handling till discrepancies calmly and following procedures that exist for good reasons even when queues are long. Badminton twice a week keeps me sociable and stops me spending every evening at a screen. Together these have taught me to organise my own time, which I know a degree will require.
This example has 4,554 characters across the three answers. Use it for ideas and structure. Your own UCAS answers must fit within 4,000 characters in total, including spaces.
Why this example works — strengths and ways to improve
This is a specific, credible statement whose strongest material connects human behaviour to technical security. The three answers do distinct jobs, and the reflection is usually earned rather than asserted. The main problem is length: at 4,554 characters it exceeds the 4,000-character limit, so cutting weaker closing material matters more than adding anything.
Subject motivation
The lock is fine; the process around it is not.
You ground your motivation in an everyday observation. The Anderson reading then extends it into a real theme of the subject, including incentives, usability and cost. The contrast between proof and adversarial thinking shows you understand what is distinctive about security, which is far stronger than a general claim of passion.
Academic preparation
rewriting it to use a salted hash taught me more than the original build did
Each A-level is tied to a concrete use: modular arithmetic for RSA, probability for passwords and estimation from Physics. The coursework admission is especially effective because it shows you can judge your own work honestly. The lunchtime group adds initiative without overstating your expertise.
Evidence and reflection
Reading those logs taught me that most hostile traffic is indiscriminate and automatic, not targeted.
This is real reflection. You say what you did, what you observed and what changed in your understanding. The test setup paragraph does the same. Reflection is thinner at the end, where 'organise my own time' is a generic skill claim rather than an insight drawn from evidence.
Relevant experience
The interesting part was negotiation rather than configuration
Setting up security for your family is ordinary but excellent evidence. It links directly back to your opening interest in usability and human behaviour, and the bilingual written instructions are a precise, credible detail. The neighbours' letters example is a looser connection and repeats the same point about patient explanation.
Credibility and voice
My practical experience is homemade rather than professional.
Your voice is modest and plausible for a school applicant. Attacking only your own configured systems keeps the practical work clearly legitimate. You could say this explicitly in a few words, since admissions readers in security value ethical awareness. Nowhere do you sound like a qualified professional, which is exactly right.
Structure and format
Badminton twice a week keeps me sociable and stops me spending every evening at a screen.
Each answer clears 350 characters, and the evidence is not duplicated across answers. However, the total is about 550 characters over the 4,000 limit. Your final paragraph and the neighbours' sentence are the weakest material and the most obvious candidates for cutting. The closing note about character counts is not part of the statement and should not be submitted.
What you’ve done well
- Your opening supermarket observation sets up a theme of people and process that recurs coherently through the reading, the coursework and the family security setup.
- The plaintext password admission and the virtual server logs show honest self-assessment and learning from direct observation, rather than claimed skills.
- The tone stays proportionate throughout, presenting cheap homemade projects as genuine preparation without inflating them.
How this draft could improve
- Cut roughly 550 characters to fit within 4,000. Start by condensing the final paragraph, keeping only one sentence on the job's procedural discipline, and removing the neighbours' letters link.
- Replace 'taught me to organise my own time' with a brief reflection connected to security, or drop it. Do not substitute another generic skill claim.
- Consider one short clause stating that you tested only systems you owned. This makes your ethical awareness visible, which fits your stated interest in law and ethics.