Learn
5.3.1 | CYBER SECURITY
01 | WHAT ARE WE PROTECTING?
Cyber security concerns protecting systems, networks and data against unauthorised access, misuse and disruption.
Three useful ideas are confidentiality, keeping information from unauthorised readers; integrity, preventing or detecting unauthorised changes; and availability, keeping services accessible when needed.
A threat can affect more than one. Stealing a password can expose data, changing records damages integrity, and overwhelming a service reduces availability.
For this lesson, learn each threat’s process and aim. The next lesson focuses on protective measures.
02 | BRUTE-FORCE ATTACK
A brute-force attack systematically tries possible credentials or keys until one is accepted or a useful result is found.
Process: many candidate passwords are tested rather than obtaining the correct password directly. The attacker aims to discover a working credential and gain unauthorised access.
Scenario: an account receives repeated failed login attempts using different guesses. This is consistent with password guessing, although the pattern alone may not establish the exact method.
The number of possibilities, allowed attempt rate and system protections affect feasibility. Do not describe brute force as a guaranteed instant success.
03 | DATA INTERCEPTION
Data interception means obtaining data while it is being transmitted. An attacker may seek private messages, credentials or other sensitive information.
Process: someone in a position to observe communication captures the traffic. Unprotected content may be readable; encrypted content cannot simply be read as plaintext without defeating the relevant protection.
Scenario: login details are sent through an unencrypted connection and captured by an unauthorised observer.
Interception concerns data in transit. Stealing a file directly from a storage device is a different route to obtaining data.
04 | DISTRIBUTED DENIAL OF SERVICE
A distributed denial-of-service (DDoS) attack uses multiple sources to overwhelm or exhaust a target’s resources, preventing legitimate users from receiving the service.
Coordinated traffic or requests
↓ Consume available capacity
Bandwidth or processing resources become exhausted
↓ Legitimate users are affected
Slow responses or failed access
Compromised devices forming a botnet can be used as sources. Distributed describes the use of multiple sources, not a requirement that every user’s device is infected.
The central aim is disruption, not necessarily stealing data. A popular site becoming slow is not, by itself, proof of an attack.
05 | HACKING IN THE THREAT CONTEXT
In this syllabus’s threat context, hacking means gaining unauthorised access to a system or data.
An attacker may exploit a weakness or use compromised credentials. Their aim may be to view, steal, alter or delete data, or misuse the system.
Scenario: someone accesses a school account without permission and changes stored records.
Not all activity described informally as hacking is malicious: authorised security testing is different. Here, make the lack of permission clear in your explanation.
06 | MALWARE: THE UMBRELLA TERM
Malware is software designed to cause harm, perform unauthorised actions or compromise a system. Virus, worm, Trojan horse, spyware, adware and ransomware are categories named in the specification.
These categories can overlap. A malicious program can use one method to enter or spread and perform several harmful actions afterwards.
Do not use “virus” as a precise label for every kind of malware. Explain the defining behaviour.
07 | VIRUS AND WORM
| Type | Defining behaviour | Possible aim / effect |
|---|---|---|
| Virus | Attaches to or infects a host file or program; replication depends on the infected host being executed | Spread infection and alter, damage or misuse data/systems |
| Worm | Self-replicates and spreads between systems without needing to attach to a host file | Spread automatically, consume resources or deliver other malicious functions |
A virus can spread when infected software runs. A worm can propagate using network communication or other suitable pathways.
Neither label tells you every final effect. Different viruses or worms can perform different actions. Both can spread without the user understanding what is happening.
08 | TROJAN HORSE
A Trojan horse disguises malicious functionality as, or within, apparently useful or legitimate software.
Process: the victim is persuaded to install or run something that appears desirable. The hidden malicious function then acts, for example stealing data or allowing unauthorised access.
Scenario: a supposed game utility includes an undisclosed credential-stealing component.
A Trojan is defined by deception, not self-replication. It can install other malware, but does not need to replicate to be a Trojan.
09 | SPYWARE AND ADWARE
| Type | Process | Aim / effect |
|---|---|---|
| Spyware | Secretly or improperly monitors activity and collects information | Obtain data such as browsing activity or typed information |
| Adware in the malware context | Displays unwanted advertising and may alter browsing behaviour or collect activity | Generate advertising income, redirect attention or track behaviour |
A keylogger is one possible spyware function, recording input such as keystrokes. Not every spyware program uses a keylogger.
Not all advertising-supported software is malware. The syllabus threat is unwanted, deceptive or unauthorised adware behaviour.
10 | RANSOMWARE
Ransomware restricts access to data or a system and demands payment or another concession. It commonly encrypts files so the victim cannot use them normally.
Process: malicious software runs, locks or encrypts resources and presents a demand. Some attackers also steal data and threaten disclosure.
Aim: extort the victim. A demand does not guarantee that payment would restore access.
Ransomware describes the extortion behaviour; it may reach the system through another technique such as a deceptive download.
11 | PHISHING
Phishing uses deceptive messages or communications that imitate a trusted source to make a person disclose information or take an unsafe action.
Process: a message claims to come from a school, bank or delivery service and urges the user to follow a link, enter details, open an attachment or approve a request.
Scenario: “Your school account expires today” directs a student to a fake login page. The attacker aims to collect credentials or trigger another harmful action.
Phishing can arrive by email, text or other communication. A personalised message or urgent tone can make the deception more persuasive.
12 | PHARMING
Pharming redirects a user towards a fraudulent destination by manipulating address-resolution information or related configuration.
Process: a user enters an expected address, but altered DNS information or a changed local mapping sends the connection towards the wrong destination.
Aim: make the victim interact with a fake service, often to obtain sensitive information.
HTTPS certificate checking is another protection layer: being redirected to a different server does not automatically guarantee that a valid secure connection for the intended host will succeed.
13 | SOCIAL ENGINEERING
Social engineering manipulates people into revealing information or taking actions that compromise security.
The attacker can exploit trust, urgency, fear or authority rather than relying only on a technical weakness.
Scenario: someone claims to be support staff and asks a user to disclose a one-time login code or approve a sign-in.
Phishing is a form of social engineering. Social engineering is broader and can also occur through a phone call or face-to-face conversation.
14 | COMPARE THE CONFUSING PAIRS
| Pair | Key distinction |
|---|---|
| Phishing / pharming | Phishing uses a deceptive communication; pharming manipulates the route or resolution to a fraudulent destination |
| Virus / worm | Virus infects a host file/program; worm self-replicates without needing a host-file attachment |
| Trojan / virus | Trojan disguises malicious functionality; virus is defined by its infection and replication mechanism |
| Interception / hacking | Interception obtains transmitted data; hacking here concerns unauthorised access |
| DDoS / data theft | DDoS primarily disrupts availability; data theft obtains information |
Developed answer: a phishing message imitates a trusted organisation and directs the user to enter credentials, resulting in disclosure to the attacker. It is not enough to write “a fake email” without the mechanism and aim.
15 | COMMON MISTAKES
- Every malware program is a virus: identify the specific behaviour.
- DDoS must steal passwords: its primary effect is service disruption.
- A Trojan must self-replicate: disguise is its defining feature.
- Phishing and pharming are identical: distinguish message deception from manipulated redirection.
- Social engineering is only technical code: it targets human decisions.
- Encryption makes every intercepted packet readable: it protects content against unauthorised reading.
- A slow website proves DDoS: symptoms can have other causes.