Mission 1 · Spec 3.6.1
Cyber security threats
What cyber security is, the weaknesses attackers exploit, and three kinds of malicious code: viruses, trojans and spyware.
- Starter 5 min
- Learn 10 min
- Lab 15 min
- Quiz 10 min
- Exam 10 min
The weakest link
A company spends millions on security software. An employee finds a USB stick labelled "Salaries 2026" in the car park and plugs it in at work. What could go wrong?
Reveal
The stick could contain malware that runs as soon as it's connected, getting straight past the firewall. Removable media is one of the threats on the spec, and it shows that people are often the weakest part of any system.
Key ideas
Cyber security is the processes, practices and technologies designed to protect networks, computers, programs and data from attack, damage or unauthorised access.
| Threat | What it means |
|---|---|
| Social engineering | Tricking people into giving away information or access (see Mission 2) |
| Malicious code (malware) | Software written to cause harm, steal data or gain access |
| Pharming | Redirecting users from a genuine website to a fake one, even when they type the correct address |
| Weak and default passwords | Easy to guess, or never changed from the manufacturer's setting (e.g. "admin") |
| Misconfigured access rights | Users can see or change data they shouldn't have access to |
| Removable media | USB sticks and external drives can carry malware in, or data out |
| Unpatched / outdated software | Known security holes that haven't been fixed by an update |
Computer virus
Attaches itself to a file or program and spreads when that file is run or shared. Can delete or corrupt data.
Trojan
Malware disguised as legitimate, useful software, so the user installs it themselves.
Spyware
Secretly records what the user does, e.g. keystrokes, and sends it to the attacker, often to steal passwords.
Name that threat
Virus, trojan or spyware?
Exam-style questions
1. Define the term cyber security.
[2 marks]Mark scheme
- Processes / practices / technologies (1)
- designed to protect networks / computers / programs / data from attack / damage / unauthorised access (1)
2. Explain what a trojan is.
[2 marks]Mark scheme
- Malware disguised as legitimate / useful software (1)
- so the user is tricked into installing it themselves (1)
3. Explain why unpatched software is a security risk.
[2 marks]Mark scheme
- It contains known vulnerabilities / security holes (1)
- which attackers can exploit because the fix / update has not been installed (1)
TUTOR NOTES
- Misconception: a trojan spreads by itself. It relies on the user installing it.
- Misconception: pharming and phishing are the same. Pharming redirects you even when you type the right address.
- Exam habit: use the spec's exact names for threats.
- Extension: which threats could a single policy of "install updates automatically" reduce?
Mission 2 · Spec 3.6.1.2
Social engineering
Blagging, phishing and shouldering: attacks on people rather than machines, and how to protect against them.
- Starter 5 min
- Learn 10 min
- Lab 20 min
- Quiz 10 min
- Exam 10 min
The phone call
"Hi, it's Dan from IT. We've spotted a problem with your account and need to reset it urgently. Can you read me the code we've just texted you?" What makes this convincing? What should you do?
Reveal
It uses a believable story, a sense of urgency and apparent authority. This is blagging. Never share codes or passwords; hang up and contact IT using a number you already know.
Key ideas
Social engineering is the art of manipulating people so they give up confidential information or access.
Blagging (pretexting)
Inventing a scenario to persuade someone to give information or do something they wouldn't normally do, often by pretending to be someone in authority.
Phishing
Sending emails or texts that pretend to be from a trusted organisation, to trick people into revealing details or clicking a harmful link.
Shouldering
Watching someone enter a PIN or password, e.g. at a cash machine or on a train. Also called shoulder surfing.
Protection
Staff training; never giving out passwords; checking sender addresses and links; verifying callers independently; covering the keypad; spam filters.
Phishing detective
Click every suspicious part of this email. There are six.Which attack?
Exam-style questions
1. Define social engineering.
[1 mark]Mark scheme
- Manipulating / tricking people into giving away confidential information / access (1)
2. Describe what is meant by phishing and give two ways a user can recognise a phishing email.
[3 marks]Mark scheme
- Emails / messages pretending to be from a trusted source to obtain personal details (1)
- Any two signs: generic greeting, urgent or threatening tone, suspicious sender address, links to unexpected websites, requests for personal details, spelling and grammar errors (1 each, max 2)
3. Explain how a company could reduce the risk of blagging.
[2 marks]Mark scheme
- Train staff to recognise blagging / never give out passwords or information over the phone (1)
- Have procedures to verify a caller's identity, e.g. calling back on a known number (1)
TUTOR NOTES
- Misconception: social engineering needs technical skill. It relies on human psychology.
- Discussion: ask the student for phishing texts they or their family have received.
- Exam habit: "describe" needs what it is and how it works; "explain" needs why.
- Extension: why does training staff reduce all three social engineering attacks?
Mission 3 · Spec 3.6.1.1 & 3.6.2
Detecting and preventing threats
Biometrics, password systems, CAPTCHA, email confirmations and automatic updates, plus penetration testing.
- Starter 5 min
- Learn 10 min
- Lab 15 min
- Quiz 10 min
- Exam 10 min
Hire a burglar
Why might a bank pay someone to try to break into its own building?
Reveal
To find weaknesses before real criminals do. In computing this is penetration testing: authorised, simulated attacks on a system to find vulnerabilities so they can be fixed.
Key ideas
Biometrics
Uses unique physical features (fingerprint, face, iris) to identify a user. Can't be forgotten or easily shared; common on mobile devices.
Password systems
Enforce strong passwords (length, mix of characters), regular changes, and lock accounts after several failed attempts.
CAPTCHA
A test that is easy for humans but hard for computers, to stop automated bots creating accounts or trying passwords.
Email confirmation
Sending a link or code to a user's email address to confirm their identity, e.g. when registering or resetting a password.
Automatic software updates
Install security patches as soon as they're released, closing known vulnerabilities.
Penetration testing
White box: simulates a malicious insider who knows the system. Black box: simulates an external attacker with no inside knowledge.
How strong is that password?
Match the defence
Exam-style questions
1. Describe the purpose of penetration testing, and the difference between white-box and black-box testing.
[3 marks]Mark scheme
- To find vulnerabilities in a system (by simulating attacks) so they can be fixed (1)
- White box simulates a malicious insider with knowledge of the system (1)
- Black box simulates an external attacker with no knowledge of the system (1)
2. Give two advantages of biometric security on a mobile phone compared with a password.
[2 marks]Mark scheme
- Cannot be forgotten (1)
- Difficult to copy / share / guess (1)
- Quicker / more convenient to use (1)
- Max 2
3. Explain why a website uses a CAPTCHA on its sign-up form.
[2 marks]Mark scheme
- To check the user is a human, not an automated program / bot (1)
- To prevent bots creating large numbers of fake accounts / spamming / brute-forcing (1)
TUTOR NOTES
- Misconception: penetration testers are hackers breaking the law. They are authorised by the system's owner.
- Misconception: white box = "good hackers". It's about how much knowledge the tester starts with.
- Lab prompt: compare "dragon" with "Purple-Kettle-Rain-42". Why does length win?
- Extension: what are the privacy concerns of storing biometric data?