Mission 1 · Spec 1.4.1
Threats to computer systems
Malware, brute-force attacks, denial of service, data interception and SQL injection: what they are and what they aim to do.
- Starter 5 min
- Learn 15 min
- Lab 10 min
- Quiz 10 min
- Exam 10 min
The ransom note
A hospital's computers suddenly display: "Your files are encrypted. Pay £500,000 in cryptocurrency to get them back." What kind of attack is this, and what might the consequences be?
Reveal
This is ransomware, a type of malware. Operations could be cancelled and patient records lost. This is why organisations need backups, anti-malware and up-to-date software.
Forms of attack
| Threat | How it works | Aim |
|---|---|---|
| Malware | Malicious software such as viruses, worms, trojans, spyware and ransomware | Delete or corrupt data, steal information, lock files for ransom |
| Social engineering | Manipulating people, e.g. phishing (see Mission 2) | Get passwords, personal or financial details |
| Brute-force attack | Automated software tries huge numbers of password combinations | Gain access to an account |
| Denial of service (DoS) | Floods a server with so many requests that it can't respond to genuine users | Make a website or service unavailable |
| Data interception and theft | Data is captured as it travels across a network, e.g. using packet-sniffing software | Steal usernames, passwords or personal data |
| SQL injection | SQL code is typed into a website's input box. If the site doesn't validate input, the database may run it | Reveal, change or delete data in the database |
You need to know what SQL injection is and how to prevent it (input validation, parameterised queries), not how to carry one out. Attacking systems you don't own is a criminal offence.
Name that attack
Exam-style questions
1. Describe what is meant by a denial of service attack.
[2 marks]Mark scheme
- A server / network is flooded with a huge number of requests (1)
- so it cannot respond to legitimate users / the service becomes unavailable (1)
2. Explain what SQL injection is and one way to prevent it.
[3 marks]Mark scheme
- SQL code is entered into an input field on a website (1)
- which is then run by the database, allowing data to be accessed / changed / deleted (1)
- Prevention: input validation / sanitisation / parameterised queries / limit database access levels (1)
TUTOR NOTES
- Misconception: brute force means physical force.
- Misconception: DoS steals data. It stops a service working.
- Exam habit: say what the attack does and what the attacker gains.
Mission 2 · Spec 1.4.1
Social engineering
Why people are the weak point in secure systems, and how to spot phishing.
- Starter 5 min
- Learn 10 min
- Lab 15 min
- Quiz 10 min
- Exam 10 min
The phone call
"Hi, it's IT support. We need your password to fix a problem with your account urgently." What makes this convincing? What should you do?
Reveal
Urgency and apparent authority. Never give out passwords; IT staff don't need them. Hang up and contact IT on a number you know. Attacks that target people instead of machines are social engineering.
Key ideas
People as the weak point
Even the best security fails if someone gives away their password, clicks a malicious link or lets a stranger into the building.
Phishing
Fake emails or texts that appear to come from a trusted organisation, designed to trick people into giving personal details or clicking a malicious link.
Other methods
Pretending to be someone on the phone (blagging), shoulder surfing, leaving infected USB sticks around.
Prevention
Staff training; spam filters; never sharing passwords; checking links and sender addresses; verifying requests independently.
Phishing detective
Click every suspicious part of this email. There are six, including one in the header.Exam-style questions
1. Explain why people are often described as the weak point in a secure system.
[2 marks]Mark scheme
- People can be tricked / manipulated / make mistakes (1)
- e.g. giving away passwords or clicking malicious links, which bypasses technical security (1)
2. Describe two features that could help a user identify a phishing email.
[2 marks]Mark scheme
- Any two: generic greeting; urgent / threatening language; suspicious sender address; links to unexpected websites; requests for personal details; spelling / grammar errors (1 each)
TUTOR NOTES
- Discussion: ask for real phishing texts the student or family have received.
- Exam habit: relate every sign to why it's suspicious.
Mission 3 · Spec 1.4.2
Identifying and preventing vulnerabilities
Penetration testing, anti-malware, firewalls, user access levels, passwords, encryption and physical security.
- Starter 5 min
- Learn 10 min
- Lab 20 min
- Quiz 10 min
- Exam 10 min
Layers of defence
A castle has a moat, walls, guards, locked doors and a safe. Why so many layers?
Reveal
If one layer fails, the others still protect what matters. Networks use the same approach: firewalls, passwords, access levels, encryption and physical locks all together.
Prevention methods
Penetration testing
Authorised people attempt to break into a system to find weaknesses, so they can be fixed before real attackers find them.
Anti-malware software
Scans files and memory for known malware, quarantines or removes it, and must be kept up to date.
Firewalls
Monitor incoming and outgoing traffic and block anything that breaks a set of rules.
User access levels
Users can only access the files and settings they need for their role, limiting the damage if an account is misused.
Passwords
Strong passwords, account lockout after failed attempts, and two-factor authentication defend against brute-force attacks.
Encryption
Scrambles data with a key, so intercepted data can't be understood.
Physical security
Locks, key cards, CCTV and security staff stop people getting physical access to servers and devices.
Match threat to defence
Password strength
Encryption in action
Exam-style questions
1. Explain how user access levels help to protect a network.
[2 marks]Mark scheme
- Users can only access the data / resources they need for their role (1)
- so sensitive data is protected / damage is limited if an account is compromised or misused (1)
2. A company is worried about brute-force attacks on its staff accounts. Describe two methods it could use to prevent them.
[4 marks]Mark scheme
- Strong password rules (1): long passwords with a mix of character types, so there are too many combinations to try (1)
- Account lockout (1): after a set number of failed attempts, so guessing is stopped (1)
- Two-factor authentication (1): a code is also needed, so a guessed password alone isn't enough (1)
- Max 4
3. What is the purpose of penetration testing?
[2 marks]Mark scheme
- To find vulnerabilities in a system by simulating an attack (1)
- so they can be fixed before a real attacker exploits them (1)
TUTOR NOTES
- Misconception: a firewall removes viruses. It filters traffic; anti-malware removes malware.
- Exam habit: match each defence to the specific threat it stops.