Connecting a computer to a network or the internet opens it up to malware, hackers and tricks such as phishing and pharming. For each threat you need to say what it is, what harm it does, and which measure reduces the risk and how.
A network lets threats reach a computer from anywhere. Malware is software written to cause harm: a virus copies itself into other files and can delete or corrupt data; spyware secretly records what the user does, such as key presses, and sends it to a third party. Hackers gain unauthorised access to a system. Phishing uses a genuine-looking email to lure the user to a fake website; pharming installs code or alters DNS so the user is redirected to a fake website even when the correct address is typed. Each threat is reduced by a matching measure: firewall, anti-virus, anti-spyware, passwords and access rights, and encryption.
Fig. 1: defence in depth: each layer stops threats the outer layers missed
Section 01
Threats from the network.
In the lab, match each threat with the defences that work against it, test some passwords, then find the giveaway signs in a phishing email.
Threat
What it is
Possible harm
Virus
Malware that attaches itself to other files or programs and replicates when they are run
Deletes or corrupts data, fills storage, makes the computer crash or run slowly
Spyware
Malware that secretly monitors the user, for example logging key presses, and sends the data to a third party
Passwords, bank details and personal data are stolen
Hacker
A person who gains unauthorised access to a computer system
Data is read, stolen, changed or deleted; malware is planted
Phishing
An email or message that appears to come from a trusted organisation, with a link to a fake website
The user types in log-in or bank details, which go to the criminal
Pharming
Malicious code on the user's computer, or a corrupted DNS server, redirects the user to a fake website
As phishing, but the user typed the correct URL so has no clue to spot
Examiner trap
Phishing and pharming are easy to mix up. In phishing the user has to click a link in a message; in pharming the user types the genuine address and is redirected without doing anything wrong.
Section 02
From one PC to a network.
The syllabus asks for measures that protect anything from a single stand-alone PC up to a network of computers. Describe how each one works, not just its name.
Firewall: hardware or software between a computer or network and the internet. It examines every packet coming in and going out and blocks traffic that breaks a set of rules (for example from a blocked IP address or to a blocked port).
Anti-virus software: scans files and memory, comparing them with a database of known virus signatures and looking for suspicious behaviour (heuristics); infected files are quarantined or deleted. The database must be updated regularly.
Anti-spyware software: detects and removes spyware, and can block it from being installed or from sending data out.
User accounts and passwords: only authorised users can log in; strong passwords, changed regularly, with the account locked after a number of failed attempts.
Access rights: on a network each user or group gets only the rights they need (no access, read-only, read/write) to each file or folder.
Software updates and user training: updates patch security holes that hackers use; training teaches users to spot phishing emails and not to open unknown attachments.
Threat
Main measures
Virus
Anti-virus software, firewall, not opening unknown attachments
Spyware
Anti-spyware software; on-screen keyboards or drop-down menus so key presses reveal nothing
Hacker
Firewall, strong passwords, access rights, encryption of the data
Phishing
Check the sender and the URL before clicking; spam filters; user training
Pharming
Anti-malware software; check the website's digital certificate and the https padlock
Worked example Describe a measure
Describe how a firewall helps protect a school network from hackers. [3]
It sits between the school network and the internet, and all traffic passes through it.
It examines each incoming and outgoing packet and checks it against a set of rules (criteria), such as allowed IP addresses and ports.
Packets that do not meet the rules are blocked, so unauthorised access attempts from outside are stopped (and it can log them).
Answer: Position, inspection against rules, blocking: one mark each.
Your turn
A user's bank password was stolen even though she only ever typed it on the genuine bank website. Name the most likely threat and one measure that would have helped.
Spyware (a key logger) recorded her key presses. Anti-spyware software, or the bank using drop-down boxes to pick characters so key presses reveal nothing.
Stage 1 · Learn
Check what the sim just showed you
Four quick checks. Each correct answer earns XP and records this skill on your profile.
Quick check+10 XP
What makes pharming different from phishing?
Quick check+10 XP
In the lab's password test, which change makes a password hardest to crack by brute force?
Quick check+10 XP
Which software compares files with a database of known signatures?
Quick check+10 XP
Which threat secretly records a user's key presses?
Section 03
Protect the data itself.
Measures against the system's attackers may fail, so the data needs its own protection. Two methods are named in the syllabus: encryption and access rights.
Encryption: plaintext is turned into ciphertext using an algorithm and a key. If data on a stolen laptop or intercepted in transmission is encrypted, it is meaningless without the key.
Access rights: stop users reading or changing data they do not need, so a single compromised or careless account cannot damage everything.
Backups: regular copies, kept in a different place, so data lost to malware, hardware failure or deletion can be restored.
Physical measures: locked server rooms and keeping devices out of public view protect a stand-alone PC as well as a network.
Worked example Matching measure to risk
A sales team carries customer data on laptops. Suggest a measure for each risk: (a) a laptop is stolen, (b) a junior employee deletes the customer file by mistake.
(a) The thief has the physical device, so a firewall or password alone may be bypassed: encrypt the hard disk so the data cannot be read without the key.
(b) The employee is an authorised user, so encryption does not help: give junior staff read-only access rights to the file, and keep backups so it can be restored.
Answer: (a) encryption; (b) access rights plus backups.
Examiner trap
Do not offer "anti-virus" or "firewall" as the answer to every threat. Match the measure to the threat, and explain how that measure stops that threat.
Stage 2 · Exam
Exam-style questions
Unlocks once the four checks above are done. Worth more XP, written to AS Paper 1 and Paper 2 standard.
Finish the four checks above to unlock the exam questions
Exam style+20 XP
Which statement about a firewall is correct?
Exam style+20 XP
An employee clicks a link in an email that looks as if it is from the company's IT department and types in a password. Which threat is this?
Exam style+20 XP
Why must anti-virus software be updated regularly?
Exam style+20 XP
A laptop holding customer records is stolen. Which measure best protects the records?
Skill unlocked
Threats and protection, matched.
This skill is now recorded on your profile. Keep the chain going.