Some attacks target computers: guessing passwords, flooding servers, planting malware. Others target people: a convincing email or a friendly phone call. For each threat you need to describe how it is carried out and what the attacker is trying to achieve.
A cyber security threat is any attempt to damage, steal or gain unauthorised access to data or computer systems. For every threat, an exam answer needs the process (how the attack is carried out) and the aim (what the attacker wants). Some threats attack the technology: brute-force attacks, data interception, DDoS attacks, hacking and malware. Others attack people or redirect them: phishing, pharming and social engineering.
These three threats are about getting at data without permission. In the lab, pick each threat to see how it works, then try the password tester to see how fast a brute-force attack cracks short passwords.
| Threat | Process | Aim |
|---|---|---|
| Brute-force attack | Software tries every possible combination of characters (or a list of common passwords) until the right password is found | To find a password and gain access to an account or system |
| Data interception | Data is captured as it is transmitted, e.g. a packet sniffer reads packets on a network, or a hacker picks up an unsecured wireless signal | To steal data such as passwords, card numbers or personal details |
| Hacking | Gaining unauthorised access to a computer system, often by exploiting weaknesses in its security | To steal, delete, change or corrupt data, or to damage the system |
"Hacking is when someone gets your data" is too vague. Say unauthorised access to a computer system, and give an aim such as stealing or deleting data.
A DDoS attack stops a service working; malware is software written to cause harm. The syllabus names six types of malware, and you must be able to tell them apart.
| Malware | Process | Aim |
|---|---|---|
| Virus | Attaches itself to another program or file; replicates when the infected file is run | To delete or corrupt files, or make the computer malfunction |
| Worm | A standalone program that replicates itself and spreads across a network on its own, with no user action | To spread to as many computers as possible, using up bandwidth and often carrying other malware |
| Trojan horse | Disguised as useful, legitimate software; once installed it runs harmful code, often opening a backdoor | To install other malware or give the attacker access to the computer |
| Spyware | Secretly monitors the user's activity, e.g. logs keystrokes, and sends the data to a third party | To steal passwords, bank details and other personal data |
| Adware | Floods the user with unwanted adverts and pop-ups, and may redirect the browser to advertising sites | To make money from adverts; can also slow the computer |
| Ransomware | Encrypts the user's files so they cannot be opened, then displays a demand for payment | To extort money in exchange for the decryption key |
A virus needs a host file and is spread when that file is run; a worm is standalone and spreads itself across networks. Do not use "virus" as the word for all malware.
Four quick checks. Each correct answer earns XP and records this skill on your profile.
What is a brute-force attack?
In the lab's password tester, what happens to the cracking time as the password gets longer?
Which malware replicates itself across a network without any user action?
Which threat redirects a user to a fake website even when they type the correct URL?
These attacks aim at the user rather than the hardware. The lab's phishing email lets you practise spotting the warning signs.
| Threat | Process | Aim |
|---|---|---|
| Phishing | The attacker sends an email or message that appears to come from a trusted organisation, with a link to a fake website where the user is asked to enter details | To steal personal data such as login details or bank details |
| Pharming | Malicious code installed on the user's computer, or on a DNS server, redirects the user to a fake website even when they type the correct URL | To steal personal data entered into the fake website |
| Social engineering | Manipulating people into breaking normal security procedures, e.g. a phone call pretending to be IT support, or leaving an infected USB stick for someone to plug in | To obtain confidential information or get access to a system |
Phishing needs the user to click a link in a message. Pharming needs no click: the user types the right address and is still redirected by malicious code.
Unlocks once the four checks above are done. Worth more XP, written to IGCSE Paper 1 standard.
What is the main aim of a DDoS attack?
Which malware is disguised as legitimate software?
A user receives an email that appears to be from their bank, asking them to click a link and confirm their password. What is this?
Which malware records a user's keystrokes and sends them to a third party?
This skill is now recorded on your profile. Keep the chain going.