Objectives: Students should be able to —
- 1 Define the term cyber security and explain its importance.
- 2 Describe the various types of cyber security threats including malware, phishing, brute force, DoS and social engineering.
- 3 Distinguish between viruses, worms, trojans, spyware and ransomware.
- 4 Explain how phishing, brute force and Denial of Service (DoS) attacks work.
- 5 Describe social engineering techniques used to manipulate users.
- 6 Explain the role of firewalls in protecting networks.
- 7 Distinguish between symmetric and asymmetric encryption.
- 8 Discuss the use of passwords, biometrics and anti-malware software as security measures.
- 9 Evaluate user access levels and automatic software updates as prevention methods.
Introduction to Cyber Security
Cyber security is the protection of computer systems, networks, devices and data from unauthorised access, attack, damage or theft.
It is important because:
- More and more sensitive data (bank details, medical records, personal information) is stored and transmitted online.
- An increasing number of devices (phones, laptops, IoT, smart TVs) are connected to the internet.
- Cyber attacks can cause huge financial loss, identity theft and damage to a company's reputation.
- National infrastructure (power grids, hospitals, transport) depends on secure computer systems.
| Term | Meaning |
|---|---|
| Vulnerability | A weakness or flaw in a system that could be exploited (e.g. outdated software, weak password). |
| Threat | A potential danger that can exploit a vulnerability (e.g. a hacker, a virus, a flood). |
| Attack | The actual act of exploiting a vulnerability to cause harm (e.g. a phishing email being sent, a brute force attempt). |
Example:
An outdated operating system (vulnerability) could be targeted by a hacker (threat) who sends ransomware to encrypt files (attack).
Cyber Security Threats
Malware (Malicious Software) is any software deliberately written to harm, exploit or gain unauthorised access to a computer system or network.
| Type | Description |
|---|---|
| Virus | Attaches itself to a host file. Spreads when the infected file is run by the user. Needs a host program to attach itself to. |
| Worm | Self-replicating program that spreads across networks without needing a host file or user action. |
| Trojan | Disguises itself as a useful/legitimate program but contains hidden malicious code. Does not self-replicate. |
| Spyware | Secretly monitors user activity (keystrokes, browsing) and sends the data to a third party without the user's knowledge. |
| Ransomware | Encrypts the user's files and demands a payment (ransom) in exchange for the decryption key. |
Common effects of malware:
- Loss or corruption of data
- Theft of personal information (passwords, bank details)
- Slow system performance
- Unauthorised access and control of the computer
Phishing is a type of social engineering attack in which the attacker sends fraudulent emails (or messages) that appear to come from a legitimate organisation (bank, online store, government). The email tricks the user into revealing sensitive information such as usernames, passwords or credit card details, often by clicking a fake link to a counterfeit website.
Typical signs of a phishing email:
- Generic greeting ("Dear Customer") instead of your name
- Spelling or grammatical mistakes
- Urgent or threatening tone ("Account will be closed in 24 hours")
- Suspicious links that do not match the official website address
- Requests for sensitive information
Pharming is a more sophisticated attack where the attacker redirects a user from a legitimate website to a fraudulent one — even if the user types the correct URL. This is done by modifying the DNS (Domain Name System) server or the hosts file on the victim's computer.
A Brute Force Attack is a method used by hackers to crack passwords or encryption keys by trying every possible combination of characters (letters, digits, symbols) until the correct one is found.
This is usually done automatically using special software that can try thousands of combinations per second.
Prevention methods:
- Use strong passwords — long, with a mix of upper/lower case, numbers and symbols.
- Lock the account after a certain number of failed attempts (account lockout).
- Introduce a delay between login attempts.
- Use CAPTCHA to verify a human, not a bot, is logging in.
- Implement two-factor authentication (2FA) — a second code is required even if the password is cracked.
A Denial of Service (DoS) attack is an attack in which a hacker floods a server, website or network with so many requests that it becomes overwhelmed and stops responding to legitimate users.
Effect:
The website/service becomes very slow or completely unavailable, causing loss of business and reputation.
A Distributed Denial of Service (DDoS) attack is a more powerful version of DoS where the attack comes from many different computers at the same time.
These computers are usually botnets — large groups of infected machines (called "zombies") controlled remotely by the hacker without the owners' knowledge.
Social engineering is the art of manipulating people into performing actions or revealing confidential information, by exploiting human psychology rather than breaking into computer systems.
It is based on the fact that humans are often the weakest link in the security chain.
Common techniques:
- Phishing — fraudulent emails pretending to be from a trusted source.
- Shoulder surfing — looking over someone's shoulder to watch them enter a password or PIN.
- Blagging (pretexting) — inventing a believable scenario (e.g. "I'm from IT support, I need your password to fix the server") to extract information.
- Tailgating / Piggybacking — following an authorised person through a secure door without their consent.
- Dumpster diving — searching through a company's rubbish to find documents with sensitive information.
(a) SQL Injection:
An SQL injection is an attack in which the hacker inserts (injects) malicious SQL commands into the input fields (login forms, search boxes) of a website. If the website does not properly validate the input, these commands are executed by the database — letting the attacker view, modify or delete data.
(b) Man-in-the-Middle (MITM) attack:
A Man-in-the-Middle attack occurs when a hacker secretly intercepts (and possibly alters) the communication between two parties who believe they are talking directly to each other. The attacker can read, modify or insert data into the conversation.
(c) Prevention methods:
| Attack | Prevention |
|---|---|
| SQL Injection | Input validation / sanitisation; using parameterised queries; limiting database user privileges. |
| MITM | Use HTTPS / TLS encryption; use a VPN; avoid public Wi-Fi for sensitive transactions; verify digital certificates. |
Methods to Keep Data Secure
A firewall is a hardware device or software program that acts as a barrier between a trusted internal network (or a single computer) and an untrusted external network (such as the internet).
How a firewall works:
- It inspects every packet of data entering or leaving the network.
- It compares the data against a set of rules defined by the network administrator.
- If the data matches an "allowed" rule, it is allowed through.
- If the data matches a "blocked" rule (or no rule), it is blocked.
Firewalls can block:
- Unauthorised incoming connections (hackers trying to break in).
- Suspicious outgoing traffic (malware trying to send data out).
- Access to specific websites, IP addresses or ports.
Encryption is the process of converting readable data (plaintext) into an unreadable form (ciphertext) using an algorithm and a key, so that only authorised parties can read it.
Decryption is the reverse process — converting the ciphertext back to plaintext using a key.
| Feature | Symmetric Encryption | Asymmetric Encryption |
|---|---|---|
| Number of keys | One (shared secret key) | Two (public + private key pair) |
| Key used | Same key for encryption and decryption | Public key encrypts, private key decrypts |
| Speed | Fast | Slow (complex maths) |
| Key distribution | Difficult — sender and receiver must share the secret key securely first | Easy — public key can be shared openly; private key is never sent |
| Example | AES, DES | RSA |
Example:
If plaintext = HELLO and key = shift by 3 (Caesar cipher), then ciphertext = KHOOR.
A strong password should:
- Be at least 8–12 characters long (longer is better).
- Contain a mix of upper-case and lower-case letters.
- Include numbers and special characters (e.g. !, @, #, $, %).
- Not be a dictionary word, name, or personal information (date of birth, pet's name).
- Not be reused across multiple accounts.
- Be changed regularly.
Example of a weak password: password123
Example of a strong password: T@7q$Lm9#xB2!
A password policy is a set of rules defined by an organisation that all users must follow. It can:
- Force users to choose passwords that meet minimum length/complexity.
- Force users to change passwords every 30/60/90 days.
- Prevent reuse of recent passwords.
- Lock accounts after several failed attempts.
Biometrics is the use of unique biological or behavioural characteristics of a person to identify them and grant access to a system or device.
Common biometric methods:
- Fingerprint scan
- Retina / Iris scan
- Facial recognition
- Voice recognition
- Palm / Vein pattern
- Cannot be lost, forgotten or stolen (unlike a password or card).
- Very hard to forge or duplicate.
- Quick and convenient — no need to remember anything.
- Always carried by the user.
- Expensive equipment required (scanners, sensors).
- If a biometric is stolen, it cannot be changed (you cannot change your fingerprint).
- Can be affected by injury, illness or environmental factors (cuts, lighting).
- Privacy concerns about storing biological data.
Anti-malware / Anti-virus software is a program designed to detect, prevent and remove malicious software (viruses, worms, trojans, spyware, ransomware) from a computer system.
How it works:
- Signature-based detection — the software compares files against a database of known malware signatures (unique patterns of code). If a file matches, it is flagged as malware.
- Heuristic analysis — the software analyses the behaviour and structure of new/unknown programs to detect suspicious activity, even if the malware is not in the signature database.
- Quarantine — if a file is found to be malicious, it is moved to a secure area (quarantine) where it cannot run, so the user can decide to delete or restore it.
- Real-time scanning — every file that is opened, downloaded or executed is scanned automatically.
(a) User Access Levels:
User access levels restrict what different users are allowed to do on a computer system or network. Each user is given specific permissions based on their role.
Typical levels:
- Administrator — full access: can install software, change settings, create/delete users.
- Standard user — limited access: can run programs and edit their own files only.
- Guest — very limited access: usually read-only or temporary.
This follows the principle of least privilege — users are given only the access they need to do their job, which limits the damage if an account is compromised.
(b) Two-Factor Authentication (2FA):
2FA is a security process in which a user must provide two different types of identification to log in:
- Something you know — a password or PIN.
- Something you have — a phone (to receive an SMS code), a security token, or an authenticator app code.
Some systems also use a third factor — something you are (biometrics) — known as Multi-Factor Authentication (MFA).
Even if a hacker steals the password, they cannot log in without the second factor.
(c) Automatic Software Updates:
Software companies regularly release updates (also called patches) to fix security vulnerabilities that have been discovered. If a system is not updated, hackers can exploit these known weaknesses.
Enabling automatic updates ensures that:
- Security holes are patched as soon as a fix is available.
- The system is protected against the latest known threats.
- The user does not have to remember to manually check for updates.
Comparison and Application
| Threat | Description | Best Prevention Method |
|---|---|---|
| Malware (virus / worm) | Malicious software that damages or steals data | Anti-malware software + automatic updates |
| Phishing | Fraudulent emails tricking users into revealing data | User training + spam filters + checking the URL |
| Brute Force Attack | Trying every password combination | Strong passwords + account lockout + 2FA |
| DoS / DDoS | Flooding a server with requests | Firewall + traffic filtering + cloud DoS protection |
| Social Engineering | Manipulating people to give up information | Staff training + clear security policies |
| SQL Injection | Injecting malicious SQL commands into input fields | Input validation + parameterised queries |
| Man-in-the-Middle | Intercepting communication between two parties | Encryption (HTTPS/TLS) + VPN |
| Data Interception / Theft | Unauthorised access to sensitive data | Encryption + user access levels + biometrics |
- Encryption — All sensitive student records should be encrypted so that even if a hacker gains access to the files, the data appears as meaningless ciphertext and cannot be read without the decryption key.
- User Access Levels — Different staff should have different permissions. Only authorised administrators should be able to view or edit sensitive data, while teachers may only see their own classes. Students and guests should have very limited access. This limits the damage if one account is compromised.
- Firewall — A firewall (hardware and/or software) should be installed between the school network and the internet to block unauthorised incoming connections and prevent malware from communicating externally.
- Strong Passwords + Two-Factor Authentication (2FA) — All staff accounts should be protected by strong passwords (long, mixed characters) and 2FA, so that even if a password is stolen through phishing or brute force, the attacker still cannot log in without the second factor.
Revision: Statements and Key Computing Terms
| Statement | Key Term |
|---|---|
| The protection of computer systems, networks and data from unauthorised access or attack. | Cyber Security |
| Any software written deliberately to harm or exploit a computer system. | Malware |
| Malware that attaches to a host file and spreads when the file is run. | Virus |
| Self-replicating malware that spreads across networks without a host file. | Worm |
| Malware disguised as a legitimate program. | Trojan |
| Malware that secretly monitors user activity and reports it to a third party. | Spyware |
| Malware that encrypts files and demands payment to decrypt them. | Ransomware |
| An attack that tricks users into revealing sensitive data via fraudulent emails. | Phishing |
| An attack that automatically redirects users from a real website to a fake one. | Pharming |
| An attack that tries every possible password combination to crack an account. | Brute Force Attack |
| An attack that floods a server with so many requests that it stops responding. | Denial of Service (DoS) |
| A DoS attack launched from many different computers at the same time. | Distributed DoS (DDoS) |
| Manipulating people into revealing confidential information. | Social Engineering |
| Looking over someone's shoulder to see their password or PIN. | Shoulder Surfing |
| Following an authorised person through a secure door without consent. | Tailgating / Piggybacking |
| A hardware or software barrier that filters network traffic using rules. | Firewall |
| Converting plaintext into unreadable ciphertext using a key. | Encryption |
| Encryption that uses the same key to encrypt and decrypt data. | Symmetric Encryption |
| Encryption that uses a public key to encrypt and a private key to decrypt. | Asymmetric Encryption |
| Using unique biological characteristics to identify a person. | Biometrics |
| Software that detects, prevents and removes malicious software. | Anti-Malware / Anti-Virus |
| Restricting what different users are allowed to do based on their role. | User Access Levels |
| Requiring two different forms of identification to log in. | Two-Factor Authentication (2FA) |
| A weakness or flaw in a system that could be exploited by an attacker. | Vulnerability |