The forms of attack on computer systems and networks: malware, phishing, social engineering, brute-force attacks, denial of service, data interception and theft, SQL injection, and people as a weak point.

Phishing (2 marks): sending fake messages (usually emails) that appear to come from a trusted organisation such as a bank, to trick the user into revealing personal information such as passwords or bank details, often by clicking a link to a fake website that looks genuine.

Brute-force attack (2 marks): an attempt to gain access by systematically trying many possible passwords or keys, often using automated software, until the correct one is found. Short or simple passwords are cracked quickly; long, complex passwords take much longer.

Markers reward "fake/trusted-looking message to trick the user into giving information" for phishing, and "trying many combinations until the password is found" for brute force. Confusing the two loses marks.

Denial of service (2 marks): an attack that floods a server or network with so many requests that it becomes overwhelmed and cannot respond to legitimate users, making the website or service unavailable. (A distributed denial of service, DDoS, uses many computers at once.)

SQL injection (2 marks): entering malicious SQL code into an input box (such as a login or search field) on a website that does not validate its inputs, so that the code is run by the database. This can let an attacker bypass a login, or read, change or delete data they should not be able to access.

Markers reward "flooding with requests so legitimate users cannot get a response" for DoS, and "malicious SQL entered into an input that the database runs" for SQL injection.