Common cyber security threats, including malware, phishing, social engineering, brute-force attacks, denial-of-service attacks, SQL injection and data interception.

A Unit 1 threats question. Malware is malicious software designed to damage, disrupt or gain unauthorised access to a computer system (1 mark), for example a virus (which attaches to files and spreads), a worm (which spreads by itself across networks), a trojan (disguised as legitimate software) or ransomware (which encrypts files and demands payment) (1 mark for a named example). Phishing is an attempt to trick a user into revealing personal or financial information, such as passwords or bank details, usually through fake emails or websites that pretend to be from a trusted organisation (1 mark for tricking the user, 1 mark for the fake message/site method). Markers reward the malicious-software definition with an example and the deception used in phishing. A common error is to confuse phishing with malware, when phishing relies on tricking a person rather than infecting the machine.

A Unit 1 explain question. A denial-of-service (DoS) attack tries to make a computer system, server or website unavailable to its legitimate users (1 mark). It does this by flooding the system with so many requests or so much traffic that it cannot cope and slows down or crashes (1 mark). The effect is that genuine users cannot access the service, which can cause lost business and disruption (1 mark). Markers reward overwhelming the system with traffic and the loss of availability to real users. A common error is to say a DoS attack steals data, when its aim is to deny access rather than to steal.