AQA 8525 · Section 3.6 · Cyber Security

Cyber Security
Threats

Malware · Phishing · Brute Force · DoS · SQL Injection

CSZoneAQA GCSE Computer Science 8525

Malware Types

Malicious Software

Virus — attaches itself to legitimate programs. Spreads when infected programs are run. Can corrupt or delete files.

Worm — self-replicates across networks without user interaction. Consumes bandwidth and crashes systems.

Trojan — disguised as legitimate software. Creates backdoors, steals data, enables remote access.

Ransomware — encrypts victim's files, demands payment for decryption key.

Spyware — secretly monitors user activity, captures keystrokes, steals passwords.

Other Threats

Attacks That Don't Need Malware

Phishing — fraudulent emails/websites that trick users into revealing credentials. Spear phishing = targeted at a specific person.

Brute force attack — tries all possible password combinations until correct one is found. Countered by lockout policies and strong passwords.

SQL injection — malicious SQL code inserted into a form field to manipulate a database. Can expose, modify, or delete data.

DDoS (Distributed Denial of Service) — many devices flood a server with requests, making it unavailable to legitimate users.

Vulnerability Examples

How Systems Become Vulnerable

Unpatched software — out-of-date OS or apps with known security holes. Attackers exploit known vulnerabilities before patches are applied.

Weak passwords — short, common, or reused passwords are easily cracked by brute force or dictionary attacks.

Misconfigured networks — open ports, default router passwords, unencrypted Wi-Fi left enabled.

Exam Practice

Have a go at this question

AQA-style question

Describe what is meant by a brute force attack and explain how it can be prevented.

3 marks

A brute force attack involves systematically trying every possible combination of characters as a password [1] until the correct one is found [1]. It can be prevented by implementing account lockout after a number of failed attempts (and/or requiring long, complex passwords) [1].

Key Takeaways

What to Remember

Malware types: virus, worm, trojan, ransomware, spyware

Phishing tricks users into giving away credentials

SQL injection manipulates databases through form inputs

DDoS overwhelms a server with traffic to deny access