CAIE 9618 · Paper 1 · Topic 1.2.10

Network Security Threats

Malware · Phishing · DOS/DDOS · Social Engineering · Countermeasures

CSZone Cambridge International AS & A Level Computer Science 9618

Types of Malware

Malicious Software

Type	Description	Key Feature
Virus	Attaches to legitimate files; spreads when file shared	Requires host file; user action to spread
Worm	Self-replicating; spreads across networks automatically	No host file needed; exploits vulnerabilities
Trojan	Disguised as legitimate software; secretly harmful	Does not self-replicate; user installs it
Ransomware	Encrypts user's files; demands payment for decryption key	Financial extortion; very damaging
Spyware	Secretly records user activity, keystrokes, passwords	Hidden; sends data to attacker
Rootkit	Hides malware presence; gives admin/root access	Hard to detect; deep system access

Phishing & Social Engineering

Exploiting Human Behaviour

PHISHING

Fraudulent emails/messages that appear to come from trusted sources (banks, HMRC, etc.) to trick users into revealing passwords, card details, or clicking malicious links. Spear phishing = targeted at specific individuals using personal info.

SOCIAL ENGINEERING

Psychologically manipulating people into divulging confidential information or granting access. Relies on human error, not technical exploits. Examples: pretexting, baiting, tailgating, impersonation.

VISHING / SMISHING

Vishing: phone call phishing. Smishing: SMS phishing. Same goal — trick victim into revealing sensitive information.

DOS and DDOS Attacks

Denial of Service

A Denial of Service (DOS) attack floods a server with so many requests that it becomes overwhelmed and unable to serve legitimate users. A Distributed DOS (DDOS) uses many machines (often a botnet) to amplify the attack.

DOS: attack originates from a single machine/IP

DDOS: coordinated attack from thousands of machines simultaneously (botnet)

Botnet: network of compromised computers controlled remotely by attacker

Countermeasures: rate limiting, traffic filtering, CDN / load balancing, IP blacklisting

Security Countermeasures

Protecting Against Attacks

Firewalls — block malicious traffic based on rules

Anti-malware — detects and removes known malware signatures

Strong passwords + MFA — prevents unauthorised access

Encryption — protects data in transit and at rest

Software updates / patching — closes known vulnerabilities

User education — teaches staff to recognise phishing and social engineering

Access control — least privilege principle — users only access what they need

Penetration testing — authorised simulated attacks to find vulnerabilities

Exam Practice

Cambridge-style questions

Question 1

Explain the difference between a virus and a worm. State one countermeasure for each.

4 marks

1 mark

Virus: attaches itself to a legitimate file/program and spreads when that file is shared — requires user action (e.g. opening file)

1 mark

Worm: self-replicating — spreads automatically across networks by exploiting vulnerabilities, no host file or user action needed

1 mark

Countermeasure for virus: anti-malware/antivirus software to scan files for known signatures

1 mark

Countermeasure for worm: regular security patches to close network vulnerabilities that worms exploit

Exam Practice

Question 2

Describe what a DDOS attack is and explain why it is more difficult to defend against than a DOS attack.

4 marks

1 mark

DDOS: Distributed Denial of Service — server is flooded with requests from many computers simultaneously, making it unavailable to legitimate users

1 mark

The attacking machines form a botnet — computers previously infected with malware and remotely controlled by the attacker

1 mark

More difficult to block than DOS because traffic comes from thousands of different IP addresses (hard to blacklist)

1 mark

Legitimate traffic and attack traffic are mixed, making it difficult to filter without also blocking real users

Common Mistakes

Don't lose easy marks

1

Saying a worm needs to attach to a file — it does not. A worm is self-contained and spreads automatically across networks without needing a host file. A virus needs a host file; a worm doesn't.

2

Saying phishing is a technical attack — phishing is a form of social engineering. It exploits human psychology (trust, urgency, fear) rather than a software vulnerability. Always make this distinction clear.

3

Saying a DOS attack hacks into a system — DOS attacks don't breach or gain access to a system. They simply overwhelm it with requests so it cannot serve legitimate users. Availability attack, not a confidentiality attack.

Topic Summary — 1.2.10

What You Need to Know

MALWARE TYPES

Virus: needs host, spreads via shared files
Worm: self-replicates, no host needed
Trojan: disguised, doesn't replicate
Ransomware: encrypts files for ransom
Spyware: records activity secretly

ATTACKS

Phishing: fake emails → steal credentials
Social engineering: exploit human trust
DOS: flood server from one source
DDOS: flood from botnet (many sources)

COUNTERMEASURES

Anti-malware software
Firewall — block suspicious traffic
Software patching — close vulnerabilities
Strong passwords + MFA
User education — recognise threats
Encryption — protect data
Penetration testing — find weaknesses

CSZone

Next Video

1.3.1

CPU Architecture

ALU · CU · Registers · Buses · Internal Architecture

Head to CSZone.co.uk for the complete worksheet, quiz, and interactive tools