3.6.1 Cyber Security Threats — AQA 8525

The CIA Triad — Principles of Cyber Security

Every cyber security goal can be mapped to one of three principles known as the CIA Triad:

C

Confidentiality
Only authorised people can access data. Attacks: data theft, interception.

I

Integrity
Data has not been altered without authorisation. Attacks: tampering, SQL injection.

A

Availability
Systems are accessible when needed. Attacks: DoS/DDoS, ransomware.

Why Do Cyber Attacks Happen?

Motivation	Description	Example
Financial gain	Most common — steal money, sell data, ransomware payments	Banking trojans, ransomware targeting hospitals
Espionage	State-sponsored hacking to steal secrets or IP	Nation-states targeting defence contractors
Hacktivism	Political or ideological motivation — disrupt organisations	DDoS attacks on government websites
Curiosity / challenge	Script kiddies testing tools, hobbyist hackers	Port scanning, exploring vulnerabilities
Sabotage	Disrupt competitors, critical infrastructure	Attacks on energy grids, water treatment

System Vulnerabilities

Software

Unpatched software

Software with known security bugs that have not been updated. Attackers exploit these vulnerabilities. Regular updates/patches are critical.

Human

Weak passwords

Easily guessed or reused passwords. Brute-force and dictionary attacks can crack them rapidly. Password length is more important than complexity alone.

Configuration

Misconfiguration

Incorrect security settings, open ports, default credentials left unchanged, unnecessary services running. Common cause of breaches.

Human

Insider threat

Employees (intentional or accidental) who cause security breaches — sharing passwords, opening phishing emails, or deliberately stealing data.

Process

Poor network policy

Lack of clear rules about device use, password policies, access control, or BYOD (Bring Your Own Device) policies.

Physical

Physical access

Unsecured hardware — someone with physical access can bypass many software security measures (boot from USB, remove hard drive).

Forms of Attack — Summary

Attack	Category	Description	Target (CIA)
Malware (virus/worm/trojan)	Malware	Malicious software installed on a device	C, I, A
Ransomware	Malware	Encrypts files, demands payment	A
Phishing	Social Eng.	Fake emails trick users into revealing credentials	C
Brute force	Technical	Tries all possible passwords systematically; dictionary attack uses common words	C
DoS / DDoS	Network	Floods server with requests — makes services unavailable	A
SQL injection	Web	Malicious SQL via web form to access/modify database	C, I
Data interception	Network	Packet sniffing — reading unencrypted data on a network	C
Keylogging	Malware	Records keystrokes to capture passwords, card numbers	C
Man-in-the-middle	Network	Intercepts and possibly alters communication between two parties	C, I

Brute Force & Dictionary Attacks

Brute force attack: tries every possible combination of characters until the correct password is found. Very slow for long passwords — a 12-character random password would take billions of years. Dictionary attack: tries common words, phrases, and known passwords from breached databases. Much faster than pure brute force. This is why "password123" is immediately cracked but "x7!Kp#mQ2vLz" is not.

Data Interception & Theft

Packet sniffing involves capturing data packets travelling across a network. On an unencrypted network (open Wi-Fi, HTTP), all data is visible in plain text — usernames, passwords, emails. Tools like Wireshark can capture packets for legitimate network analysis, but are also misused by attackers. Countermeasure: HTTPS/TLS encryption makes intercepted data unreadable.

Exam tip: When asked to describe a cyber attack, always cover: (1) what it is, (2) how it works, (3) what data/system it targets. When asked for countermeasures, be specific — "use encryption" is better than "make it more secure." Map attacks to the CIA triad: DoS attacks target Availability; phishing/data theft targets Confidentiality.

⚠️ Common Mistakes

Using "hacking" as an attack type — "hacking" is vague. Name specific attacks: phishing, SQL injection, brute force, DoS, etc.
Saying brute force attacks always work quickly — a truly random long password (16+ characters) would take longer than the universe's lifetime to crack. Length is critical.
Confusing ransomware with spyware — ransomware encrypts files and demands payment; spyware secretly monitors activity and sends data to attackers.

▶

Video coming soon

Key points

CIA Triad: Confidentiality, Integrity, Availability — every cyber attack targets at least one
Forms of attack: malware (virus/worm/trojan/ransomware/keylogger), phishing, DoS/DDoS, SQL injection, MITM, brute force, data interception
Brute force: tries all combinations; dictionary attack: uses common words — long random passwords resist both
System vulnerabilities: unpatched software, weak passwords, misconfiguration, insider threats, poor policy
Data interception on unencrypted networks — HTTPS/TLS prevents readable capture

Click slide or press arrow keys to navigate

✍️

Worksheet — 3.6.1 Forms of Cyber Attack

8 questions · 22 marks

Q1What do the letters in the CIA Triad stand for? Give one example cyber attack that targets each principle.[3]

✅ Mark scheme

Mark scheme

C = Confidentiality — example: phishing/data interception/keylogging [1]; I = Integrity — example: SQL injection/man-in-the-middle [1]; A = Availability — example: DoS/DDoS/ransomware [1].

Q2Explain the difference between a brute force attack and a dictionary attack on a password.[2]

✅ Mark scheme

Mark scheme

A brute force attack systematically tries every possible combination of characters until the correct password is found [1]; a dictionary attack uses a list of common words, phrases, and previously breached passwords — much faster than pure brute force but only effective if the password is a common word or pattern [1].

Q3What is a keylogger? Which CIA principle does it primarily threaten?[2]

✅ Mark scheme

Mark scheme

A keylogger is malware (or hardware device) that records every keystroke made on a keyboard, capturing passwords, credit card numbers, and other sensitive data without the user's knowledge [1]; it primarily threatens Confidentiality — private data is secretly captured and sent to the attacker [1].

Q4Give three reasons why cyber attacks occur (motivations of attackers).[3]

✅ Mark scheme

Mark scheme

Any three: financial gain (stealing data/money, ransomware payments) [1]; espionage/intelligence gathering (nation-states stealing secrets) [1]; hacktivism (political/ideological motivation, disrupting organisations) [1]; curiosity/challenge (testing vulnerabilities, script kiddies) [1]; sabotage (disrupting competitors or critical infrastructure) [1].

Q5What is meant by 'data interception'? How does HTTPS protect against it?[3]

✅ Mark scheme

Mark scheme

Data interception (packet sniffing) is when an attacker captures data packets as they travel across a network [1]; on an unencrypted network (HTTP, open Wi-Fi) the data is in plain text and usernames/passwords/emails can be read [1]; HTTPS uses TLS/SSL encryption so even if packets are captured, the data is scrambled and unreadable without the private key [1].

Q6State two system vulnerabilities that attackers might exploit and explain how each can be reduced.[4]

✅ Mark scheme

Mark scheme

Any two: unpatched software — attackers exploit known vulnerabilities in outdated software; reduced by keeping all software and OS updated [1+1]; weak passwords — susceptible to brute force and dictionary attacks; reduced by using long, random passwords and 2FA [1+1]; misconfiguration — incorrect settings expose systems; reduced by security audits and following security best practices [1+1]; insider threats — employees accidentally or deliberately cause breaches; reduced by least-privilege access control and staff training [1+1].

Q7A company is hit by ransomware. Explain what ransomware does and which of the CIA principles it attacks.[3]

✅ Mark scheme

Mark scheme

Ransomware is malware that encrypts the victim's files, making them inaccessible [1]; the attackers demand a ransom payment (usually cryptocurrency) in exchange for the decryption key [1]; it primarily attacks Availability — the company cannot access its own systems and data; potentially also Confidentiality if data is exfiltrated before/during encryption [1].

Q8Explain why a long random password (e.g. "x7!Kp#mQ2vLz") is more secure against brute force than a short complex one (e.g. "P@55").[2]

✅ Mark scheme

Mark scheme

The number of possible combinations grows exponentially with password length [1]; "P@55" has only 4 characters — even with special characters, the number of combinations is small and can be cracked quickly; "x7!Kp#mQ2vLz" has 12 characters — the number of possible combinations is astronomically larger, making brute force take billions of years even with powerful computers [1].

✓

Check your answers above.

Topic Quiz

Q 1 of 10

You scored

out of 10

Card 1 of 8

Click to flip

🎉

All done!

Term	Definition

🔒

Pro Content

Subscribe to unlock all AQA 8525 lessons, worksheets, quizzes and mini tests.

£7.99/month

or £59/year

Upgrade to Pro

The CIA Triad — Principles of Cyber Security

C

I

A

Why Do Cyber Attacks Happen?

System Vulnerabilities

Unpatched software

Weak passwords

Misconfiguration

Insider threat

Poor network policy

Physical access

Forms of Attack — Summary

Brute Force & Dictionary Attacks

Data Interception & Theft

Key points

Worksheet — 3.6.1 Forms of Cyber Attack

Mini Test — 3.6.1 Forms of Cyber Attack