📡 Paper 1 · 1.2 Communication and Internet Technologies
1.2.10 Network Security Threats
Cambridge 9618 · International A Level Computer Science · ~15 min read
Notes
Video
Slides
Quiz
Worksheet

Malware

Malware is malicious software designed to harm, disrupt, or gain unauthorised access to a computer system. Key types:

TypeDescriptionKey distinction
VirusAttaches itself to a legitimate program or file and spreads when that file is executedRequires a host file; requires user action to spread
WormSelf-replicating malware that spreads across networks automatically without user actionNo host file needed; spreads independently
Trojan horseDisguises itself as legitimate software — delivers a malicious payload once installedDoes not self-replicate; relies on user executing it
RansomwareEncrypts the victim's files and demands payment (ransom) for the decryption keyOften spread by email attachments or drive-by downloads
SpywareSecretly monitors user activity and collects data (keystrokes, credentials, browsing) and sends it to an attackerOperates silently in background
AdwareDisplays unwanted advertisements; may also track user behaviourMay be bundled with legitimate software

Social Engineering Attacks

Phishing

Fraudulent emails, messages, or websites designed to trick users into revealing sensitive information (passwords, credit card numbers). Emails often impersonate trusted organisations and contain urgent-sounding messages.

Pharming

Attackers redirect users from legitimate websites to fraudulent ones without their knowledge — by corrupting DNS records or modifying the hosts file. Unlike phishing, the user doesn't click a suspicious link; they navigate normally but are redirected.

Social engineering

Manipulating people psychologically rather than technically to gain access to systems or information. Examples: pretexting (false identity), baiting (leaving infected USB drives), vishing (voice phishing over phone).

Technical Attacks

Brute force attack

Systematically trying all possible password combinations until the correct one is found. Prevention: account lockouts after failed attempts, long/complex passwords, multi-factor authentication.

Denial of Service (DoS) / Distributed Denial of Service (DDoS)

A DoS attack overwhelms a server with traffic, making it unavailable to legitimate users. A DDoS uses many compromised machines (a botnet) to launch the attack simultaneously — much harder to block.

Man-in-the-Middle (MitM) attack

An attacker secretly intercepts and potentially modifies communication between two parties who believe they are communicating directly. Prevention: TLS/SSL encryption, certificate verification.

SQL Injection

Malicious SQL code is inserted into a web form or URL input that is passed to a database query without proper sanitisation. If successful, the attacker can read, modify, or delete database contents. Prevention: input validation, prepared statements/parameterised queries.

Cross-Site Scripting (XSS)

Malicious scripts are injected into web pages viewed by other users. When a victim loads the page, the script executes in their browser, potentially stealing session tokens or redirecting users.

Prevention and Countermeasures

ThreatPrevention
MalwareAntivirus software, regular software updates/patching, not downloading from untrusted sources
PhishingUser education, email spam filters, verify URLs before clicking
PharmingDNSSEC, HTTPS with certificate verification, up-to-date OS
Brute forceAccount lockout, strong/long passwords, multi-factor authentication (MFA)
DoS/DDoSRate limiting, traffic filtering, CDN services (e.g. Cloudflare), ISP-level blocking
MitMTLS/SSL encryption, certificate verification
SQL injectionInput validation, parameterised queries/prepared statements
XSSInput sanitisation, Content Security Policy (CSP) headers
Exam tip: Cambridge questions often ask you to identify the type of attack from a description, or to state both an attack type AND a prevention measure. Key distinguishers: worm spreads without user action (virus needs host file); pharming redirects without the user clicking anything; DDoS uses a botnet (DoS uses a single source); SQL injection exploits unsanitised database inputs.
⚠️ Common Mistakes
  • Saying a worm needs a host file — a worm is self-contained and self-replicating; a virus attaches to a host file
  • Confusing phishing and pharming — phishing tricks users into clicking fake links; pharming redirects legitimate navigation to a fake site
  • Saying DoS and DDoS are the same — DDoS uses multiple machines (a botnet); DoS uses a single machine
  • Saying antivirus prevents SQL injection — antivirus does not protect against SQL injection; parameterised queries do
✅ Notes completed!
Video coming soon
Click slide or press arrow keys to navigate

Worksheet — 1.2.10 Network Security Threats

8 questions · instantly marked · Cambridge 9618 standard

Q1State the difference between a virus and a worm.[4]
✅ Mark scheme
Mark scheme
A virus attaches itself to a host file/program and spreads when that file is executed — requires user action [2]; a worm is self-contained and self-replicating — spreads automatically across networks without requiring a host file or user action [2].
Q2Describe how a phishing attack works and state two ways users can protect themselves.[4]
✅ Mark scheme
Mark scheme
Phishing uses fraudulent emails or websites that impersonate trusted organisations to trick users into revealing sensitive information such as passwords or banking details [2]; any two protective measures (1 each): check the sender's email address carefully; verify URLs before clicking; do not click suspicious links; use email spam filters; use multi-factor authentication [2].
Q3Explain how a DDoS attack works and how it differs from a DoS attack.[4]
✅ Mark scheme
Mark scheme
A DoS attack floods a server with traffic from a single source, making it unavailable to legitimate users [1]; a DDoS attack uses many compromised computers (a botnet) to launch the attack simultaneously [1]; DDoS is harder to block because traffic comes from many different IP addresses [1]; both aim to exhaust the server's resources so it cannot respond to legitimate requests [1].
Q4Explain what SQL injection is and state how it can be prevented.[4]
✅ Mark scheme
Mark scheme
SQL injection inserts malicious SQL code into a user input field that is passed unsanitised to a database query [2]; if successful, an attacker can read, modify, or delete database contents [1]; prevention: input validation/sanitisation; parameterised queries (prepared statements) that separate code from data [1].
Q5Explain the difference between pharming and phishing.[4]
✅ Mark scheme
Mark scheme
Phishing tricks users into clicking fake links or visiting fraudulent websites by sending deceptive emails [2]; pharming redirects users from legitimate websites to fraudulent ones without the user clicking a suspicious link — by corrupting DNS records or the system hosts file — the user navigates normally but is silently redirected [2].
Q6Describe what ransomware is and state two ways an organisation can protect itself.[4]
✅ Mark scheme
Mark scheme
Ransomware encrypts the victim's files and demands a ransom payment for the decryption key [2]; protection (1 each for any two): regular offline/offsite backups so files can be restored; antivirus/antimalware software; keeping OS and software patched/updated; user education — not opening suspicious email attachments [2].
Q7Explain what a man-in-the-middle (MitM) attack is and how TLS prevents it.[4]
✅ Mark scheme
Mark scheme
A MitM attack is where an attacker secretly intercepts communication between two parties, who believe they are communicating directly — the attacker can read or modify messages [2]; TLS prevents MitM by: encrypting data so intercepted traffic cannot be read [1]; verifying the server's identity via a digital certificate signed by a trusted CA — if an attacker intercepts, they cannot present a valid certificate [1].
Q8A company's database was accessed by an attacker who typed ' OR 1=1 -- into the login form. Name the type of attack and explain how this works.[4]
✅ Mark scheme
Mark scheme
SQL injection [1]; the login form passes user input directly into a SQL query without sanitisation [1]; the malicious input ' OR 1=1 -- alters the query so that the condition is always true — bypassing the login check and granting access without a valid password [1]; the -- comments out the rest of the query [1].
Topic Quiz
Question 1 of 15
You scored
out of 15
Card 1 of 12
Click to reveal definition
🎉
All cards reviewed!
TermDefinition
🎯

Mini Test — 1.2.10 Security Threats

10 questions · 10 marks · 10 minutes

← 1.2.9 Cloud Computing
17 of 82 · Cambridge 9618
1.3.1 CPU Architecture →
🔒
Pro lesson
Upgrade to CSZone Pro to access all Cambridge 9618 A Level lessons.
Upgrade to Pro →