Cambridge 9618 · International A Level Computer Science · ~18 min read
Notes
Video
Slides
Quiz
Worksheet
Malware (Malicious Software)
Malware is any software deliberately designed to disrupt, damage, or gain unauthorised access to a computer system. The main types are:
🦠 Virus
Attaches itself to legitimate files/programs. Requires a host file and human action (opening the file) to spread. Replicates when host is executed. Can corrupt or delete files.
🪱 Worm
Self-replicating — spreads across networks without a host file and without human action. Exploits OS/application vulnerabilities. Consumes bandwidth and can crash systems.
🐴 Trojan
Disguised as legitimate, useful software. User installs it willingly. Does not self-replicate (unlike virus/worm). Creates a backdoor for attackers or delivers a payload.
💰 Ransomware
Encrypts victim's files and demands payment (usually cryptocurrency) for the decryption key. Spread via phishing emails or exploits. Can cripple organisations.
👁️ Spyware
Secretly monitors user activity — collects browsing history, credentials, personal data — and sends it to an attacker. Often bundled with legitimate software. Usually hidden from the user.
⌨️ Keylogger
Records all keystrokes typed by the user. Captures passwords, credit card numbers, messages. Can be hardware (physical device) or software-based.
Social Engineering Attacks
Social engineering exploits human psychology rather than technical vulnerabilities. The attacker manipulates people into revealing confidential information or performing actions that compromise security.
Social engineering techniques
📧
Phishing
Mass fraudulent emails impersonating trusted organisations (banks, government, Amazon) to steal credentials or install malware. Often contains urgency ("Your account will be closed").
🎯
Spear Phishing
Targeted phishing — attacker researches a specific individual and personalises the attack. Much more convincing than mass phishing; often uses victim's real name, employer, colleagues.
📱
Vishing / Smishing
Vishing = voice phishing (phone calls); Smishing = SMS phishing (text messages). Attacker impersonates bank, HMRC, tech support to steal credentials or payment details.
👁️🗨️
Shoulder Surfing
Physically observing someone entering a PIN, password, or sensitive data. Happens at ATMs, cafés, public transport. Simple but effective low-tech attack.
🎣
Baiting / Pretexting
Baiting: leaving infected USB drives for curious victims to find and plug in. Pretexting: creating a fabricated scenario ("I'm from IT support") to extract information.
Network and Technical Attacks
🕵️ Man-in-the-Middle (MITM)
Attacker secretly intercepts and potentially alters communications between two parties who believe they're communicating directly. Often targets unencrypted Wi-Fi.
Example: attacker on public Wi-Fi intercepts login credentials sent over HTTP
💉 SQL Injection
Malicious SQL code inserted into an input field to manipulate a database. Can extract, modify, or delete data. Affects websites that don't sanitise user inputs.
Example: login form input: ' OR 1=1; --
💥 DDoS Attack
Distributed Denial of Service — overwhelming a server with traffic from thousands of compromised machines (botnet) until it crashes. Target cannot serve legitimate users.
Example: botnet of 100,000 infected devices floods a website
🔑 Brute Force
Systematically trying every possible password/key until the correct one is found. Slow for long complex passwords. Dictionary attacks use lists of common passwords instead.
Example: trying A, B, C … AA, AB … until password found
📡 Packet Sniffing
Capturing network traffic to examine packets. On unencrypted networks, captures credentials, emails, data in plain text. Used legitimately for network diagnostics.
Example: using Wireshark on HTTP traffic to capture login data
🔁 Replay Attack
Capturing and retransmitting valid network data to trick a system into accepting it again. E.g. replaying a valid authentication token to gain unauthorised access.
Monitors and controls incoming/outgoing network traffic based on rules. Blocks unauthorised access. Can be hardware or software. Packet filtering or stateful inspection.
🛡️
Antivirus / Anti-malware
Scans files and memory for known malware signatures. Provides real-time protection. Regular updates ensure new malware patterns are detected.
🔐
Encryption
Encrypts data in transit (HTTPS/TLS) and at rest (full disk encryption). Even if intercepted, data is unreadable without the key. Protects against MITM attacks.
🔑
Strong Passwords + MFA
Long complex passwords resist brute force. Multi-Factor Authentication requires something you know (password) + something you have (phone/token). Stops credential theft attacks.
🔄
Software Updates / Patching
Fixes known security vulnerabilities in OS and applications. Attackers exploit unpatched systems. Automatic updates ensure patches apply promptly.
🎓
User Education & Training
Teaching users to recognise phishing, avoid suspicious links/attachments, use strong passwords. Human error is the most common attack vector.
👤
Access Control / Least Privilege
Users only given permissions they need for their role. Limits damage from compromised accounts. Separates administrator and user privileges.
💾
Backup & Recovery
Regular backups of data to offline or remote storage. Allows recovery from ransomware without paying ransom. Test backups to ensure they work.
🔍
Input Validation / Sanitisation
Checking and cleaning user inputs before they reach the database/server. Prevents SQL injection and cross-site scripting (XSS). Use parameterised queries for database access.
🚨
Intrusion Detection System (IDS)
Monitors network/system activity for malicious patterns and alerts administrators. Can detect port scans, DDoS, unusual traffic, known attack signatures.
Cambridge 9618 exam tip: Know malware types precisely: virus (needs host file, spreads when executed), worm (no host, self-replicating across networks), trojan (disguised as legitimate software, no self-replication), ransomware (encrypts files for ransom), spyware (secret data collection), keylogger (records keystrokes). For social engineering: phishing (email), spear phishing (targeted), vishing (voice), smishing (SMS). For network attacks: SQL injection (malicious SQL in input), DDoS (botnet floods server), MITM (intercepts traffic), brute force (try all passwords). Prevention: firewall, antivirus, encryption, MFA, updates, user training, least privilege, input validation, backups. For SQL injection prevention: parameterised queries (prepared statements) or input sanitisation.
⚠️ Common Mistakes
Confusing virus and worm — a virus needs a host file and human action to spread; a worm self-replicates across networks without a host and without human action
Saying trojans self-replicate — trojans do NOT replicate; they disguise themselves as legitimate software to trick the user into installing them
Confusing DDoS and DoS — DoS (Denial of Service) comes from one machine; DDoS (Distributed DoS) uses thousands of compromised machines (botnet) — much harder to block
Saying a firewall stops all attacks — a firewall filters network traffic but cannot stop social engineering, insider threats, or attacks that use legitimate-looking traffic
Forgetting that SQL injection is prevented by INPUT VALIDATION/parameterised queries, not by antivirus or firewalls
Saying phishing only uses email — phishing variants include vishing (voice/phone), smishing (SMS), and spear phishing (targeted); the exam may ask you to distinguish between them
✅ Notes completed!
▶
Video coming soon
Click slide or press arrow keys to navigate
Worksheet — 3.5.1 Security Threats
8 questions · Cambridge 9618 standard
Q1State two differences between a virus and a worm.[2]
✅ Mark scheme
Any two from: a virus attaches to a host file; a worm does not need a host file [1]; a virus requires human action (running the infected file) to spread; a worm self-replicates and spreads automatically across networks without human action [1]; a virus spreads when the host file is opened/executed; a worm spreads by exploiting network vulnerabilities [1].
Q2Describe how a phishing attack works. Include how the victim is deceived and what the attacker aims to obtain.[3]
✅ Mark scheme
The attacker sends fraudulent emails that appear to come from a legitimate, trusted source (e.g. a bank, government agency, or online retailer) [1]; the email contains a link to a fake website that closely resembles the legitimate site — the victim is deceived into entering their credentials (username, password) or personal/financial details [1]; the attacker captures these credentials/details to gain unauthorised access to the victim's accounts or to commit fraud [1]. Accept any valid mechanism such as malicious attachment that installs malware when opened.
Q3A company website has a login form. An attacker enters the following into the username field: admin' OR '1'='1'; --. Explain what type of attack this is and why it might succeed.[4]
✅ Mark scheme
This is a SQL injection attack [1]; the malicious input is inserted into the SQL query without being sanitised — the quote character (') closes the username string prematurely, and 'OR 1=1' is appended [1]; since 1=1 is always true, the condition evaluates to true for every row in the database — the attacker gains access without knowing a valid password [1]; the '--' comments out the rest of the query (the password check) so it is ignored entirely [1].
Q4Explain the difference between a DDoS attack and a regular DoS attack. Why is DDoS harder to defend against?[3]
✅ Mark scheme
A DoS (Denial of Service) attack floods a server with traffic from a single source machine — the server cannot respond to legitimate requests [1]; a DDoS (Distributed Denial of Service) uses a botnet — a network of thousands of compromised machines (often infected with malware without the owners' knowledge) — all simultaneously sending traffic to the target [1]; DDoS is harder to defend against because the traffic comes from thousands of different IP addresses, making it very difficult to distinguish attack traffic from legitimate traffic — simply blocking one IP does not stop the attack [1].
Q5State four measures an organisation can take to protect against security threats. For each, briefly explain what it protects against.[4]
✅ Mark scheme
Any four from: firewall — blocks unauthorised network traffic / external attack attempts [1]; antivirus — detects and removes known malware such as viruses, worms, trojans [1]; encryption — protects data in transit from man-in-the-middle interception; data is unreadable without the key [1]; multi-factor authentication — prevents account takeover even if a password is stolen via phishing [1]; software updates/patching — fixes known vulnerabilities that worms/exploits target [1]; user education/training — helps users recognise phishing and social engineering attacks [1]; input validation/parameterised queries — prevents SQL injection [1]; backups — allows recovery from ransomware without paying [1]; principle of least privilege — limits damage if an account is compromised [1].
Q6A user receives an email from "IT Support" saying they need to reset their password urgently by clicking a link. Describe what type of attack this might be and state two checks the user should make before clicking.[3]
✅ Mark scheme
This is likely a phishing attack — the attacker is impersonating an IT department to steal the user's credentials [1]; any two checks: check the sender's actual email address (not just the display name) — legitimate IT support uses company domain emails [1]; hover over the link to check the actual URL before clicking — it may redirect to a fake site not on the company's domain [1]; contact IT support directly using a known phone number or internal messaging to verify the request [1]; check for signs of urgency, poor grammar, or spelling errors which are common phishing indicators [1].
Q7Describe how a SQL injection attack works. Explain why the following login query is vulnerable: SELECT * FROM Users WHERE username='[input]' AND password='[input]', and show an example malicious input for the username field. State two ways to prevent SQL injection.[5]
✅ Mark scheme
SQL injection: an attacker inserts SQL metacharacters into user input to alter the query's logic [1]; the query is vulnerable because user input is concatenated directly into the SQL string without sanitisation, allowing injected SQL to be executed [1]; example malicious input: username = admin'-- (or admin' OR '1'='1) — the -- comments out the password check, granting access without a valid password [1]; Prevention 1: use parameterised queries (prepared statements) — user input is treated as data, never as SQL [1]; Prevention 2: input validation / whitelist checking — reject or escape special characters such as ' ; -- before processing [1].
Q8Describe the difference between a virus, a worm, and a Trojan horse. For each, state: how it spreads, whether it requires user action to propagate, and one method used to detect or prevent it.[6]
✅ Mark scheme
Virus: attaches to legitimate files; spreads when the infected file is shared or executed; requires user action (opening the file) to propagate [1]; detection: anti-virus software scans files for known virus signatures [1]; Worm: self-replicating program that spreads across networks by exploiting vulnerabilities; does not require user action — it propagates automatically [1]; detection/prevention: firewall blocks unexplained outbound connections; OS patches close exploited vulnerabilities [1]; Trojan horse: disguised as legitimate software; spread by deceiving users into downloading and running it; requires user action to install [1]; prevention: software should only be downloaded from trusted, verified sources; application allow-listing prevents unauthorised executables running [1].
Topic Quiz
Question 1 of 10
You scored
out of 10
Card 1 of 12
Click to reveal definition
🎉
All cards reviewed!
Term
Definition
🎯
Mini Test — 3.5.1 Security Threats
10 questions · 10 marks · 10 minutes
⏱ 10:00
Section A — Multiple Choice [5 marks]
Q1What distinguishes a worm from a virus?
Q2Ransomware attacks a system by:
Q3What is spear phishing?
Q4What is the best defence against SQL injection attacks?
Q5What is a botnet?
Section B — Short Answer [5 marks]
Q6State three types of malware and give one characteristic of each.
Mark schemeAny three from: Virus — attaches to a host file, needs human action to spread [1]; Worm — self-replicating across networks, no host file needed [1]; Trojan — disguised as legitimate software, no self-replication [1]; Ransomware — encrypts files, demands ransom for decryption key [1]; Spyware — secretly collects user data/activity [1]; Keylogger — records keystrokes to capture passwords [1].
Q7Explain what a man-in-the-middle attack is and describe one way to prevent it.
Mark schemeA man-in-the-middle (MITM) attack is where an attacker secretly intercepts and can read or alter communications between two parties who believe they are communicating directly with each other [1]; prevention: using encryption (HTTPS/TLS) ensures data in transit is encrypted so even if intercepted it cannot be read; using a VPN, or only connecting to trusted networks [1].
Q8Describe how a brute force attack works and state one measure to reduce its effectiveness.
Mark schemeA brute force attack systematically tries every possible combination of characters for a password until the correct one is found — it is guaranteed to eventually find the password but takes longer for longer/more complex passwords [1]; measure to reduce effectiveness: use long, complex passwords (the longer and more complex, the exponentially longer a brute force takes) [1]; OR: account lockout after a set number of failed attempts — prevents automated rapid guessing; OR: CAPTCHA to slow automated attempts; OR: MFA so knowing the password alone is insufficient.
Q9Explain the principle of least privilege and why it is important for security.
Mark schemeThe principle of least privilege means each user account/process is given only the minimum permissions necessary to perform its intended function — nothing more [1]; importance: if an account is compromised by an attacker, they can only access and modify what that account could access — limiting the damage; a standard user account being compromised is far less damaging than an administrator account being compromised [1].
Q10A company suffers a ransomware attack and all files are encrypted. Suggest how regular backups could have reduced the impact, and state one property that backups should have to be most effective.
Mark schemeIf the company had regular backups, they could restore their files from the backup without paying the ransom — the attack would cause minimal disruption rather than catastrophic data loss [1]; property: backups should be stored offline or in a separate location (not connected to the main network) — ransomware often attacks all connected network drives; if the backup is connected it may also be encrypted by the ransomware [1]. Accept: backups should be tested/verified regularly to ensure they actually work.