Cybersecurity is the practice of protecting systems, networks, and data from digital attacks, unauthorised access, damage, or theft. As more of our personal and professional lives move online, cybersecurity has become one of the most critical areas of computing.
Cyber threats can target individuals, businesses, governments, and critical infrastructure such as hospitals and power grids.
Malware (malicious software) is any software intentionally designed to harm, disrupt, or gain unauthorised access to a computer system. There are several distinct types:
| Type | How it works | Key feature |
|---|---|---|
| Virus | Attaches itself to a legitimate program or file and spreads when that file is executed or shared | Requires a host file; spreads through user action |
| Worm | Self-replicates and spreads across networks without needing a host file or user interaction | Self-propagating; can spread extremely fast |
| Trojan | Disguises itself as legitimate software to trick users into installing it, then performs malicious actions | Does not self-replicate; relies on deception |
| Ransomware | Encrypts the victim's files and demands a ransom (often cryptocurrency) in exchange for the decryption key | High financial impact; WannaCry is a famous example |
| Spyware | Secretly monitors user activity and sends data (keystrokes, passwords, browsing habits) to an attacker | Runs silently in the background |
Phishing involves sending fraudulent emails or messages that appear to come from a legitimate, trusted source (such as a bank, employer, or government agency). The goal is to trick recipients into:
Example: An email claiming to be from HMRC saying "You have a tax refund — click here to claim it" leads to a fake site that harvests the victim's bank details.
Social engineering manipulates people psychologically rather than exploiting technical vulnerabilities. Attackers exploit trust, urgency, or fear to trick people into revealing information or granting access. Phishing is one form of social engineering. Others include:
SQL injection exploits web forms that do not properly validate user input. An attacker types malicious SQL commands into an input field (such as a search box or login form). If the website passes this input directly to a database without sanitising it, the attacker can:
' OR 1=1 --)SQL injection is one of the most common and dangerous web vulnerabilities.
A Denial of Service (DoS) attack floods a server or network with enormous amounts of traffic or requests, overwhelming it so that it cannot respond to legitimate users — effectively taking the service offline.
A Distributed DoS (DDoS) uses a botnet — a network of thousands of compromised machines — to launch the attack simultaneously from multiple sources, making it far harder to block.
Impact: loss of revenue, reputational damage, and disruption to critical services.
A brute force attack systematically tries every possible combination of characters until the correct password is found. The time required depends on the password length and complexity — a short, simple password can be cracked in seconds; a long, complex one could take centuries.
Countermeasures: account lockout after failed attempts, strong password policies, MFA.
In a man-in-the-middle attack, the attacker secretly intercepts the communication between two parties (e.g. a user and their bank's website). The attacker can read, alter, or inject data without either party realising. This is especially dangerous on unsecured public Wi-Fi networks.
Countermeasure: using HTTPS (encrypted connections) prevents MitM attacks.
A firewall monitors and filters incoming and outgoing network traffic based on predefined security rules. It acts as a barrier between a trusted internal network and untrusted external networks (such as the internet).
Important: a firewall blocks suspicious traffic — it does NOT remove malware. Antivirus software does that.
Encryption converts data into an unreadable format (ciphertext) that can only be decoded with the correct key. Even if data is intercepted, it is useless without the key.
A strong password is long, complex, and unique — using a mix of uppercase, lowercase, digits, and symbols. Password managers help users manage many different strong passwords.
Multi-factor authentication (MFA) requires users to prove their identity using two or more different types of evidence:
Even if an attacker steals a password, they cannot log in without the second factor.
Software vulnerabilities are discovered regularly. Developers release patches — updates that fix these security holes. Keeping software and operating systems up to date closes known vulnerabilities before attackers can exploit them. Delaying updates leaves systems exposed.
Access control ensures users can only access the data and systems they need for their role. The principle of least privilege means giving users the minimum permissions required — reducing the damage if an account is compromised.
Penetration testing (ethical hacking) involves authorised security professionals attempting to breach a system using the same techniques as real attackers. Vulnerabilities discovered can then be patched before malicious actors find and exploit them.
Since many attacks (especially phishing and social engineering) target human behaviour rather than technical systems, training staff to recognise threats is one of the most effective defences. This includes spotting suspicious emails, safe password practices, and knowing who to report incidents to.
The Computer Misuse Act 1990 is the primary UK law addressing cybercrime. It created three specific criminal offences:
| Offence | Description | Example |
|---|---|---|
| 1. Unauthorised access | Accessing any computer system or data without permission — even if no damage is done | Logging into someone else's account without their consent |
| 2. Unauthorised access with intent | Accessing a system without permission with the intent to commit a further crime | Breaking into a company's database to steal credit card details for fraud |
| 3. Unauthorised modification | Making unauthorised changes to computer data — includes installing malware, deleting files, or altering records | Releasing a virus that corrupts files on other people's machines |
The Act was later updated by the Police and Justice Act 2006 to cover DDoS attacks and other modern threats.
8 Edexcel-style questions · instantly marked
| Term | Definition |
|---|
Timed exam-style test.