Computers and networks store and transmit vast amounts of sensitive data — personal information, financial data, intellectual property. Cyber threats are attempts to damage, disrupt, or gain unauthorised access to computer systems or data. OCR J277 requires knowledge of specific threats, their methods, and motivations.
Malware
Malware (malicious software) is software designed to disrupt, damage, or gain unauthorised access to a computer system.
Type
Description
Effect
Virus
Self-replicating code that attaches to legitimate files and spreads when files are shared
Corrupts or deletes files; spreads to other computers
Worm
Self-replicating malware that spreads across networks WITHOUT needing to attach to a file
Consumes network bandwidth; can carry payloads; spreads very fast
Trojan
Malware disguised as legitimate software. Does NOT self-replicate.
Opens backdoor for attacker; can download other malware
Spyware
Secretly monitors user activity
Steals passwords, keystrokes, credit card numbers
Adware
Displays unwanted advertisements
Slows system; may redirect to malicious sites
Ransomware
Encrypts the victim's files and demands payment for the decryption key
Data inaccessible; financial loss; reputational damage
Social Engineering
Social engineering manipulates people into revealing confidential information or performing actions that compromise security. It exploits human psychology rather than technical vulnerabilities.
Phishing
Deceptive emails, messages, or websites that appear to be from a trusted source (e.g. a bank, HMRC, Royal Mail) to trick victims into revealing passwords, credit card numbers, or personal information. The target clicks a malicious link or attachment.
Spear Phishing
A targeted form of phishing aimed at a specific individual or organisation, using personalised information to make the attack more convincing. Much harder to detect than general phishing.
Pharming
Redirects users from a legitimate website to a fake one (even if they type the correct URL). Achieved by corrupting DNS or the computer's hosts file. The user thinks they're on the real site but enters details into a fake.
Vishing (Voice Phishing)
Phone calls where the attacker pretends to be from a trusted organisation (bank, HMRC, tech support) to extract sensitive information verbally.
Other Cyber Threats
Brute Force Attack
Systematically trying every possible combination of characters to crack a password. Automated tools can try millions of combinations per second. Weak/short passwords are especially vulnerable.
Denial of Service (DoS) Attack
Flooding a server or network with so many requests that it becomes overwhelmed and cannot serve legitimate users. A Distributed DoS (DDoS) uses many compromised computers (a botnet) simultaneously — much harder to block.
Data Interception / Man-in-the-Middle
An attacker intercepts data being transmitted between two parties. They can read, alter, or steal the data. Particularly effective on unsecured Wi-Fi networks. Prevented by encryption (HTTPS).
SQL Injection
Inserting malicious SQL code into an input field (e.g. a login form) to manipulate the database — extracting, modifying, or deleting data. Example: entering ' OR '1'='1 in a username field to bypass login.
Activist groups attacking organisations they disagree with (DDoS)
Challenge / curiosity
Script kiddies and hobbyist hackers
Blackmail
Ransomware; threatening to leak data unless paid
Exam tip: Know the difference between virus (attaches to files, self-replicates), worm (no attachment needed, network-based), trojan (disguised, no self-replication), ransomware (encrypts files for ransom). Phishing vs pharming: phishing tricks the user into clicking a fake link; pharming redirects them even when typing the correct URL. DoS vs DDoS: DDoS uses multiple computers (botnet). SQL injection is about inserting malicious code into input fields.
⚠️ Common Mistakes
Saying a worm attaches to files — worms spread on their own across networks without needing a host file
Saying a trojan self-replicates — trojans do NOT self-replicate; they're just disguised as legitimate software
Confusing phishing and pharming — phishing requires the user to click a link; pharming hijacks DNS/hosts file
Saying DoS and DDoS are the same — DDoS uses multiple computers (distributed) making it harder to block
Not explaining WHY ransomware is effective — it encrypts files so the victim cannot access them without the key
• Social engineering: phishing, pharming, vishing with real examples
• DoS and DDoS attacks explained
• SQL injection demonstration
Click slide or press arrow keys to navigate
Worksheet — 1.4.1 Cyber Threats
8 questions · 22 marks
Q1What is malware? Give two examples.[3]
✅ Mark scheme
Malware is malicious software designed to disrupt, damage, or gain unauthorised access to a computer system [1]; examples include (any two): virus, worm, trojan, spyware, ransomware, adware [1][1].
Q2Describe the difference between a virus and a worm.[2]
✅ Mark scheme
A virus attaches itself to legitimate files and needs human action (file sharing) to spread [1]; a worm is self-replicating and spreads across networks independently without needing to attach to a file [1].
Q3Explain how ransomware works and why it is effective.[3]
✅ Mark scheme
Ransomware encrypts the victim's files [1]; the attacker demands payment (a ransom) in exchange for the decryption key [1]; it is effective because the victim cannot access their files without the key and may feel compelled to pay [1].
Q4What is phishing? Describe how a phishing attack typically works.[3]
✅ Mark scheme
Phishing is a social engineering attack [1]; the attacker sends a deceptive email/message appearing to be from a trusted source (e.g. a bank) [1]; it contains a link to a fake website or malicious attachment designed to steal login credentials or personal information [1].
Q5Explain what a DDoS attack is and how it differs from a DoS attack.[3]
✅ Mark scheme
A Denial of Service (DoS) attack floods a server with traffic/requests so it cannot serve legitimate users [1]; a Distributed DoS (DDoS) uses many compromised computers (a botnet) simultaneously [1]; DDoS is harder to block because traffic comes from many different IP addresses [1].
Q6What is SQL injection? Give an example of how it could be used.[3]
✅ Mark scheme
SQL injection involves entering malicious SQL code into an input field (e.g. login form) to manipulate the underlying database [1]; e.g. entering ' OR '1'='1 in a username field can bypass authentication [1]; attackers can extract, modify, or delete database records [1].
Q7Describe two motivations behind cyber attacks.[2]
✅ Mark scheme
Any two from: financial gain (stealing data/ransomware) [1]; espionage (stealing government secrets) [1]; disruption/hacktivism (attacking organisations they disagree with) [1]; challenge/curiosity [1]; blackmail [1].
Q8A user receives an email appearing to be from their bank asking them to confirm their password. They click the link, which takes them to a convincing-looking website. What type of attack is this? Explain how it works.[3]
✅ Mark scheme
This is phishing [1]; a deceptive email is sent impersonating a trusted organisation (the bank) [1]; the link leads to a fake website designed to steal the user's login credentials when they enter them [1].
?
out of 22 — self-mark above
Topic Quiz
Question 1 of 15
You scored
out of 15
Card 1 of 15
Click to reveal definition
🎉
Complete!
Term
Definition
🎯
Mini Test — 1.4.1 Cyber Threats
10 questions · 10 marks · 10 minutes
⏱ 10:00
10 marks
Section A — Multiple Choice [5 marks]
Q1Which type of malware spreads across networks without needing to attach to a file?
Q2What does ransomware do to a victim's data?
Q3What is the key characteristic of a trojan horse?
Q4A DDoS attack differs from a DoS attack because:
Q5What type of attack involves entering malicious code into a website input field to manipulate a database?
Section B — Short Answer [5 marks]
Q6Describe what phishing is.
Mark schemeA social engineering attack where deceptive emails/messages appear to be from a trusted source to trick victims into revealing passwords or personal information. [1]
Q7What is pharming and how does it differ from phishing?
Mark schemePharming redirects users from a legitimate website URL to a fake one by corrupting DNS/hosts file; phishing requires the user to click a fake link. With pharming, even typing the correct URL takes you to the fake site. [1]
Q8What is a brute force attack?
Mark schemeA brute force attack systematically tries every possible combination of characters to crack a password. Automated tools can try millions of combinations per second. [1]
Q9State two differences between a virus and a worm.
Mark schemeVirus attaches to files; worm spreads independently without a host file [½]. Virus needs user action (file sharing) to spread; worm spreads automatically across networks [½]. [1]
Q10State two motivations for cyber attacks.
Mark schemeAny two: financial gain; espionage; disruption/hacktivism; challenge/curiosity; blackmail. [1]