5.3 Cyber security

Cyber Security Threats

1. Defining Malware

Malware (Malicious Software) is an umbrella term for any software intentionally designed to cause damage to a computer, server, client, or computer network.

The "Virus" Distinction: People often use "Virus" to mean any bad software, but technically, a Virus is a specific type of malware that must attach itself to a program and requires human action (like opening a file) to spread. Other malware, like Worms, can spread on their own.

2. Common Cyber Threats

Viruses

Code that replicates itself by attaching to other files. It can delete data or corrupt the operating system.

Example: You download a "free game" that contains a hidden script. When you run the game, the script deletes your documents.
Worms

Standalone malware that replicates itself to spread to other computers, usually across a network, without human help.

Example: A program enters a company network through one weak PC and automatically copies itself to every other PC on the server.
Trojan Horse

Software that looks legitimate but contains a hidden malicious function. It creates a "backdoor" for hackers.

Example: A "PC Speed Up" tool that actually installs software allowing a hacker to control your webcam remotely.
Spyware

Software that gathers information about a person or organization without their knowledge (includes Keyloggers).

Example: A hidden program records every key you press while logging into your bank and sends it to a server in another country.
Ransomware

Encrypts the user's files and demands a payment (usually in Bitcoin) to provide the decryption key.

Example: A hospital's patient records are locked; a message appears saying they must pay $50,000 to get the data back.
Phishing

Sending fraudulent communications (usually email) that appear to come from a reputable source to steal sensitive data.

Example: An email from "Paypal" tells you your account is locked and asks you to click a link to "verify" your password.
Pharming

Malicious code installed on a user's PC or a DNS server that misdirects users to a fraudulent website even if they type the correct URL.

Example: You type "www.bank.com", but the malware sends you to a fake version of the site that looks identical to the real one.
DoS / DDoS

Flooding a server with useless traffic to make it crash or become unavailable to legitimate users.

Example: Millions of automated "requests" hit a school's website at once, causing the server to shut down during exam results day.

2b. Brute-force Attack

A brute-force attack is an attempt to gain access to an account by trying every possible combination of characters until the correct password is found. It uses software to make the attempts automatically, at enormous speed, rather than a person guessing.

It relies entirely on there being few enough possibilities to get through. That is why the standard defences work the way they do:

  • Longer passwords — each extra character multiplies the number of combinations, so length matters far more than complexity alone.
  • A mixture of character types — upper case, lower case, numbers and symbols enlarge the set of possibilities per character.
  • Limiting login attempts — locking the account after a few failures, which stops the attack outright because it depends on making millions of attempts.
  • Two-step verification — a correct password alone is then not enough to get in.
Why it is not the same as phishing. A brute-force attack does not involve deceiving anybody — nobody is tricked into handing anything over. It is a computational attack on the password itself. Phishing and social engineering target the user; brute force targets the password.

3. Social Engineering

Many of these threats rely on Social Engineering. This is the art of manipulating people so they give up confidential information. It targets the human rather than the hardware.

⚠️ Exam Alert: Phishing vs. Pharming
  • Phishing: Uses an Email to lure the user.
  • Pharming: Uses Malicious Code to redirect the user (even if they type the right address).

Cybersecurity Protection Measures

1. Access Control & Authentication

The first line of defense is ensuring only authorized users can access the system.

Passwords & Biometrics

Using unique strings or physical traits (Fingerprints, FaceID) to verify identity.

Requirement: Passwords should be "strong" (mixed case, symbols, numbers).

Two-Factor Authentication (2FA)

Requires two forms of identification: Something you know (password) and Something you have (a code sent to your phone).

1b. Access Levels and Privileges

Authentication proves who you are. Access levels decide what you are then allowed to do — and the two are different security measures.

Each user account is given a set of privileges determining which data it can reach and what it may do with it. A common arrangement is:

  • Read-only — the user can view data but cannot alter it;
  • Read and write — the user can view and change data;
  • No access — the data is not visible to that user at all;
  • Administrator — full control, including managing other users' access.

In a school system, for example, a student may read their own report but not edit it, a teacher may enter grades for their own classes, and only an administrator can create accounts. The principle is to give every user the minimum access their role requires, so that a compromised account exposes as little as possible.

2. Network Defenses

Firewalls

Monitors incoming and outgoing traffic. It blocks data packets that do not meet specific security criteria.

  • Prevents unauthorized access.
  • Can block specific IP addresses or ports.
Proxy Servers

Acts as an intermediary. It hides the user's real IP address from the web and can filter out malicious websites before they reach the user.

3. Data Protection: Encryption

If data is stolen or intercepted, Encryption ensures the thief cannot read it.

How it Works

Plaintext is converted into Ciphertext using an algorithm and a "Key."

PLAINTEXT + KEY ➔ CIPHERTEXT

Symmetric Encryption: Uses the same key for both encrypting and decrypting. (Risky to share the key).

Asymmetric Encryption: Uses a Public Key to encrypt and a Private Key to decrypt. (Much more secure for the Internet).

4. Software Defense

Anti-Malware Software

Scans files against a database of known "Signatures" of malware. If a match is found, the file is quarantined or deleted.

Security Updates (Patches)

Software developers release "patches" to fix security holes (vulnerabilities) discovered in their programs. Keeping software updated is vital.

5. Human Defenses

Since many attacks target humans (Social Engineering), education is the best defense:

  • Don't click: Links in suspicious emails.
  • Verify: Check the URL of a website before entering data (look for the padlock 🔒).
  • Privacy Settings: Limit what you share on social media.
⚠️ Exam Tip: If asked how to protect a network, mention Firewalls and Proxy Servers. If asked how to protect data being sent, the answer is Encryption.