Malware is malicious software intentionally designed to cause harm. You need five kinds: viruses, worms, Trojans, ransomware and key loggers.
A cyberattack is an attempt to damage, disrupt or gain unauthorised access to a computer system, network or its data.
Malware can: delete or corrupt data; steal data such as passwords and bank details; lock users out; slow computers and networks; give a criminal control of a computer.
Criminal hackers break into computer systems and networks without permission. They get in in two main ways: by exploiting technical vulnerabilities (weaknesses in software) and by social engineering (tricking people). Both come later in this topic.
Breaking into a system is a crime under computer misuse legislation (see the Environmental, ethical and legal issues topic).
Malware
Malicious software intentionally designed to cause harm.
Cyberattack
An attempt to damage, disrupt or gain unauthorised access to a computer system, network or data.
Criminal hacker
Someone who breaks into computer systems and networks without permission.
Edexcel 1CP2 · 5.3.1
Viruses and worms
Virus
Worm
What it is
Malware that attaches itself to another program or file (its host).
Standalone malware: it needs no host file.
How it replicates
When the infected file is run or opened, the virus runs and copies itself into other files.
It copies itself automatically.
How it spreads
When infected files are shared (email attachments, downloads, USB sticks, shared drives) and then opened.
Across networks on its own, through security weaknesses in other computers, with no user action.
Harm
Deletes or corrupts files; slows the computer; may carry other malware.
Uses up bandwidth, slowing the network; may carry other malware, such as ransomware.
How a virus and a worm spread
Exam tipExaminers often saw worms confused with viruses. A worm does not need a host file or a person to open anything: ‘worms spread through links in emails’ wasn’t accepted. It spreads itself across a network.
Virus
Malware that attaches itself to a program or file and copies itself into other files when the infected file is run.
Worm
Standalone malware that replicates itself and spreads across networks without a host file or any user action.
Edexcel 1CP2 · 5.3.1
Trojans, ransomware and key loggers
Key loggers can be software or a small hardware device plugged between a keyboard and a computer. Some employers use them legally to monitor work computers; the threat is their malicious use.
Ransomware often arrives through a Trojan, a worm or a phishing email.
Malware
How it works
What criminals use it for
Trojan
Disguised as legitimate, useful software (a free game, a ‘speed-up’ tool). The user installs it themselves, not knowing what it is. It doesn’t replicate.
Once installed: opening a ‘back door’ so the criminal can control the computer; stealing data; installing other malware.
Ransomware
Encrypts the user’s files or locks the computer, then displays a demand for payment.
Extorting money: victims are told to pay (often in cryptocurrency) to get a key to unlock their files. Paying doesn’t guarantee the files come back.
Key logger
Records every key the user presses and sends the record to the criminal.
Capturing usernames, passwords and card numbers as they are typed, so the criminal can log in as the victim.
Exam tip‘A Trojan is a virus’ won’t score. Say how it gets installed (disguised as useful software, so the user installs it) and what it does next (opens a back door, steals data).
Trojan
Malware disguised as legitimate software, which the user installs; it then steals data or gives a criminal access.
Ransomware
Malware that encrypts or locks a user’s files and demands payment to release them.
Key logger
Malware (or a device) that records the keys a user presses, so passwords and card numbers can be stolen.
Back door
A hidden way into a computer that lets a criminal get in without logging in normally.
Edexcel 1CP2 · 5.3.1
Technical vulnerabilities
A technical vulnerability is a weakness in hardware or software that a hacker can exploit to get into a system. Pearson names two.
Protection: install updates and patches promptly (turn on automatic updates); keep anti-malware and its signature database updated automatically; replace software that the maker no longer supports.
Vulnerability
Why it is exploited
Unpatched software
Software (including the operating system) has bugs that leave security holes. The maker releases a patch (an update that fixes them). Once a patch is out, the hole is widely known, so hackers target computers that haven’t installed it.
Out-of-date anti-malware
Anti-malware can only recognise malware in its database of signatures. If the database isn’t updated, new malware isn’t recognised, so it can infect the computer unnoticed.
Exam tipLink the weakness to the attack: ‘the update fixes a known security hole (1), so an unpatched computer can still be attacked through that hole (1).’
Technical vulnerability
A weakness in hardware or software that a hacker can exploit.
Patch
An update released by a software maker to fix bugs and security holes.
Unpatched software
Software that hasn’t had the latest fixes installed, so known security holes are still open.
Edexcel 1CP2 · 5.3.1
Social engineering
Social engineering means manipulating people into giving away confidential information or access, or into breaking normal security procedures. It attacks people, not technology.
Attackers use trust, fear, urgency, curiosity or greed: ‘Your account will be closed today…’, ‘You’ve won…’.
Why clicking a link from an unknown sender is risky: it may download malware, or open a fake login page that captures whatever is typed.
Protection: train staff to spot the signs; never give passwords by phone or email; check a caller’s identity by calling back on a known number; type known web addresses yourself; report suspicious messages.
Technique
How it works
Example
Phishing
Fake emails or texts that seem to come from a trusted organisation, often with a link to a fake website or an infected attachment.
An email ‘from the tax office’ says a refund is waiting and links to a fake form asking for bank details.
Pretexting
The attacker invents a believable story (a pretext) and pretends to be someone with a reason to ask, to win the victim’s trust.
A caller claims to be from the company’s auditors and needs the finance manager’s login ‘to finish the audit today’.
Baiting
Offering something tempting to lure the victim into a trap.
USB sticks labelled ‘Staff pay rises’ left in a car park, loaded with malware; a ‘free film’ download containing a Trojan.
Quid pro quo
Offering a service or reward in exchange for information or access (‘something for something’).
A caller offers ‘free help’ to fix a slow computer if the user turns off their anti-malware and gives remote access.
Exam tipSocial engineering isn’t a technical attack. When asked how to stop it, start with people: training and clear rules (an acceptable use policy). Technical measures such as email filtering and multi-factor authentication (Network security topic) help too.
Social engineering
Manipulating people into giving away confidential information or access, or breaking security procedures.
Phishing
Fake emails or texts that seem to come from a trusted organisation, to get the victim to click a link or give away details.
Pretexting
Inventing a believable story and pretending to be someone else to win the victim’s trust and get information.
Baiting
Luring a victim with something tempting, such as a free download or an infected USB stick.
Quid pro quo
Offering a service or reward in exchange for information or access.
Edexcel 1CP2 · 5.3.2
Anti-malware
Anti-malware software detects malware, stops it running and removes it. It scans files as they are downloaded or opened, and scans the whole computer on a schedule.
When malware is found, the file is quarantined (moved somewhere it can’t run) or deleted, and the user is alerted.
Most anti-malware uses both methods together.
Signature-based detection
Behaviour-based detection
How it works
Compares the code in each file with a database of signatures (patterns unique to known malware).
Monitors what programs do and flags suspicious actions, such as changing system files, copying itself or encrypting lots of files quickly.
Strength
Fast; accurate for malware already in the database.
Can detect new malware that has no signature yet, and malware that changes its code.
Weakness
Can’t detect new malware until the database is updated.
May flag safe programs that behave unusually (false alarms); can slow the computer.
The two detection methods
Utility softwareAnti-malware is also a utility (Operating systems and utility software topic). Here you need its two detection methods.
Anti-malware
Software that detects, quarantines and removes malware.
Signature
A pattern in a file’s code that identifies a particular known piece of malware.
Signature-based detection
Comparing files with a database of known malware signatures.
Behaviour-based detection
Monitoring what programs do and flagging suspicious actions.
Quarantine
Moving a suspect file to a safe area where it can’t run or spread.
Edexcel 1CP2 · 5.3.2
Encryption
Encryption is the process of encoding data so that it cannot be read by anyone who doesn’t have the decryption key.
Plaintext is the readable data. An algorithm and a key turn it into ciphertext, which looks like random characters. Only someone with the right key can decrypt it back to plaintext.
Encryption doesn’t stop data being stolen, copied or intercepted. It makes stolen data useless to anyone without the key.
Data stored: encrypt hard drives, laptops, phones, USB sticks and backups, so a lost or stolen device gives nothing away.
Data sent: encrypt data travelling over networks, such as web pages sent by HTTPS (Protocols topic) and messaging apps.
The key must be kept secret and separate from the data: sending the key with the data defeats the point.
Plaintext, ciphertext and the key
Exam tipDon’t say encryption ‘stops hackers getting the data’. Say the data can’t be understood without the key.
Encryption
Encoding data so that it cannot be read by anyone without the decryption key.
Plaintext
Data in its readable form, before encryption or after decryption.
Ciphertext
Encrypted data, unreadable without the key.
Key
The secret value used with the algorithm to encrypt or decrypt data.
Edexcel 1CP2 · 5.3.2
Acceptable use policies
An acceptable use policy (AUP) is a document that sets out what users may and may not do with an organisation’s computer systems, and what happens if they break the rules. Users usually sign it before they get an account.
Typical contents: password rules (don’t share or write them down); no installing software; no USB sticks from home; don’t open attachments or links from unknown senders; which websites and personal use are allowed; how to handle personal data; how to report a problem or suspicious email; the consequences of breaking the policy.
How it protects systems and data: users know which actions are safe and which are banned, so they follow safe practices; the consequences are clear, which deters risky behaviour; the organisation can take action if someone breaks it.
An AUP is a policy: it changes how people behave. It doesn’t technically block anything by itself, so it works alongside anti-malware, firewalls and access control.
Exam tipExaminers saw AUPs confused with access control and anti-malware. An AUP is a set of rules for people. Explain it as: users follow safe practices (1) because the permitted activities and consequences are set out (1).
Acceptable use policy (AUP)
A document setting out what users may and may not do with an organisation’s systems, and the consequences of breaking the rules.
Edexcel 1CP2 · 5.3.2
Backup and recovery
A backup is a copy of data kept separately, so the data can be restored if the original is lost, damaged, deleted, stolen or encrypted by ransomware. Recovery is restoring data from a backup.
Back up regularly: the more often, the less work is lost when something goes wrong. Many organisations make a full backup weekly and incremental backups daily.
Off-site storage: keep a copy in a different place (another building or the cloud), so a fire, flood or theft at the main site doesn’t destroy the backup too.
RAID: data is stored across several hard drives; in mirroring, every file is written to two drives at once, so if one drive fails the other still has the data and work carries on. RAID doesn’t replace backups: a deleted or ransomware-encrypted file is changed on both drives.
Stand-by equipment and premises: spare computers, servers or a second site ready to use, so the organisation can keep working while the main systems are fixed.
Recovery procedures: a written plan of what to do and who does it; regularly test that backups can actually be restored.
Full backup
Incremental backup
What is copied
Every file.
Only files that have changed since the last backup (of either kind).
Time and storage
Slow; needs the most storage.
Quick; needs much less storage.
Recovery
Simple: restore one backup.
Slower: restore the last full backup, then every incremental backup since, in order.
A full backup, then incremental backups
Exam tip‘To keep data safe’ is too vague. Say what happens if there is no backup: data lost through hardware failure, corruption, deletion or ransomware (1) could not be restored, so work would have to be redone or be lost for good (1).
Backup
A copy of data stored separately so it can be restored if the original is lost or damaged.
Recovery
Restoring data from a backup.
Full backup
A copy of every file.
Incremental backup
A copy of only the files that have changed since the last backup.
RAID
Storing data across several drives, e.g. mirroring it on two, so one drive can fail without data being lost.
Off-site storage
Keeping backups in a different location from the original data.
Genious