Cyber security consists of the processes, practices and technologies designed to protect networks, computers, programs and data from attack, damage or unauthorised access.
Processes and practices: what people and organisations do, e.g. training staff, checking who can see which files, making backups.
Technologies: hardware and software that protect, e.g. anti-malware software, firewalls, encryption.
Its main purposes are to protect networks, computers, programs and data from:
• attack: e.g. malware or someone trying to break in;
• damage: e.g. data being deleted or changed;
• unauthorised access: e.g. someone reading data they have no right to see.
A cyber security threat is anything that could lead to one of these. You need seven: social engineering, malware, pharming, weak and default passwords, misconfigured access rights, removable media, and unpatched or outdated software.
The threats on the course
Exam tip‘Keeping you safe online’ earns nothing as a definition. Learn AQA’s wording: processes, practices and technologies to protect networks, computers, programs and data from attack, damage or unauthorised access.
Cyber security
The processes, practices and technologies designed to protect networks, computers, programs and data from attack, damage or unauthorised access.
Unauthorised access
Using or viewing a computer system or data without permission.
AQA 8525 · 3.6.2.1
Social engineering
Social engineering is the art of manipulating people so they give up confidential information.
It attacks people, not technology. A strong system can still be broken into if someone is tricked into handing over a password.
Attackers use trust, fear, urgency or helpfulness: ‘Your account will be closed today unless…’, ‘I’m from IT support and need your password to fix this.’
The three forms you need are blagging, phishing and shouldering (next section).
How to protect against social engineering
Why it helps
Train staff to spot the signs (urgent requests, odd sender addresses, callers asking for passwords)
People are the target, so people who know the tricks are harder to fool.
A policy that staff never give passwords or personal data over the phone or by email
Even a convincing caller gets nothing.
Check identities: call back on a number you already know, not one the caller gives
An attacker can’t answer a call to the real number.
Check links and sender addresses before clicking; type known web addresses yourself
Stops a fake link leading to a fake site.
Cover the keypad when entering a PIN; use privacy screens on laptops in public
Stops someone watching what you type.
DefencesTechnical measures that also help, such as two-factor authentication and biometrics, are in the Network security topic.
Social engineering
The art of manipulating people so they give up confidential information.
AQA 8525 · 3.6.2.1
Blagging, phishing and shouldering
Blagging v phishing: blagging uses an invented scenario aimed at a targeted victim, often live, by phone or in person. Phishing uses fraudulent messages, usually email or text, often sent to many people, usually with a link to a fake site.
Shouldering needs no message or story at all: the attacker just watches.
Form
AQA definition
What it looks like
Blagging (pretexting)
The act of creating and using an invented scenario to engage a targeted victim in a manner that increases the chance the victim will divulge information or perform actions that would be unlikely in ordinary circumstances.
A caller pretends to be from the bank’s fraud team and talks a particular person into ‘confirming’ their security details. The invented story (the pretext) is the key.
Phishing
A technique of fraudulently obtaining private information, often using email or SMS.
A text that looks like it’s from a delivery firm says a parcel is waiting and links to a fake page asking for card details. Often sent to thousands of people at once.
Shouldering (shoulder surfing)
Observing a person’s private information over their shoulder, e.g. cashpoint machine PIN numbers.
Someone in a queue watches a person type their PIN, or reads a password typed on a laptop on a train.
Exam tip‘Making up a story’ is too thin for both blagging and phishing. For blagging, add the invented scenario and the targeted victim who is persuaded to do or say something they normally wouldn’t. For phishing, add the fake email or SMS trying to get private data such as passwords or bank details.
Blagging (pretexting)
Creating and using an invented scenario to engage a targeted victim so they are more likely to divulge information or perform actions they normally wouldn’t.
Phishing
A technique of fraudulently obtaining private information, often using email or SMS.
Shouldering
Observing a person’s private information over their shoulder, e.g. cashpoint machine PIN numbers.
AQA 8525 · 3.6.2.2
Malware: viruses, trojans and spyware
Malware is an umbrella term used to refer to a variety of forms of hostile or intrusive software. You need three forms.
Protecting against malware: anti-malware software that scans files and removes threats; keeping software up to date; only installing software from trusted sources; not opening unexpected attachments or links; regular backups so data can be restored.
Form
What it is
How it works
Computer virus
A small program, with a malicious purpose, attached to another program or data file.
When the infected program or file is run (executed), the virus runs too. It replicates by attaching itself to other programs, so it spreads, e.g. through shared files.
Trojan
A program, with a malicious purpose, that hides in or masquerades as desirable software, such as a utility or a game.
The user is fooled into installing it themselves, thinking it’s useful. Once installed it attacks the computer, e.g. opening a way in for an attacker. It doesn’t replicate.
Spyware
Malicious software that gathers data from a user and sends it back to a third party without the consent of the user.
It runs secretly, recording e.g. keys pressed, websites visited or passwords, and sends the data to the attacker.
Exam tipDescribe how it works, not just that it’s harmful. A virus spreads when the infected file is executed, not just downloaded. Worms, adware and ransomware gained no marks when AQA asked about its three forms: stick to virus, trojan and spyware.
DefencesAutomatic software updates and firewalls are in the Network security topic.
Malware
An umbrella term used to refer to a variety of forms of hostile or intrusive software.
Virus
A small program, with a malicious purpose, attached to another program or data file; it replicates by attaching itself to other programs.
Trojan
A program, with a malicious purpose, that hides in or masquerades as desirable software, such as a utility or a game, but attacks computers it infects.
Spyware
Malicious software that gathers data from a user and sends it back to a third party without the consent of the user.
AQA 8525 · 3.6.2
Pharming
Pharming is a cyber attack intended to redirect a website’s traffic to a fake website.
The user types the correct web address, or uses a saved bookmark, but ends up on a fake copy of the site.
It can be done by malware that changes settings on the user’s computer, or by tampering with the system that turns web addresses into IP addresses, so many users are redirected at once.
The fake site looks like the real one. When users log in, the attacker collects their usernames, passwords or card details.
Pharming v phishing: phishing tricks someone into clicking a link in a fake message; pharming needs no message: even careful users who type the address are sent to the fake site.
Protection: anti-malware software and up-to-date software stop the computer’s settings being changed; users can check that the site uses HTTPS and that its address and certificate are correct before logging in.
Phishing starts with a message; pharming redirects a correctly typed address
Pharming
A cyber attack intended to redirect a website’s traffic to a fake website.
AQA 8525 · 3.6.2
Weak and default passwords
A weak password is one that is easy for a human or computer to guess, e.g. password1, a pet’s name, or a short word.
People can guess passwords from things they know about you, such as birthdays and names found on social media.
A computer can try millions of guesses a second, working through lists of common passwords and dictionary words. Short passwords using only lowercase letters fall very quickly.
A default password is usually pre-configured by a manufacturer with the assumption that it will be changed by the user. Default passwords are often well known or can be easily discovered, e.g. in the device’s online manual.
Routers, security cameras, printers and smart devices often ship with a default admin password such as admin. If it isn’t changed, anyone who finds the device can log in and change its settings.
Sharing or reusing passwords makes things worse: one leaked password opens several accounts, and you can’t tell who did what.
DefencesStrong password rules, locking accounts after failed attempts, and two-factor authentication are in the Network security topic.
Weak password
A password that is easy for a human or computer to guess.
Default password
A password pre-configured by a manufacturer, assuming the user will change it; often well known or easily discovered.
AQA 8525 · 3.6.2
Misconfigured access rights
Misconfigured access rights occur when users or groups are given the wrong permissions to access resources.
Access rights (permissions) say what each user can do with each file or folder: nothing, read only, or read and change.
Examples of misconfiguration: every staff member can open the payroll folder; a trainee can delete customer records; a contractor who has left can still log in; a shared folder is open to the public on the Internet.
How it’s exploited: a user (or an attacker using their account) can see, copy, change or delete data they should never reach. A curious or angry employee, or malware running under their account, does more damage.
The fix is about permissions themselves: give each user only the access their job needs (least privilege); make data read-only where it only needs to be viewed; review rights regularly; remove accounts when people leave.
Exam tipThis was the least understood threat in an AQA exam. MAC address filtering and two-factor authentication don’t fix it: they control who gets onto the network or into an account, not what an account is allowed to do once it’s in.
Access rights
Permissions that set what a user or group can do with a resource, e.g. no access, read only, or read and write.
Misconfigured access rights
When users or groups are given the wrong permissions to access resources.
AQA 8525 · 3.6.2
Removable media and unpatched software
A patch is an update that fixes a problem, often a security weakness.
Both threats are about everyday habits: plugging things in, and clicking ‘remind me later’ on updates.
Threat
What it is
How it can be exploited
Removable media
Any removable secondary storage device onto which data can be copied and easily removed from the computer, e.g. a USB memory stick.
Malware in: a stick used on an infected computer at home carries malware onto a work computer; attackers even leave infected sticks where staff will find them. Data out: data copied onto a stick can be lost, stolen or taken by someone leaving the organisation.
Unpatched and/or outdated software
Unpatched software is software with known security vulnerabilities that have not been fixed through applying a software update.
Once a weakness is made public, attackers write tools to exploit it, so computers that haven’t been updated are easy targets. Outdated software that the maker no longer supports gets no fixes at all, so new weaknesses stay open for ever.
DefencesAutomatic software updates are in the Network security topic. Organisations can also scan removable media with anti-malware software or block USB ports.
Removable media
Any removable secondary storage device onto which data can be copied and easily removed from the computer, e.g. USB memory stick.
Unpatched software
Software with known security vulnerabilities that have not been fixed through applying a software update.
Patch
A software update that fixes a problem, such as a security weakness.
AQA 8525 · 3.6.2
Penetration testing
Penetration testing is the process of attempting to gain access to resources without knowledge of usernames, passwords and other normal means of access.
What it’s for: an organisation pays testers to simulate an attack, with permission, to find its weaknesses before real attackers do. The testers report what they found so it can be fixed.
Type 1: simulating a malicious insider. The person or team testing the system has knowledge of, and possibly basic credentials for, the target system. It shows what a dishonest employee could do.
Type 2: simulating an external attack. The person or team testing the system has no knowledge of any credentials for the target system. It shows what an outsider could do.
Insider and external penetration tests
Exam tipAlways say the attack is simulated and authorised. Answers that described ‘hacking’, ‘white hat/black hat’ hackers or ‘black box testing’ lost marks. For the external type, say the tester has no knowledge of any credentials.
Penetration testing
The process of attempting to gain access to resources without knowledge of usernames, passwords and other normal means of access.
Malicious insider
Someone inside an organisation, such as an employee, who misuses their access.
Genious