Home Notes Papers

Cyber security

Paper 1

This section is examined in Paper 1.

Cyber Security Threats: Malware and Botnets

Malware is malicious software designed to damage or gain unauthorized access to a computer system. It includes viruses, worms, trojan horses, spyware, adware, and ransomware.

A botnet is a network of compromised computers (bots) controlled by a perpetrator. This is often created through a DDoS (Distributed Denial of Service) attack process:

  1. A perpetrator sends malware to users (e.g., via email or download).
  2. The user unknowingly downloads and installs the malware.
  3. Each infected computer becomes a 'bot' under the perpetrator's control.
  4. The perpetrator initiates an attack by commanding all bots to send requests simultaneously to a target web server.
  5. The server is overwhelmed by traffic, causing it to crash or become unavailable.
Brute-force Attack
A brute-force attack is a method of gaining unauthorized access by systematically trying every possible combination of characters until the correct password is found. It relies on trial and error rather than exploiting software vulnerabilities.
Cyber Security Threats: Phishing and Pharming

Phishing involves sending fraudulent communications (usually emails) that appear to come from a reputable source. The aim is to trick the user into revealing sensitive information (like passwords or credit card numbers) by clicking a malicious link or downloading an attachment.

Pharming redirects users to a fake website without their knowledge, even if they type the correct URL. The process typically involves:

  1. A user clicks an attachment or link containing malware.
  2. Malicious software is downloaded onto the user's computer.
  3. When the user enters a legitimate website address, the malware redirects them to a fake site designed to steal their data.
⚠︎ Confusing Phishing and Pharming
Mistake: Students often describe phishing as redirecting users to fake websites via DNS manipulation.
Correction: Phishing relies on social engineering (deceptive emails/messages) to trick the user into clicking a link. Pharming involves malware or DNS poisoning that automatically redirects the user to a fake site regardless of what they type.
Describing DDoS Attacks in Diagrams
When asked to annotate a diagram of a DDoS attack, you must explicitly mention the perpetrator sending malware to create a botnet. Examiners look for the phrase 'bots send requests simultaneously' or 'overwhelm the server'. Simply stating 'the server crashes' is insufficient because it does not explain the process of how the crash was caused. You must show the link between the malware infection and the resulting traffic flood.
Security Solutions: Authentication and Access Control
Two-step verification (2SV) or two-factor authentication (2FA) requires two forms of identification: something you know (password) and something you have (e.g., a code sent to a phone). This prevents unauthorized access even if the password is stolen.

Strong passwords are complex, long, and unique. They resist brute-force attacks because the number of possible combinations increases exponentially with length and character variety.

Firewall
A firewall is a security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between a trusted internal network and untrusted external networks (like the internet).
Security Solutions: Data Protection and Maintenance
Backups are copies of data stored separately from the original. Regular backups are essential to restore data after a ransomware attack or hardware failure. Backups should be stored offline or off-site to ensure they are not encrypted by malware that infects the main system.

Regular updates and patching fix security vulnerabilities (bugs) in software. Hackers often exploit known vulnerabilities; applying patches closes these 'holes', preventing malware infection.

⚠︎ Misunderstanding Encryption and Firewalls
Mistake: Stating that encryption stops data from being stolen during transmission.
Correction: Encryption makes data meaningless (unreadable) to anyone without the key. It does not stop the data from being intercepted; it protects its confidentiality if it is intercepted.

Mistake: Using a firewall to protect data in transit over the internet.
Correction: Firewalls protect the network boundary. To secure data in transit, use encryption (e.g., HTTPS/TLS).

Explaining How Solutions Keep Data Safe
When explaining how a solution works, use the phrase 'prevents unauthorized access' or 'protects confidentiality'. For example, when discussing 2FA, explain that it adds an extra layer of security so that a stolen password alone is insufficient. Examiners accept answers that link the mechanism (e.g., 'requires second factor') directly to the outcome ('prevents hacker from logging in').
Past Paper Practice
Q:
Describe a brute-force attack. [3]
A:
A brute-force attack involves trial and error to guess a password. The attacker enters combinations repeatedly until the correct password is found. This can be carried out manually or automatically by software.
Q:
Give two examples of malware. [2]
A:
  1. Virus
  2. Worm (or Trojan horse, Spyware, Adware, Ransomware).
Q:
Describe the process of a DDoS attack. [5]
A:
  1. A perpetrator/third party sends malware.
  2. The user downloads/installs the malware.
  3. Each computer is turned into a bot.
  4. This creates a botnet.
  5. The third party initiates the attack, and all bots send requests simultaneously to the web server, causing it to crash.
Q:
Give two security solutions to prevent DDoS attacks. [2]
A:
  1. Proxy server (to filter traffic).
  2. Firewall (to block suspicious IP addresses).
    (Alternatively: Users scanning computers with anti-malware to remove bots).
Q:
Describe the aim of a pharming attack. [1]
A:
To obtain personal data/details from users by redirecting them to a fake website.
Beta v0.7.8 Free while we're in beta — it transitions to paid post launch. Thank you for supporting us at this stage!