Cyber Security Threats (CIE IGCSE Computer Science)

Cybersecurity threats pose a major challenge for individuals and organisations that rely on digital technology to store and transmit sensitive information. 

Brute-Force Attack 

• A brute-force attack is a trial-and-error method used to crack passwords or encryption keys by trying every possible combination until the correct one is found
• The aim of a brute-force attack is to gain unauthorised access to a system or network

Data Interception

• Data interception involves eavesdropping on communication channels to intercept and steal sensitive information, such as passwords, credit card numbers, or personal data
• The aim of data interception is to steal sensitive information for personal gain or to use it for further cyber attacks

Distributed Denial of Service (DDoS) Attack

• A DDoS attack is where multiple computers are used as bots
• They flood a server with lots of requests at the same time which the server can’t respond to; causing it to crash or become unavailable to users
• The aim of a DDoS attack is to disrupt the normal functioning of a system or network by denying users access

Hacking

• Hacking involves gaining unauthorised access to a system or network to steal or manipulate data, disrupt services, or cause damage
• The aim of hacking can vary from personal gain to activism or cyber espionage

Malware

Malware is malicious software designed to harm or gain unauthorised access to a system or network. Types of malware include:

• A virus is a piece of code that attaches itself to a legitimate program or file and then replicates itself to spread to other programs or files on the computer. It can cause damage to the system, including deleting data or damaging hardware
• A worm is similar to a virus but is a standalone program that can spread and replicate itself over computer networks. It can take up storage space or bandwidth
• A Trojan horse is a program that disguises itself as a legitimate program or file, but when installed, it can delete data or damage hardware
• Spyware is software that records all key presses and transmits these to a third party
• Adware is a type of software that displays unwanted advertisements on the computer without the user's consent. Some of these may contain spyware and some may link to viruses when clicked
• Ransomware is a type of malware that encrypts the user's files and demands a ransom payment to decrypt them. It can cause data loss, and financial damage and disrupt business operations

The aim of malware attacks can range from data theft to extortion or disruption of services

Phishing

• Phishing involves the user is sent an email which looks legitimate
• This contains a link to a fake website where the user is encouraged to enter their details
• The aim of phishing is to steal sensitive information for personal gain or to use it for further cyber attacks

Pharming

• Pharming involves malware being downloaded without the user’s knowledge
• This redirects the user to a fake website where they’re encouraged to enter their personal details
• The aim of pharming is to steal sensitive information for personal gain or to use it for further cyber attacks

Social Engineering

• Social engineering involves manipulating individuals to gain access to confidential information or to perform an action that benefits the attacker
• This can include techniques such as:
  • This involves posing as someone else to gain trust or access to sensitive information
  • Attackers might pretend to be a co-worker, IT support personnel, or a law enforcement officer to get people to divulge sensitive information or perform an action they wouldn't otherwise do
  • Baiting is a social engineering technique that involves enticing a victim with a desirable item or promise to extract sensitive information or gain access to a system
  • Attackers might leave a USB drive with a tempting label, like "salary information," in a public place and wait for someone to pick it up and plug it into a computer
  • Once the drive is connected to the computer, the attacker can access sensitive information or install malware
  • Pretexting involves creating a fake scenario to extract sensitive information
  • The attacker might pose as a bank representative and ask for personal information to "verify your account”
• Impersonation
• Baiting
• Pretexting

• The aim of social engineering is to exploit human behaviour and vulnerabilities to gain unauthorised access to a system or network

Accidental Damage

Data could also be accidentally damaged in many ways:

Example	Prevention
Loss of power	Use a UPS
Liquids being spilt	Don’t have water near the device
Flooding	Keep device in a waterproof box when not is use
Fire	Use electrics safety and keep device in a fireproof box when not is use
Hardware failure	Correct care and maintenance of hardware
Software failure	Making sure it is always up to date
Human error: Pressing delete by mistake Not saving data Not shutting down the computer correctly	Add verification method for data deletion Set access levels for data to limit who can delete the data
Incorrect use of storage device	Making sure device is ejected before removing