Cyber Security
Social engineering and malware named threat by threat, plus every detection and prevention method in the specification, with the reason each one works.
What cyber security is, and social engineering
Cyber security is the processes, practices and technologies used to protect networks, computers, programs and data from attack, damage and unauthorised access.
Social engineering
Social engineering means manipulating a person into giving away information or access, rather than attacking the technology. It works because people are helpful, busy and reluctant to challenge someone who sounds authoritative.
| Threat | What it is |
|---|---|
| Blagging | Inventing a scenario to persuade someone to hand over information, for example pretending to be from IT and needing the password to fix an urgent fault |
| Phishing | Sending a message that appears to come from a legitimate organisation, to trick the recipient into revealing details or clicking a malicious link |
| Pharming | Redirecting a user to a fake website even though they typed the correct address, by altering DNS or the host file |
| Shouldering | Watching someone enter a PIN or password over their shoulder, at a cash machine or on a train |
It bypasses every technical control. Encryption, firewalls and strong passwords all protect data from an attacker who does not have the password. None of them help once somebody has been persuaded to give it away.
- The sender's address does not match the real organisation.
- The message is urgent and threatens you, to stop you thinking.
- It says Dear Customer instead of using your name.
- Spelling and grammar mistakes.
- The link goes somewhere different to what it says, which you can see by hovering over it.
- An attachment you were not expecting, here a program file.
Malicious code and other threats
Malware is any software written with the intention of causing harm.
| Type | Behaviour |
|---|---|
| Virus | Attaches itself to a file and spreads when that file is opened or shared |
| Worm | Spreads by itself across a network without needing a user to do anything |
| Trojan | Pretends to be legitimate software so the user installs it willingly |
| Ransomware | Encrypts the victim's files and demands payment for the key |
| Spyware | Records activity such as keystrokes and sends it to the attacker |
Other weaknesses AQA names
Weak and default passwords. A password that is short, common or left as the manufacturer set it can be guessed or brute forced in seconds.
Misconfigured access rights. Giving users more permission than their job needs means a single compromised account exposes far more than it should.
Removable media. A USB stick can carry malware straight past the firewall, because it never touches the network at all.
Unpatched or outdated software. Most successful attacks exploit weaknesses that were fixed months earlier in an update the victim never installed.
A question describing a fake email asking a user to confirm bank details is phishing. One describing a phone call from a supposed colleague is blagging. Using the general word "hacking" throws away the mark.
- Malware: virus, worm, trojan, ransomware and spyware.
- Social engineering: phishing, blagging and shouldering trick people instead of computers.
- Brute force: try every combination until one works.
- Denial of service: flood a server so real users cannot get in.
- SQL injection: database code typed into an input box.
- Interception: reading data as it travels, for example on public Wi-Fi.
Detecting and preventing attacks
| Method | How it helps |
|---|---|
| Biometric measures | Uses a physical characteristic such as a fingerprint, which cannot be guessed or easily shared |
| Password systems | Requiring length, mixed character types and a limit on failed attempts makes guessing and brute force impractical |
| CAPTCHA | Distinguishes a human from an automated script, blocking bulk automated attacks |
| Email confirmations | Confirms that the person requesting an account or a change controls that address |
| Automatic software updates | Closes known weaknesses promptly, without relying on anyone remembering |
| Penetration testing | Authorised simulated attacks that find weaknesses before an attacker does |
| Anti-malware software | Scans files against known threats and removes them before they run |
| Firewalls | Inspect traffic entering and leaving the network and block anything not permitted |
| User access levels | Give each user only the permissions their role requires, limiting the damage one compromised account can do |
| Encryption | Scrambles data so it is unreadable without the key, even if it is stolen |
| Physical security | Locks, alarms and controlled access stop somebody simply walking in and taking a machine |
Two ideas that carry most of the marks
Encryption does not stop data being stolen. It makes stolen data useless. Saying that distinguishes a strong answer from a vague one.
Penetration testing is authorised. The same actions without permission are a criminal offence under the Computer Misuse Act. Questions rely on that distinction.
No single measure is sufficient. A firewall does not help against a user who installs a trojan, anti-malware does not help against a stolen laptop, and encryption does not help against a phished password. The answer to "how should this organisation protect itself" is always several measures, each covering a different route in.
- No single defence is enough, so several layers are used. An attacker has to get past all of them.
- Match each threat to the defence that answers it. This pairing is asked in the exam.
- A common word is cracked at once, however long it feels to type.
- Eight random characters from 95 symbols: about 6.6 quadrillion possibilities.
- Five random words from a list: far more possibilities, and easier to remember.
Key terms you must be able to define
- Cyber security
- The processes and technologies used to protect networks, computers, programs and data from attack and unauthorised access.
- Social engineering
- Manipulating people into giving away information or access rather than attacking technology.
- Blagging
- Inventing a scenario to persuade someone to give away information.
- Phishing
- Sending messages that appear legitimate in order to trick the recipient into revealing details.
- Pharming
- Redirecting a user to a fake website even when they type the correct address.
- Shouldering
- Observing someone entering a password or PIN in order to steal it.
- Malware
- Software written with the intention of causing harm.
- Ransomware
- Malware that encrypts the victim's files and demands payment for the key.
- Penetration testing
- Authorised simulated attacks carried out to find weaknesses before an attacker does.
- Firewall
- A system that inspects traffic entering and leaving a network and blocks anything not permitted.
- User access level
- The set of permissions granted to a user, limiting what they may see and do.
- Encryption
- Scrambling data so that it cannot be read without the correct key.
Flashcards
Say the definition out loud before you flip the card. Retrieving it from memory is what builds recall, reading it again is not.
Reach the top grade on this topic
Three things lift an answer on this topic.
Name the specific threat. Blagging, phishing, pharming and shouldering are separate named threats, and the exam expects the right word for the scenario described.
Say what a measure actually achieves. Encryption does not prevent theft, it makes theft useless. A firewall does not remove malware, it blocks traffic. Access levels do not stop an account being compromised, they limit what a compromised account can reach.
Match the measure to the threat in the question. A question about a stolen laptop wants encryption and physical security. One about staff clicking links wants training and email filtering. Listing every measure you know earns fewer marks than choosing two and justifying them.
Mistakes that cost marks here
- Calling every attack 'hacking'. The specification names the individual threats and expects them.
- Saying anti-malware prevents all attacks. It detects known threats, so a brand new one may get through.
- Saying encryption stops data being stolen. It stops stolen data being read.
- Describing penetration testing as illegal hacking. It is carried out with permission, which is precisely the difference.
- Offering only one measure when a question asks how an organisation should protect itself. Different routes in need different defences.
The single most common way into an organisation is not a technical flaw. Year after year, the attack that succeeds most often is somebody being persuaded to hand over a password, which is why social engineering is a specification topic in its own right.
Knowledge check
Exam-style questions
Five written questions in the style of the real paper. Write a full answer, then let the marker check it against the mark scheme.
- LManipulating or tricking people rather than attacking technology
- LIn order to obtain information or access
Social engineering means manipulating people into giving away confidential information or access, rather than attacking the technology directly. It works because it bypasses technical protections entirely.
- LPhishing, sending a message that appears to come from a legitimate organisation
- LThe recipient is tricked into revealing details or clicking a malicious link
- LBlagging, inventing a scenario to persuade someone to hand over information
- LShouldering, watching someone enter a password or PIN
Phishing is sending a message, usually an email or text, that appears to come from a legitimate organisation such as a bank or a school. The message creates a reason to act quickly and directs the recipient to a fake site or asks them to reply with their details, so that the attacker obtains their credentials. Blagging is different in that it is targeted and interactive: the attacker invents a plausible scenario, for example telephoning an employee while pretending to be from the IT department and claiming to need their password to fix an urgent fault, and relies on the victim wanting to be helpful and not wanting to challenge someone who sounds authoritative.
- LUpdates fix known weaknesses in the software
- LThose weaknesses become public knowledge once a fix is released
- LSo unpatched systems are easier targets, and most successful attacks exploit weaknesses that were already fixed
Software updates exist largely to close security weaknesses that have been discovered since the software was released. Once an update is published, the existence and often the details of the weakness it fixes become public, so attackers know precisely what to look for on systems that have not applied it. That makes an unpatched system a considerably easier target than it was before the fix existed. The great majority of successful attacks do not use previously unknown flaws at all: they exploit weaknesses for which a fix had been available for months, which is why applying updates promptly, or setting them to install automatically, is one of the most effective measures available.
- LEncrypt the data on the laptops
- LSo that if a laptop is lost or stolen the records cannot be read
- LUse strong passwords or biometric login on each laptop
- LSo that an unauthorised person cannot simply switch the laptop on and use it
- LUse user access levels so each member of staff sees only what their role needs
- LKeep regular backups, or keep software updated, and justify it
The first measure is to encrypt the data held on each laptop. A laptop taken home can be lost or stolen, and physical possession would otherwise give an attacker the entire customer database. Encryption does not prevent the theft, but it makes the stolen copy unreadable without the key, which turns a serious data breach into the loss of a piece of hardware. The second is strong authentication on each machine, either a long password meeting complexity rules or a biometric login. That stops somebody who picks the laptop up from simply switching it on and reading whatever is open, and it should be combined with a limit on failed attempts so the password cannot be guessed repeatedly. The third is user access levels, so that each member of staff has access only to the records their role actually requires. That limits the damage a single compromised account can do, and it also protects against honest mistakes. Alongside those, the business should keep regular backups held separately and ensure operating system and application updates install automatically, since backups are the only reliable defence against ransomware and updates close the weaknesses most attacks rely on.