Most attacks target the person
It is tempting to picture cyber security as a battle between clever software. In practice the majority of successful attacks work by persuading a human being to do something — click a link, open an attachment, or hand over a password.
That shapes the whole subject. Technical defences matter, but a firewall cannot stop a user who has been convinced to type their password into a convincing fake page. This is why every answer about protection should include training and caution alongside the software.
| Threat | What it does | Main defence |
|---|---|---|
| Brute force attack | tries every possible password | long passwords; lock after failed attempts |
| Data interception | reads data travelling on a network | encryption |
| DDoS attack | floods a server so it cannot respond | firewall, traffic filtering |
| Hacking | unauthorised access to a system | strong passwords, two-factor authentication |
| Malware | harmful software of several kinds | anti-malware, updates, caution |
| Phishing | a fake message requesting details | check sender and link; never log in via a link |
| Pharming | redirects you to a fake site | check the address; anti-malware |
| Social engineering | manipulates a person into helping | training and verification procedures |
The kinds of malware
Malware is the general term, and the syllabus expects the specific types by name, since each behaves differently and needs a different response.
A virus attaches itself to a file and needs that file to be run to spread. A worm spreads by itself across a network with no user action at all, which is why worms spread so much faster. A trojan disguises itself as something useful and is installed willingly by the victim. Spyware records activity, and a keylogger is spyware that records every keystroke including passwords. Ransomware encrypts the victim's files and demands payment. Adware displays unwanted advertising and often tracks the user as well.
Virus and worm are not the same word
A virus needs a host file and a user to run it. A worm is self-replicating and needs neither — it finds vulnerable machines on the network and copies itself to them. That difference explains why a worm can spread worldwide in hours while a virus depends on people sharing files, and exam questions ask for it directly.
Phishing, pharming and social engineering
These three all attack the person rather than the machine, and the distinctions between them are examined.
Phishing sends a message pretending to be from a trusted organisation, containing a link to a fake site. The victim must be persuaded to click. Pharming is more insidious: malicious code alters the machine's DNS settings or a DNS server, so that typing the correct address still leads to the fake site. No link needs to be clicked at all.
Social engineering is the general technique of manipulating a person into breaking security — a phone call claiming to be from the IT department and asking for a password, or someone in a delivery uniform asking to be let through a locked door.
The sender and the link are the two that matter most. Only the part immediately before the final dot identifies the owner, so a domain containing the right letters proves nothing at all.
Why pharming is harder to defend against
Against phishing, the advice "type the address yourself instead of clicking the link" works. Against pharming it does not — the address is correct and the redirection happens afterwards. The defences are anti-malware to prevent the DNS settings being altered in the first place, and checking that the site has a valid HTTPS certificate for the name you actually typed.
Defences
Each defence addresses particular threats, and a full answer names which.
A firewall examines traffic entering or leaving a network and blocks anything not permitted by its rules — the main defence against unauthorised access and flooding attacks. Anti-malware scans for known malicious software and removes it. Two-factor authentication requires a second proof beyond the password, so a stolen password alone is not enough. Biometrics use a physical characteristic that cannot be guessed or shared. Access levels restrict each user to what they need, so a compromised account does not expose everything. And automatic updates close known vulnerabilities before they can be exploited.
An online banking system must protect against brute force attacks and phishing. Describe the measures for each.
- Against brute force: require long passwords combining several character types.Each additional character multiplies the number of possibilities to try.
- Lock the account after a small number of failed attempts.This is the decisive measure — it makes trying millions of passwords impossible regardless of how fast the attacker is.
- Add two-factor authentication, such as a code sent to the registered phone.Even a correctly guessed password is then insufficient.
- Against phishing: never include links in customer emails, and say so publicly.If the bank never sends links, any message containing one is identifiable as fraudulent.
- Train customers to type the address themselves and check for the padlock and the correct domain.Phishing attacks the person, so the defence must reach the person.
Account lockout and two-factor authentication against brute force; a no-links policy and customer education against phishing.
Before you leave this chapter
- Most successful attacks target people, not software.
- A virus needs a host file and a user; a worm spreads itself across a network.
- Phishing needs you to click a link; pharming redirects you even when you type the address correctly.
- Account lockout, not password length alone, is what defeats brute force.
- Name the specific defence for the specific threat — a firewall does not stop phishing.