Data representation and security · GCSE Computer Science
Cyber security
How systems are actually attacked — malware, people and weak configuration — and the controls that make an attack expensive.
Most attacks start with a person, not a genius hacker.
The important bits
What you need to know
- 1
Threats need a vulnerability (unpatched software, reused passwords, an open port) and a motive. Security is risk management, not a promise of perfection.
- 2
Malware types: virus (needs a host file, spreads on execution), worm (self-spreads across networks), trojan (pretends to be useful), ransomware (encrypts for payment), spyware, adware, botnets. Name the behaviour, not just the scare-word.
- 3
Social engineering: phishing emails, smishing, pretexting phone calls, USB drops, tailgating. The payload is often a credential, not an elegant zero-day.
- 4
Technical attacks: brute-force password guessing, dictionary attacks, denial of service / DDoS (overwhelm a service), SQL injection against sloppy databases, man-in-the-middle on open Wi-Fi.
- 5
People and process: poor access control, unenforced updates, no backups, oversharing on social media, insider threat. A firewall cannot save an admin who clicks a fake invoice.
- 6
Prevention: penetration testing, anti-malware, firewalls, encryption (data in transit and at rest), strong unique passwords plus hashing on the server, two-factor authentication, user access levels (least privilege), physical security, and an acceptable-use policy people actually see.
- 7
Backups (offline/offline-from-ransomware) are a control against ransomware and hardware failure. If the only copy is on the same live disk, you do not have a backup.
- 8
The Computer Misuse Act 1990 is the UK criminal backdrop: unauthorised access, unauthorised access with intent to commit further offences, and unauthorised modification. “I was only testing” is not a defence without permission.
Go deeper
Phishing works because it copies a real workflow
A good phish looks like the school gateway, a delivery firm or a bank, complete with logos and a sense of urgency. It asks you to “confirm” a password on a lookalike domain, or to open a macro-laden spreadsheet. Technical DNS and TLS help, but the decision is human. Defences stack: spam filters, reporting buttons, 2FA so a stolen password is not enough, and a culture that treats unexpected payment requests as call-back-on-a-known-number events. In exam answers, do not stop at “do not click links”. Say why the email is crafted (urgency, authority) and which control would have blocked the next step (2FA, least privilege, offline backups if the click was ransomware).
Go deeper
SQL injection is a validation failure with a punchline
If a login box concatenates whatever the user typed into an SQL statement, an attacker can type a fragment that changes the query’s meaning — for example turning a password check into a condition that is always true. The fix is not “install antivirus”. It is parameterised queries, least-privilege database accounts, and validating input. That is why this topic sits next to programming: security is often just programming done without trusting the user. When a paper asks for a method of attack and a prevention, pair SQL injection with input sanitisation/parameterisation, not with a firewall unless you explain a web-application firewall specifically.
See the idea in action
Scenario: a surgery cannot open any files; a message demands Bitcoin. Identify ransomware. Immediate: disconnect affected machines from the network to slow spread. Recovery: restore from offline backups, not by paying (no guarantee, funds crime). Prevention that was missing: segmented backups, least privilege, patching, phishing training, 2FA on remote access. That chain — identify, contain, recover, prevent — is how 6-mark applied questions want to be structured.
Exam technique
Turn knowledge into marks
Match the defence to the threat. Encryption does not stop DDoS. A firewall does not stop a malicious insider with legitimate credentials. Markers notice scattergun lists.
Common mistakes
Do not give these marks away
- 01
Using “hacker” and “virus” for every threat.
- 02
Saying a firewall “removes viruses”.
- 03
Forgetting the human layer: policies, training, physical access, and phishing.
Which control best reduces the damage of a stolen password?
AA faster CPU
BTwo-factor authentication and hashed password storage
CSwitching from star to bus topology
DIncreasing screen resolution
Show the answer
Two-factor authentication and hashed password storage. 2FA demands a second factor the thief probably lacks. Hashing (with salt) means the server is not holding the real password for bulk theft. Topology and graphics are unrelated.
Quick questions
If this is the bit you searched
Does paying ransomware recover the files?
Sometimes, often not, and it funds further crime. The sustainable control is a tested backup that ransomware cannot reach. UK guidance is not to pay.
What does the Computer Misuse Act actually ban?
Unauthorised access to computer material, doing so with intent to commit further offences, and unauthorised modification (including malware). Authorised penetration tests sit on the right side of permission.