What you'll learn
Cyber security is about protecting computer systems, networks and data from attack, damage and unauthorised access. For AQA GCSE Computer Science you need to know the common threats to a system, the social engineering and malware techniques attackers use, and the methods used to protect systems against them. This guide covers the main forms of attack — including phishing, malware, brute-force attacks, denial of service and SQL injection — and the defences such as firewalls, encryption, strong passwords and user access levels. By the end you should be able to describe how each attack works, identify how systems are made vulnerable, and explain the measures used to keep them secure.
Key terms and definitions
Cyber security — The processes and practices designed to protect networks, computers and data from attack or unauthorised access.
Malware — Malicious software written to damage or gain unauthorised access to a computer system.
Social engineering — Manipulating people into giving away confidential information or access, rather than attacking the technology directly.
Phishing — Sending fake emails or messages that appear genuine to trick people into revealing personal information.
Brute-force attack — Trying many password combinations automatically until the correct one is found.
Denial of service (DoS) attack — Flooding a server with requests so it cannot respond to genuine users.
SQL injection — Entering database commands into an input box to gain access to or damage a database.
Firewall — Hardware or software that controls what traffic is allowed in and out of a network.
Core concepts
Threats to a system
Computer systems face many threats. Some target the technology directly, such as malware or attacks on a database. Others target the people who use the system, tricking them into giving away information. A single system is often protected against several threats at once, because attackers may try more than one method.
Social engineering
Social engineering exploits people rather than software. The most common form is phishing, where an attacker sends an email or message that looks like it comes from a trusted source, such as a bank, asking the victim to click a link and enter their details. Other forms include shouldering (watching someone enter a password or PIN) and blagging (inventing a scenario to persuade someone to give away information). These attacks work because they rely on human trust and carelessness, which is why user education is such an important defence.
Malware
Malware is malicious software. The main types you need to know are:
- Viruses — attach themselves to files and spread when the file is opened, damaging data or software.
- Worms — self-replicating programs that spread across networks without needing a file to attach to.
- Trojans — malware disguised as a genuine, useful program that the user installs themselves.
- Spyware — secretly records what a user does, such as the keys they press, and sends it to the attacker.
- Ransomware — encrypts a user's files and demands payment to unlock them.
Brute-force and denial of service attacks
A brute-force attack uses software to try huge numbers of password combinations very quickly until it finds the right one. Strong, long passwords make this far harder because there are many more possible combinations to try.
A denial of service (DoS) attack floods a server with so many requests that it cannot cope, so genuine users cannot access the service. A distributed version uses many computers at once to make the flood even larger.
SQL injection
SQL injection targets databases. If a website does not check what users type into an input box, an attacker can type in database (SQL) commands instead of ordinary data. These commands may reveal confidential information, change data, or delete records. It is a common attack on badly designed websites and is prevented by validating and checking all user input.
Methods of protecting a system
Systems are protected using a combination of measures:
- Firewalls — control the traffic entering and leaving a network, blocking unauthorised access.
- Strong passwords — long passwords with a mix of letters, numbers and symbols resist brute-force attacks.
- User access levels — give each user only the access they need, so a compromised account cannot reach everything.
- Encryption — scrambles data so that even if it is intercepted, it cannot be read without the key.
- Anti-malware software — detects and removes viruses and other malware.
- Automatic software updates (patching) — fix security weaknesses as they are discovered.
- Penetration testing — deliberately testing a system to find weaknesses before an attacker does.
The role of people
Even the best technical defences can be defeated if users are careless, so training people to recognise phishing, use strong passwords, and not share login details is a key part of security. Many successful attacks succeed because of human error rather than a technical flaw.
Penetration testing and network policies
Organisations often use penetration testing, where security experts deliberately attack a system in a controlled way to find weaknesses before a real attacker does. Any weaknesses found can then be fixed. Alongside this, organisations set network policies — rules that all users must follow, such as changing passwords regularly, only installing approved software, and locking screens when away from a desk. These policies reduce the chances of a successful attack by making sure everyone behaves securely. Regular backups are also important: if data is lost or encrypted by ransomware, a recent backup means the organisation can restore its files without paying an attacker.
Why input validation matters
Many attacks, including SQL injection, succeed because a system trusts whatever a user types in. Input validation checks that data entered is sensible and in the expected form before it is used — for example, checking that an email address contains an @ symbol, or rejecting input that contains database commands. Validating input is a simple but powerful defence, because it stops malicious data from being processed in the first place. Well-designed software validates every input a user can control.
Worked examples
Example 1: Identifying an attack
A user receives an email claiming to be from their bank, asking them to click a link and confirm their password. What type of attack is this, and how should the user respond? This is phishing, a form of social engineering. The user should not click the link or enter any details; instead they should delete the email or contact the bank directly using a known, trusted method.
Example 2: Explaining a defence
Explain how a strong password protects against a brute-force attack. A brute-force attack tries many password combinations automatically. A long password using a mix of letters, numbers and symbols has an enormous number of possible combinations, so it would take far too long to try them all, making the attack impractical.
Example 3: Choosing protection for a database
A website stores customer records in a database. Suggest two measures to protect it from attack. First, validate and check all user input to prevent SQL injection. Second, encrypt the stored data so that even if it is stolen, it cannot be read without the key. Setting user access levels would also limit the damage from a compromised account.
Example 4: Explaining user access levels
Explain why giving users different access levels improves security. User access levels ensure each person can only reach the data and functions they need. If one account is compromised, the attacker can only access a limited part of the system, not everything, which reduces the potential damage.
Common mistakes and how to avoid them
A common mistake is confusing the types of malware. Learn the key difference: a virus needs a file to attach to, a worm spreads by itself, and a Trojan is disguised as a genuine program the user installs. Precise definitions earn the marks.
Students often describe social engineering as a technical attack. It is not — it targets people, tricking them into giving away information. This distinction is frequently tested.
Another error is treating a firewall as though it removes malware. A firewall controls network traffic and blocks unauthorised access; removing malware is the job of anti-malware software. Match the defence to the threat.
When explaining strong passwords, do not just say "it is hard to guess". Explain that a longer, more varied password has far more possible combinations, so a brute-force attack would take too long.
Finally, remember that many attacks succeed through human error. Technical defences alone are not enough; user education is part of good security.
Exam technique for "Cyber Security"
Questions often describe a scenario and ask you to identify the attack and suggest protection. Name the specific attack (phishing, SQL injection, DoS, and so on) rather than just saying "a hacker", and match each threat to a suitable defence.
For "explain" questions, give the mechanism: say how the attack works or how the defence stops it, not just what it is. For example, explain that encryption scrambles data so it cannot be read without the key.
A common longer question asks you to describe several ways to protect a system. Aim to give a range of measures — a technical one (firewall, encryption), an access one (passwords, access levels), and a human one (user training) — to show breadth. Always link each measure to the threat it addresses.
Quick revision summary
- Cyber security protects systems, networks and data from attack and unauthorised access.
- Social engineering targets people: phishing, shouldering and blagging trick users into revealing information.
- Malware includes viruses (attach to files), worms (self-spreading), Trojans (disguised), spyware and ransomware.
- Brute-force attacks try many passwords; DoS attacks flood a server; SQL injection enters database commands via unchecked input.
- Protections: firewalls, strong passwords, user access levels, encryption, anti-malware, updates and penetration testing.
- Many attacks exploit human error, so user education is essential.