What you'll learn
This revision guide covers all the cyber security content you need for WJEC GCSE Computer Science. You'll learn about different types of threats to computer systems and networks, how attackers exploit vulnerabilities, and the methods organisations use to protect data and systems. Understanding these concepts is essential for Paper 1 (Understanding Computer Science) and forms a significant portion of the examined content.
Key terms and definitions
Malware — malicious software designed to damage, disrupt or gain unauthorised access to a computer system
Phishing — fraudulent emails or messages that trick users into revealing personal information or downloading malware
Social engineering — manipulating people into breaking security procedures or revealing confidential information
Firewall — security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules
Encryption — converting data into a coded format that cannot be read without the decryption key
Penetration testing — authorised simulated cyber attack on a system to identify vulnerabilities before malicious attackers can exploit them
Brute force attack — systematic method of trying all possible combinations of passwords or encryption keys until the correct one is found
Authentication — process of verifying the identity of a user or device before allowing access to a system
Core concepts
Types of cyber threats
Malware variants
Viruses attach themselves to legitimate programs and replicate when the host program runs. They require user action to spread, such as opening an infected email attachment or running a downloaded file. Viruses can delete files, corrupt data or slow system performance.
Worms are self-replicating programs that spread automatically across networks without user intervention. Unlike viruses, they don't need to attach to other programs. The 2017 WannaCry attack was a worm that spread across hundreds of thousands of computers worldwide within hours.
Trojans disguise themselves as legitimate software but perform malicious actions once installed. They don't replicate like viruses or worms but often create backdoors for attackers to access systems remotely. Users unknowingly install Trojans by downloading what appears to be useful software.
Spyware monitors user activity without consent, collecting personal information like passwords, credit card details and browsing habits. Keyloggers are a specific type of spyware that record every keystroke, allowing attackers to capture login credentials.
Ransomware encrypts files on infected systems and demands payment (usually in cryptocurrency) for the decryption key. The 2017 WannaCry attack affected the NHS, causing cancelled operations and locked medical records.
Adware displays unwanted advertisements, often redirecting browsers to advertising websites. While less dangerous than other malware, it slows systems and compromises user experience.
Network-based attacks
Denial of Service (DoS) attacks flood a server with requests, overwhelming it so legitimate users cannot access services. A Distributed Denial of Service (DDoS) attack uses multiple compromised computers (a botnet) to launch coordinated attacks, making them harder to stop.
Man-in-the-middle attacks occur when an attacker secretly intercepts and potentially alters communication between two parties who believe they're communicating directly. This often happens on unsecured public Wi-Fi networks.
SQL injection attacks insert malicious SQL code into input fields on websites, exploiting poor input validation. Attackers can access, modify or delete database contents, potentially exposing customer details or financial records.
Packet sniffing involves capturing data packets travelling across a network to read their contents. On unencrypted networks, attackers can intercept usernames, passwords and sensitive data.
Social engineering techniques
Social engineering exploits human psychology rather than technical vulnerabilities. It's often the weakest link in security systems.
Phishing uses fraudulent emails that appear to come from legitimate organisations (banks, online retailers, government departments). Messages typically create urgency ("Your account will be suspended") and include links to fake websites that harvest login credentials. Spear phishing targets specific individuals with personalised messages, making attacks more convincing.
Pretexting involves creating a fabricated scenario to extract information. An attacker might phone claiming to be from IT support, requesting passwords to "fix a problem."
Baiting offers something enticing to trick victims. Examples include leaving infected USB drives in public places labelled "Salary Information" or offering free downloads that contain malware.
Shouldering (shoulder surfing) means observing someone entering sensitive information like PINs or passwords by looking over their shoulder in public places.
Tailgating involves following authorised personnel through secure doors without proper authentication, exploiting politeness or inattention.
Authentication and access control
Authentication methods
Passwords remain the most common authentication method but create security challenges. Strong passwords should:
- Be at least 8-12 characters long
- Include uppercase and lowercase letters, numbers and symbols
- Avoid dictionary words, personal information or common patterns
- Be unique for each account
Biometric authentication uses physical characteristics:
- Fingerprint scanners read unique ridge patterns on fingertips
- Facial recognition analyses facial features and proportions
- Iris scanning examines unique patterns in the coloured ring around pupils
- Voice recognition identifies individuals by voice characteristics
Biometric data cannot be forgotten or easily stolen, but requires specialised hardware and raises privacy concerns.
Two-factor authentication (2FA) requires two different authentication methods:
- Something you know (password)
- Something you have (mobile phone receiving a code, security token)
- Something you are (biometric data)
Using two different categories significantly improves security. Even if passwords are compromised, attackers cannot access accounts without the second factor.
CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) prevents automated attacks by presenting challenges that humans can solve but programs struggle with, such as identifying objects in images or typing distorted text.
Access levels and permissions
Organisations implement user access levels to restrict what different users can do:
- Administrators have full control over systems and can modify all settings
- Standard users can run programs and access specific files but cannot install software or change system settings
- Guest accounts provide minimal access for temporary users
This principle of least privilege ensures users only have access rights necessary for their role, limiting damage from compromised accounts or insider threats.
Data protection methods
Encryption
Encryption transforms readable data (plaintext) into an unreadable format (ciphertext) using an algorithm and encryption key. Only someone with the correct decryption key can reverse the process.
Symmetric encryption uses the same key for encryption and decryption. It's fast and efficient for encrypting large amounts of data but requires secure key distribution. If the key is intercepted during transmission, security is compromised.
Asymmetric encryption uses two mathematically related keys: a public key for encryption and a private key for decryption. The public key can be freely shared while the private key remains secret. This solves the key distribution problem but is computationally slower.
Encryption protects:
- Data in transit (emails, online transactions, file transfers)
- Data at rest (stored files, databases, backup drives)
- Communications (messaging apps, video calls)
Network security measures
Firewalls examine data packets entering or leaving networks, blocking traffic that doesn't meet security rules. They can be hardware devices or software programs. Firewalls work by:
- Filtering traffic based on IP addresses, ports or protocols
- Blocking access to specific websites or services
- Preventing unauthorised external access to internal networks
- Logging attempted security breaches
MAC address filtering allows network administrators to specify which devices can connect to a network by their unique Media Access Control addresses. However, MAC addresses can be spoofed (faked) by determined attackers.
Network policies include:
- Hiding SSID (network name) to make wireless networks less visible
- Using WPA2 or WPA3 encryption protocols for Wi-Fi
- Segmenting networks to isolate sensitive data
- Implementing Virtual Private Networks (VPNs) to encrypt internet connections
Software updates and patches
Software developers regularly release security patches to fix vulnerabilities discovered after release. Updates may include new features alongside security improvements.
Automatic updates ensure systems receive patches quickly, closing security holes before attackers exploit them. Many major cyber attacks succeed because organisations fail to apply available patches promptly.
Security policies and procedures
Organisational policies
Acceptable Use Policies (AUP) define appropriate behaviour when using organisational systems, including:
- Prohibited activities (visiting certain websites, downloading unauthorised software)
- Password requirements and management
- Data handling procedures
- Consequences for policy violations
Disaster recovery plans outline procedures for restoring systems after security incidents, including:
- Backup schedules and storage locations
- Staff responsibilities during incidents
- Communication protocols
- Steps to resume normal operations
Backup strategies follow the 3-2-1 rule:
- Keep 3 copies of important data
- Store copies on 2 different types of media
- Keep 1 copy offsite (cloud storage or physically separate location)
Regular backups protect against ransomware, hardware failure and accidental deletion.
Physical security
Cyber security isn't purely digital. Physical security measures include:
- Locks and access cards controlling who enters server rooms
- CCTV surveillance monitoring sensitive areas
- Biometric access controls for high-security zones
- Visitor sign-in procedures tracking who accesses premises
- Device security (cable locks for laptops, keeping equipment out of sight)
Penetration testing
Organisations employ penetration testers (ethical hackers) to identify vulnerabilities before malicious attackers can exploit them. Testers:
- Attempt to breach systems using methods real attackers might use
- Document discovered vulnerabilities
- Recommend improvements to security measures
- Provide evidence for compliance requirements
This proactive approach identifies weaknesses in both technical systems and human procedures.
Worked examples
Example 1: Identifying threats (4 marks)
Question: A school stores student records on a network server. Describe two different cyber security threats to this data and explain how each could affect the school.
Answer: Threat 1: Ransomware could encrypt all student records [1 mark], preventing staff from accessing attendance data, medical information or contact details needed for daily operations [1 mark].
Threat 2: A data breach caused by SQL injection could expose personal information of students [1 mark], violating GDPR regulations and potentially leading to identity theft affecting students and their families [1 mark].
Mark scheme notes: Marks awarded for correctly naming specific threats (not just "malware" or "hacking") and explaining realistic, specific consequences relevant to the scenario.
Example 2: Comparing security methods (6 marks)
Question: Compare the use of passwords and biometric authentication for securing a smartphone. Discuss the advantages and disadvantages of each method.
Answer: Passwords: Advantage - Can be changed if compromised [1 mark] and don't require specialised hardware [1 mark]. Disadvantage - Can be forgotten or written down insecurely [1 mark] and vulnerable to shoulder surfing [1 mark].
Biometric authentication: Advantage - Cannot be forgotten and difficult to steal or replicate [1 mark]. Disadvantage - Cannot be changed if biometric data is compromised [1 mark] and may fail to recognise legitimate users due to injuries or environmental conditions [1 mark].
Mark scheme notes: Any 6 valid points from advantages/disadvantages of either method. Must show understanding of practical implications, not just theoretical knowledge.
Example 3: Security measures (5 marks)
Question: A company requires employees to use two-factor authentication when accessing the network remotely. Explain how two-factor authentication works and why it is more secure than using passwords alone.
Answer: Two-factor authentication requires two different types of authentication from separate categories [1 mark]. For example, the employee enters their password (something they know) [1 mark] then enters a code sent to their mobile phone (something they have) [1 mark]. This is more secure because even if an attacker steals or guesses the password [1 mark], they cannot access the account without the second factor, which requires physical possession of the employee's phone [1 mark].
Mark scheme notes: Must explain the process clearly and provide specific examples of different authentication categories. Security benefit must be explicitly linked to requiring multiple factors.
Common mistakes and how to avoid them
Using "hacking" as a catch-all term — Be specific about the type of attack (phishing, SQL injection, brute force). "Hacking" is too vague for exam answers and won't earn marks for technical accuracy.
Confusing viruses, worms and Trojans — Remember: viruses attach to programs and need user action; worms self-replicate across networks automatically; Trojans disguise themselves as legitimate software. Learn the key distinguishing features.
Describing consequences without naming threats — Questions asking you to "describe a threat" require you to name it first. Don't just explain what could happen without identifying what causes it.
Stating security measures without explaining how they work — Don't just write "use a firewall" or "encrypt data." Explain what firewalls do (monitor and filter traffic based on rules) and why encryption protects data (makes it unreadable without the key).
Confusing authentication and encryption — Authentication verifies identity; encryption protects data. These are different security measures serving different purposes.
Thinking biometric authentication is perfect — Acknowledge limitations: biometric data can't be changed if compromised, systems may fail to recognise legitimate users, and implementation requires expensive hardware.
Exam technique for "Cyber Security"
"Describe" questions require you to give characteristics or features. Use technical terminology and provide enough detail for the examiner to understand what you mean. For 4-mark questions, make two distinct points with development of each (2+2 structure).
"Explain" questions need you to show understanding of why or how something works. Link cause and effect explicitly. Use connective words like "because," "therefore," "which means" to show relationships between ideas.
Context matters — If the question presents a scenario (school, hospital, online shop), tailor your answer to that context. Generic answers about "data loss" earn fewer marks than specific consequences relevant to the situation described.
Mark allocation guides depth — A 1-mark question needs one valid point. A 6-mark question typically requires 3 developed points or 6 individual valid points. If you've only written one sentence for a 6-mark question, you haven't provided enough detail.
Quick revision summary
Cyber security protects systems and data from unauthorised access, damage and theft. Key threats include malware (viruses, worms, Trojans, ransomware, spyware), network attacks (DoS, SQL injection, packet sniffing) and social engineering (phishing, pretexting, baiting). Protection methods include authentication (passwords, biometrics, two-factor), encryption (symmetric and asymmetric), firewalls, access controls and regular updates. Organisations implement security policies, backup strategies and penetration testing. Understanding specific threats, how they work and appropriate countermeasures is essential for exam success.