The CIA triad: what are we protecting?
Before asking "how was it attacked?", ask "what did the attack break?" Security people use three words. Their first letters spell CIA (nothing to do with spies).
| Corner | Means | Broken when… | Defended by… |
|---|---|---|---|
| Confidentiality | Only the right people see it | Messages leak; someone reads your files | Passwords, encryption, access levels |
| Integrity | Not changed without permission | Someone edits grades; malware corrupts files | Access levels, hashing, backups |
| Availability | Works when needed | A website is flooded offline; ransomware locks files | Backups, firewalls, spare servers |
Which corner broke?
Malware: harmful software
Malware = malicious software. The types are named by how they spread and what they do.
| Type | How it works | Picture it as | Main defence |
|---|---|---|---|
| Virus | Hides inside a file; spreads when people share or open it | A cold from touching something | Anti-malware; don't open unknown files |
| Worm | Spreads across networks on its own, using security holes | A cold walking door to door | Updates (patches); firewall |
| Trojan | Pretends to be useful, so you install it yourself | The wooden horse of Troy | Only install from trusted stores |
| Ransomware | Encrypts your files and demands payment for the key | A kidnapper | Offline backups |
| Spyware | Secretly records what you do or type | Someone reading over your shoulder | Anti-malware; permissions |
Why are backups the defence against ransomware? Ransomware breaks availability: your files are still there but locked. If a clean copy is kept somewhere the malware can't reach (offline, or in versioned cloud storage), you just restore it. Paying the criminals is not a defence: there is no guarantee you get the key.
Social engineering: hacking people
It's often easier to trick a person than to break a computer. Social engineering means getting someone to give away access or information. It works by pressing four buttons in our heads.
Phishing: a fake email or text that looks official and leads to a fake login page. Spear phishing is aimed at one person, using real details about them.
Blagging (pretexting): a made-up story on the phone or in person: "I'm from IT, I need your password to fix your account."
Shoulder surfing: watching someone type a PIN or password.
Baiting: leaving an infected USB stick labelled "Exam answers" where someone will find it and plug it in.
Phishing signs: urgency or threats, a sender address or link that is nearly right, a generic greeting ("Dear customer"), spelling mistakes, and any request for a password. A real company never asks for your password.
Name the trick
Technical attacks: using weak systems
These attacks go after the computer, not the person. For each one, learn the idea and the defence. You don't need to know how to do them.
| Attack | The idea, in one line | Breaks | Defence |
|---|---|---|---|
| Brute force | Try every possible password until one works | C | Long passwords, lock-outs, 2FA |
| Dictionary attack | Try common words and leaked passwords first | C | Don't use real words alone; passphrases |
| DoS / DDoS | Flood a server so real users can't get in | A | Firewalls, traffic filtering, spare servers |
| Interception | Read data as it travels, e.g. on open Wi-Fi | C | Encryption (HTTPS, VPN) |
| SQL injection | Type database commands into a form box that trusts its input | C, I | Validation, parameterised queries |
The textbook illustration is a login box where someone types ' OR '1'='1. Glued into the command, it turns "name equals what you typed" into "name equals nothing, or 1 equals 1", which is always true. That's why the program must never glue user text into a command.
Why length beats complexity: the maths
A brute-force attack tries every possible password. So the question is: how many possible passwords are there? It's the "patterns" rule from Topic 2 again, with more than 2 choices per position.
A 4-digit PIN: each position has 10 choices (0–9).
First digit: 10 choices. For each of those, the second digit has 10: 10 × 10 = 100 so far.
All four: 10 × 10 × 10 × 10 = 10⁴ = 10,000 PINs.
Lower-case letters: 26 choices each. 8 letters: 26⁸ ≈ 209 billion.
A computer trying 1 billion guesses a second: 209,000,000,000 ÷ 1,000,000,000 ≈ 209 seconds. About 3½ minutes.
Now 12 lower-case letters: 26¹² ≈ 95 quadrillion ÷ 1 billion ≈ 95 million seconds ≈ 3 years. Four more letters, 500,000 times longer.
Passphrase meter
Type a made-up example, never a real password. Nothing is saved or sent.
Length multiplies, symbols only add a bit. A long passphrase of random words (like purple-violin-tuesday-rain) beats a short messy one (like P@ss1!). Swapping o for 0 doesn't help: attackers try those swaps first.
Defences: layers, like an onion
No single defence stops everything. So we stack them. An attacker must get through every layer; we only need one to hold. This is called defence in depth.
| Defence | What it does | Stops… |
|---|---|---|
| Strong passwords + 2FA | Something you know + something you have (a code on your phone) | Brute force, stolen passwords |
| Lock-outs | Block login after 3–5 wrong tries | Brute force |
| Firewall | Checks network traffic against rules; blocks the rest | Worms, unwanted connections, some DoS |
| Anti-malware | Scans files for known malware and suspicious behaviour | Viruses, trojans, spyware |
| Updates (patches) | Fix security holes the makers found | Worms, exploits of old bugs |
| Access levels | Each user gets only what they need (students can read, not edit grades) | Insiders changing data |
| Encryption | Stolen data is unreadable without the key | Interception, stolen laptops |
| Backups | A clean copy to restore | Ransomware, accidents |
| Validation | Only accept input in the expected form | SQL injection |
| Penetration testing | Hire permitted testers to find holes first | Unknown weaknesses |
| Training + physical security | Teach people the signs; locks, cameras, swipe cards | Social engineering, theft |
Why 2FA works: step through a login
Encryption, starting with Caesar
Encryption turns readable plaintext into scrambled ciphertext using a key. Only someone with the key can turn it back. The oldest famous one is the Caesar cipher: shift every letter by the same amount.
Plaintext HELLO, key 3.
H → K, E → H, L → O, L → O, O → R.
Ciphertext KHOOR. To decrypt, shift back 3.
Why "mod 26"? Letters are numbered 0 (A) to 25 (Z). Y is 24; 24 + 3 = 27, but there is no letter 27. Divide by 26 and keep the remainder: 27 mod 26 = 1 = B. Like a clock going past 12 (Topic 3's overflow is the same idea, with 256).
Breaking Caesar: frequency analysis
Caesar has only 25 useful keys, so you could just try them all. But there's a smarter trick, discovered by the Arab scholar al-Kindi about 1,100 years ago: some letters are much more common than others.
In English, E is the most common letter (about 12%), then T, A, O.
Caesar moves every letter by the same amount, so the shape of the letter counts moves too, just slid sideways.
Count the letters in the ciphertext. Find the tallest bar. It's probably E in disguise.
The distance from E to that letter is the key.
Crack the message
This message was encrypted with a secret key. Slide the shift until the purple bars (the message) line up with the amber bars (normal English).
Short messages may not follow the usual pattern. Frequency analysis needs enough text: a few sentences, not one word.
Modern encryption and hashing
Modern keys are huge numbers: 128 or 256 bits. A 256-bit key has 2²⁵⁶ possible values, a number with 78 digits. Trying them all would take longer than the age of the universe, even with every computer on Earth.
Hashing: a one-way fingerprint
A hash function turns any data into a fixed-length fingerprint. The same input always gives the same hash, but you can't run it backwards.
Websites store the hash of your password, not the password. At login they hash what you type and compare. If the database leaks, the attacker gets fingerprints, not passwords.
Tiny hash demo
A toy hash (not a real secure one) so you can see the idea: change one letter and the whole fingerprint changes.
AQA and OCR GCSE need encryption as an idea and the Caesar cipher. Public-key, hashing and the maths behind them go beyond GCSE, but they explain the padlock in your browser (Topic 16).
The law, and what makes hacking ethical
The same action can be a crime or a job. The difference is permission. A penetration tester has a written contract saying exactly what they may test.
| UK: Computer Misuse Act 1990 | Spain: Código Penal |
|---|---|
| Section 1: unauthorised access to a computer ("just looking" counts). Up to 2 years. | Art. 197 bis: accessing a system without authorisation. 6 months to 2 years. |
| Section 2: unauthorised access with intent to commit a further crime. Up to 5 years. | Usually charged together with the further crime. |
| Section 3: unauthorised acts that impair a computer (malware, deleting data, DoS). Up to 10 years. | Arts. 264 and 264 bis: damaging data or stopping a system working. 6 months to 3 years, more if serious. |
| Section 3ZA: causing serious damage (e.g. to national infrastructure). Up to 14 years, or life. | Aggravated forms of 264 carry longer sentences. |
Data law too: a breach of personal data must be reported (UK GDPR + Data Protection Act 2018 in the UK; EU GDPR + LOPDGDD in Spain). See Topic 19.
The password lock build uses a lock-out. Here's why that one rule matters so much:
Without a lock-out, a computer can try about 1 billion guesses a second.
Allow 3 tries, then lock for 10 seconds: that's 3 ÷ 10 = 0.3 guesses a second.
A 6-letter lower-case password: 26⁶ ≈ 309 million possibilities.
309,000,000 ÷ 0.3 ≈ 1 billion seconds ≈ 33 years, instead of 0.3 seconds.
Common mix-ups
Read the left, then the right.
A virus and a worm are the same thing.
A virus needs a person to spread it; a worm spreads by itself over the network.
P@ssw0rd! is strong because it has symbols.
It's a dictionary word with common swaps. Attackers try those first. Length matters most.
Looking around someone's account is fine if you don't change anything.
Unauthorised access alone is an offence (CMA section 1; art. 197 bis in Spain).
A firewall stops viruses in email attachments.
A firewall filters network traffic. Infected files are anti-malware's job.
Encryption stops data being stolen.
It can still be stolen; it just can't be read without the key.
Hashing and encryption are the same.
Encryption can be reversed with the key. A hash is one-way.
Only clever hackers cause breaches.
Most start with a person: a phishing click, a reused password, a lost laptop.
Check yourself
Quick questions, then endless practice with full working.