Year 11 · Computer Science · Autumn 2
The internet and its uses · Lesson 3 of 5
Cyber security threats
Theory5.3 Cyber security
Year 11 · Computer Science · The internet and its uses · Lesson 3 of 5
You will learn to
- Describe the eight threats: brute-force attack, data interception, DDoS, hacking, malware, pharming, phishing and social engineering.
- Describe the six types of malware: virus, worm, Trojan horse, spyware, adware and ransomware.
- Explain how a brute-force attack works, and why longer passwords slow it down.
Year 11 · Computer Science · The internet and its uses · Lesson 3 of 5
Success criteria
You have got it when you can say:
- I can say what each threat is, how it works and what the attacker wants.
- I can explain the difference between phishing and pharming.
- I can name the six types of malware and say what each one does.
Year 11 · Computer Science · The internet and its uses · Lesson 3 of 5
Retrieval starter
Questions from before. Write your answers, then show them.
- Last lesson
DNS…
A Turns a domain name into an IP addressB Stores cookiesC Encrypts the page
A. Turns a domain name into an IP address
- Last unit
An interrupt is…
A A type of virusB A loop that never endsC A signal that makes the CPU pause and deal with something
C. A signal that makes the CPU pause and deal with something
- Earlier this unit
A session cookie…
A Is a type of virusB Lasts for yearsC Is deleted when the browser closes
C. Is deleted when the browser closes
Year 11 · Computer Science · The internet and its uses · Lesson 3 of 5
Key words (1 of 5)
- Internet
- The worldwide network of connected computer networks: the physical infrastructure.
- URL
- Uniform resource locator: the text address of a web page, made of protocol, domain name and file name.
- HTTP / HTTPS
- The rules for sending web pages; HTTPS adds encryption using SSL.
Year 11 · Computer Science · The internet and its uses · Lesson 3 of 5
Key words (2 of 5)
- Web browser
- Application software that fetches web pages and renders HTML so you can see them.
- DNS
- Domain Name System: servers that find the IP address that matches a domain name.
- IP address
- A number that identifies a device on a network, such as 151.101.0.81.
- Digital currency
- Money that exists only electronically.
Year 11 · Computer Science · The internet and its uses · Lesson 3 of 5
Key words (3 of 5)
- Brute-force attack
- Trying every possible password or key until the right one is found.
- DDoS
- Distributed denial of service: flooding a server with requests from many computers so real users cannot reach it.
- Malware
- Software designed to cause harm, such as a virus, worm, Trojan horse, spyware, adware or ransomware.
Year 11 · Computer Science · The internet and its uses · Lesson 3 of 5
Key words (4 of 5)
- Phishing
- A fake message that tricks the user into clicking a link and giving personal details on a fake site.
- Pharming
- Malicious code or a tampered DNS server redirects the user to a fake website, even if they type the correct URL.
- Social engineering
- Manipulating people into breaking normal security rules.
Year 11 · Computer Science · The internet and its uses · Lesson 3 of 5
Key words (5 of 5)
- Firewall
- Hardware or software that checks traffic in and out against rules and blocks anything that breaks them.
- Proxy server
- A server between the user and the internet that filters requests, hides the user's IP address and caches pages.
- SSL
- Secure Sockets Layer: a protocol that uses certificates and encryption to secure data between browser and server.
The explanation · step 1 of 14 · part 1 of 3
Brute-force attack
A brute-force attack is when a criminal tries every possible password (or key) until one works. Software tries millions of guesses each second.
The aim is to get into an account or system, then steal data or cause harm.
Longer passwords with a mix of character types have far more possible combinations, so they take much longer to crack.
The explanation · step 1 of 14 · part 2 of 3
Brute-force attack (continued)
Each extra character multiplies the number of guesses needed. That is why length matters more than anything else.
The explanation · step 1 of 14 · part 3 of 3
Brute-force attack (continued)
Defences: long, complex passwords; locking the account after a few failed attempts; two-step verification.
The explanation · step 2 of 14 · part 1 of 2
Data interception
Data interception is when data is stolen while it is being sent, for example over Wi-Fi or across the internet.
A criminal can use a packet sniffer, a program that captures and examines data packets as they pass. On an unsecured public Wi-Fi network this is easy.
The aim is to read passwords, card numbers or private messages.
The explanation · step 2 of 14 · part 2 of 2
Data interception (continued)
Defences: encryption (HTTPS/SSL so captured data cannot be read); avoid public Wi-Fi for banking, or use a VPN; use strong Wi-Fi encryption at home.
The explanation · step 3 of 14 · part 1 of 3
Distributed denial of service (DDoS)
A denial of service (DoS) attack floods a web server with so many requests that it cannot cope. Real users cannot reach the website.
In a distributed DoS (DDoS), the requests come from thousands of computers at once. These are often ordinary devices infected with malware and controlled by the criminal. This group is called a botnet.
The aim is to take a website offline, often to cause loss of sales or to demand money.
The explanation · step 3 of 14 · part 2 of 3
Distributed denial of service (DDoS) (continued)
Requests from so many different places are hard to block, because they look like normal visitors.
The explanation · step 3 of 14 · part 3 of 3
Distributed denial of service (DDoS) (continued)
Defences: a proxy server or firewall that filters out the flood of traffic; anti-malware on your own devices so they do not join a botnet.
The explanation · step 4 of 14 · part 1 of 2
Hacking
Hacking is gaining unauthorised access to a computer system. Unauthorised means without permission.
A hacker may steal, change or delete data, or install malware. This is illegal in most countries.
Ethical hacking is different: a company pays an expert to try to break in, so weaknesses can be found and fixed.
The explanation · step 4 of 14 · part 2 of 2
Hacking (continued)
Defences: firewalls, strong passwords and authentication, access levels, and keeping software updated so known weaknesses are fixed.
The explanation · step 5 of 14 · part 1 of 2
Malware: virus, worm and Trojan horse
Malware (malicious software) is any software written to cause harm. Cambridge lists six types. The first three spread or get in; the last three do specific damage.
| Type | How it works | Example of harm |
|---|---|---|
| Virus | Attaches itself to a program or file. Needs a user to run that file. Then copies itself to other files. | Deletes or corrupts files; makes the computer crash |
| Worm | A standalone program that copies itself across a network on its own. No user action needed. | Uses up bandwidth and slows networks; can carry other malware |
| Trojan horse | Disguised as useful, legitimate software. The user installs it willingly. | Once installed, it lets in other malware such as spyware, or gives the criminal remote access |
The explanation · step 5 of 14 · part 2 of 2
Malware: virus, worm and Trojan horse (continued)
Virus versus worm: a virus needs a host file and a user to run it. A worm spreads by itself across a network.
The explanation · 9 more steps
More on the lesson page
The lesson page has the rest of the explanation, step by step:
- Malware: spyware, adware and ransomware
- Phishing and pharming
- Social engineering
- Solutions: access levels, anti-malware and authentication
- Solutions: updates, checking messages and links
- Solutions: firewalls and privacy settings
- Solutions: proxy servers
- Solutions: SSL
- Matching threats to defences
Year 11 · Computer Science · The internet and its uses · Lesson 3 of 5
Try it: How long to crack it?
Year 11 · Computer Science · The internet and its uses · Lesson 3 of 5
Quick quiz · 1 of 3
Pharming is…
- A Guessing every password
- B Being sent to a fake website even when you type the right address
- C A fake email asking for a password
B. Being sent to a fake website even when you type the right address
Phishing needs you to click. Pharming redirects you, often through poisoned DNS.
Year 11 · Computer Science · The internet and its uses · Lesson 3 of 5
Quick quiz · 2 of 3
A DDoS attack…
- A Encrypts your files for money
- B Guesses passwords
- C Floods a server with requests from many machines
C. Floods a server with requests from many machines
Distributed denial of service: so many requests the server cannot answer real ones.
Year 11 · Computer Science · The internet and its uses · Lesson 3 of 5
Quick quiz · 3 of 3
Each block in a blockchain contains…
- A Only a password
- B A hash of the previous block, so any change shows
- C A picture
B. A hash of the previous block, so any change shows
Change one block and every hash after it stops matching.
Year 11 · Computer Science · The internet and its uses · Lesson 3 of 5
Exit ticket
Answer on paper before you go. Then check.
A proxy server…
A Is the same as a routerB Sits between users and the internet, filtering and cachingC Stores the DNS
B. Sits between users and the internet, filtering and caching It can block sites, hide the user's address and keep copies of popular pages.
The World Wide Web is…
A Pages that use the internet via HTTPB The same thing as the internetC The cables and routers
A. Pages that use the internet via HTTP The internet is the network. The web is one service on it.