Paper 1 practice: topics 4 to 6

Two kinds of software

Software is a set of instructions that tells the hardware what to do. There are two main kinds.

System software runs and looks after the computer itself. The user often does not notice it working.

Application software does a job the user wants done, such as writing an essay or editing a photo.

Application software needs system software underneath it. A word processor cannot run without an operating system.

The operating system and its nine functions

The operating system (OS) is the most important piece of system software. Examples are Windows, macOS, Linux, Android and iOS.

It sits between the user, the applications and the hardware. It manages everything so that they all work together.

Cambridge lists nine functions. Learn all nine, with an example for each.

Files, interface, peripherals and drivers

Managing files. The OS keeps track of where each file is stored on the disk. It organises files into folders and controls who can open them.

Providing an interface. A GUI (graphical user interface) uses windows, icons, menus and a pointer. A CLI (command line interface) uses typed commands. A GUI is easier to learn; a CLI is faster for experts.

Peripherals are devices connected to the computer, such as a printer, keyboard or webcam. A device driver is a small program that translates between the OS and one particular device.

The OS also uses buffers and queues for slow devices. For example, it holds a print job in a queue until the printer is ready.

Memory and multitasking

Managing memory. Every running program needs space in RAM. The OS gives each program its own area and takes it back when the program closes.

It also stops one program from writing into another program's memory. This prevents crashes and protects data.

If RAM is full, the OS can use virtual memory: it moves pages of data that are not in use to secondary storage.

Managing multitasking. A single processor core can only run one instruction at a time. The OS gives each program a tiny slice of processor time in turn.

The slices are so short that all the programs seem to run at the same time. The OS decides the order using priorities.

Platform, security and user accounts

Providing a platform for running applications. Apps do not control hardware directly. They ask the OS to do things for them, such as "save this file" or "show this window".

This is why an app written for Android will not run on iOS. Each app is written for one platform.

Providing system security. The OS asks for a password or fingerprint at login. It installs security updates and can run a firewall and anti-malware.

Managing user accounts. Each user has a username and password. The OS keeps their files and settings apart and gives each account its own access rights (what it is allowed to do).

The layers: hardware, firmware, OS, applications

Software is built in layers. Each layer runs the one above it.

Hardware is the physical parts. When you switch on, the hardware runs the firmware.

Firmware is software stored permanently in ROM or flash memory on the motherboard. It includes the bootloader, a small program that loads the OS from storage into RAM.

The OS then starts and takes control. Finally, the OS runs the applications you choose.

There is a diagram for this step in the IGCSE library.

What an interrupt is and how it is generated

An interrupt is a signal sent to the processor. It says "something needs your attention now".

Interrupts are generated by hardware (a device) or by software (a running program).

Each interrupt has a priority. An urgent one, such as a power failure, is dealt with before a less urgent one.

How the processor handles an interrupt

The processor checks for interrupts at the end of every fetch–decode–execute cycle.

If there is an interrupt with a higher priority than the current task, the processor stops what it is doing.

It saves the current state (the contents of its registers, such as the PC) so it can come back later.

It then runs an interrupt service routine (ISR): a small program written to deal with that type of interrupt.

When the ISR finishes, the processor reloads the saved state and carries on with the task exactly where it stopped.

There is something to try for this step in the IGCSE library.

After the ISR: what happens next

When the ISR is finished, the processor checks for any other interrupts that are waiting.

If there are more, it handles them in priority order. Each one gets its own ISR.

When none are left, it restores the saved state and the original program continues.

Try the interrupt toy above. Press Key press while the program runs, then press Step a few times. Watch the PC and ACC being saved on the stack and then put back.

Brute-force attack

A brute-force attack is when a criminal tries every possible password (or key) until one works. Software tries millions of guesses each second.

The aim is to get into an account or system, then steal data or cause harm.

Longer passwords with a mix of character types have far more possible combinations, so they take much longer to crack.

Data interception

Data interception is when data is stolen while it is being sent, for example over Wi-Fi or across the internet.

A criminal can use a packet sniffer, a program that captures and examines data packets as they pass. On an unsecured public Wi-Fi network this is easy.

The aim is to read passwords, card numbers or private messages.

Distributed denial of service (DDoS)

A denial of service (DoS) attack floods a web server with so many requests that it cannot cope. Real users cannot reach the website.

In a distributed DoS (DDoS), the requests come from thousands of computers at once. These are often ordinary devices infected with malware and controlled by the criminal. This group is called a botnet.

The aim is to take a website offline, often to cause loss of sales or to demand money.

Hacking

Hacking is gaining unauthorised access to a computer system. Unauthorised means without permission.

A hacker may steal, change or delete data, or install malware. This is illegal in most countries.

Ethical hacking is different: a company pays an expert to try to break in, so weaknesses can be found and fixed.

Malware: virus, worm and Trojan horse

Malware (malicious software) is any software written to cause harm. Cambridge lists six types. The first three spread or get in; the last three do specific damage.

Malware: spyware, adware and ransomware

These three types are named after what they do once they are on a device.

Phishing and pharming

Phishing is sending a fake email or message that looks like it comes from a trusted organisation, such as a bank. It tries to make the user click a link to a fake website and type in their personal details.

Pharming is when malicious code is installed on the user's computer, or a DNS server is tampered with. It redirects the user to a fake website, even when they type the correct URL.

Both aim to steal login details, card numbers or other personal data.

Social engineering

Social engineering is manipulating people, rather than computers, into breaking security. It uses trust, fear, curiosity or urgency.

Phishing is one kind. Another is a phone call from someone pretending to be the IT department.

Baiting leaves a USB stick labelled "Salaries" in the car park, hoping someone plugs it in. Scareware is a fake pop-up saying "Your PC is infected, call now".

The aim is to get passwords, access to a building or system, or to get malware installed.

Solutions: access levels, anti-malware and authentication

Access levels give each user only the rights they need. A student can read the school timetable but cannot change it. This limits the damage if an account is hacked.

Anti-malware software includes anti-virus and anti-spyware. It scans files and compares them with a database of known malware. It quarantines or deletes anything harmful and checks downloads as they arrive.

Authentication proves a user is who they say they are.

Solutions: updates, checking messages and links

Automating software updates means the OS and apps download and install fixes by themselves. Updates close security holes that hackers and malware use.

Checking the spelling and tone of communications helps spot phishing. Warning signs are spelling mistakes, a general greeting such as "Dear customer", and an urgent or threatening tone.

Checking URLs in links before clicking: hover over the link to see where it really goes. Look for misspellings such as `paypa1.com` or extra words such as `bbva-secure-login.net`.

Solutions: firewalls and privacy settings

A firewall sits between a computer (or network) and the internet. It can be hardware, software or both.

It examines all traffic coming in and going out. It checks each packet against a set of rules, such as allowed IP addresses or ports. Traffic that breaks the rules is blocked.

It can also log traffic and warn the user when a program tries to connect to the internet.

Privacy settings control who can see your information, for example on social media. Setting a profile to "friends only" stops strangers seeing your location and photos, which social engineers use.

Solutions: proxy servers

A proxy server is a server that sits between the user's computer and the web server. Requests go to the proxy first, and the proxy fetches the page on the user's behalf.

It can filter requests, blocking access to certain websites. Schools use this to block unsuitable sites.

It hides the user's IP address, because the web server only sees the proxy's address. This protects the user's identity.

It can cache (store copies of) popular pages, so they load faster the next time.

In front of a web server, it can absorb and filter heavy traffic, helping to protect against DDoS attacks.

Solutions: SSL

SSL (Secure Sockets Layer) is a security protocol that encrypts data sent between a browser and a web server. Its modern version is called TLS, but the exam uses the name SSL.

It is what turns HTTP into HTTPS. It uses an SSL certificate: a digital document that proves the website is who it claims to be.

Matching threats to defences

Exam questions often give a scenario and ask you to name the threat and the best defence. Try the threats toy: read each scenario, name the threat, then pick the defence.

Always explain how the defence stops that threat. "Install a firewall" is a weak answer. "A firewall blocks incoming traffic that does not meet its rules" is stronger.

There is something to try for this step in the IGCSE library.

The three parts of an automated system

An automated system is a mix of hardware and software that does a job without a person controlling it.

A sensor is an input device that measures something physical, such as temperature or light, and sends the reading as data.

A microprocessor is the processor on a single chip. It compares the sensor reading with a stored set value (the target) and decides what to do.

An actuator is an output device that makes something move or switch, such as a motor, a valve, a heater or a pump.

The control loop, step by step

An automated system runs a loop. It keeps checking and correcting, all day, without stopping.

Use the greenhouse toy. Drag the temperature reading, or change the set values (heater on below, window opens above). Press Run one loop and watch the microprocessor compare them and switch the actuators on or off.

To match the example below, set Window opens above to 24 and drag the temperature to 27.

In the exam, write the steps in this order: sensor reads, ADC converts, microprocessor compares with the set value, actuator acts, the loop repeats.

There is something to try for this step in the IGCSE library.

Scenarios: industry and transport

In industry, automated systems control production lines, chemical plants and power stations.

In transport, they control trains, traffic lights and parts of cars, and they are the basis of self-driving vehicles.

Scenarios: agriculture and weather

In agriculture, automated systems water crops, feed animals and control greenhouses.

In weather monitoring, automated stations take readings day and night in remote places.

Scenarios: gaming, lighting and science

In gaming, sensors in controllers and headsets turn movement into actions in the game.

In lighting, light and infra-red sensors switch lights on and off by themselves.

In science, automated systems run experiments and take readings for long periods.

Advantages and disadvantages in general

Many exam questions ask you to evaluate an automated system. Use these general points, but always link them to the scenario in the question.