People will try to break in. This unit is the threats and the defences. You can start with prevention if you already know the attack names.
1.4.1 Threats to computer systems and networks
Learn a definition, what the attacker wants, and one tell.
| Threat | What it is | Typical goal |
|---|---|---|
| Malware | Software designed to harm or exploit. Includes virus (needs a host file; spreads when you run it), worm (spreads by itself over a network), trojan (pretends to be useful), ransomware (encrypts files and demands money), spyware (steals data silently) | Damage, money, data |
| Social engineering | Tricking a human, not a firewall. Includes phishing (fake emails/sites), blagging/pretexting, shouldering (watching you type a PIN) | Passwords, payments, access |
| Brute force | Trying many passwords (or keys) until one works | Account takeover |
| Denial of service (DoS / DDoS) | Flooding a service so legitimate users cannot use it. DDoS uses many machines (often a botnet) | Take a site offline |
| Data interception / packet sniffing | Capturing traffic on a network | Steal unencrypted data |
| SQL injection | Typing SQL into a form so the database runs the attacker’s command (dump tables, bypass login) | Steal or wreck data |
Phishing is a kind of social engineering. Do not treat them as unrelated in a long answer — say so.
A virus is not the same as a worm. Marker gold: virus needs a user to run an infected file; worm self-propagates.
1.4.2 Identifying and preventing vulnerabilities
Match defence to threat. A list of tools with no link scores poorly.
| Defence | What it does | Hits |
|---|---|---|
| Penetration testing | Authorised attackers try to break in and report holes before criminals do | Finds weaknesses (does not patch them by itself) |
| Anti-malware | Detects/removes known (and sometimes behaviour-based) malware | Virus, trojan, many worms |
| Firewall | Allows or blocks traffic by rules (ports, IPs, applications) | Unwanted incoming/outgoing connections |
| User access levels | People only get the rights they need (least privilege). Admin is rare | Limits damage if one account is stolen |
| Passwords | Strong, unique, not shared; lockouts after failures; 2FA where you can | Brute force, some social engineering |
| Encryption | Scramble data so intercepted bits are useless without the key. Disk, HTTPS, Wi-Fi (WPA2/3) | Interception |
| Physical security | Locks, locked server rooms, cables, CCTV, shredding disks | Stolen hardware, shouldering |
Input sanitisation / parameterised queries belong with SQL injection: never concatenate raw user text into an SQL string.
Patching / updates close known holes — worms love unpatched services.
A full 6-mark “discuss how a company can protect…” wants several defences, each tied to a threat, plus a limitation (staff still click phishing; encryption needs key management; pentest is a snapshot in time).
Exercises ask you to pair attacks with defences. The quiz never blocks 1.5.