Cybersecurity: Threats and Protection
Why Cybersecurity Matters
Cyber security is the field concerned with defending digital systems and data from attack. It affects everyone: a hospital storing patient records, a bank holding millions of account details, a school with pupil data, and an individual with a social media profile. Cyber threats do not require physical proximity — an attacker can target systems from anywhere in the world, which is what makes them so difficult to defend against.
Threats come from two broad directions. Some exploit technical weaknesses in software or networks. Others exploit the most unpredictable part of any system: the people using it. Understanding how attacks work is the first step towards building effective defences.
Malware: The Five Types
Malware (malicious software) is any program designed to cause harm. There are five types you need to know for your exam.
A computer virus attaches to an existing file or program. When the infected file is opened or shared — for example, via an email attachment or a USB drive — the virus copies itself to other files. Viruses require a host file and rely on user action to spread.
A worm is similar to a virus but does not need a host file. It spreads automatically across networks by exploiting security vulnerabilities, with no user action required. A single unpatched device on a network can allow a worm to propagate to every connected machine.
A trojan (or trojan horse) disguises itself as useful software — a free game, a codec update, a utility. Once installed, it operates silently, typically opening a back door that gives an attacker remote access. Unlike a virus or worm, a trojan does not self-replicate.
Ransomware encrypts the victim’s files, making them inaccessible, and then demands a ransom payment in exchange for the decryption key. High-profile ransomware attacks have targeted hospitals, councils and businesses. Even paying the ransom does not guarantee that files will be restored.
A key logger is a form of spyware that runs hidden in the background and records every key pressed on the device. Passwords, bank account details, messages and search terms are all captured. The collected data is transmitted back to the attacker without the user’s knowledge.
Five malware types: virus (attaches to files, needs user action to spread), worm (spreads automatically across networks, no host file needed), trojan (disguised as legitimate software, opens a back door), ransomware (encrypts files and demands payment), key logger (records keystrokes silently).
Technical Vulnerabilities
Hackers do not always need sophisticated malware — they can exploit weaknesses that organisations have failed to close. The two main technical vulnerabilities in this specification are unpatched software and out-of-date anti-malware.
When a software vulnerability is discovered, the developer releases a security patch — an update that closes the gap. Systems that have not applied the patch remain exposed. Attackers can find published details of known vulnerabilities and write code to exploit them. This is why applying software updates promptly matters: the update often closes a door that attackers are already trying to walk through. Similarly, anti-malware software that has not been updated cannot recognise the latest threats, leaving newer malware able to operate undetected.
Social Engineering
Social engineering targets human psychology rather than technical flaws. Attackers create believable scenarios or apply pressure to trick people into doing something that compromises security — revealing a password, clicking a link, or transferring money. Three common forms are shown below.
Phishing arrives as an email or text message that appears to come from a trusted source — a bank, a delivery company, or a well-known service. It typically creates urgency (“Your account will be suspended unless you act now”) and directs the target to a fake website to harvest credentials. Spear phishing is a targeted variant aimed at a specific individual, using personalised details to make the deception more convincing.
Pretexting (sometimes called blagging) involves inventing a convincing story to gain access or information. An attacker might call a company helpdesk claiming to be an IT contractor who urgently needs a user’s credentials reset, or pose as a supplier requesting bank account details. The invented scenario creates a sense of authority or urgency that overrides the target’s normal caution.
Shouldering (shoulder surfing) is the simplest form of social engineering: physically watching someone enter private information. It can happen at cashpoints, on public transport, or in shared workspaces where someone observes a colleague typing a password or reading a confidential document.
The Five Protections
Defending digital systems requires a layered approach. The specification names four groups: anti-malware software, encryption, acceptable use policies, and backup and recovery procedures. Backup and recovery are two separate steps, so there are five methods to learn. Together these form a defence strategy that addresses different points of failure.
Anti-malware software detects and removes malicious programs by comparing files and behaviour against databases of known threats and suspicious patterns. It works best when updated frequently so that definitions include the most recent threats. Anti-malware can catch known viruses, worms and trojans before they execute, and can quarantine suspicious files for review.
Encryption converts data into a scrambled form that can only be read by someone with the correct key. If an attacker intercepts encrypted data in transit or steals an encrypted file, they cannot read its contents without the key. Encryption protects data at rest (stored on a device or server) and in transit (moving across a network).
An acceptable use policy (AUP) sets out the rules governing how staff may use an organisation’s IT systems. It defines what is and is not permitted: which websites may be accessed, whether personal use is allowed, how sensitive data must be handled, and the penalties for misuse. A well-enforced AUP reduces the likelihood of employees accidentally (or deliberately) introducing threats through risky behaviour.
Backup involves regularly copying data to a separate location — an external drive, a secure server or a cloud service — so that if the original is lost, corrupted or encrypted by ransomware, the data can be restored. Backups must be frequent enough to limit data loss to an acceptable period and stored in a location not directly accessible from the primary system (to prevent ransomware encrypting the backup too).
Recovery procedures are the documented plans and steps an organisation follows after a successful attack or system failure. They specify who does what, in what order, to restore services and data. Without tested recovery procedures, even organisations with good backups may take much longer than necessary to return to normal operation after an incident.
The five protections to learn are: anti-malware software (detects and removes malicious programs), encryption (scrambles data so it is unreadable without a key), acceptable use policy (rules governing how staff use IT systems), backup (regularly copies data to a separate location), and recovery procedures (documented steps to restore systems after an attack).