Cybersecurity Threats and Defences

Why Cybersecurity Matters

Every connected device is a potential target. Attackers have financial, political or personal motivations to steal data, disrupt services or hold organisations to ransom. Understanding how attacks work is the first step towards defending against them. Your exam expects you to describe specific threats, explain how each works, and match it with appropriate defences.

Malware

Malware (malicious software) is a broad term covering any software designed to harm a system or its users. Key types include:

• Virus — attaches itself to a legitimate file and spreads when that file is shared. It requires a host file and user action to propagate.
• Worm — spreads automatically across a network without needing a host file or user action, exploiting security vulnerabilities.
• Trojan — disguises itself as legitimate software to trick users into installing it. Once active, it can open a backdoor for an attacker.
• Ransomware — encrypts a victim’s files and demands payment (a ransom) for the decryption key.
• Spyware — secretly monitors user activity, capturing keystrokes, passwords and browsing habits, and sends this data to an attacker.

Phishing and Social Engineering

Phishing attacks impersonate trusted organisations — banks, delivery companies, employers — using convincing but fraudulent emails or websites. The goal is to steal login credentials, financial details or personal information.

Social engineering is the broader category that phishing belongs to. Social engineering exploits human psychology rather than technical vulnerabilities. Variants include:

• Spear phishing — a targeted phishing attack aimed at a specific individual, using personal information to appear more convincing.
• Pretexting — the attacker invents a scenario (e.g. pretending to be IT support) to gain the victim’s trust and extract information.
• Baiting — leaving infected storage devices (e.g. USB sticks) in public places, hoping a curious person will plug one in.

Brute-Force Attacks

A brute-force attack systematically tries every possible password or key until the correct one is found. Modern computers can try billions of combinations per second, making short or simple passwords easy to crack. Dictionary attacks are a faster variant that uses common words and passwords first rather than every character combination.

Denial of Service (DoS) and Distributed DoS (DDoS)

A Denial of Service (DoS) attack overwhelms a server with requests until it can no longer respond to genuine users. A Distributed Denial of Service (DDoS) attack uses a botnet — thousands of infected devices controlled by the attacker — to send traffic simultaneously, making it far harder to block because the traffic comes from many sources.

DoS/DDoS attacks target availability: the victim’s website or service becomes inaccessible. Financial services, gaming platforms and news sites are common targets.

Data Interception

Data interception (sometimes called a man-in-the-middle attack) occurs when an attacker secretly captures data travelling between two parties. On unsecured Wi-Fi networks, an attacker can intercept packets and read unencrypted data such as login credentials sent over HTTP. Using a rogue access point — a fake Wi-Fi hotspot — is one method attackers use to position themselves between a victim and the internet.

SQL Injection

SQL injection targets web applications that use databases. Many websites use SQL (Structured Query Language) to retrieve data — for example, when a user logs in, the application queries the database for matching credentials. If the input is not properly validated, an attacker can insert SQL commands into a form field to bypass authentication, extract data or delete records.

For example, entering ' OR '1'='1 as a username can trick a poorly written login query into returning all user records, granting access without a valid password.