Cyber-security: Threats & Impacts
The Cyber-Security Threat Landscape
Cyber-security threats are deliberate attempts to damage, disrupt or gain unauthorised access to IT systems or data. The spec groups threats into four categories: Denial of Service (DoS), hacking, malware and social engineering. You must be able to define each named threat, explain how it works and describe the damage it causes.
Denial of Service (DoS)
A DoS attack floods a server, network or website with so many requests that it becomes overwhelmed and unable to respond to legitimate users. Businesses lose revenue and reputation when customers cannot access their services. A distributed DoS (DDoS) attack uses many computers at once, often as part of a botnet. It is far more powerful than a single-machine attack and much harder to block.
Hacking
Hacking refers to a person gaining unauthorised access to a system. The spec distinguishes three types by motive and authorisation status. Black hat hackers act with malicious intent: stealing data, installing malware, demanding ransoms or causing disruption for financial or political gain. Grey hat hackers access systems without permission but do not intend damage — they may discover a vulnerability and inform the organisation, sometimes without asking first. White hat hackers are authorised security professionals hired to test systems for weaknesses and fix them before attackers exploit them.
The legal status matters: black and grey hat hackers both access systems without permission (illegal); white hat hackers operate with explicit written permission (legal). A grey hat hacker who reports a flaw without permission still broke the law by accessing the system, even if their intent was benign.
Black hat = malicious, unauthorised. Grey hat = non-malicious but still unauthorised (discloses vulnerabilities without permission). White hat = authorised security professional, paid to find and fix vulnerabilities. The difference is permission and intent, not just intent.
Malware
Malware is the umbrella term for any malicious software. The spec lists seven named types. A virus attaches itself to a legitimate file and spreads when that file is shared — it requires human action (opening a file) to spread. A worm spreads automatically across networks without any user action. A Trojan horse disguises itself as legitimate software to trick users into installing it, then performs harmful actions secretly. A ransomware attack encrypts the victim’s files and demands a payment for the decryption key. Spyware secretly monitors user activity and sends data (such as passwords or browsing history) to the attacker. Adware floods the device with unwanted adverts and may redirect browsers to malicious sites. A botnet (mentioned above) turns the infected device into a “zombie” that the attacker controls remotely — often used for DDoS attacks or sending spam.
Social engineering exploits human behaviour, not software flaws. The spec lists six methods. Phishing uses fake emails or websites that appear to come from a trusted source (a bank, a delivery company) to trick victims into entering passwords or personal details. Pretexting involves the attacker creating a convincing fake scenario (pretending to be IT support, for example) to persuade a victim to share information or grant access.
Baiting tempts victims with something attractive — for example, leaving a USB drive labelled “Payroll 2024” in a car park. A curious employee plugs it into a work computer, infecting the network. Quid pro quo offers something in exchange for information — an attacker may phone an employee claiming to be IT support and offer to fix a problem in exchange for login credentials. Scareware displays frightening fake warnings (e.g. “Your computer is infected with 15 viruses! Click here to fix it!”) to panic users into downloading malware or paying for fake security software. Shoulder surfing is the simplest method: the attacker physically observes a victim entering a PIN, password or sensitive information in a public place.
The six social engineering methods are: phishing, pretexting, baiting, quid pro quo, scareware and shoulder surfing. A common exam error is naming only phishing — all six are examinable and each has a distinct mechanism.
Impacts of a Cyber-Security Attack
The spec lists six categories of impact. Data destruction: files are permanently deleted or overwritten, potentially destroying years of records. Data manipulation: data is altered without authorisation, producing incorrect outputs (e.g. changing a bank balance). Data modification: closely related to manipulation — data is changed (e.g. altering a student’s exam record). Data theft in transit and at rest: data is intercepted while being transmitted (“in transit”, e.g. captured over an unencrypted Wi-Fi connection) or stolen from stored files (“at rest”, e.g. a breached database). Denial of service to authorised users: a DoS or ransomware attack stops legitimate users from accessing systems they rely on. Identity theft: personal data (name, address, payment card details) is stolen and used to impersonate the victim, opening accounts or making purchases fraudulently.
An individual may face financial loss (fraudulent transactions, ransom payments), emotional distress (privacy violation, fear of identity theft), and the considerable time and effort needed to reclaim a stolen identity. An organisation faces financial losses (ransomware payments, lost revenue during downtime, regulatory fines), reputational damage (customers lose trust and take their business elsewhere), operational disruption (staff cannot work while systems are offline) and legal liability (if customer data was not properly protected).