Community resourceWorksheet

J277 1.4.1 Threats and attacks

Part 1 of 3 · J277 1.4 · Network security

The forms of attack in OCR J277 1.4.1, explained through their mechanisms and effects.

Students will:

  • recognise malware and explain how it can harm files or data
  • distinguish phishing from brute-force attacks
  • explain denial of service, interception and SQL injection
  • apply an attack mechanism to a new situation
  • retrieve attack names without a word bank

Inside: 4 text sections, 1 multiple-choice activity, 3 completion activities, 6 written answers. 23 marks. Suggested teaching time: 45–65 minutes. 1 diagram.

Includes a teacher guide with suggested sections, timings and common misconceptions.

Series: J277 1.4 · Network security, part 1 of 3.

Shared by Coding PathwayVerified teacher

  • 14 cells
  • About 60 minutes
  • CC BY-SA 4.0
  • Shared 17 Aug 2026
  • Updated 27 Oct 2026

Preview

The whole resource, exactly as a class sees it. Answers and marking are held back.

Threats and attacks

A threat could harm a system or its data. A vulnerability is a weakness. An attack tries to exploit a weakness or cause harm. Focus on what happens and why it matters, rather than just naming a threat.

1. Malicious software

Malware is software designed to cause harm, such as stealing data, damaging files or disrupting a service. These examples show different behaviours:

ExampleBehaviour
VirusAttaches to a file/program and can spread when the infected item runs.
WormCopies itself across networks without needing a host file.
TrojanAppears useful or genuine but performs a hidden malicious action.
Spyware/keyloggerSecretly collects activity or keys pressed, potentially stealing login details.
RansomwareLocks or encrypts files and demands payment to restore access.

These examples help you recognise how malware harms a system. Learning a list of names alone does not explain its effect.

Fill in the blanks3 marks
A Answer 1 attaches to a file/program. A Answer 2 can copy itself across a network without a host file. A Answer 3 looks like useful software but has a hidden malicious action.
  • virus
  • worm
  • Trojan
  • encryption
  • firewall
Written answer2 marks

A student runs a downloaded program that contains malware. Explain one way the malware could harm the student's files or personal data.

Students type their answer here.

2. People and accounts

Social engineering manipulates a person into revealing information or doing something unsafe. Phishing uses a message or site that pretends to be trustworthy. A fake sign-in page may collect a password; a deceptive attachment may deliver malware.

A brute-force attack systematically tries many possible passwords to find the correct one and gain unauthorised access. It does not rely on persuading someone to reveal the password. Short, predictable passwords are easier to guess.

Different routes to an account Phishing deceives a person into revealing a password. Brute force tries possible passwords. Either can lead to unauthorised account access; the methods are different. Phishing A deceptive message or website persuades a person to reveal a secret. Brute force Many possible passwords are tried to find one that works. Both may lead to account access.
Multiple choice1 mark

A message pretending to come from a school's IT team asks a student to enter a password on a copied sign-in page. Which attack is most precisely described?

  • ABrute force
  • BPhishing
  • CDenial of service
  • DSQL injection
Written answer3 marks

A student follows a link in a message that appears to come from a school club. Explain how this could lead to an attacker accessing the student's club account.

Students type their answer here.

Written answer2 marks

Describe how a brute-force attack could gain access to an account.

Students type their answer here.

3. Services, transfers and databases

AttackHow it works and its purpose
Denial of service (DoS)Overwhelms a server or network with requests/traffic, using up its capacity so genuine users cannot use it. A distributed attack uses many devices.
Data interception and theftCaptures data while it travels across a network. An attacker may obtain confidential (private) details or copy them for misuse.
SQL injectionMalicious database instructions are entered through insecure input. If treated as part of a database command, they may reveal, change or delete records.

A DoS attack aims to disrupt access; it does not have to steal data. SQL injection concerns input being treated as database instructions. You need the concept, not attack commands.

Fill in the blanks3 marks
Answer 1 overloads a service. Answer 2 captures data during transmission. Answer 3 uses insecure input to interfere with database commands.
  • SQL injection
  • data interception
  • denial of service
  • encryption
Written answer3 marks

Explain how a denial of service attack could stop students using a school's homework website.

Students type their answer here.

Written answer2 marks

A website handles form input insecurely when using its database. Explain how SQL injection could let an attacker view or change records.

Students type their answer here.

Written answer2 marks

Describe how data interception could help an attacker steal confidential information.

Students type their answer here.

Fill in the blanks2 marks
Name each form of attack without using the tables. (a) Software secretly records a user's keys pressed: Answer 1. (b) Many possible account passwords are tried systematically: Answer 2.

Review

Choose one answer that names an attack without explaining it. Add what the attacker does and the resulting harm.