Network security 1: threats and forms of attack

A computer system can be attacked through software, network connections or the people who use it. In this worksheet, you will learn to recognise the forms of attack named in OCR J277 and explain how each attack is used and what the attacker is trying to achieve.

By the end, you should be able to:

• explain malware, using common types as examples of how malicious software behaves
• explain social engineering and phishing
• explain brute-force and denial of service attacks
• explain data interception and theft
• explain the concept of SQL injection
• identify attacks from unfamiliar scenarios
• develop answers using linked cause and effect

All examples are for defensive study. You do not need to write malicious code or know technical attack commands.

Work through the explanation, checks and applications in order. Use the final challenge to connect several ideas.

1. Threat, vulnerability and attack

A security threat is something that could cause harm to a device, system, network or its data. A vulnerability is a weakness that could be exploited. An attack is an attempt to exploit a weakness or cause harm.

The harm may affect:

• confidentiality, when information is seen or stolen by an unauthorised person
• integrity, when data is changed, damaged or deleted
• availability, when legitimate users cannot access a system or service

These labels are a useful thinking tool. OCR mainly rewards a concrete explanation of what happens to the device, system, service or data. For example, data interception can expose confidential information, while a denial of service attack can make a service unavailable.

An exam-ready explanation

For a question about a form of attack, build a chain:

1. Name it: identify the attack precisely.
2. Explain how: describe what the attacker or malicious software does.
3. Explain the purpose or effect: state the useful consequence for the attacker or the harm to the victim.

A developed point sounds like this:

A brute-force attack systematically tries many possible password combinations until the correct one is found. This could let the attacker gain unauthorised access to an account and its data.

Avoid vague endings such as “this is dangerous” or “the system is hacked”. State what happens to the system, service or data. If the question asks you to describe a threat, do not replace that description with a prevention method.

2. Malware

Malware is malicious software designed to damage a system, disrupt it, steal data or gain unauthorised access.

• A virus attaches itself to a file or program. It is activated when a user opens or runs the infected item, then it can copy itself and infect other files.
• A worm copies itself and spreads across networks without needing to attach to a file or wait for a user to run it. Rapid spreading can consume network resources.
• A Trojan appears to be legitimate or useful software. A user is deceived into installing it, after which it performs a hidden malicious action. Unlike a virus or worm, a Trojan does not copy itself.
• Spyware secretly monitors activity and sends collected information, such as login details, to another person. A software keylogger is a specific type of spyware that records keys pressed by a user, potentially capturing passwords or other sensitive information.
• Ransomware encrypts files or locks access to a system, then demands payment for access to be restored.

The malware type describes how it behaves. The final effect might include corrupted files, stolen credentials, lost access or reduced network performance.

3. Attacking people and accounts

Social engineering uses deception or manipulation to persuade a person to reveal information or perform an unsafe action. It targets people as a possible weak point rather than relying only on a technical weakness.

Phishing is a form of social engineering. A message is made to look as if it comes from a trusted organisation or person. It may pressure the recipient to follow a link, open an attachment or enter login details into a fake site. The purpose may be to steal credentials or deliver malware.

A brute-force attack systematically tries many possible passwords until the correct one is found. Its purpose is to gain unauthorised access. Short or predictable passwords reduce the number of attempts needed, although any password could eventually be found if unlimited attempts and time were available.

Do not confuse the methods. Phishing tries to persuade a person to give away a credential. Brute force tries combinations to discover it.

4. Attacking services, data and databases

A denial of service (DoS) attack sends a very large number of requests or large amounts of traffic to a server or network. Processing capacity or bandwidth is consumed, so the service becomes slow or unavailable to legitimate users. A distributed denial of service (DDoS) attack sends the traffic from many compromised devices, often called a botnet. The purpose is disruption, not necessarily data theft.

Data interception occurs when an unauthorised person captures data while it is being transferred across a network. They may copy packets and obtain credentials, financial details or other confidential information. Interception is the method; theft or misuse of the captured data may be the purpose.

SQL injection is an attack on a database-backed system. Malicious database instructions are entered through an input field. If the input is handled insecurely, the system may treat the input as part of a database command. The attacker may then view, change or delete data, or gain unauthorised access. OCR requires the concept, not the ability to construct an attack.

Review

Without looking back, choose four attacks and say or write one how statement and one purpose or effect statement for each. Then check your explanations against the worksheet.

You should be able to answer both questions for every OCR form of attack:

1. How is the attack used?
2. What is its purpose or effect?

Your key vocabulary is: malware, social engineering, phishing, brute force, denial of service, data interception and theft, and SQL injection. The named OCR requirement is malware: you must explain how it can be used and its purpose or effect. The virus, worm, Trojan, spyware, ransomware and keylogger examples in this worksheet help you recognise different malware behaviour; do not let memorising labels replace a clear explanation of the threat.