Preview

The whole resource, exactly as a class sees it. Answers and marking are held back.

Network security 1: threats and forms of attack

A computer system can be attacked through software, network connections or the people who use it. In this worksheet, you will learn to recognise the forms of attack named in OCR J277 and explain how each attack is used and what the attacker is trying to achieve.

By the end, you should be able to:

describe malware and distinguish common types
explain social engineering and phishing
explain brute-force and denial of service attacks
explain data interception and theft
explain the concept of SQL injection
identify attacks from unfamiliar scenarios
develop answers using linked cause and effect

All examples are for defensive study. You do not need to write malicious code or know technical attack commands.

1. Threat, vulnerability and attack

A security threat is something that could cause harm to a device, system, network or its data. A vulnerability is a weakness that could be exploited. An attack is an attempt to exploit a weakness or cause harm.

The harm may affect:

confidentiality, when information is seen or stolen by an unauthorised person
integrity, when data is changed, damaged or deleted
availability, when legitimate users cannot access a system or service

These labels are a useful thinking tool. OCR mainly rewards a concrete explanation of what happens to the device, system, service or data. For example, data interception can expose confidential information, while a denial of service attack can make a service unavailable.

An exam-ready explanation

For a question about a form of attack, build a chain:

Name it: identify the attack precisely.
Explain how: describe what the attacker or malicious software does.
Explain the purpose or effect: state the useful consequence for the attacker or the harm to the victim.

A developed point sounds like this:

A brute-force attack systematically tries many possible password combinations until the correct one is found. This could let the attacker gain unauthorised access to an account and its data.

Avoid vague endings such as “this is dangerous” or “the system is hacked”. State what happens to the system, service or data. If the question asks you to describe a threat, do not replace that description with a prevention method.

2. Malware

Malware is malicious software designed to damage a system, disrupt it, steal data or gain unauthorised access.

A virus attaches itself to a file or program. It is activated when a user opens or runs the infected item, then it can copy itself and infect other files.
A worm copies itself and spreads across networks without needing to attach to a file or wait for a user to run it. Rapid spreading can consume network resources.
A Trojan appears to be legitimate or useful software. A user is deceived into installing it, after which it performs a hidden malicious action. Unlike a virus or worm, a Trojan does not copy itself.
Spyware secretly monitors activity and sends collected information, such as login details, to another person. A software keylogger is a specific type of spyware that records keys pressed by a user, potentially capturing passwords or other sensitive information.
Ransomware encrypts files or locks access to a system, then demands payment for access to be restored.

The malware type describes how it behaves. The final effect might include corrupted files, stolen credentials, lost access or reduced network performance.

Fill in the blanks6 marks

A ______ attaches to a file and is activated when the infected item is run. A ______ can copy itself across a network without attaching to a file. A ______ is disguised as legitimate software. ______ secretly monitors activity, and a software keylogger is a specific type of ______. ______ locks or encrypts data and demands payment.

virus
worm
Trojan
spyware
keylogger
ransomware

Multiple choice, several answers3 marks

Which three statements correctly identify a malware type from its behaviour? Select all that apply.

AFiles are encrypted and payment is demanded: spyware
BA useful-looking application performs a hidden malicious action after installation: Trojan
CAn infected document runs malicious software when opened: virus
DSoftware records every key pressed: denial of service
ESoftware copies itself between networked devices without attaching to a file: worm

Written answer6 marks

Compare a virus, a worm and a Trojan. Explain one distinguishing feature of each.

Use one linked sentence for each type. Include attachment and user action for a virus, independent replication for a worm, and disguise without self-replication for a Trojan.

Students type their answer here.

3. Attacking people and accounts

Social engineering uses deception or manipulation to persuade a person to reveal information or perform an unsafe action. It targets people as a possible weak point rather than relying only on a technical weakness.

Phishing is a form of social engineering. A message is made to look as if it comes from a trusted organisation or person. It may pressure the recipient to follow a link, open an attachment or enter login details into a fake site. The purpose may be to steal credentials or deliver malware.

A brute-force attack systematically tries possible passwords or encryption keys until the correct one is found. Its purpose is to gain unauthorised access. Short or predictable passwords reduce the number of attempts needed, although any password could eventually be found if unlimited attempts and time were available.

Do not confuse the methods. Phishing tries to persuade a person to give away a credential. Brute force tries combinations to discover it.

Fill in the blanks6 marks

______ relies on ______ to manipulate a person. A fake message designed to steal ______ is an example of ______. A ______ attack instead tests ______ until the correct password or key is found.

social engineering
phishing
brute force
deception
possible combinations
credentials

4. Attacking services, data and databases

A denial of service (DoS) attack sends a very large number of requests or large amounts of traffic to a server or network. Processing capacity or bandwidth is consumed, so the service becomes slow or unavailable to legitimate users. A distributed denial of service (DDoS) attack sends the traffic from many compromised devices, often called a botnet. The purpose is disruption, not necessarily data theft.

Data interception occurs when an unauthorised person captures data while it is being transferred across a network. They may copy packets and obtain credentials, financial details or other confidential information. Interception is the method; theft or misuse of the captured data may be the purpose.

SQL injection is an attack on a database-backed system. Malicious database instructions are entered through an input field. If the input is handled insecurely, the system may treat the input as part of a database command. The attacker may then view, change or delete data, or gain unauthorised access. OCR requires the concept, not the ability to construct an attack.

Fill in the blanks6 marks

A ______ attack overwhelms a service and targets its ______. When traffic comes from many compromised devices, this is a ______ attack. ______ captures information travelling across a network and threatens ______. ______ places malicious database instructions into an insecure input.

denial of service
distributed denial of service
data interception
SQL injection
availability
confidentiality

Multiple choice, several answers3 marks

Which statements correctly link an attack to its purpose or likely effect? Select all that apply.

AA denial of service attack aims to make a service unavailable to legitimate users
BA brute-force attack makes a website unavailable by flooding it with page requests
CSQL injection can be used to gain unauthorised access to database data
DData interception can be used to steal confidential information while it is being transferred
EPhishing automatically copies itself between networked computers

Written answer4 marks

Explain how a denial of service attack could prevent students from using a school's online learning platform.

Build a chain: many requests or heavy traffic, a resource that becomes overloaded, then the effect on legitimate students. For a fourth mark, distinguish DDoS.

Students type their answer here.

Written answer8 marks

Identify the most likely form of attack in each scenario and give one clue that supports your answer.

A. An employee receives an urgent message that copies the organisation's branding and asks them to sign in through a link.

B. A website input is treated as a database instruction, exposing customer records.

C. Software silently sends a user's browsing activity and saved login details to another person.

D. Network packets containing unencrypted account details are captured while in transit.

Write four pairs in the form: 'A: attack, because clue'. Use the most precise name available.

Students type their answer here.

Written answer8 marks

Stretch challenge: A ticket website suffers three incidents. First, customers receive convincing fake support emails and some enter their passwords on a false sign-in page. Next, thousands of compromised devices repeatedly request the ticket page until genuine customers cannot connect. Finally, an attacker uses insecure input on the booking form to access the customer database.

Analyse the three forms of attack. For each one, name the attack, explain how it is used, and state one intended purpose or effect.

Organise your answer into three mini-paragraphs. Use the pattern: 'This is... The attacker... Therefore...'. The three best labels are all different.

Students type their answer here.

Review

Without looking back, choose four attacks and say or write one how statement and one purpose or effect statement for each. Then check your explanations against the worksheet.

You should be able to answer both questions for every OCR form of attack:

How is the attack used?
What is its purpose or effect?

Your key vocabulary is: malware, social engineering, phishing, brute force, denial of service, data interception and theft, and SQL injection. Within malware, make sure you can distinguish a virus, worm, Trojan, spyware, ransomware, and recognise a software keylogger as a type of spyware.