Cybersecurity basics: passwords, malware and phishing

Lerne es beim Spielen

Beantworte diese Fragen für Energie, dann angle und erkunde. Kein Konto nötig.

Für Lehrkräfte: sofort einsetzbare Lektionsfolien, Lernnotizen, Diagramme für Cybersecurity basics: passwords, malware and phishing (KS3 Computing, Digital Literacy) — nutze sie in deiner Lektion oder starte das Thema als interaktive Klassenaktivität, die deine Lernenden als Live-Spiel spielen.

Lektionsnotizen

Strong Passwords

A strong password is long, random, and unique for each account.
Use a mix of upper and lower case letters, numbers, and symbols.
Avoid using personal information like names, birthdays, or common words.
Consider using a passphrase – a sequence of random words – which is easier to remember and harder to crack.
Never reuse passwords across different accounts; if one is compromised, others are at risk.
Use a password manager to store and generate strong passwords securely.

Long, unique passphrases with a password manager and multi-factor authentication resist guessing far better than short reused passwords.

Malware Types

Malware is malicious software designed to harm or exploit devices and data.
A virus attaches itself to a file or program and spreads when the infected file is opened.
A worm spreads automatically across networks without needing a host file.
Ransomware locks your files or device and demands payment to restore access.
Malware can be delivered via email attachments, malicious links, or compromised websites.
Keeping software updated helps patch vulnerabilities that malware exploits.

Phishing and Social Engineering

Phishing is a scam where attackers trick people into revealing sensitive information or installing malware.
It is a form of social engineering – manipulating people rather than hacking systems.
Phishing messages often pretend to be from trusted sources like banks or government agencies.
They create urgency or fear, e.g., 'Your account has been compromised – click here now.'
The goal is usually to steal login credentials, financial details, or install malware.
Phishing is the most common type of cybercrime globally.

Types of Phishing

Email phishing – bulk emails sent to many people, often with fake login links.
Spear phishing – targeted attacks on specific individuals using personal information to seem credible.
Vishing (voice phishing) – fake phone calls, often using VoIP and number spoofing.
Smishing (SMS phishing) – fraudulent text messages with links or phone numbers.
Quishing – phishing using QR codes that lead to malicious sites.
Page hijacking – redirecting users from legitimate websites to malicious ones.

Staying Safe Online

Always think critically before clicking links or opening attachments, even if they look familiar.
Check the sender's email address or phone number for unusual details.
Hover over links to see the real URL before clicking.
Never enter personal information on a site reached via a suspicious link.
Use multi-factor authentication (MFA) where possible for extra security.
Keep all software and devices updated to protect against known vulnerabilities.

Software Updates

Software updates fix security holes (vulnerabilities) that attackers can exploit.
Enable automatic updates for your operating system, apps, and antivirus.
Updates often include patches for newly discovered malware threats.
Ignoring updates leaves your device at higher risk of infection.
Only download updates from official sources to avoid fake update scams.

A security update patches the vulnerability an attacker could otherwise exploit.

Account and Device Safety

Use a different strong password for each important account.
Log out of accounts on shared or public devices.
Be cautious when using public Wi-Fi – avoid accessing sensitive accounts without a VPN.
Install and maintain reputable antivirus software.
Back up important data regularly to recover from ransomware attacks.
Report phishing attempts to your school, workplace, or relevant authorities.

A phishing message uses urgency to make you click; the safe response is stop, check independently, report.

The malware infection chain: delivery, execution, infection, impact, then persistence and spread.

Social engineering relies on urgency, impersonation and requests for sensitive information; pause, verify, report.

Folien

Step through every slide for this topic — plus flashcards and revision notes — with a free account.

REGISTRIEREN — GRATIS ANMELDEN

Übungsfragen

Gratis-Vorschau — 8 von 58 Fragen. Registriere dich, um alle zu sehen.

1.Phishing is a type of social engineering attack.
Easy
True or false?
2.What does the term 'phishing' refer to?
Easy
- AUsing a fishing rod to catch fish
- BA type of computer virus
- CA scam that uses lures to 'fish' for sensitive information
- DA method of securing passwords
3.Malware only includes viruses.
Easy
True or false?
4.Which of the following are types of malware mentioned in the source? (Select all that apply)
Easy
- AVirus
- BWorm
- CRansomware
- DPhishing
- EAdware
5.Spear phishing targets a specific individual or group.
Easy
True or false?
6.What is 'smishing'?
Easy
- APhishing via email
- BPhishing via SMS text messages
- CPhishing via voice calls
- DPhishing via QR codes
7.Keeping software up to date is not important for cybersecurity.
Easy
True or false?
8.Match each phishing type to its description.
Medium
- Vishing
- Smishing
- Quishing
- Voice phishing
- SMS phishing
- QR code phishing

Mehr Fragen

9.Which of the following is a good practice for creating a strong password?
Medium
- AUsing your name and birthdate
- BUsing the same password for all accounts
- CUsing a long passphrase with a mix of characters
- DWriting it down on a sticky note on your monitor
10.Phishing attacks are always easy to spot because they have spelling mistakes.
Easy
True or false?
11.Put the following steps in the order a typical phishing attack might occur:
Medium
- Attacker sends a fraudulent email appearing to be from a trusted source
- Victim clicks a link to a fake login page
- Victim enters their login credentials
- Attacker uses the stolen credentials to access the victim's account
12.Which of the following are examples of social engineering techniques used in phishing? (Select all that apply)
Medium
- ACreating a sense of urgency
- BImpersonating a trusted organization
- CUsing technical hacking to break into a server
- DSending a fake login page link
13.Which of the following are listed in the source as types of malware? (Select all that apply)
Medium
- AVirus
- BWorm
- CRansomware
- DSpyware
14.Match each phishing term to its description.
Medium
- Spear phishing
- Whaling
- Bulk phishing
- Targets a specific individual using personal information
- Targets senior executives or high-value individuals
- Sent to a wide audience without specific targeting
15.Arrange these steps in order for creating a strong password:
Medium
- Think of a memorable phrase or sentence
- Take the first letter of each word
- Add numbers and special characters
- Make it at least 12 characters long
16.Vishing takes advantage of people's lower awareness and trust in voice telephony compared to email.
Easy
True or false?
17.Phishing attacks are always easy to spot because they contain spelling mistakes.
Easy
True or false?
18.According to the source, phishing attacks among businesses increased from 72% in 2017 to 94% in 2023.
Easy
True or false?
19.Which of the following is a reason why spear phishing attacks are often more effective than general phishing attempts?
Medium
- AThey are sent in bulk to a wide audience
- BThey are tailored to specific individuals using personal or organizational information
- CThey always use QR codes
- DThey are delivered only via voice calls
20.According to the source, vishing takes advantage of the public's higher awareness and trust in voice telephony compared to email phishing.
Medium
True or false?
21.A company receives an email that appears to be from its CEO, asking an employee to urgently transfer funds to a new account. The email also contains a link to a login page that looks legitimate but is fake. Which type of phishing attack is this most likely to be?
Medium
- AVishing
- BSpear phishing
- CSmishing
- DQuishing
22.Which of the following are listed in the source as potential targets of phishing attacks? (Select all that apply)
Medium
- AFinancial institutions
- BEmail and cloud productivity providers
- CStreaming services
- DGovernment agencies
- ESocial media platforms
23.According to the source, phishing is the most prevalent type of cybercrime globally.
Easy
True or false?
24.An attacker uses a compromised website to redirect visitors to a malicious page that installs malware. This technique is known as:
Hard
- AVishing
- BPage hijacking
- CSmishing
- DSpear phishing
25.In the spear phishing study, older women had the highest susceptibility to clicking on simulated phishing links.
Easy
True or false?
26.Match each phishing technique to its primary vector.
Medium
- Vishing
- Smishing
- Quishing
- Voice calls
- SMS text messages
- QR codes
27.According to the source, which of the following is a reason why spear phishing attacks are often more effective than general phishing attempts?
Medium
- AThey are sent in bulk to a wide audience.
- BThey are tailored to specific individuals and leverage personal or organizational information.
- CThey always use QR codes.
- DThey target only streaming services.
28.In vishing attacks, attackers use text-to-speech synthesizers to make automated phone calls to large numbers of people.
Medium
True or false?
29.Put the following steps in the order a typical email phishing attack might occur, according to the source.
Hard
- Attacker sends fraudulent emails that appear to be from a trusted source.
- Victim is redirected to a fake login page.
- Victim enters their credentials on the fake page.
- Attacker uses the stolen credentials to steal money or install malware.
30.Which of the following best explains why the integration of generative AI has intensified the threat of phishing?
Challenge
- AIt allows attackers to send emails without any internet connection.
- BIt enables attackers to launch highly convincing, automated, and hyper-targeted phishing campaigns at an unprecedented scale.
- CIt makes all phishing attacks use QR codes.
- DIt only affects businesses, not individuals.
31.Phishing is a form of social engineering and a scam.
Easy
True or false?
32.Phishing attacks are always targeted at specific individuals.
Easy
True or false?
33.What does the term 'phishing' derive from?
Easy
- AFishing
- BPhreaking
- CPharming
- DSpamming
34.Which of the following is an example of a strong password?
Easy
- Apassword123
- BTr0ub4dor&3
- Cadmin
- D12345678
35.Which of the following are mentioned in the source as types of malware? (Select all that apply)
Easy
- AVirus
- BWorm
- CRansomware
- DSpyware
- EAdware
36.Vishing takes advantage of the public's lower awareness and trust in voice telephony compared to email phishing.
Easy
True or false?
37.Spear phishing attacks are often more effective than general phishing attempts because they are tailored to specific individuals.
Medium
True or false?
38.Which of the following are listed in the source as examples of social engineering techniques used in phishing attacks? (Select all that apply)
Medium
- ACreating a false sense of urgency
- BImitating legitimate communications
- CUsing technical exploits to bypass security
- DPretending to be a trusted source
- EUsing brute force to crack passwords
39.According to the source, phishing attacks among businesses increased from 72% in 2017 to 86% in 2020, and reached 94% in 2023.
Easy
True or false?
40.In the spear phishing study, the susceptibility of older users remained stable during the 21-day study, while it declined among young users.
Medium
True or false?
41.Fill in the blank: A strong password should be ___ and not easily guessed.
Easy
A strong password should be ____ and not easily guessed.
42.Fill in the blank: ___ is a type of phishing that uses voice calls to trick victims.
Easy
____ is a type of phishing that uses voice calls to trick victims.
43.What is the main purpose of phishing attacks?
Easy
44.Fill in the blank: ___ is a type of malware that encrypts your files and demands payment.
Easy
____ is a type of malware that encrypts your files and demands payment.
45.Name one type of malware mentioned in the source.
Medium
46.According to the source, by what percentage did phishing attacks among businesses increase from 2017 to 2020?
Easy
47.In the study on spear phishing susceptibility, what was the percentage point difference between the older users who clicked on simulated phishing links and the youth aged 18–25?
Easy
48.What does the term 'phishing' derive from, according to the source?
Easy
49.In the study on spear phishing susceptibility, what was the percentage point increase in susceptibility from the youth group to the older group?
Medium
50.According to the source, what percentage of businesses experienced phishing attacks in 2020?
Easy
51.Fill in the blanks to complete the sentence about phishing attacks among businesses.
Easy
Phishing attacks among businesses rose from ____% in 2017 to ____% in 2020, and reached ____% in 2023.
52.Fill in the blanks to complete the sentence about phishing techniques.
Medium
Phishing techniques include ____ (voice phishing), ____ (SMS), and ____ (QR code).
53.Explain why spear phishing attacks are often more effective than general phishing attempts.
Medium
54.Describe two measures that can help prevent or reduce the impact of phishing attacks, according to the source.
Hard
55.According to the source, by what percentage did phishing attacks among businesses increase from 2017 to 2020?
Easy
- A13 %
- B15 %
- C16 %
- D14 %
56.In the study on spear phishing susceptibility, what was the percentage point difference between the older users who clicked on simulated phishing links and the youth aged 18–25?
Easy
- A15 %
- B16 %
- C17 %
- D14 %
57.In the study on spear phishing susceptibility, what was the percentage point increase in susceptibility from the youth group to the older group?
Medium
- A16 %
- B14 %
- C15 %
- D17 %
58.According to the source, what percentage of businesses experienced phishing attacks in 2020?
Easy
- A95 %
- B104 %
- C86 %
- D77 %

Lernnotizen

## Cybersecurity Basics: Passwords, Malware & Phishing ### Why Strong Passwords Matter - **Strong passwords** are your first line of defence. They should be long, unique, and not easily guessed (avoid names, birthdays, common words). - Use a mix of letters, numbers, and symbols. Never reuse passwords across accounts. - Consider a password manager to keep track of them. ### Malware Types - **Virus**: Malicious software that attaches to a program or file and spreads when you run it. - **Worm**: Self-replicating malware that spreads without human action, often over networks. - **Ransomware**: Locks your files or device and demands payment (ransom) to unlock them. - Malware can be delivered via phishing, malicious downloads, or compromised websites. ### Phishing and Social Engineering - **Phishing** is a scam where attackers trick you into revealing sensitive info or installing malware. It's a form of **social engineering**. - Common types: - **Email phishing**: Bulk fake emails that look like they're from a bank or service, directing you to a fake login page. - **Spear phishing**: Targeted at specific people, using personal info to seem credible. - **Vishing**: Voice phishing via phone calls, often with spoofed numbers. - **Smishing**: Phishing via text messages (SMS). - **Quishing**: Phishing using QR codes. - **Red flags**: Urgency, unexpected attachments/links, requests for personal info, poor spelling/grammar, unusual sender addresses. ### Staying Safe - **Software updates**: Install updates promptly – they patch security holes. - **Think before you click**: Hover over links to see the real URL; don't enter credentials on unfamiliar sites. - **Use multi-factor authentication (MFA)** where possible. - **Be cautious** with calls, texts, and emails asking for sensitive data. - **Report** suspicious messages to your teacher, parent, or IT department. ### Key Facts - Phishing is the most common cybercrime globally. - Business phishing attacks rose from 72% in 2017 to 94% in 2023. - Generative AI makes phishing more convincing and automated. - The term 'phishing' was first recorded in 1995 in the AOHell toolkit.

Phishing: A form of social engineering and a scam where attackers deceive people into revealing sensitive information or installing malware such as viruses, worms, adware, or ransomware.
Social engineering: Psychological manipulation of people to divulge confidential information or perform actions, often used in phishing.
Virus: Malware that attaches to a program or file and spreads when the infected file is executed.
Worm: Self-replicating malware that spreads without human action, often over networks.
Ransomware: Malware that locks or encrypts a victim's files or device and demands payment (ransom) to restore access.
Spear phishing: Targeted phishing attacks tailored to specific individuals, using personal or organizational information to increase credibility.
Vishing: Voice phishing using VoIP or phone calls, often with spoofed numbers, to trick victims into revealing sensitive information.
Smishing: Phishing via SMS text messages, asking victims to click links, call numbers, or provide personal information.
Quishing: Phishing using QR codes to direct victims to malicious websites or downloads.
Software updates: Patches and fixes released by software vendors to address security vulnerabilities and improve functionality.

Karteikarten

What is phishing?

Phishing is a form of social engineering and a scam where attackers deceive people into revealing sensitive information or installing malware.

What are common types of malware mentioned in the source?

Viruses, worms, adware, and ransomware.

What is the origin of the term 'phishing'?

It was first recorded in 1995 in the cracking toolkit AOHell, and is a variation of fishing, referring to lures to 'fish' for sensitive information.

What is spear phishing?

Spear phishing is a targeted phishing attack tailored to specific individuals, using personal or organizational information to increase credibility and success.

What is vishing?

Vishing (voice phishing) uses VoIP to make automated phone calls, often spoofing numbers, to trick victims into revealing sensitive information.

What is smishing?

Smishing (SMS phishing) uses mobile text messages to deliver bait, asking victims to click links, call numbers, or provide private information.

What is quishing?

Quishing is phishing using QR codes to trick users into visiting malicious sites or downloading malware.

What is page hijacking?

Page hijacking involves redirecting users to malicious websites by compromising legitimate web pages, often using cross-site scripting.

What is a watering hole attack?

A watering hole attack compromises a website frequented by a target group to exploit visitors, often used with page hijacking.

Why are strong passwords important?

Strong passwords help protect accounts from unauthorized access, reducing the risk of identity theft and data breaches.

What is social engineering?

Social engineering is manipulating people into divulging confidential information or performing actions, often by exploiting trust or urgency.

What is ransomware?

Ransomware is malware that encrypts a victim's files and demands payment for decryption.

What is a virus?

A virus is malware that attaches to legitimate files and spreads when the infected file is executed.

What is a worm?

A worm is self-replicating malware that spreads without human action, often over networks.

Why are software updates important for security?

Updates patch vulnerabilities that attackers could exploit, helping to protect against malware and other threats.

What is a common sign of a phishing email?

Urgency or threats, requests for personal information, and links to fake login pages.

What should you do if you receive a suspicious email?

Do not click links or download attachments; report it and delete it.

What is two-factor authentication (2FA)?

2FA adds an extra layer of security by requiring a second form of verification beyond a password.

What is a MiTM 2FA attack?

A man-in-the-middle attack that intercepts 2FA credentials to bypass security.

What is the role of user education in preventing phishing?

Educating users helps them recognize and avoid phishing attempts, reducing the success of attacks.

What is the trend in phishing attacks among businesses?

Phishing attacks among businesses rose from 72% in 2017 to 86% in 2020, reaching 94% in 2023.

What is the goal of bulk phishing attacks?

Bulk attacks are not targeted and are sent to a wide audience to trick anyone into giving away sensitive information or credentials.

What is the impact of generative AI on phishing?

Generative AI enables highly convincing, automated, and hyper-targeted phishing campaigns at an unprecedented scale.

Unlock all 58 questions, flashcards & more

Erstelle ein Gratis-Konto, um alle Fragen, Folien, Karteikarten und Lernnotizen zu diesem Thema zu sehen.

REGISTRIEREN — GRATIS ANMELDEN

Altklausuren

Altklausuren-Übungen für dieses Thema kommen bald.

Bald verfügbar