Cyber Security

Learn it by playing

Answer these questions to earn energy, then fish and explore. No account needed.

For teachers: ready-to-use lesson slides, revision notes, diagrams for Cyber Security (Computer Science, CIE) — use them in your lesson, or run the topic as a live class game.

Notes

Cyber Security Threats

**Brute-force attack**: repeatedly tries password/PIN combinations; **dictionary attack** tries common words/phrases.
**Data interception & theft**: uses a **packet sniffer** to capture network data and steal usernames/passwords.
**DDoS attack**: floods a server with requests from many **bots** (compromised computers), making it unusable.
**Hacking**: exploits weaknesses (unpatched software, outdated anti-malware) to gain unauthorised access.
**Malware**: malicious software including **virus** (replicates, corrupts files), **worm** (spreads across network), **Trojan** (disguised as legitimate), **spyware** (records activity), **adware** (displays ads), **ransomware** (encrypts files, demands ransom).
**Pharming**: redirects user to a fake website by altering DNS settings or browser settings; protect with anti-malware, check URLs, look for padlock icon.
**Phishing**: sends fraudulent emails/SMS claiming to be from a reputable company to trick users into revealing details.
**Social engineering**: exploits human weaknesses (e.g., fraudulent phone calls, pretexting) to gain confidential data.

Keeping Data Safe – Access Control & Authentication

**Access levels**: set based on role – **full access** (create/edit/delete), **read-only**, **no access**.
**Authentication**: verifies user identity via **usernames/passwords**, **multi-factor authentication**, **CAPTCHA**, or **biometrics** (fingerprint, facial recognition, iris scan).
Biometrics are more secure than passwords: cannot be guessed, faked, recorded by spyware, or shoulder-surfed.

Keeping Data Safe – Software & Network Defences

**Anti-malware**: scans files/emails/websites for known malware signatures; includes anti-virus, anti-spam, anti-spyware; updates automatically.
**Firewall**: monitors incoming/outgoing traffic, filters based on rules; can be hardware (protects whole network) or software (protects individual devices).
**Proxy server**: hides user's IP address/location, filters web traffic, blocks malicious content.
**SSL (Secure Socket Layer)**: encrypts data transmitted over the internet; uses digital certificate with public key for authentication.
**Automatic software updates**: ensure vulnerabilities are patched quickly without user intervention.

Keeping Data Safe – User Practices & Communication

**Privacy settings**: control personal information shared online; review regularly to prevent identity theft.
**Check URLs**: verify links before clicking (e.g., `amaz.on.co.uk` vs `amazon.co.uk`) to avoid phishing.
**Monitor communication**: phishing emails often have spelling/grammar errors, urgent tone, or lack professionalism.
**User vigilance**: lock devices, log off when not in use, do not share passwords, encrypt data, keep software up to date.

DDoS attack: attacker controls botnet to flood server with requests, denying service to legitimate users.

Practice questions

Free preview — 8 of 40 questions. Sign up to see them all.

1.What is the term for a type of malware that locks a user's computer and demands payment to unlock it?
Easy
- ARansomware
- BSpyware
- CAdware
- DTrojan
2.Which of the following is a method used to prevent unauthorised access by monitoring and filtering network traffic based on a set of rules?
Easy
- AFirewall
- BProxy server
- CAnti-malware
- DSSL
3.A company's website becomes slow and eventually crashes because a large number of requests are sent to it from multiple compromised computers. What type of attack is this?
Medium
- ADDoS attack
- BBrute-force attack
- CPhishing attack
- DData interception
4.Which security measure uses unique physical characteristics such as fingerprints or iris scans for authentication?
Medium
- ABiometrics
- BCAPTCHA
- CMulti-factor authentication
- DEncryption
5.A user receives an email that appears to be from their bank, asking them to click a link and enter their login details. The email contains several spelling mistakes. What type of threat is this?
Hard
- APhishing
- BPharming
- CSocial engineering
- DSpyware
6.An attacker repeatedly tries different combinations of a user's password to gain unauthorised access. Which type of attack is this?
Hard
- ABrute-force attack
- BDictionary attack
- CDDoS attack
- DData interception
7.Which of the following is a type of malware that can replicate itself and spread to other computers on a network without needing to attach to a host file?
Easy
- AWorm
- BVirus
- CTrojan
- DSpyware
8.What is the purpose of a proxy server in network security?
Medium
- ATo hide a user's IP address and location
- BTo encrypt data transmitted over the internet
- CTo scan for malware in email attachments
- DTo manage user access levels

Slides

Cyber Security Threats

Cyber security threats are attacks that target computer systems and networks.
Common threats include brute-force attacks, data interception, DDoS, hacking, malware, pharming, phishing, and social engineering.
These attacks can lead to data theft, system damage, and financial loss.

Which of the following is a cyber security threat?

Firewall
Brute-force attack
SSL
Anti-malware

Brute-Force Attack

A brute-force attack repeatedly tries different combinations of passwords or PINs to gain unauthorised access.
A dictionary attack is a form of brute-force attack that tries common words and phrases like 'password' or '1234'.
These attacks exploit weak or predictable passwords.

A ____ attack tries every possible combination of characters to crack a password.

Data Interception & Theft

Data interception involves capturing data as it travels across a network.
Attackers use tools like packet sniffers to collect usernames, passwords, and other sensitive information.
This stolen data can be used for unauthorised access to systems.

Which device is commonly used for data interception?

Firewall
Packet sniffer
Proxy server
Router

DDoS Attack

A Distributed Denial of Service (DDoS) attack floods a server with requests from many compromised computers (bots).
This overwhelms the server, making it unavailable to legitimate users.
DDoS attacks can cause financial loss and reputational damage to organisations.

Which of these are true about a DDoS attack?

It uses multiple computers to send requests.
It aims to improve server performance.
It can make a website unavailable.
It is easy to trace back to the attacker.

Hacking

Hacking is exploiting weaknesses in a system to gain unauthorised access.
Hackers target unpatched software and outdated anti-malware.
Motives include stealing data, installing malware, or disrupting operations.

What do hackers often exploit to gain access?

Strong passwords
Unpatched software
Firewalls
Encryption

Malware Types

Malware (malicious software) includes viruses, worms, Trojans, spyware, adware, and ransomware.
Viruses replicate and corrupt files; worms spread across networks.
Trojans disguise as legitimate software; spyware spies on user activity; ransomware encrypts files and demands payment.

____ is malware that encrypts files and demands a ransom for decryption.

Pharming and Phishing

Pharming redirects users to fake websites by altering DNS settings or browser settings.
Phishing sends fraudulent emails or SMS pretending to be from reputable companies to steal personal information.
Protect against pharming by keeping anti-malware updated and checking URLs.

What is the main difference between pharming and phishing?

Pharming uses fake websites; phishing uses fake messages.
Pharming uses fake messages; phishing uses fake websites.
Both are the same.
Pharming is a type of malware.

Social Engineering

Social engineering exploits human weaknesses rather than technical flaws.
Examples include fraudulent phone calls and pretexting (fake texts from authorities).
Human errors like sharing passwords or not locking devices are common vulnerabilities.

Which of these are examples of social engineering?

A fake phone call pretending to be from IT support.
A brute-force attack on a password.
A text message claiming to be from HR asking for personal data.
Installing anti-malware software.

Keeping Data Safe: Access Levels

Access levels control what users can see and do on a network.
Permissions include full access, read-only, or no access.
Users are assigned roles (e.g., administrators, teachers, students) with appropriate restrictions.

Which access level allows a user to open, create, edit, and delete files?

Read-only
Full access
No access
Restricted

Anti-Malware and Authentication

Anti-malware software scans for known malware signatures and blocks threats.
Authentication verifies user identity using passwords, multi-factor authentication, CAPTCHA, or biometrics.
Biometrics (fingerprints, facial recognition) are more secure than passwords as they are unique and hard to fake.

____ uses unique biological characteristics like fingerprints for authentication.

Firewalls and Proxy Servers

A firewall monitors and filters network traffic based on rules, blocking unauthorised access.
Firewalls can be hardware (protecting the whole network) or software (protecting individual devices).
A proxy server hides a user's IP address and can filter web traffic, blocking malicious content.

What does a firewall do?

Encrypts data
Monitors and filters network traffic
Stores passwords
Creates backups

SSL and Other Protections

SSL (Secure Socket Layer) encrypts data transmitted over the internet to prevent interception.
Automatic software updates ensure vulnerabilities are patched quickly.
Checking URLs and monitoring communication (spelling, tone) helps prevent phishing.

Which of these help protect against phishing?

Checking URLs before clicking links.
Using SSL for data encryption.
Looking for spelling errors in emails.
Sharing passwords with colleagues.

Unlock all 40 questions, slides & more

Create a free account to see every question, the slides, flashcards and revision notes for this topic.

Past papers

Past-paper practice for this topic is coming soon.

🗂️ Coming soon