Cyber Security: Threats and Defences

Cyber security consists of the processes, practices, and technologies designed to protect networks, computers, programs, and data from attack, damage, or unauthorised access.

The main purposes of cyber security are to maintain:

Property	What it means
Confidentiality	Data is accessible only to those authorised to see it
Integrity	Data is accurate and has not been tampered with
Availability	Systems and data are accessible when needed by legitimate users

Cyber attacks target one or more of these properties. Stealing data attacks confidentiality. Altering records attacks integrity. Ransomware — encrypting a victim's files until a payment is made — attacks availability.

AQA 8525 requires knowledge of the main threat categories, how they work, and the defences used to detect and prevent them. The sections below work through each in turn.

Social engineering is the manipulation of people into revealing confidential information or performing actions that compromise security. It exploits human psychology rather than technical vulnerabilities.

AQA 8525 requires knowledge of three social engineering techniques:

Blagging (pretexting) — the attacker invents a convincing scenario (a pretext) to obtain information from a target. Example: calling an employee and claiming to be from IT support, requesting a password to "fix an urgent system problem."

Phishing — using deceptive emails or SMS messages to trick recipients into revealing private information (credentials, bank details) or clicking a link that leads to a malicious site. Phishing messages are designed to appear to come from a trusted organisation (a bank, a delivery company, a government department).

Shouldering (shoulder surfing) — directly observing a person entering private information, such as watching someone type a PIN at a cash machine or a password at a keyboard. Requires physical proximity.

Technique	Attack vector	Typical defence
Blagging	Phone, in person, or email	Verify caller identity; never share credentials verbally
Phishing	Email or SMS	Check sender address; do not click unsolicited links
Shouldering	Physical presence	Shield screen and keyboard; be aware of surroundings

Social engineering is often more effective than technical attacks because it bypasses security technology entirely, targeting human behaviour instead.

Malware (malicious software) is any software designed to harm, disrupt, or gain unauthorised access to a computer system. AQA 8525 requires knowledge of three types:

Computer virus — self-replicating code that attaches itself to legitimate programs or files. When the infected file is opened or executed, the virus copies itself to other files and may deliver a payload: deleting files, corrupting data, or creating backdoors. Viruses spread whenever infected files are shared.

Trojan — malicious software disguised as a legitimate, useful application. Unlike a virus, a Trojan does not self-replicate. It relies on the user installing it willingly, deceived into believing it is something benign (a game, a free utility, an email attachment). Once installed, a Trojan may install further malware, steal data, or create remote access.

Spyware — software that secretly monitors a user's activities and transmits information to an attacker. A keylogger (a common form of spyware) records every keystroke, capturing passwords, messages, and financial data.

Type	Self-replicates?	Primary spread mechanism	Main harm
Virus	Yes	Infected files and email attachments	Damages or destroys data
Trojan	No	Disguised as desirable software	Installs backdoors; enables remote access
Spyware	No	Bundled with other software	Steals credentials and private data

AQA 8525 specifies four additional threat categories beyond social engineering and malware:

Pharming — redirects users from a legitimate website to a fraudulent copy, typically by corrupting DNS records or editing the device's hosts file. Unlike phishing, pharming works even when the user types the correct URL into the browser — they are silently redirected to the attacker's page.

Weak and default passwords — many devices (routers, IP cameras, smart devices) ship with manufacturer default credentials such as admin/admin. Users who do not change them leave a trivially accessible entry point. Short or common passwords are also vulnerable to brute-force attacks (trying every possible combination) and dictionary attacks (trying common words and phrases).

Misconfigured access rights — granting users more permissions than they require gives a compromised account greater potential for damage. The principle of least privilege holds that each account should have only the minimum access necessary for its purpose, limiting the blast radius of any breach.

Removable media — USB drives and other portable storage can introduce malware when plugged into a system, including on air-gapped networks where internet-based attacks are impossible. Some sophisticated attacks specifically target isolated systems via planted USB devices.

Unpatched and outdated software — software vulnerabilities are regularly discovered and publicly disclosed. Security patches fix these vulnerabilities. Systems running unpatched software remain exposed to known attack methods that have been publicly documented, sometimes for years.

AQA 8525 specifies five defence measures that organisations and individuals use to protect systems:

Biometric measures — authenticate users using physical characteristics: fingerprint, face recognition, iris scan. Widely deployed on mobile devices as a secure, convenient alternative to passwords. A biometric is difficult to steal compared to a password.

Password systems — the most common authentication method. Effective passwords are long, avoid dictionary words, and use a mix of character types. Password managers generate and store unique complex passwords, removing the human tendency to reuse credentials.

CAPTCHA — a challenge presented to users to distinguish humans from automated scripts. CAPTCHAs (Completely Automated Public Turing tests to tell Computers and Humans Apart) prevent bots from submitting forms at high speed, blocking bulk account creation, brute-force login attempts, and automated data scraping.

Email confirmation — verifying account creation, password resets, or sensitive actions by sending a confirmation link to a registered email address. This ensures that whoever performed the action also controls the associated email account.

Automatic software updates — applying security patches promptly as they are released closes known vulnerabilities. Automatic updates remove the dependency on users manually installing patches, reducing the window during which a system is exposed.

Penetration testing (pen testing) is an authorised attempt to gain access to a system without using standard credentials, with the goal of finding security vulnerabilities before malicious attackers do.

Organisations commission penetration tests to:

• Identify weaknesses in their network, applications, or user behaviour before they are exploited
• Verify whether existing defences are effective in practice
• Satisfy security standards and regulatory compliance requirements

AQA 8525 specifies two types of penetration test:

Type	Who is being simulated	Starting access level
Internal	A malicious insider (e.g. a disgruntled employee with existing access)	Has some basic credentials
External	An outside attacker with no prior knowledge of the system	No credentials

An internal pen test models the threat from someone already inside the organisation — a more damaging scenario if overlooked, since the attacker begins with legitimate access. An external test models the most common attack scenario: a remote attacker attempting to break in from scratch.

Penetration testing is a controlled, authorised activity. The testers work for the organisation and report findings rather than exploit them. It is a defensive security measure, not an attack.

1. Confusing phishing and pharming

Phishing uses deceptive messages (email, SMS) to trick users into visiting a fake site or revealing information. Pharming redirects users to a fraudulent site without any deceptive message — even a correctly typed URL leads to the attacker's page. Pharming requires no user error; phishing depends on it.

2. Calling a Trojan a type of virus

A Trojan is not a virus. A virus self-replicates; a Trojan does not. A Trojan relies on the user installing it voluntarily (while being deceived about what it is). Describing a Trojan as "a virus that disguises itself" is incorrect — they are different categories of malware.

3. Describing CAPTCHA as an encryption method

CAPTCHA is a challenge mechanism to distinguish humans from automated scripts. It does not encrypt data. Conflating it with password hashing, TLS, or any encryption mechanism is incorrect.

4. Listing antivirus software as a specified AQA defence

AQA 8525's five specified defences are: biometric measures, password systems, CAPTCHA, email confirmations, and automatic software updates. Antivirus software is not one of the five listed defences. Do not substitute it when a question asks for a specific measure from the spec list.

5. Confusing internal and external penetration testing

Internal pen testing simulates an insider with basic access credentials. External pen testing simulates an outside attacker starting with no credentials. The distinction is the starting access level, not the location of the tester.