Cambridge IGCSE · Computer Science
Cyber Security
The big idea: attackers look for the weakest point in a system — often a person, not a computer — so cyber security is really about layering defences (technical + human) so that no single mistake gives an attacker everything.
Chapter Summary
- Eight main threats: brute-force, data interception, DDoS, hacking, malware, pharming, phishing, social engineering.
- Malware has six flavours — virus, worm, trojan, spyware, adware, ransomware — each doing damage a slightly different way.
- Defence comes in layers: access levels, anti-malware, authentication (passwords/CAPTCHA/biometrics), automatic updates, firewalls, proxy servers, SSL, and privacy settings.
- Humans are frequently "the weak point" — social engineering exploits trust, not code.
- Checking URLs and communication tone are simple, low-tech ways to catch phishing/pharming.
1. Cyber Security Threats
Brute-Force Attack
Imagine someone has a padlock with a 4-digit code, and you don't know the combination. The dumbest — but sometimes effective — way to open it is to just try every single combination: 0000, 0001, 0002... all the way to 9999. That's a brute-force attack: an attacker automates guessing, trying huge numbers of password combinations per second until one works.
A smarter cousin of this is the dictionary attack. Instead of trying every possible combination, it only tries words and phrases people actually use as passwords — password, 1234, qwerty. Because so many real people pick predictable passwords, this shortcut cracks accounts far faster than a pure brute-force search.
Why this matters
The longer and more random a password is, the more combinations exist, and the longer a brute-force attack takes. A 4-digit PIN has only 10,000 combinations (fast to crack); a long password with upper/lowercase, numbers and symbols has billions+ (impractically slow to crack).
Q: Why is "P@ssw0rd123" still a weak password even though it contains symbols and numbers?
Data Interception & Theft
Data travelling across a network is like a postcard, not a sealed envelope — if it isn't encrypted, anyone who can "see" the traffic can read it. A packet sniffer is a tool (hardware or software) that captures data packets moving across a network, letting a thief read usernames, passwords, and other sensitive information as it travels.
This is especially dangerous on public Wi-Fi, where an attacker on the same network can sniff traffic between your device and the router.
DDoS Attack
Picture a small shop with one till. Now imagine a thousand people crowd the entrance at once, not to buy anything, but just to block real customers from getting in. That's a Distributed Denial of Service (DDoS) attack — a server gets flooded with requests from many different devices at once until it can't keep up, and genuine users can't access the service.
The word "Distributed" is key: the flood comes from many devices spread across the internet (often infected computers called bots, controlled remotely without their owners knowing). This makes it very hard to trace the attack back to one person, because the traffic looks like it's coming from thousands of innocent machines.
Effect
Q: Describe what is meant by a DDoS attack. [4 marks]
Hacking
identifying and exploiting weaknesses