Curriculum Portal

neurologyYou need to know

• A cyberattack is a deliberate attempt to gain unauthorised access to a computer system, damage it, disrupt its operation or steal data.
• Malware is malicious software designed to damage a system, disrupt its operation, spy on users, steal data or gain unauthorised access.
• Viruses attach themselves to files and spread when infected files are run, while worms can copy themselves and spread across networks without direct user action.
• Trojan malware appears legitimate to persuade a user to install it, ransomware encrypts data and demands payment, and spyware secretly collects information about a user.
• Social engineering manipulates people into revealing confidential information, granting access or carrying out unsafe actions, making users a potential weak point in security.
• Phishing is a form of social engineering in which fraudulent messages or websites impersonate a trusted organisation to steal credentials or persuade users to install malware.
• A brute-force attack uses repeated automated guesses to discover a password or other authentication information; longer, less predictable passwords increase the time required.
• A denial-of-service attack overwhelms a system or network with traffic or requests so that legitimate users cannot access its services.
• Data interception captures data while it is being transmitted across a network, while data theft involves obtaining information without the owner's permission.
• SQL injection places malicious SQL commands into an insecure input field so that a database may reveal, alter or delete data, or allow unauthorised access.
• Penetration testing is an authorised attempt to find and report system vulnerabilities by using techniques similar to those used by attackers, allowing weaknesses to be corrected before a real attack.
• Anti-malware software detects known or suspicious malware, blocks it and may quarantine or delete infected files; it must be updated regularly to recognise new threats.
• A firewall examines incoming and outgoing network traffic and permits or blocks connections according to security rules, reducing unauthorised network access and some denial-of-service traffic.
• User access levels restrict which files, data and system functions each account can use, so users receive only the permissions needed for their role and a compromised account causes less damage.
• Strong passwords are long, difficult to predict and not reused across accounts; limiting login attempts or adding delays reduces the effectiveness of brute-force attacks.
• Encryption converts plaintext into ciphertext using an encryption key, so intercepted or stolen data cannot be understood without the correct decryption key.
• Physical security measures such as locked doors, secure server rooms, surveillance, alarms and biometric access prevent unauthorised people from reaching devices or storage media.
• No single prevention method removes every vulnerability, so layered security combines technical controls, user procedures and physical measures to reduce both the likelihood and impact of attacks.

• Classify a described security incident as malware, social engineering, brute force, denial of service, data interception, data theft or SQL injection, using evidence from the scenario.
• Explain how a given attack is carried out and distinguish its immediate method from its purpose, such as stealing data, disrupting a service or gaining unauthorised access.
• Match each identified threat to suitable prevention methods and explain how each control reduces either the likelihood or impact of the attack.
• Assess password security by considering length, unpredictability, uniqueness and controls such as login-attempt limits.
• Configure user access levels according to the principle of least privilege, granting each user only the permissions required for their role.
• Interpret firewall or anti-malware actions to determine why traffic, files or programs have been allowed, blocked, quarantined or deleted.
• Plan an ethical penetration test by defining authorisation, scope, tests, evidence collection and the secure reporting of discovered vulnerabilities.
• Evaluate a security plan by identifying remaining vulnerabilities and recommending layered improvements involving software, access control, encryption and physical security.