Cyber Security

Cambridge expects you to know the standard catalogue of cyber threats. Each one has a different mechanism — and a different best defence.

Brute-force attack. The attacker tries every possible password until one works. Mitigated by long, complex passwords, account lockouts after failed attempts, CAPTCHA and MFA.

DDoS (Distributed Denial of Service). A botnet (many compromised devices) floods a target server with traffic, making it unreachable to legitimate users. Mitigated by traffic filtering, rate limiting, anti-DDoS services (Cloudflare, AWS Shield).

Data interception. Capturing data while it's being transmitted (e.g. sniffing on a public Wi-Fi). Mitigated by ENCRYPTION — SSL/TLS, VPN, encrypted file transfers.

Malware. Malicious software in many forms (viruses, worms, trojans, ransomware, spyware). Mitigated by anti-malware software, automatic updates, careful downloading, sandboxing.

Phishing. Fake emails / messages that look legitimate, tricking the user into clicking a link and entering credentials on a fake site. Mitigated by user education, anti-phishing browser extensions, link previews, MFA.

Pharming. DNS or hosts-file compromise that redirects a user to a fake site even when they type the correct URL. Mitigated by anti-malware scanning, DNS over HTTPS, certificate validation, user awareness.

Social engineering. Manipulating people psychologically — impersonating IT staff, urgent fake requests, baiting. Mitigated by user training, verification procedures, zero-trust policies.

Cambridge tip. Mark schemes ask candidates to MATCH each threat to a relevant defence. Memorising the threat list isn't enough — pair each one with its mitigation.

Malware is the umbrella term. The 0478 syllabus expects you to identify the main types.

Virus. Attaches itself to a host file or program. Spreads when the host is run, replicating into other files on the same system. Often damages or deletes data.

Worm. Standalone program that spreads automatically across networks WITHOUT needing a host file. Replicates rapidly; can saturate network bandwidth on its own.

Trojan horse. Disguised as legitimate software (a useful tool, a game, an attachment). Doesn't replicate itself — relies on the user installing it. When run, opens a backdoor or steals data.

Ransomware. Encrypts the victim's files using strong cryptography and demands a ransom (usually in cryptocurrency) for the decryption key. High-profile attacks have shut down hospitals, fuel pipelines and city governments.

Spyware. Secretly monitors user activity — keylogging, screenshot capture, microphone/camera access — and exfiltrates data to the attacker. Used for credential theft and corporate espionage.

Adware. Forces unwanted advertising. Less destructive but degrades user experience and can lead to other malware.

Rootkit. Deeply embedded in the operating system; very hard to detect or remove. Used to maintain persistent access after a compromise.

Cambridge tip. Don't lump all malware together as 'a virus'. Mark schemes test each type's specific mechanism.

These two attacks both end with the user on a fake site, but they get there differently.

Phishing.

1. Attacker sends an email/text/call that LOOKS legitimate ('Your bank account has been suspended — click here to verify').
2. User clicks the link, which leads to a FAKE site mimicking the real one.
3. User enters credentials → attacker captures them.

Defence: user education ('look at the URL'), anti-phishing browser tools, hover-to-preview links, MFA, blocking the messages at the email gateway.

Pharming.

1. Attacker compromises DNS (or the user's local hosts file, or the local DNS resolver via cache poisoning).
2. The user types the correct URL (e.g. bankofengland.com).
3. Their browser is redirected to a FAKE site with the same URL.
4. User enters credentials → attacker captures them.

Pharming is more dangerous BECAUSE it bypasses the standard advice ('don't click suspicious links'). Defence: anti-malware scanning of hosts files, secure DNS (DNSSEC, DNS-over-HTTPS), checking HTTPS certificates carefully.

Cambridge tip. Mark scheme expects students to differentiate by MECHANISM (user clicks vs DNS compromise) AND by required user action (clicking required vs no clicking required).

Firewall. Software or hardware that filters incoming and outgoing network traffic against rules. Blocks unauthorised connections. Defends against intrusion attempts, brute-force probing, some DDoS, and unauthorised data exfiltration.

Anti-malware (anti-virus) software. Scans files and processes for known malware signatures and suspicious behaviour. Quarantines or removes infections. Defends against viruses, worms, trojans, ransomware and spyware. Must be regularly updated to recognise new threats.

SSL / TLS encryption. Encrypts data in transit. Defends against data interception. The basis of HTTPS.

MFA (Multi-Factor Authentication). Requires a password PLUS something else (a code from your phone, a fingerprint, a hardware key). Defends against brute-force, leaked passwords, and phishing where credentials are captured.

Biometrics. Fingerprint, face, iris recognition. Often used as one factor of MFA. Hard to share or replicate. Defends against password theft and casual unauthorised access.

Automatic updates. Patches security holes as soon as they're fixed. Defends against malware that exploits known vulnerabilities and against many forms of intrusion.

CAPTCHA. Distinguishes humans from bots. Defends against brute-force and automated form-spam attacks.

Anti-phishing browser extensions / spam filters. Catch suspicious messages and links before the user sees them. Defend against phishing.

Strong password policies. Long, complex, unique passwords (typically managed in a password manager). Defends against brute force and credential stuffing.

User education. The single highest-leverage defence. Most successful attacks involve a person being tricked rather than a piece of software being broken.

Cambridge tip. Mark scheme structure for 'identify defences' is usually: NAME the defence + STATE the threat it mitigates. Both halves are needed for full marks.