Launching your learning experience…
Detailed notes on The internet and its uses for Cambridge IGCSE Computer Science, covering key concepts, explanations, examples, and exam-focused revision points.
Threats and defences. The threat catalogue: brute force, DDoS, malware (virus, worm, trojan, ransomware, spyware), phishing, pharming, social engineering, data interception. The defences: firewalls, anti-malware, encryption, biometrics, MFA, SSL/TLS, captcha, anti-phishing tools and user education.
Mapped to the Cambridge IGCSE 0478 syllabus (2026-2028).
Brute force, DDoS, malware, phishing/pharming, social engineering, data interception.
Cambridge expects you to know the standard catalogue of cyber threats. Each one has a different mechanism — and a different best defence.
Brute-force attack. The attacker tries every possible password until one works. Mitigated by long, complex passwords, account lockouts after failed attempts, CAPTCHA and MFA.
DDoS (Distributed Denial of Service). A botnet (many compromised devices) floods a target server with traffic, making it unreachable to legitimate users. Mitigated by traffic filtering, rate limiting, anti-DDoS services (Cloudflare, AWS Shield).
Data interception. Capturing data while it's being transmitted (e.g. sniffing on a public Wi-Fi). Mitigated by ENCRYPTION — SSL/TLS, VPN, encrypted file transfers.
Malware. Malicious software in many forms (viruses, worms, trojans, ransomware, spyware). Mitigated by anti-malware software, automatic updates, careful downloading, sandboxing.
Phishing. Fake emails / messages that look legitimate, tricking the user into clicking a link and entering credentials on a fake site. Mitigated by user education, anti-phishing browser extensions, link previews, MFA.
Pharming. DNS or hosts-file compromise that redirects a user to a fake site even when they type the correct URL. Mitigated by anti-malware scanning, DNS over HTTPS, certificate validation, user awareness.
Social engineering. Manipulating people psychologically — impersonating IT staff, urgent fake requests, baiting. Mitigated by user training, verification procedures, zero-trust policies.
Cambridge tip. Mark schemes ask candidates to MATCH each threat to a relevant defence. Memorising the threat list isn't enough — pair each one with its mitigation.
Virus, worm, trojan, ransomware, spyware — different mechanisms.
Malware is the umbrella term. The 0478 syllabus expects you to identify the main types.
Virus. Attaches itself to a host file or program. Spreads when the host is run, replicating into other files on the same system. Often damages or deletes data.
Worm. Standalone program that spreads automatically across networks WITHOUT needing a host file. Replicates rapidly; can saturate network bandwidth on its own.
Trojan horse. Disguised as legitimate software (a useful tool, a game, an attachment). Doesn't replicate itself — relies on the user installing it. When run, opens a backdoor or steals data.
Ransomware. Encrypts the victim's files using strong cryptography and demands a ransom (usually in cryptocurrency) for the decryption key. High-profile attacks have shut down hospitals, fuel pipelines and city governments.
Spyware. Secretly monitors user activity — keylogging, screenshot capture, microphone/camera access — and exfiltrates data to the attacker. Used for credential theft and corporate espionage.
Adware. Forces unwanted advertising. Less destructive but degrades user experience and can lead to other malware.
Rootkit. Deeply embedded in the operating system; very hard to detect or remove. Used to maintain persistent access after a compromise.
Cambridge tip. Don't lump all malware together as 'a virus'. Mark schemes test each type's specific mechanism.
Phishing tricks users via messages; pharming compromises DNS.
These two attacks both end with the user on a fake site, but they get there differently.
Phishing.
Defence: user education ('look at the URL'), anti-phishing browser tools, hover-to-preview links, MFA, blocking the messages at the email gateway.
Pharming.
bankofengland.com).Pharming is more dangerous BECAUSE it bypasses the standard advice ('don't click suspicious links'). Defence: anti-malware scanning of hosts files, secure DNS (DNSSEC, DNS-over-HTTPS), checking HTTPS certificates carefully.
Cambridge tip. Mark scheme expects students to differentiate by MECHANISM (user clicks vs DNS compromise) AND by required user action (clicking required vs no clicking required).
Match the defence to the threat — that's what mark schemes test.
Firewall. Software or hardware that filters incoming and outgoing network traffic against rules. Blocks unauthorised connections. Defends against intrusion attempts, brute-force probing, some DDoS, and unauthorised data exfiltration.
Anti-malware (anti-virus) software. Scans files and processes for known malware signatures and suspicious behaviour. Quarantines or removes infections. Defends against viruses, worms, trojans, ransomware and spyware. Must be regularly updated to recognise new threats.
SSL / TLS encryption. Encrypts data in transit. Defends against data interception. The basis of HTTPS.
MFA (Multi-Factor Authentication). Requires a password PLUS something else (a code from your phone, a fingerprint, a hardware key). Defends against brute-force, leaked passwords, and phishing where credentials are captured.
Biometrics. Fingerprint, face, iris recognition. Often used as one factor of MFA. Hard to share or replicate. Defends against password theft and casual unauthorised access.
Automatic updates. Patches security holes as soon as they're fixed. Defends against malware that exploits known vulnerabilities and against many forms of intrusion.
CAPTCHA. Distinguishes humans from bots. Defends against brute-force and automated form-spam attacks.
Anti-phishing browser extensions / spam filters. Catch suspicious messages and links before the user sees them. Defend against phishing.
Strong password policies. Long, complex, unique passwords (typically managed in a password manager). Defends against brute force and credential stuffing.
User education. The single highest-leverage defence. Most successful attacks involve a person being tricked rather than a piece of software being broken.
Cambridge tip. Mark scheme structure for 'identify defences' is usually: NAME the defence + STATE the threat it mitigates. Both halves are needed for full marks.
Verbatim phrases and definitions Cambridge mark schemes credit.
Cyber security appears on every Paper 1. Most-tested questions: identify malware types (6-8 marks), phishing vs pharming (4-6 marks), defences for given threats (6-8 marks). Examiner reports flag the all-malware-is-a-virus error and the phishing/pharming confusion as the most common mistakes.
Sources: Cambridge IGCSE Computer Science 0478 syllabus (2026-2028); 0478 Examiner Reports 2022-2024; 0478/12 May/Jun 2024 question paper and mark scheme. Last reviewed 2026-05-09.
Step-by-step solutions to past-paper-style questions on cyber security, written exactly the way a tutor would explain them at the board.
Question
(a) A website is flooded with so much traffic from many compromised computers that genuine users cannot access it. Name this threat. [1] (b) Software repeatedly tries every possible combination of characters to discover a user's password. Name this threat. [1]
Step-by-step solution
Step 1
(a) — read the key words. 'Flooded with traffic' + 'many compromised computers' (a botnet) + 'genuine users cannot access it' is the textbook description of a DDoS (Distributed Denial of Service) attack.
Step 2
(b) — 'every possible combination' of characters tried in turn is the definition of a brute-force attack. Don't write 'hacking' — that is too general for the mark.
Answer
(a) DDoS (Distributed Denial of Service). (b) Brute-force attack.
Examiner tip
AO1. One mark each. The examiner wants the precise term — 'denial of service / DDoS' and 'brute force'. Vague answers like 'a hack' or 'spamming' score 0.
Question
(a) State one security method that helps prevent unauthorised connections reaching a computer over a network. [1] (b) State one method that prevents data being understood if it is intercepted while being transmitted. [1]
Step-by-step solution
Step 1
(a) — a network gatekeeper. A firewall filters incoming/outgoing traffic against rules and blocks unauthorised connections. (A proxy server is also acceptable.)
Step 2
(b) — protect data in transit. Encryption (SSL/TLS) scrambles the data, so even if it is intercepted it cannot be understood without the key.
Answer
(a) Firewall (or proxy server). (b) Encryption / SSL / TLS.
Examiner tip
AO1/AO2. One mark each. Note the deliberate pairing: firewall ↔ unauthorised connections, encryption ↔ data interception. Matching the right defence to the named threat is exactly what the mark scheme rewards.
Question
Describe phishing and pharming, identifying TWO differences between them. (6 marks)
Step-by-step solution
Step 1
Phishing (2 marks). The attacker sends fraudulent COMMUNICATIONS (typically emails or texts) that appear to come from a legitimate source, tricking the user into clicking a link and entering credentials on a fake site.
Step 2
Pharming (2 marks). The attacker compromises DNS (or hosts files) so that even when a user types the correct URL, their browser is redirected to a fake site. Doesn't require the user to click anything malicious.
Step 3
Two differences (2 marks). (a) Phishing requires user ACTION (click); pharming doesn't. (b) Phishing relies on convincing fake messages; pharming relies on compromised DNS / hosts records — much harder for users to detect.
Answer
Phishing: fake messages → click → fake site. Pharming: DNS compromise → typed URL goes to fake site. Pharming bypasses 'don't click suspicious links' advice.
Examiner tip
AO1/AO2. 1+1 for the two descriptions, 1+1 for two valid differences. A common loss is describing both but giving only one genuine difference — the two points must be distinct (e.g. user-action vs DNS, detectability).
Question
Identify THREE defences against cyber-security threats and explain what each protects against. (6 marks)
Step-by-step solution
Step 1
Firewall (2 marks). Filters incoming and outgoing network traffic against rules. Blocks unauthorised connections — defence against intrusion, brute-force, some DDoS, and unauthorised data exfiltration.
Step 2
Anti-malware software (2 marks). Scans files and processes for known malware signatures and suspicious behaviour. Defends against viruses, worms, trojans, ransomware, spyware. Must be regularly updated.
Step 3
Multi-factor authentication / biometrics (2 marks). Requires more than one form of authentication (password + code from app, or fingerprint, or face). Protects against compromised passwords, brute-force, phishing.
Answer
Firewall, anti-malware, MFA / biometrics. Other valid: SSL/TLS encryption, automatic updates, captcha, password rules, user access levels, user education / awareness, anti-phishing browser extensions.
Examiner tip
AO1/AO2. 1 mark for naming each defence, 1 mark for stating what it protects against. The 'what it protects against' half is where students lose marks — always pair the defence to a threat.
Question
Identify and describe FOUR types of malware. (8 marks)
Step-by-step solution
Step 1
Virus (2 marks). Malicious code that ATTACHES itself to a host file or program. Spreads when the host is run, replicating into other files. Often damages or deletes data.
Step 2
Worm (2 marks). A standalone program that SPREADS automatically across networks WITHOUT needing a host file. Replicates rapidly and can saturate bandwidth.
Step 3
Trojan (2 marks). Disguised as legitimate software (e.g. a useful tool or game). When run, opens a backdoor or steals data. Doesn't replicate itself — relies on user installation.
Step 4
Ransomware (2 marks). Encrypts the victim's files and demands a ransom (typically in cryptocurrency) in exchange for the decryption key.
Answer
Virus (attaches to hosts), worm (self-spreading across networks), trojan (disguised), ransomware (encrypts and demands payment). Other valid: spyware (keylogging / data exfiltration), adware (forced ads).
Examiner tip
AO1. 1 mark to name + 1 mark to describe each of four types (4×2). Naming the type without a distinguishing mechanism scores only half — the key contrast is virus (needs a host) vs worm (self-spreads) vs trojan (disguised, no replication).
Question
An online bank is worried about its customers' accounts being accessed by attackers. Describe THREE different threats to the customers' accounts and, for each, give a suitable prevention method. (6 marks)
Step-by-step solution
Step 1
Threat 1 — phishing. Customers are tricked by fake bank emails into entering login details on a spoof site. Prevention: two-factor authentication (2FA) — the stolen password alone is not enough to log in, plus user education to spot fake emails.
Step 2
Threat 2 — brute-force attack. An attacker tries many password combinations against an account. Prevention: strong passwords + account lockout / CAPTCHA after several failed attempts so automated guessing is blocked.
Step 3
Threat 3 — data interception. Login data captured on an unsecured network. Prevention: SSL/TLS encryption (HTTPS) so intercepted data cannot be read.
Step 4
Pick the right pairing. Each prevention must actually counter its threat: 2FA defeats stolen passwords, lockout/CAPTCHA defeats automated guessing, encryption defeats interception. A firewall would NOT stop phishing, so don't pair them.
Answer
Phishing → 2FA / user awareness; brute-force → strong passwords + lockout/CAPTCHA; data interception → SSL/TLS encryption. (Also valid: social engineering → staff/customer training; malware keylogger → anti-malware.)
Examiner tip
AO2/AO3. 1 mark per threat (×3) and 1 mark per matching prevention (×3). The discriminator is whether the prevention genuinely counters the named threat — a mismatched pair (e.g. 'firewall' for phishing) scores the threat mark only.
High-scoring sample answers for cyber security on the Cambridge IGCSE 0478 paper, with examiner-style notes mapping each response to the mark scheme and assessment objectives.
Malware secretly records the keys a user presses and sends this data to an attacker.
Name this type of malware. [1 mark]
Model answer
Spyware (a keylogger is an accepted example of spyware).
Why this scores
AO1, 1 mark. Must give the specific term 'spyware' (or keylogger). 'A virus' or 'malware' is too general and scores 0.
State two tasks performed by a firewall to help protect a computer system. [2 marks]
Model answer
Why this scores
AO1, 2 marks (1 per valid task, max 2). Reward: examines incoming/outgoing traffic; checks against rules; blocks unauthorised connections; can blacklist/whitelist addresses. Note the prevention is matched to the threat of unauthorised network access.
Describe what is meant by social engineering and give one way an organisation can reduce this threat.
[3 marks]
Model answer
Social engineering is the manipulation of people (rather than technology) into divulging confidential information or performing actions that compromise security — for example, an attacker phones an employee pretending to be IT support and creates a false sense of urgency to obtain a password.
Reducing the threat: train staff to recognise such attempts and to verify the identity of anyone requesting credentials / never share passwords.
Why this scores
AO1/AO2, 3 marks: 2 for the description (manipulating people psychologically + example/method such as impersonation or urgency), 1 for a valid prevention. The prevention must target people (staff training / awareness), correctly matching the human-centred threat.
A user is worried that someone could log in to their account if their password is stolen. Explain how two-factor authentication (2FA) reduces this risk, and give one other method that also helps.
[4 marks]
Model answer
2FA (3 marks): It requires a second piece of evidence in addition to the password — typically something the user has, such as a one-time code sent to / generated on their phone, or something the user is (a biometric). Even if an attacker has stolen the password, they do not have the second factor (the phone / fingerprint), so they still cannot log in.
Other method (1 mark): biometrics (fingerprint / face recognition), or using strong / regularly changed passwords, or account lockout after failed attempts.
Why this scores
AO1/AO2, 4 marks: up to 3 for explaining 2FA (second factor; something you have/are; password alone is insufficient) and 1 for a distinct additional method. The method must not just restate 2FA. Marks reward linking the defence to the specific 'stolen password' threat.
Describe how phishing and pharming differ, and describe how a user can guard against each.
[5 marks]
Model answer
Phishing: the attacker sends fraudulent emails/texts that appear genuine, tricking the user into clicking a link and entering credentials on a fake website. It relies on the user taking an action (clicking).
Pharming: the attacker alters DNS records or the local hosts file so that even when the user types the correct URL, the browser is redirected to a fake site — no clicking is required, making it harder to detect.
Guarding against phishing: do not click links in unexpected emails; check the sender / URL carefully; use anti-phishing tools / email filters; user awareness training.
Guarding against pharming: check the site uses HTTPS / valid SSL certificate before entering data; keep anti-malware and the OS updated to protect the hosts file; use a trusted DNS.
Why this scores
AO1/AO2, 5 marks: 1 phishing description, 1 pharming description, 1 for a clear difference (user-action/clicking vs DNS redirection), 1 phishing prevention, 1 pharming prevention. Each prevention must correctly match its threat — anti-phishing/awareness for phishing, certificate-checking/anti-malware for pharming.
Describe three different threats to a computer system and, for each, describe a suitable prevention method.
[6 marks]
Model answer
Threat 1 — Malware (e.g. virus / ransomware): malicious software that infects the system to damage, encrypt or steal data. Prevention: install and regularly update anti-malware/antivirus software and enable automatic OS updates to patch vulnerabilities.
Threat 2 — Brute-force attack: software repeatedly tries every password combination to gain access. Prevention: enforce strong/complex passwords and lock the account (or use CAPTCHA) after several failed attempts.
Threat 3 — Data interception: data captured while transmitted over a network (e.g. unsecured Wi-Fi). Prevention: encrypt the data using SSL/TLS (HTTPS) so intercepted data cannot be understood.
Why this scores
AO2/AO3, 6 marks: 1 per threat described (×3) + 1 per matching prevention (×3), max 6. Threats must be genuinely different, and each prevention must counter its named threat (anti-malware↔malware, strong passwords/lockout↔brute-force, encryption↔interception). A mismatched pairing scores the threat mark only.
Definitions to memorise and the exact keywords mark schemes credit for cyber security answers — sharpened from recent examiner reports for the 2026 0478 sitting.
An attack that tries every possible combination of characters (e.g. for passwords) until the correct one is found. Defended against by long, complex passwords, account lockouts and CAPTCHA.
An attack where many compromised devices (a botnet) flood a target with traffic, making it unreachable to legitimate users.
Capturing data while it is being transmitted — e.g. on an unsecured Wi-Fi network. Defended against by encryption (SSL/TLS).
Sending fraudulent emails or texts that look legitimate, designed to trick the user into clicking a link and entering credentials on a fake site.
Redirecting a user to a fake site by altering DNS records or local hosts files — even when the user types the correct URL.
Manipulating people psychologically to give up credentials or take harmful actions (impersonating IT staff, urgent fake requests).
Malicious software. Umbrella term for viruses, worms, trojans, ransomware, spyware, adware, rootkits.
Malware that ATTACHES to a host file or program and spreads when the host is run.
A standalone malware program that spreads across networks AUTOMATICALLY, without needing a host or user action.
Malware DISGUISED as legitimate software. Doesn't replicate itself; relies on the user installing it.
Malware that ENCRYPTS the victim's files and demands payment in exchange for the decryption key.
Malware that secretly monitors user activity (keystrokes, screenshots) and exfiltrates the data to an attacker.
Hardware or software that filters traffic based on rules. Blocks unauthorised connections and known-bad sources.
Requires more than one form of authentication: typically something you KNOW (password) plus something you HAVE (phone code) or something you ARE (biometric).
Protocols that encrypt data sent over a network. The basis for HTTPS. Uses asymmetric crypto for the handshake, symmetric for bulk traffic.
The traps other students keep falling into on cyber security questions — taken from recent Cambridge IGCSE 0478 examiner reports and mark schemes — and how to avoid them.
0478 Examiner Reports 2022-2024
Why it happens
'Virus' is the most familiar term.
How to avoid it
Virus = ONE specific type. Malware is the umbrella; viruses, worms, trojans, ransomware are separate types with different mechanisms and defences. Use the right term.
Why it happens
Vague mental model of 'security software'.
How to avoid it
Firewall = NETWORK filter (incoming/outgoing connections). Anti-malware = file/process scanner on the device. Two different jobs; you need both.
Why it happens
Students lump all 'security' answers together.
How to avoid it
HTTPS encrypts traffic in TRANSIT — defends against data interception, NOT malware. Match the defence to the threat.
Why it happens
Similar names.
How to avoid it
Phishing: USER clicks a fake link in an email. Pharming: DNS is compromised; typed URL goes to a fake site without any clicking. Different attack, different defence.
The things students keep getting wrong in this sub-topic, answered.