AQA GCSE Computer Science: Cyber Security

A small online shop stores its customers' names, addresses and payment details on a server connected to the internet. The owner is worried about cyber attacks and wants to protect the business.

Discuss the threats this online shop faces and the methods it could use to protect its systems and data. Your answer should describe at least two different threats and at least two different protection methods, explaining how each method helps. (6 marks)

An employee receives an email that appears to be from the company's IT department. It says: "Your password expires today — click this link and re-enter your username and password to keep your account active." The link leads to a fake website that records anything typed into it. This is an example of social engineering.

(a) Name the specific type of social-engineering attack described here. (1 mark)

(b) Describe one way the employee could recognise that this email is likely to be an attack, and one action the company could take to reduce the risk of such attacks succeeding. (3 marks)

A website has a login form. A user enters their username and password, which the website inserts into a database query to check against stored records. An attacker types unexpected database commands into the username box instead of a real username. This is a SQL injection attack.

(a) Explain how a SQL injection attack could allow the attacker to gain access to data they should not see. (2 marks)

(b) State one way a website developer could defend against SQL injection. (1 mark)

A brute-force attack is used to try to gain access to a user's account.

(a) Describe how a brute-force attack works. (1 mark)

(b) Explain how requiring a strong password makes a brute-force attack less likely to succeed. (1 mark)

(c) Other than using a strong password, state one measure a system could use to make brute-force attacks much harder, and briefly explain how it helps. (1 mark)

Malware is malicious software designed to harm or gain unauthorised access to a computer system.

(a) State what a virus does that makes it spread. (1 mark)

(b) State what ransomware does to a victim's files. (1 mark)

Organisations sometimes employ specialists to deliberately attack their own systems in a controlled way, in order to find weaknesses before real attackers do.

Name this method of testing the security of a system. (1 mark)