Threats to computer systems and networks
Why computer systems are attacked
Criminals attack computer systems to steal data, such as personal details and bank card numbers, to make money, for example by demanding a ransom, or to disrupt an organisation.
Getting into a computer system without permission is a crime under the Computer Misuse Act 1990. These notes explain how attacks work in principle, so that you can understand how to prevent them.
People are often the weakest point in a system: a strong system can still be broken into if someone is tricked into giving away their password.
Malware
Malware (malicious software) is any software written to harm a computer or its user, installed without the user knowing. It often arrives in an email attachment, a download or an infected memory stick.
| Type | What it does |
|---|---|
| Virus | Attaches itself to files and spreads when they're opened or shared |
| Worm | Copies itself across a network, with no help from users |
| Trojan | Pretends to be useful software, but does harm once installed |
| Ransomware | Encrypts the user's files and demands payment to unlock them |
| Spyware | Secretly records what the user does, such as the keys they press, and sends it to the attacker |
Its purpose may be to delete or steal data, spy on users, or extort money.
Key terms
Social engineering
Social engineering means tricking people into giving away information, such as passwords, or into letting an attacker in. It targets people, not computers.
- Phishing: a fake email, text or website pretends to come from a trusted organisation, such as a bank. It asks the user to click a link and enter their password or card details, which go to the criminal.
- Pretending on the phone: a criminal calls, pretending to be from the IT department, and asks for the user's password 'to fix a problem'.
- Shoulder surfing: watching someone type their PIN or password.
The purpose is to get access to accounts and systems, or to steal money.
Key terms
Brute-force and denial of service attacks
Brute-force attack: software tries every possible password, one after another, until one works. Short, simple passwords are found quickly, as there are far fewer to try. The purpose is to get into an account.
Denial of service (DoS) attack: a website or server is flooded with so many requests that it can't respond to genuine users, so it slows down or stops. In a distributed denial of service (DDoS) attack, the requests come from thousands of computers, often infected with malware. The purpose is to disrupt an organisation, perhaps for revenge, or to demand money to stop.
Key terms
Data interception and theft
Data interception is capturing data as it travels across a network. On an unsecured network, such as some public Wi-Fi, software can capture the packets passing by and read anything that isn't encrypted, such as passwords or messages.
Data theft also includes stealing devices, such as laptops and memory sticks, and copying data from a system by someone inside an organisation.
The purpose is to steal personal details, passwords or company secrets, to use or to sell.
Key terms
SQL injection
SQL injection is an attack on a database behind a website. It works when a program joins the user's input straight into an SQL query. The attacker types SQL code instead of normal input, which changes what the query does.
Here's a harmless illustration on a small example table, students:
| name | year |
|---|---|
| Ada | 10 |
| Ben | 11 |
| Cal | 10 |
| Dee | 9 |
A program asks for a year and builds its query by joining the input on to the end:
SELECT name FROM students WHERE year = (input)
- Input 10 makes the query ... WHERE year = 10, which shows Ada and Cal, as intended.
- Input 10 OR 1 = 1 makes the query ... WHERE year = 10 OR 1 = 1. Since 1 = 1 is always true, every row matches, and all four names are shown.
On a real website, the same idea could reveal or change data the user should never see.
Key terms
Threats and how to prevent them
| Threat | How it works | How to prevent it |
|---|---|---|
| Malware | Harmful software installed without the user knowing | Anti-malware software; keep software updated; don't open unknown attachments |
| Phishing and social engineering | Tricks people into giving away details | Staff training; check senders and links; never share passwords |
| Brute-force attack | Tries every password | Strong passwords; lock the account after a few failed attempts; two-step verification |
| Denial of service | Floods a server with requests | A firewall to block suspicious traffic; extra server capacity |
| Data interception and theft | Captures data on a network, or steals devices | Encryption; physical security |
| SQL injection | Changes a query with typed-in SQL | Input validation, such as checking the year is a number; parameterised queries, which pass input to the database as a value, never as SQL |
Exam tip
When asked how a method prevents a threat, say how: 'locking the account after three wrong passwords stops a brute-force attack trying every password'.