Cyber security threats: malicious code (malware)

The idea

Malware is software written to cause harm or gain unauthorised access. Learners should distinguish types by behaviour. A virus attaches to a legitimate file and spreads when that file runs. A worm self-replicates across networks without a host file. A trojan disguises itself as useful software but carries a harmful payload. Ransomware encrypts files and demands payment. Spyware secretly collects data such as keystrokes. Adware floods the user with unwanted adverts. Each type has a matching defence, such as antivirus software, firewalls, regular updates, backups and user caution about downloads.

What earns the marks

• Defines malware as software designed to damage a system, steal data or gain unauthorised access.
• Distinguishes a virus, which needs a host file and user action to spread, from a worm, which self-replicates across a network.
• Explains that a trojan disguises itself as legitimate software and delivers a harmful payload once run.
• Describes ransomware as encrypting files and demanding payment, and spyware as secretly gathering information such as keystrokes.
• Links a defence to the threat, for example antivirus, firewall, patching, backups or avoiding untrusted downloads.

Common mistakes and how to put them right

• Using 'virus' as a synonym for all malware.

  Put it right: A virus is one type that needs a host file, while worms, trojans, ransomware and spyware behave differently.

• Saying a worm needs a host file to spread.

  Put it right: A worm self-replicates across networks without attaching to a host file.

• Believing a trojan is harmless because it looks legitimate.

  Put it right: The disguise hides a harmful payload that runs once the software is installed.

Exam tips

• Name the specific malware type that matches the described behaviour rather than answering 'a virus'.
• State how the malware spreads or what it does, then give one matching defence.
• Use precise terms such as self-replicating, payload, encrypt and keystroke logging.