Describe what malware is and how it can be protected against.

The idea

Malware is software written to cause harm or gain unauthorised access to a system, rather than to do a useful job for the user. It may delete or corrupt files, spy on activity, lock data and demand payment, or quietly take control of a machine. Protection works in layers. Anti-malware software scans files and running programs against known signatures and suspicious behaviour, and its definitions must be kept up to date. A firewall filters incoming and outgoing network traffic. The operating system and applications should be patched, because updates close the weaknesses malware exploits. Users should avoid opening unexpected attachments or links, and download software only from trusted sources. Strong, unique passwords and regular backups limit the damage if an attack succeeds.

What earns the marks

• Defines malware as software designed to cause harm, disrupt a system or gain unauthorised access, not as a hardware fault.
• Identifies anti-malware software that scans for known signatures and suspicious behaviour, and notes that definitions must be updated.
• Identifies a firewall as filtering network traffic to block unauthorised connections.
• Explains that installing operating system and software updates patches known vulnerabilities.
• Recognises user behaviour measures such as avoiding suspicious links and attachments and using trusted download sources.
• Recognises that strong passwords and regular backups reduce the impact of an attack.

Common mistakes and how to put them right

• Treating a virus as a hardware problem.

  Put it right by stating that malware is software and is removed by software tools and safe practice, not by replacing components.

• Assuming anti-malware alone is sufficient.

  Put it right by explaining that protection is layered and includes firewalls, updates, user caution and backups.

• Confusing a firewall with anti-malware.

  Put it right by saying a firewall filters network traffic, while anti-malware scans files and programs for malicious code.

Exam tips

• Read the question stem to see whether it asks what malware is, how it spreads, or how it is prevented, and answer only that part.
• Link each protection method to the specific threat it reduces rather than listing methods without purpose.
• Eliminate options that describe recovery after damage when the question asks about protection before damage occurs.