OCR · GCSE · Computer Science
Course version: J277 · Version from Sept 2022
Forms of attack Malware Social engineering, e.g. phishing, people as the…
Full specification wording
Threats to computer systems and networks: Forms of attack Malware Social engineering, e.g. phishing, people as the ‘weak point’ Brute-force attacks Denial of service attacks Data interception and theft The concept of SQL injection
Attacks target technical flaws and human behaviour.
Checked against the OCR J277 specification on .
- 4 key terms
Study notes
From the checked teaching notes for this specification point.
The idea
Attacks target technical flaws and human behaviour. Malware is software written to harm or exploit, including viruses that attach to files, worms that self-replicate across networks, trojans disguised as useful programs, and ransomware that encrypts data for payment. Social engineering manipulates people: phishing emails or messages trick users into revealing credentials or opening attachments, exploiting people as the weak point. Brute-force attacks try many passwords or keys until one works. Denial of service floods a service with traffic so genuine users cannot access it; a distributed version uses many compromised devices. Data interception and theft captures data in transit, for example on unsecured Wi-Fi. SQL injection inserts malicious SQL through unvalidated input to read or alter a database.
What earns the marks
- Malware categories: virus, worm, trojan, ransomware, with a distinguishing behaviour for each.
- Social engineering manipulates trust; phishing uses fake messages to obtain credentials or deliver malware.
- People are a weak point because they can be deceived even when technical controls are sound.
- Brute-force attacks repeatedly guess passwords or keys, often using dictionaries or automated tools.
- Denial of service overwhelms a service with traffic; distributed denial of service uses many sources.
- Data interception and theft captures data in transit, such as on unsecured public Wi-Fi.
- SQL injection exploits unvalidated input to run unintended SQL against a database.
Common mistakes and how to put them right
Calling every piece of malware a virus.
Put it right by distinguishing self-replicating worms and disguised trojans from viruses that need a host file.
Confusing phishing with pharming or spam.
Put it right by defining phishing as a deceptive message that impersonates a trusted party to extract information.
Describing SQL injection as simply 'hacking a database'.
Put it right by explaining that malicious SQL is inserted through unvalidated user input.
Exam tips
- For each attack, state the mechanism and one realistic impact, such as data loss or service unavailability.
- Match each attack to a suitable defence, for example input validation against SQL injection and staff training against phishing.
- Use precise terms: write 'distributed denial of service' when many compromised devices are involved.
Try the lesson
The start of the Threats to computer systems and networks: Forms of attack Malware Social engineering, e.g. phishing, people as the ‘weak point’ Brute-force attacks Denial of service attacks Data interception and theft The concept of SQL injection lesson, made from checked teaching notes for this specification point.
Have a go first
Which form of attack involves tricking a user into revealing confidential information, such as a password, by sending a fake email?
Listen
Attacks target technical flaws and human behaviour. Malware is software written to harm or exploit, including viruses that attach to files, worms that self-replicate across networks, trojans disguised as useful programs, and ransomware that encrypts data for payment. Social engineering manipulates people: phishing emails or messages trick users into revealing credentials or opening attachments, exploiting people as the weak point. Brute-force attacks try many passwords or keys until one works. Denial of service floods a service with traffic so genuine users cannot access it; a distributed version uses many compromised devices. Data interception and theft captures data in transit, for example on unsecured Wi-Fi. SQL injection inserts malicious SQL through unvalidated input to read or alter a database. A strong answer earns marks for these points. Malware categories: virus, worm, trojan, ransomware, with a distinguishing behaviour for each. Social engineering manipulates trust; phishing uses fake messages to obtain credentials or deliver malware. People are a weak point because they can be deceived even when technical controls are sound. Brute-force attacks repeatedly guess passwords or keys, often using dictionaries or automated tools. A common slip: Calling every piece of malware a virus. Instead, distinguishing self-replicating worms and disguised trojans from viruses that need a host file. Exam tip: For each attack, state the mechanism and one realistic impact, such as data loss or service unavailability.
See it
Key words
Say what each word means before you turn the card.
Malware
Try answering aloud or in your head before turning the card.
Social engineering
Try answering aloud or in your head before turning the card.
Brute-force attacks
Try answering aloud or in your head before turning the card.
SQL injection
Try answering aloud or in your head before turning the card.
See every definition
- Malware
- Software written to harm or exploit, including viruses that attach to files, worms that self-replicate across networks, trojans disguised as useful programs, and ransomware that encrypts data for payment.
- Social engineering
- Manipulating people, for example through phishing emails or messages that trick users into revealing credentials or opening attachments, exploiting people as the weak point.
- Brute-force attacks
- Trying many passwords or keys until one works.
- SQL injection
- Inserting malicious SQL through unvalidated input to read or alter a database.
Label the diagram
Some boxes have lost their names. Pick the right name for each number.
1Box 1
2Box 2
3Box 3
There is more to this lesson
The full lesson goes on to check your understanding and help you earn the marks. Create a free account to carry on, with your progress saved.
A week of Premium from your first lesson · Then the free plan continues · No card, no charge
Test your understanding of Threats to computer systems and networks: Forms of attack Malware Social engineering, e.g. phishing, people as the ‘weak point’ Brute-force attacks Denial of service attacks Data interception and theft The concept of SQL injection
Active recall beats re-reading. Take an instant quiz now to test what you’ve learned and lock it into long-term memory.
A week of Premium from your first lesson · Then the free plan continues · No card, no charge