Threats to computer systems and networks — OCR GCSE Computer Science
Teaching note checked against the official specification.
Threats to computer systems encompass software-based malware, human engineering attacks, and network vulnerabilities like SQL injection and brute-force cracking. For OCR GCSE Computer Science, students must understand the mechanics, impacts, and specific prevention strategies for each digital threat.
Test yourself on Threats to computer systems and networks with OCR GCSE practice questions.
Start free
A week of Premium from your first lesson · Then the free plan continues · No card, no charge
Threats to computer systems and networks explained
Attacks target technical flaws and human behaviour.
Read the full explanation
Malware is software written to harm or exploit, including viruses that attach to files, worms that self-replicate across networks, trojans disguised as useful programs, and ransomware that encrypts data for payment. Social engineering manipulates people: phishing emails or messages trick users into revealing credentials or opening attachments, exploiting people as the weak point. Brute-force attacks try many passwords or keys until one works. Denial of service floods a service with traffic so genuine users cannot access it; a distributed version uses many compromised devices. Data interception and theft captures data in transit, for example on unsecured Wi-Fi. SQL injection inserts malicious SQL through unvalidated input to read or alter a database.
Your focus
- Describe common forms of attack and how each operates.
- Explain how human behaviour and technical flaws create vulnerabilities.
- Suggest appropriate defences that reduce the likelihood or impact of each attack.
Which command word is this?
Give a specific name or brief point without elaboration (e.g., 'State one form of social engineering' requires only 'Phishing').
Threats to computer systems and networks exam tips
Topic Overview
Threats to computer systems and networks covers the various vulnerabilities, malicious software, and human factors that jeopardise data integrity, confidentiality, and availability. It forms a central component of Component 01 (Computer systems) within OCR GCSE Computer Science.
Understanding these threats enables computer scientists to identify attack vectors such as social engineering, malware, and code injection. This foundational knowledge underpins the study of defensive design, network policies, and modern cyber security strategies.
Key Concepts
- →Malware types: Viruses, worms, trojans, ransomware, spyware, and adware, each defined by their distinct propagation and payload characteristics.
- →Social engineering: Exploitation of human trust and cognitive biases rather than software flaws, exemplified by phishing, shoulder surfing, and pretexting.
- →Technical network exploits: Targeted attack vectors including brute-force attacks, denial of service (DoS/DDoS), data interception/packet sniffing, and SQL injection.
- →Vulnerability factors: System weaknesses arising from unpatched software, poor network policies, weak passwords, and lack of employee training.
Marking Points
- Malware categories: virus, worm, trojan, ransomware, with a distinguishing behaviour for each.
- Social engineering manipulates trust; phishing uses fake messages to obtain credentials or deliver malware.
- People are a weak point because they can be deceived even when technical controls are sound.
- Brute-force attacks repeatedly guess passwords or keys, often using dictionaries or automated tools.
- Denial of service overwhelms a service with traffic; distributed denial of service uses many sources.
- Data interception and theft captures data in transit, such as on unsecured public Wi-Fi.
- SQL injection exploits unvalidated input to run unintended SQL against a database.
Examiner Tips
- 💡For each attack, state the mechanism and one realistic impact, such as data loss or service unavailability.
- 💡Match each attack to a suitable defence, for example input validation against SQL injection and staff training against phishing.
- 💡Use precise terms: write 'distributed denial of service' when many compromised devices are involved.
- 💡Avoid generic terms like 'hack' or 'damage'. Use specific technical phrases such as 'unauthorised access', 'packet sniffing', 'data interception', or 'saturating bandwidth'.
- 💡Pair threats directly with the component affected (e.g., SQL injection targets the database backend via unvalidated form inputs, while DDoS targets web server availability).
- 💡When explaining social engineering, focus on human deception rather than technical flaws in computer hardware or protocols.
Common Mistakes
- Calling every piece of malware a virus: correct this by distinguishing self-replicating worms and disguised trojans from viruses that need a host file.
- Confusing phishing with pharming or spam: correct this by defining phishing as a deceptive message that impersonates a trusted party to extract information.
- Describing SQL injection as simply 'hacking a database': correct this by explaining that malicious SQL is inserted through unvalidated user input.
- Believing a Trojan horse replicates itself. Unlike viruses and worms, Trojans do not replicate; they disguise themselves as legitimate software to deceive users into installing them.
- Assuming firewalls prevent all malware infections. Firewalls monitor and filter incoming and outgoing network traffic based on rules; they cannot detect social engineering or inspect encrypted payloads containing zero-day exploits.
- Confusing brute-force attacks with dictionary attacks. A pure brute-force attack systematically checks every possible combination of characters, whereas a dictionary attack uses a curated list of common words and phrases.
Revision Plan
- 1Day 1-3: Categorise and master all malware types, creating a comparison table detailing propagation method, requirement of host file, and typical payload.
- 2Day 4-6: Study social engineering vectors (phishing, shoulder surfing, pretexting) and technical exploits (brute-force, DoS/DDoS, SQL injection).
- 3Day 7-9: Practice past exam questions focusing on explaining the mechanism of each attack and matching it to appropriate prevention techniques.
- 4Day 10: Complete timed exam-style scenarios involving multi-mark explanations of corporate network attacks.
Exam Question Types
- 📋Short definition and identification questions (1-2 marks), asking students to identify a threat from a brief scenario.
- 📋Detailed mechanism explanations (3-4 marks), requiring step-by-step descriptions of how attacks like SQL injection or DDoS take place.
- 📋Scenario-based evaluation questions (6-8 marks), where a fictional company suffers a breach and the student must analyse the threats and recommend defensive measures.
Command Word Expectations (OCR)
Identify / State
Give a specific name or brief point without elaboration (e.g., 'State one form of social engineering' requires only 'Phishing').
Describe
Provide the factual characteristics or step-by-step sequence of a threat without necessarily explaining causes or reasons.
Explain
Set out the causes, mechanisms, or consequences of an attack using connective phrasing such as 'which causes' or 'meaning that'.
How Students Lose Marks (Examiner Pitfalls)
Pitfall: Confusing a virus with a worm by stating both require a host file to execute.
❌ Weak Answer (Loses Marks):A worm is a type of virus that infects programs and damages files when clicked.
Example improved answer:A virus attaches itself to an existing host file or program and relies on human interaction to spread. In contrast, a worm is standalone software that replicates itself automatically across networks without user intervention.
Examiner Tip: Always specify whether self-replication requires host attachment and human interaction when contrasting malware types.
Pitfall: Vaguely describing phishing as just 'hacking an email account' without noting social engineering.
❌ Weak Answer (Loses Marks):Phishing is when hackers send bad emails to hack your computer and steal money.
Example improved answer:Phishing is a social engineering technique where an attacker impersonates a reputable organisation via email to deceive users into disclosing sensitive personal data, such as usernames and passwords.
Examiner Tip: Use precise terminology such as 'social engineering' and identify the mechanism (fraudulent communication) and the objective (harvesting credentials).
Step-by-Step Worked Solutions
Question: An online clothing retailer stores customer accounts in a database linked to its web application. Explain how an SQL injection attack could compromise this database and state one method to prevent it. (4 marks)
- 1.Step 1: Explain the vulnerability exploited. The web application takes user input from a form or URL parameter without validating or escaping it.
- 2.Step 2: Describe the action taken by the attacker. Malicious SQL commands (such as 'OR 1=1') are entered into the input field instead of expected data.
- 3.Step 3: Detail the outcome on the database. The database interpreter executes the injected string as code, granting unauthorised access to bypass authentication or extract sensitive customer records.
- 4.Step 4: Provide an effective prevention technique. Implement prepared statements (parameterised queries) or rigorous input validation to ensure input is treated purely as data, not executable code.
Final Answer: SQL injection occurs when unvalidated user input containing malicious SQL statements is passed directly to the database interpreter, allowing attackers to manipulate queries to view or delete data. It is prevented by using prepared statements/parameterised queries.
Question: Describe how a Distributed Denial of Service (DDoS) attack operates and explain its impact on a business web server. (4 marks)
- 1.Step 1: Identify the source of the attack. An attacker uses a botnet, which is a network of compromised devices (zombies) controlled remotely.
- 2.Step 2: Describe the attack mechanism. The botnet concurrently floods the target server with an overwhelming volume of fraudulent internet traffic or requests.
- 3.Step 3: Detail the technical impact. The server's bandwidth and processing resources become completely saturated, preventing it from handling legitimate incoming requests.
- 4.Step 4: Relate to the business consequence. The business website becomes unavailable or crashes, resulting in lost sales, customer dissatisfaction, and reputational damage.
Final Answer: A DDoS attack employs a botnet of infected computers to flood a web server with excessive traffic. This exhausts system bandwidth and resources, rendering the web server unreachable to legitimate users and halting business operations.
Active Recall Memory Test
What distinguishes a worm from a virus in terms of replication?
Key Fact: A worm replicates across networks independently without needing to attach to a host file or requiring human execution, whereas a virus must attach to a host file and run.
What parameterised security feature prevents SQL injection attacks?
Key Fact: Prepared statements (parameterised queries).
What is the primary operational objective of a Denial of Service (DoS) attack?
Key Fact: To flood a system or network with traffic so that server resources are exhausted and service becomes unavailable to legitimate users.
Which social engineering attack involves visually observing a user typing in confidential data like a PIN or password?
Key Fact: Shoulder surfing.
Frequently Asked Questions
What is the difference between a DoS attack and a DDoS attack?
A Denial of Service (DoS) attack originates from a single computer and single internet connection, making it relatively straightforward to block via IP filtering. A Distributed Denial of Service (DDoS) attack employs a botnet composed of thousands of geographically dispersed, compromised computers. This distributed structure overwhelms the target with vast traffic volumes and makes mitigation far harder, as traffic arrives from thousands of distinct IP addresses.
How does ransomware work on a computer system?
Ransomware is malicious software that, once executed, silently locates and encrypts critical user files using advanced cryptographic algorithms. After the files are encrypted, it displays a ransom notification demanding payment, often in cryptocurrency, in exchange for a decryption key. Even if the ransom is paid, there is no technical guarantee that the criminals will provide the key or restore access.
Why is human error often considered the biggest security threat to a network?
Even with advanced technical defences like firewalls and intrusion detection systems, humans remain susceptible to manipulation and oversight. Employees can be tricked by social engineering tactics like phishing, choose weak passwords, lose unencrypted USB drives, or fail to apply essential security patches. Because of these factors, human error provides attackers with a direct path inside protected networks without having to breach software defences directly.
What is brute force cracking and how can users defend against it?
A brute-force attack involves an automated tool systematically trying every possible combination of alphanumeric characters and symbols until the correct password is found. Defense relies on enforcing complex password policies that use long strings composed of upper and lower case letters, numbers, and symbols to exponentially increase possible combinations. Implementing account lockouts after a set number of incorrect attempts and requiring two-factor authentication (2FA) will render brute-force attacks ineffective.
Can anti-malware software detect all types of malware instantly?
No, anti-malware software primarily relies on signature-based detection, which scans files for known bit patterns from a database of identified threats. If a cybercriminal deploys a brand new, custom threat known as a zero-day exploit, its signature will not yet exist in the database. While modern security software also uses heuristic analysis to flag suspicious program behaviour, sophisticated malware can alter its code or remain dormant to evade heuristic detection.