[5.3.1–2] Threats & mitigations
Cyber Security Threats and How to Keep Data Safe
Why cyber security matters
Cyber security is about protecting computers, networks, and data from unauthorised access or damage. For IGCSE you should be able to describe the main types of threats and explain practical mitigations that reduce risk. Attacks may target individuals, schools, businesses, or governments, and can lead to data loss, financial cost, or disruption to services.
This page introduces common threats such as brute-force attacks, distributed denial of service (DDoS), malware (viruses, worms, trojans, ransomware, spyware), phishing, and wider social engineering. You will also learn layered defences including technical controls (e.g. firewalls, encryption), procedural controls (e.g. backups, updates), and human controls (e.g. training, good password practice).
Core Threat Types
High-level overview
| Threat | What it is | Main impact | Typical target |
|---|---|---|---|
| Brute-force | Automated guessing of passwords or encryption keys | Account compromise, unauthorised access | Login portals, Wi-Fi, encrypted files |
| DDoS | Overwhelming a service with traffic from many devices | Service unavailability, slowdown, outage | Websites, game servers, school portals |
| Malware | Malicious software (virus, worm, trojan, ransomware, spyware) | Data loss, theft, system damage or control | Any connected device |
| Phishing | Fraudulent messages that trick users to reveal data or install malware | Credential theft, payments to fraudsters | Email, SMS, messaging apps, fake websites |
| Social engineering | Manipulating people to bypass technical controls | Policy violations, information leakage | Staff, students, helpdesks |
Threat Walkthroughs
Tabbed scenarios
Brute-force attack: An attacker uses automated tools to try thousands or millions of passwords against a login. Short or common passwords can be guessed quickly. Accounts without lockout or rate limiting are especially vulnerable.
Mitigations: Use long, unique passwords and a password manager; enable multi-factor authentication (MFA) so a code or app approval is required after the password; enforce account lockout after several failed attempts; use CAPTCHAs to slow automated attempts.
DDoS attack: A botnet (many compromised devices) sends huge volumes of traffic to a website so legitimate users cannot get through. This is disruption rather than theft.
Mitigations: Use content delivery networks (CDNs) and DDoS scrubbing services to absorb or filter the traffic; configure rate limiting and firewall rules; ensure scalable hosting and have an incident response plan to re-route or temporarily restrict non-essential services.
Phishing: Messages pretend to be from a trusted source and ask you to click a link or open an attachment. Obvious phishing may include spelling mistakes and odd addresses. Convincing phishing copies real branding. Spear-phishing targets a specific person using personal details.
Mitigations: Provide user awareness training to check sender details and URLs; hover over links before clicking; use spam filters, email authentication (SPF/DKIM/DMARC), and open attachments in protected viewer modes; report suspicious messages to IT.
Malware Categories
How they spread and what they do
Virus: Attaches to legitimate files and spreads when those files are shared. Often needs user action to run. Worm: Self-replicates across networks without user action, exploiting vulnerabilities.
Mitigations: Keep operating systems and applications up to date; use reputable anti-malware; limit unnecessary file sharing; apply least-privilege permissions to reduce spread.
Trojan: Disguised as useful software but performs malicious actions once installed. Spyware: Secretly collects data such as keystrokes or browsing habits.
Mitigations: Install software only from trusted sources; verify permissions requested; use endpoint protection that detects unusual behaviour; educate users about “too good to be true” downloads.
Ransomware encrypts files and demands payment. Backups are essential because paying the ransom does not guarantee recovery and encourages further crime.
Mitigations: Maintain regular offline or off-site backups; patch systems promptly; restrict macro execution; segment networks so an infection cannot reach all devices at once; rehearse recovery procedures.
Layered Defence (Defence in Depth)
Combining technical, procedural and human controls
| Layer | Controls | What it helps prevent |
|---|---|---|
| Technical | Firewall, anti-malware, secure configuration, encryption, MFA, automatic updates | Unauthorised access, malware infection, data theft |
| Procedural | Backups, incident response plan, acceptable use policy, change control | Data loss, slow recovery, risky behaviours |
| Human | Awareness training, phishing simulations, clear reporting routes | Phishing success, social engineering, delayed response |
No single control is perfect. When multiple layers are used, an attacker must defeat several barriers, which greatly lowers risk.
Good Practice for Individuals
Everyday habits that reduce risk
- Use long, unique passwords and turn on MFA wherever possible.
- Think before clicking links or opening attachments. Verify the sender through a separate channel if unsure.
- Install updates promptly for operating systems, browsers, and apps.
- Back up important files to a separate location that is not always connected.
- Only install software and apps from trusted stores or publishers.
- Lock screens when away and keep devices physically secure.
Deep Dive: Encryption and Data Safety
Data at rest and data in transit
Encryption transforms information so that only someone with the correct key can read it. Data at rest (stored on a drive or phone) can be protected with full-disk encryption. Data in transit (moving over a network) should be sent using secure protocols such as HTTPS or a VPN. Encryption does not stop theft, but it ensures stolen files are unreadable without the key.
For exams, you should be able to state that encryption protects confidentiality, but that it must be combined with secure key management and access controls to be effective.
Key Terms
| Term | Definition |
|---|---|
| Brute-force attack | Automated trial-and-error attempts to guess credentials or keys. |
| DDoS | Overloading a service with traffic from many sources to make it unavailable. |
| Malware | Software designed to damage, disrupt, or steal data from systems. |
| Phishing | Fraudulent communication that tricks users into revealing data or installing malware. |
| Social engineering | Manipulation of people to break security procedures. |
| Firewall | Network security device or software that monitors and filters traffic. |
| MFA | Multi-factor authentication: requires two or more proofs of identity. |
| Backup | Copy of data stored separately to allow recovery after loss or corruption. |
| Patch/Update | Software fix to remove vulnerabilities and improve security. |
| Encryption | Method of encoding data so only authorised parties can read it. |
Key Takeaways
- Common threats include brute-force, DDoS, malware, phishing, and social engineering.
- Layered defence combines technical, procedural, and human controls to reduce risk.
- Strong passwords, MFA, updates, and careful handling of emails and links are essential daily habits.
- Backups and encryption protect data if devices are lost, stolen, or infected with ransomware.
- No single control is perfect; combining controls is the most effective strategy.