Topic 5 The Internet & Its Uses · Page 5.5

Cyber Security Lab

Eight threats, the solutions that stop them, and the look-alikes that trip students up: brute-force vs hacking, phishing vs pharming, DDoS vs malware. Learn the 8 threats and the solutions well. Then match each threat to the solutions that actually defeat it. And try to spot a phishing email before it fools you.

Path

5.5 Path

Mistakes

Progress

Stats

0%Accuracy

0Answered

0Streak

Bookmarks

Book Notes

Title

Note

Knowledge Vault 2.0

Knowledge Vault

Add entry

Entries

📚 Book Notes

📖 Learn

🎮 Activities

🎯 Matrix

✎ Practice

📋 Exam

🔄 Review

🏆 Mastery

§1 · Topic overview

What do I need to know before I start?

This page covers Cambridge syllabus 5.3 Cyber security. It has two lists to know well: the 8 threats and the solutions. (The syllabus lists ten solutions; this page combines its two "checking" items — checking the spelling and tone of communications, and checking the URL attached to a link — into one, giving 9.) For every threat, know three things — what happens, the aim, and which solutions defeat it. On defence, the key message is layered defence: no single solution is enough. Two pairs are often confused — phishing vs pharming (a link fools you vs a redirect fools you) and malware vs virus (a virus is only one type of malware). Describe threats and solutions in two steps: what it is, then how it works or what it stops.

§2 · Learning objectives

By the end of 5.5 you can…

You can…	Why it matters
Describe the 8 threats: what happens and the aim	Describing beats naming — say what happens and the aim
Name the 6 malware sub-types and how each behaves	"Malware = virus only" throws away easy marks
Describe the 9 solutions and how each works	Solutions questions ask how it defends, not just its name
Match each solution to the threats it defeats	The Matrix tab drills exactly this — a common higher-mark question
Tell phishing from pharming, and malware from virus	Two look-alikes that are often confused
List what makes a password strong	"Use a strong password" earns little without the detail

§3 · Key terminology

Cambridge-approved terms

Brute-force

Software repeatedly tries password combinations until it finds the right one.

Data interception

A packet sniffer captures data packets as they travel across a network.

DDoS

A botnet floods a web server with requests at once to crash it.

Hacking

Exploiting vulnerabilities to gain unauthorised access to data.

Malware

Malicious software installed without the user's knowledge (6 sub-types).

Phishing

A fake email with a link to a fake site that captures credentials.

Pharming

Malicious code redirects a correct URL to a fake site.

Social engineering

Manipulating a person into revealing confidential data.

Layered defence

Combining many solutions — no single one is enough.

§4 · Core theory

The tables you must know cold

The 8 threats — what happens and the aim

Threat	What happens	Aim
Brute-force	Software cycles through password combinations until one works	Gain access to an account
Data interception	A packet sniffer examines packets travelling across a network	Steal data for identity theft / fraud
DDoS	A botnet floods a server with simultaneous requests	Crash the server (extortion, revenge, activism)
Hacking	Vulnerabilities are exploited to gain unauthorised access	Steal, corrupt or leak data
Malware	Malicious software is installed without the user's knowledge	Damage the device, steal data, ransom files
Phishing	A fake email links to a fake site that captures details	Steal personal / financial data
Pharming	Code redirects a correct URL to a fake site	Steal personal / financial data
Social engineering	A person is manipulated into revealing confidential data	Gain access to accounts / systems

Malware — the 6 sub-types

Type	How it behaves
Virus	Attaches to a file; needs the user to run it to spread; can corrupt data
Worm	Self-replicating; spreads across a network without a host file or user action
Trojan	Disguised as legitimate software; opens the door for other malware
Spyware	Secretly records keystrokes / activity and sends it to the attacker
Adware	Pushes unwanted adverts; slows the device; can carry other malware
Ransomware	Encrypts files and demands payment for the key (e.g. WannaCry)

The 9 solutions — what each does and best defeats (the Matrix tab uses this same mapping)

Solution	How it works	Best defeats
Access levels	Different users get read / write / no access	Social engineering · also helps: hacking, brute-force (limits the damage)
Anti-malware	Scans files against known definitions; quarantines threats	Malware, pharming · also helps: phishing, DDoS, hacking
Authentication	Strong password + biometric + 2FA prove identity	Brute-force, hacking · also helps: social engineering
Automatic updates	Auto-installs security patches, closing known holes	Hacking, malware
Checking URL / link	Hover to see the real URL; check sender, spelling, tone	Phishing · also helps: pharming, social engineering
Firewall	Examines traffic against criteria; blocks / closes ports	Hacking, DDoS · also helps: malware
Privacy settings	Restrict who can see your data online	Social engineering · also helps: phishing
Proxy server	Filters requests; caching absorbs DDoS traffic	DDoS · also helps: hacking, malware
SSL / TLS	Certificate authenticates the site; data encrypted in transit	Data interception · also helps: spotting fake sites (phishing, pharming)

Strong password checklist: long (e.g. 12 or more characters); a mix of upper and lower case; numbers; symbols; not a dictionary word; not based on personal information. Never just write "use a strong password" — describe what makes it strong.

§5 · Common misconceptions

Traps that regularly cost marks

Phishing = pharming. Phishing: a link fools you. Pharming: a redirect fools you even when the URL you typed is correct.

Malware = virus. A virus is one type of malware. Worms, trojans, spyware, adware and ransomware are separate.

"Install anti-virus and you're safe." No single solution is enough — think layered defence.

Naming without describing. Naming alone is rarely enough — describe what it does as well.

SSL stops everything. SSL/TLS's main job is defeating data interception — it encrypts data in transit. It won't stop malware, DDoS or brute-force.

"Use a strong password." Too vague alone — say long, mixed characters, no dictionary word, no personal info.

§6 · Quick knowledge check

Check yourself — tap to reveal

Say the answer out loud in exam wording, then tap to check.

1 · What is the difference between phishing and pharming?

Tap to reveal

Phishing: you click a fake link in an email that leads to a fake site. Pharming: malicious code redirects you to a fake site even though you typed the correct URL.

2 · Name the six types of malware.

Tap to reveal

Virus, worm, trojan, spyware, adware, ransomware.

3 · Describe a DDoS attack.

Tap to reveal

A botnet of infected computers sends huge numbers of requests to a web server at once, aiming to crash it.

4 · Which threat is SSL/TLS mainly used to defend against?

Tap to reveal

Data interception — it encrypts data in transit so intercepted packets are meaningless.

5 · Give three solutions that help against hacking.

Tap to reveal

Any three: authentication, automatic updates, firewall, access levels, proxy server.

6 · What makes a password strong?

Tap to reveal

Long (e.g. 12 or more characters), a mix of upper/lower case, numbers and symbols, no dictionary word, and not based on personal information.

✅ Ready for Learn?

You've met the 8 threats, the 9 solutions and the two look-alikes. Open the Learn tab for the phishing-email inspector, then use the Matrix tab to drill which solution stops which threat.

📚 From the Textbook

Cyber-security threats fall into eight big categories, and Cambridge expects you to describe each one crisply: what happens, what the aim is, and which security solutions defeat it. On the defence side there are nine solutions, and no single one is enough — the key message is "layered defence". Never write "install anti-virus and you're safe". Write: strong password + biometric + 2FA + firewall + anti-malware + auto-updates + SSL + access levels + privacy settings, each defeating a specific set of threats. In 2017 the WannaCry ransomware spread around the world as a worm, through a vulnerability in Windows, encrypting files and demanding payment in Bitcoin. In the UK, some hospitals had to turn patients away. Microsoft had released a security patch two months earlier, so computers with automatic updates were already protected. That is why every layer matters.

💡 Getting Started

Think of one of your own passwords. Would it stand up to a brute-force attack? Try scoring it against a strong-password checklist: is it long (12 or more characters), does it mix upper + lower + number + symbol, does it avoid dictionary words and personal details? If not — you'll want to change it after finishing this lab.

🔬 Computer Science in Context: the 21 October 2016 DDoS

On 21 October 2016, a botnet called Mirai — made of home cameras, DVRs and routers infected with malware — launched a 1.2 Tbps DDoS attack on Dyn, a company that runs DNS servers. Twitter, Netflix, Spotify, Reddit, GitHub, PayPal — all went dark for hours across the eastern US and Europe. It wasn't PCs doing the attack. It was baby monitors. Mirai got in mostly by using factory-default passwords. The lesson: every device on the internet is a potential bot — change default passwords and update the firmware on smart devices, or you could be helping.

💬 Discussion: whose fault is it?

A user clicks a phishing link and gets their bank account emptied. Is it the user's fault for clicking? The bank's fault for not detecting the fraud? The email provider's for not filtering the phishing email? The internet's for allowing the fake website to exist? Most security experts argue for shared responsibility — every layer should have done something. That's the whole point of "defence in depth".

⚠️ The Cambridge Exam Trap — Phishing vs Pharming

Candidates often confuse these two. Similar names, similar goal (steal your data) — but the attack method is completely different.

🎣 Phishing

You click a fake link in an email/message. That link takes you to a fake site that looks legit. You type your details in. They're stolen.

Defence: check the sender, spelling, tone; hover over links before clicking; the URL bar tells the truth.

🌾 Pharming

You type the correct URL for a legit site — but malicious code (on your device or on a DNS) silently redirects you to a fake site. You didn't click anything wrong.

Defence: anti-malware to remove the redirecting code; check for HTTPS + a valid digital certificate before typing anything sensitive.

⚠ How to remember: Phishing = a link fools you. Pharming = a redirect fools you. If the URL you TYPED is correct but you end up on a fake site → pharming. If the URL you CLICKED took you to a fake site → phishing.

🎣 Signature Lab — Phishing Email Inspector

Below is an email that landed in a user's inbox. Something feels off. Click on every part that looks like a red flag — but careful: some parts are perfectly normal, and flagging them counts against you. Then hit Check. Hover over the link before clicking to see where it really goes.

From:

security-alert@amaz0n-support.co

To:

you@yourmail.com

Date:

Mon 6 Oct 2026, 09:14

Subject:

🚨URGENT: Your acount has been suspended!!! Action required within 24 hours 🚨

Dear Valued Customer,

We have detected unusal activity on your account. For your security we have temporarily suspended your account and all pending orders.

To avoid permanent closure of your acount within 24 hours, please click the link bellow and verify your full password, credit card number and social security number:

Verify My Account Now → (hover to see real URL)

Thank you for shoping with us.

Amazon Security Team

Click each red flag you can spot, then hit Check. There are 7 to find.

The 8 threats — at a glance

Threat	What happens	Aim
Brute-force	Software cycles through password combinations until the right one is found.	Gain access to an account to steal data or make purchases.
Data interception	Packet sniffer software examines data packets as they travel across a network.	Steal personal data for identity theft or fraud.
DDoS	A botnet of infected computers sends huge numbers of requests to a web server simultaneously.	Crash the web server. Motives: extortion, revenge, activism.
Hacking	Exploiting vulnerabilities (weak passwords, unpatched software, open ports) to gain unauthorised access.	Steal, corrupt or leak data.
Malware	Malicious software installed without user's knowledge. Sub-types: virus, worm, trojan, spyware, adware, ransomware.	Damage the device, steal data, encrypt files for ransom.
Phishing	Fake email with a link to a fake site that captures credentials.	Steal personal / financial data.
Pharming	Malicious code redirects a user to a fake site even when the correct URL is entered.	Steal personal / financial data.
Social engineering	Manipulating a person (via call, quiz, in-person con) into revealing confidential data.	Gain access to accounts / company systems.

Malware — the family tree

Type	How it behaves
Virus	Attaches itself to a file. Needs the user to run the infected file to spread. Can delete or corrupt data.
Worm	Self-replicating — spreads across a network without needing user action or a host file.
Trojan	Disguises itself as legitimate software. Once installed, opens the door for other malware or gives an attacker access.
Spyware	Secretly records the user's activity — keystrokes, screen captures, browsing habits — and sends the data to the attacker.
Adware	Pushes unwanted adverts, often through pop-ups. Slows the device and can carry other malware.
Ransomware	Encrypts the user's files and demands payment (often in cryptocurrency) for the decryption key. WannaCry was this.

⚠ Malware ≠ Virus: A virus is one type of malware. All viruses are malware, but not all malware is a virus (worms, trojans, spyware etc are all separate). In an exam, if you're asked about "malware" and only mention viruses, you're throwing away easy marks.

The 9 solutions — what each one actually does

The syllabus lists ten; "checking the spelling and tone of communications" and "checking the URL attached to a link" are combined here as Checking URL / link. The Matrix tab uses this same mapping.

Solution	How it works	Best defeats
Access levels	Different users get different levels of access (read / write / no access) — only senior staff see sensitive data.	Social engineering · also helps: hacking, brute-force (limits the damage even if a breach happens)
Anti-malware	Scans files against a database of known malware definitions. Quarantines / deletes anything it finds.	Malware, pharming (removes redirect code) · also helps: phishing (email attachments), DDoS (stops your PC becoming a bot), hacking
Authentication	Proves the user is who they claim: strong password (long, mixed characters), biometric (fingerprint, face), 2FA (extra code by SMS/email).	Brute-force, hacking · also helps: social engineering
Automatic software updates	Auto-installs security patches as soon as they're released — closes known vulnerabilities before attackers exploit them.	Hacking, malware (WannaCry hit un-updated machines)
Checking URL / link	Before clicking: hover over links to see real URL. Check spelling, tone, personalisation of email. Confirm sender.	Phishing · also helps: pharming, social engineering
Firewall	Hardware or software barrier that examines incoming and outgoing traffic against set criteria. Blocks anything that fails. Can close ports.	Hacking, DDoS (rate-limits) · also helps: malware (blocks known bad traffic)
Privacy settings	Restricts who can see your data on social media and online accounts. Highest privacy = only your connections see your info.	Social engineering (attackers can't build a profile) · also helps: phishing
Proxy server	Sits between users and the web server. Examines requests, filters bad ones, uses caching to absorb DDoS traffic.	DDoS · also helps: hacking, malware
SSL / TLS	A digital certificate authenticates the site and the data is encrypted during transmission, so intercepted data is meaningless.	Data interception · also helps: spotting fake sites (a valid certificate)

Strong password — the checklist

A strong password:

Long — e.g. 12 or more characters (the longer the better)
Mix of uppercase and lowercase letters
Includes numbers
Includes symbols (! @ # $ % etc)
Not a dictionary word or predictable phrase
Not based on personal information (pet name, birthday, favourite team)

Weak → Strong examples

mrsnuffles01 — weak. Dictionary word + personal + predictable number.

Password123! — weak. Still a dictionary word, common suffix.

1gH6dk@dnlwm!dosTsjlpa — strong. Long, mixed, no pattern, no dictionary words.

⚠ Exam wording: Don't just write "use a strong password". Describe what makes it strong — long, mix of characters, no dictionary word. That's the safest way to earn the marks.

⭐ Activity 1 — Threat Identifier

Read the description. Name the threat.

Press New.

🎮 Activity 2 — Phishing or Pharming?

Classic exam trap. Read the scenario, pick the attack.

Press New.

🎮 Activity 3 — Solution Identifier

Read what the solution does. Name it.

Press New.

🎮 Activity 4 — Malware Family

Which sub-type of malware does the description match?

Press New.

⏱️ Activity 5 — 60-Second Threat Sprint

Rapid recall. Match each description to the correct term.

Score: 0

Press Start Sprint.

🎯 Threat vs Solution Matrix

The other classic exam trap: students learn solutions in isolation without knowing which threat each one actually defeats. Click each cell where the solution (column) helps defend against the threat (row). Multiple solutions can defend against the same threat. Hit Check to see your accuracy — you'll get colour-coded feedback.

Legend: ✓ correct match · ✗ wrong match · ✓ also accepted · ! missed (core)

Practice questions

Press New.

Cambridge-style questions from 2022–2025 + m26

Press New.

Review quiz

Press New.

Exam traps

⚠ 1 (THE big one): Phishing = fake link the user clicks. Pharming = correct URL, but redirected by malicious code. Similar goal, different attack. Never swap.

⚠ 2: Malware ≠ virus. A virus is one type of malware. If asked about "malware", mention that there are several types (virus, worm, trojan, spyware, adware, ransomware).

⚠ 3: Firewall ≠ anti-malware. Firewall examines traffic going in/out. Anti-malware scans files on the device. Both help, they're not the same thing.

⚠ 4: A DDoS is not the same as hacking. Hacking = unauthorised access. DDoS = crashing a server by overload — the attacker doesn't get inside.

⚠ 5: "Strong password" alone isn't a full answer. Describe what makes it strong: long, mix of characters, no dictionary word.

⚠ 6: SSL/TLS's main job is defending against data interception. It does not stop hacking, malware or DDoS, so don't offer it for those.

⚠ 7: Two-step verification / 2FA needs two different pieces of data (usually password + code sent to phone or email). If both pieces are passwords, it isn't 2FA.

⚠ 8: When explaining how anti-malware works, always say compares against a database of malware definitions, then quarantines / deletes. Both parts earn marks.

⚠ 9: Social engineering is about people, not machines. Phishing IS a form of social engineering (it manipulates a person to click), but so are phone scams and in-person cons.

Memory triggers

Tap to reveal

"Phish reels you in; pharm redirects you" → tap

Phishing uses a lure (link) you have to bite. Pharming quietly redirects even when you're heading to the right place.

"Bot → Zombie → Botnet → DDoS" → tap

A bot (or zombie) is a computer infected with malware and controlled by an attacker. Many bots together = a botnet. A botnet weaponised = a DDoS attack.

"WannaCry — three things that could have saved you" → tap

1. Automatic updates (the patch was released two months before the attack). 2. A firewall blocking the network port it spread through. 3. Anti-malware with up-to-date definitions. Layered defence: each one helps.

"Firewall is a gatekeeper. Anti-malware is a security guard." → tap

Firewall checks who's coming through the door. Anti-malware checks who's already inside. Two different jobs.

"The 6 clues in a phishing email" → tap

Sender address doesn't match; generic greeting; spelling / grammar errors; urgent or threatening tone; link URL doesn't match; asks for sensitive data.

Mastery grid

Track which concepts you have secured. Tap a badge to toggle.

Skills breakdown

🎉 Topic 5 complete

When you finish 5.5, Topic 5 The Internet & Its Uses is complete: the internet vs the WWW, URLs, DNS, HTTPS, browsers and cookies (5.1–5.3), digital currency and blockchain (5.4), and cyber-security threats and solutions (5.5).