Cyber Security Lab
2,500 attacks a day. 90% of malware arrives by email. Every year the exam asks about it, and every year candidates blur brute-force into hacking, phishing into pharming, and DDoS into malware. Learn the 8 threats and the 9 solutions — cold. Then match each threat to the solutions that actually defeat it. And try to spot a phishing email before it fools you.
5.5 Path
Mistakes
Stats
Bookmarks
Book Notes
Knowledge Vault
Add entry
Entries
What do I need to know before I start?
Section 5.5 has two lists you must know cold: the 8 threats and the 9 solutions. For every threat, Cambridge wants three things — what happens, the aim, and which solutions defeat it. On defence, the message from every mark scheme is layered defence: no single solution is enough. Two pairs are confused every year — phishing vs pharming (a link fools you vs a redirect fools you) and malware vs virus (a virus is only one type of malware). Describe threats and solutions in two steps: what it is, then how it works or what it stops.
By the end of 5.5 you can…
| You can… | Why it matters |
|---|---|
| Describe the 8 threats: what happens and the aim | Two-step descriptions earn two marks; naming alone earns one |
| Name the 6 malware sub-types and how each behaves | "Malware = virus only" throws away easy marks |
| Describe the 9 solutions and how each works | Solutions questions ask how it defends, not just its name |
| Match each solution to the threats it defeats | The Matrix tab drills exactly this — a common higher-mark question |
| Tell phishing from pharming, and malware from virus | The two look-alikes examiners set traps on every session |
| List what makes a password strong | "Use a strong password" scores nothing without the detail |
Cambridge-approved terms
Software repeatedly tries password combinations until it finds the right one.
A packet sniffer captures data packets as they travel across a network.
A botnet floods a web server with requests at once to crash it.
Exploiting vulnerabilities to gain unauthorised access to data.
Malicious software installed without the user's knowledge (6 sub-types).
A fake email with a link to a fake site that captures credentials.
Malicious code redirects a correct URL to a fake site.
Manipulating a person into revealing confidential data.
Combining many solutions — no single one is enough.
The tables you must know cold
The 8 threats — what happens and the aim
| Threat | What happens | Aim |
|---|---|---|
| Brute-force | Software cycles through password combinations until one works | Gain access to an account |
| Data interception | A packet sniffer examines packets travelling across a network | Steal data for identity theft / fraud |
| DDoS | A botnet floods a server with simultaneous requests | Crash the server (extortion, revenge, activism) |
| Hacking | Vulnerabilities are exploited to gain unauthorised access | Steal, corrupt or leak data |
| Malware | Malicious software is installed without the user's knowledge | Damage the device, steal data, ransom files |
| Phishing | A fake email links to a fake site that captures details | Steal personal / financial data |
| Pharming | Code redirects a correct URL to a fake site | Steal personal / financial data |
| Social engineering | A person is manipulated into revealing confidential data | Gain access to accounts / systems |
Malware — the 6 sub-types
| Type | How it behaves |
|---|---|
| Virus | Attaches to a file; needs the user to run it to spread; can corrupt data |
| Worm | Self-replicating; spreads across a network without a host file or user action |
| Trojan | Disguised as legitimate software; opens the door for other malware |
| Spyware | Secretly records keystrokes / activity and sends it to the attacker |
| Adware | Pushes unwanted adverts; slows the device; can carry other malware |
| Ransomware | Encrypts files and demands payment for the key (e.g. WannaCry) |
The 9 solutions — what each does and best defeats
| Solution | How it works | Best defeats |
|---|---|---|
| Access levels | Different users get read / write / no access | Social engineering, hacking |
| Anti-malware | Scans files against known definitions; quarantines threats | Malware, phishing, pharming |
| Authentication | Strong password + biometric + 2FA prove identity | Brute-force, hacking, social engineering |
| Automatic updates | Auto-installs security patches, closing known holes | Hacking, malware |
| Checking URL / link | Hover to see the real URL; check sender, spelling, tone | Phishing, pharming |
| Firewall | Examines traffic against criteria; blocks / closes ports | Hacking, malware, DDoS |
| Privacy settings | Restrict who can see your data online | Social engineering, phishing |
| Proxy server | Filters requests; caching absorbs DDoS traffic | DDoS, hacking, malware |
| SSL / TLS | Encrypts data in transit via a digital certificate | Data interception (only) |
Traps that cost marks every session
Check yourself — tap to reveal
Say the answer out loud in exam wording, then tap to check.
✅ Ready for Learn?
You've met the 8 threats, the 9 solutions and the two look-alikes. Open the Learn tab for the phishing-email inspector, then use the Matrix tab to drill which solution stops which threat.
📚 From the Textbook
Roughly 2,500 cyber-security attacks happen every day, and over 90% of malware arrives by email. The threats fall into eight big categories, and Cambridge expects you to describe each one crisply: what happens, what the aim is, and which security solutions defeat it. On the defence side there are nine solutions, and no single one is enough — the message from every mark scheme is "layered defence". Never write "install anti-virus and you're safe". Write: strong password + biometric + 2FA + firewall + anti-malware + auto-updates + SSL + access levels + privacy settings, each defeating a specific set of threats. You already met WannaCry in 5.4 — ransomware, delivered via email, encrypting files until Bitcoin was paid. That attack is the textbook example of why every layer matters: strong passwords alone couldn't stop it, and firewall alone couldn't stop it, but the machines that had auto-updates enabled had already patched the exploit and survived.
💡 Getting Started
Think of one of your own passwords. Would it stand up to a brute-force attack? Try scoring it against a strong-password checklist: is it at least 12 characters, does it mix upper + lower + number + symbol, does it avoid dictionary words and personal details? If not — you'll want to change it after finishing this lab.
🔬 Computer Science in Context: the 21 October 2016 DDoS
On 21 October 2016, a botnet called Mirai — made of home cameras, DVRs and routers infected with malware — launched a 1.2 Tbps DDoS attack on Dyn, a company that runs DNS servers. Twitter, Netflix, Spotify, Reddit, GitHub, PayPal — all went dark for hours across the eastern US and Europe. It wasn't PCs doing the attack. It was baby monitors. The lesson: every device on the internet is a potential bot, and if you don't update the firmware on your smart doorbell, you're helping.
💬 Discussion: whose fault is it?
A user clicks a phishing link and gets their bank account emptied. Is it the user's fault for clicking? The bank's fault for not detecting the fraud? The email provider's for not filtering the phishing email? The internet's for allowing the fake website to exist? In practice, mark schemes lean towards shared responsibility — every layer should have done something. That's the whole point of "defence in depth".
⚠️ The Cambridge Exam Trap — Phishing vs Pharming
Every year, candidates confuse these two. Similar names, similar goal (steal your data) — but the attack method is completely different.
You click a fake link in an email/message. That link takes you to a fake site that looks legit. You type your details in. They're stolen.
Defence: check the sender, spelling, tone; hover over links before clicking; the URL bar tells the truth.
You type the correct URL for a legit site — but malicious code (on your device or on a DNS) silently redirects you to a fake site. You didn't click anything wrong.
Defence: anti-malware to remove the redirecting code; check for HTTPS + a valid digital certificate before typing anything sensitive.
🎣 Signature Lab — Phishing Email Inspector
Below is an email that landed in a user's inbox. Something feels off. Click on every part that looks like a red flag — sender address, subject wording, greeting, spellings, tone, link, or the ask. Then hit Check. Hover over the link before clicking to see where it really goes.
Dear Valued Customer,
We have detected unusal activity on your account. For your security we have temporarily suspended your account and all pending orders.
To avoid permanent closure of your acount within 24 hours, please click the link bellow and verify your full password, credit card number and social security number:
Verify My Account Now → (hover to see real URL)
Thank you for shoping with us.
Amazon Security Team
The 8 threats — at a glance
| Threat | What happens | Aim |
|---|---|---|
| Brute-force | Software cycles through password combinations until the right one is found. | Gain access to an account to steal data or make purchases. |
| Data interception | Packet sniffer software examines data packets as they travel across a network. | Steal personal data for identity theft or fraud. |
| DDoS | A botnet of infected computers sends huge numbers of requests to a web server simultaneously. | Crash the web server. Motives: extortion, revenge, activism. |
| Hacking | Exploiting vulnerabilities (weak passwords, unpatched software, open ports) to gain unauthorised access. | Steal, corrupt or leak data. |
| Malware | Malicious software installed without user's knowledge. Sub-types: virus, worm, trojan, spyware, adware, ransomware. | Damage the device, steal data, encrypt files for ransom. |
| Phishing | Fake email with a link to a fake site that captures credentials. | Steal personal / financial data. |
| Pharming | Malicious code redirects a user to a fake site even when the correct URL is entered. | Steal personal / financial data. |
| Social engineering | Manipulating a person (via call, quiz, in-person con) into revealing confidential data. | Gain access to accounts / company systems. |
Malware — the family tree
| Type | How it behaves |
|---|---|
| Virus | Attaches itself to a file. Needs the user to run the infected file to spread. Can delete or corrupt data. |
| Worm | Self-replicating — spreads across a network without needing user action or a host file. |
| Trojan | Disguises itself as legitimate software. Once installed, opens the door for other malware or gives an attacker access. |
| Spyware | Secretly records the user's activity — keystrokes, screen captures, browsing habits — and sends the data to the attacker. |
| Adware | Pushes unwanted adverts, often through pop-ups. Slows the device and can carry other malware. |
| Ransomware | Encrypts the user's files and demands payment (often in cryptocurrency) for the decryption key. WannaCry was this. |
The 9 solutions — what each one actually does
| Solution | How it works | Best defeats |
|---|---|---|
| Access levels | Different users get different levels of access (read / write / no access) — only senior staff see sensitive data. | Social engineering, hacking (limits the damage even if breach happens) |
| Anti-malware | Scans files against a database of known malware definitions. Quarantines / deletes anything it finds. | Malware, phishing (email attachments), pharming (redirect code), DDoS (prevents your PC being a bot) |
| Authentication | Proves the user is who they claim: strong password (long, mixed characters), biometric (fingerprint, face), 2FA (extra code by SMS/email). | Brute-force, hacking, social engineering |
| Automatic software updates | Auto-installs security patches as soon as they're released — closes known vulnerabilities before attackers exploit them. | Hacking, malware (WannaCry hit un-updated machines) |
| Checking URL / link | Before clicking: hover over links to see real URL. Check spelling, tone, personalisation of email. Confirm sender. | Phishing, pharming |
| Firewall | Hardware or software barrier that examines incoming and outgoing traffic against set criteria. Blocks anything that fails. Can close ports. | Hacking, malware (blocks known bad traffic), DDoS (rate-limits) |
| Privacy settings | Restricts who can see your data on social media and online accounts. Highest privacy = only your connections see your info. | Social engineering (attackers can't build a profile), phishing |
| Proxy server | Sits between users and the web server. Examines requests, filters bad ones, uses caching to absorb DDoS traffic. | DDoS, hacking, malware |
| SSL / TLS | Encrypts data during transmission using a digital certificate. Intercepted data is meaningless. | Data interception (only) |
Strong password — the mark-scheme checklist
- At least 12 characters long (the longer the better)
- Mix of uppercase and lowercase letters
- Includes numbers
- Includes symbols (! @ # $ % etc)
- Not a dictionary word or predictable phrase
- Not based on personal information (pet name, birthday, favourite team)
Weak → Strong examples
mrsnuffles01 — weak. Dictionary word + personal + predictable number.
Password123! — weak. Still a dictionary word, common suffix.
1gH6dk@dnlwm!dosTsjlpa — strong. Long, mixed, no pattern, no dictionary words.
⭐ Activity 1 — Threat Identifier
Read the description. Name the threat.
Press New.
🎮 Activity 2 — Phishing or Pharming?
Classic exam trap. Read the scenario, pick the attack.
Press New.
🎮 Activity 3 — Solution Identifier
Read what the solution does. Name it.
Press New.
🎮 Activity 4 — Malware Family
Which sub-type of malware does the description match?
Press New.
⏱️ Activity 5 — 60-Second Threat Sprint
Rapid recall. Match each description to the correct term.
🎯 Threat vs Solution Matrix
The other classic exam trap: students learn solutions in isolation without knowing which threat each one actually defeats. Click each cell where the solution (column) helps defend against the threat (row). Multiple solutions can defend against the same threat. Hit Check to see your accuracy — you'll get colour-coded feedback.
Adaptive practice
Press New.
Cambridge-style questions from 2022–2025 + m26
Press New.
Review quiz
Press New.
Exam traps
Memory triggers
Tap to reveal
Mastery grid
Track which concepts you have secured. Tap a badge to toggle.