GCSEPaper 1Network securityThreats to computer systems and networks
1.4.1

Threats to computer systems and networks

Malware, social engineering, brute force, denial of service and SQL injection.

Learning Objectives

  • 1Describe different forms of malware and their effects
  • 2Explain social engineering and why people are the "weak point" of a secure system
  • 3Explain how a brute-force attack works
  • 4Explain how a denial of service attack works
  • 5Explain how data interception and theft occurs
  • 6Describe the concept of SQL injection

Malware

Malware (malicious software) is any software designed to cause harm or gain unauthorised access to a system. There are several types:
  • Virus – attaches itself to a file or program and spreads when that file is opened, it can corrupt or delete data.
  • Trojan – disguises itself as legitimate software, tricking the user into installing it, then lets an attacker access the system.
  • Spyware – secretly monitors what a user does, such as keystrokes or logins, and sends that information to the attacker.
Malware is an umbrella term for hostile or intrusive software. Key types: a virus attaches to a legitimate file or program and spreads when the infected file is opened, corrupting or deleting data and potentially slowing systems down. A trojan disguises itself as legitimate software, once installed it can create a backdoor allowing an attacker to control the system or steal data, without spreading itself the way a virus does. Spyware secretly gathers information about a user, such as keystrokes or login details, and sends it to the attacker.
Malware covers any software designed to damage, disrupt or gain unauthorised access to a system. A virus requires a host file/program and user action (opening it) to spread, and typically corrupts or deletes data. A trojan relies on deception rather than self-replication, appearing legitimate to trick the user into installing it, then granting the attacker access (e.g. via a backdoor). Spyware operates covertly, harvesting sensitive information (keystrokes, credentials, browsing activity) and transmitting it to the attacker without the user's knowledge.
VirusAttaches to a file, spreads when openedCorrupts or deletes dataTrojanDisguises itself as legitimate softwareTricks the user into installing itSpywareSecretly gathers info (e.g. keystrokes)Sends it to the attacker

Social engineering

Social engineering means tricking people into giving away confidential information, rather than hacking a system directly. People are often called the "weak point" of a secure system, because even with strong technical security, a person can be tricked into handing over access. Phishing is a common example: a fake email or message, pretending to be from a trustworthy source (like a bank), tricks the victim into giving away details like passwords.
Social engineering is the manipulation of people, rather than systems, to gain confidential information. People are described as the "weak point" of a secure system because they have legitimate access to data and systems, but can be deceived into giving that access away, no matter how strong the technical security is. Phishing is the most common form: a communication (often email) is disguised to look like it is from a reputable source, containing a link or request designed to trick the victim into revealing information such as login details.
Social engineering exploits human behaviour rather than technical vulnerabilities, since people with legitimate system access can be manipulated into bypassing security themselves. This makes people the "weak point" even in a technically well-secured system. Phishing typically impersonates a trusted source to deceive the victim into disclosing sensitive information (e.g. login credentials) via a fraudulent link or request.
Spotting a phishing emailFromsecurity@paypa1-support.comSubjectURGENT: your account closes todayWe could not verify your account. Confirm yourpassword now or it will be permanently closed.Confirm now!The sender address is not the real domain!It creates panic to rush you into acting!A real company never asks for your passwordIt attacks the person, not the system

Brute-force attacks

A brute-force attack is when an attacker's software automatically tries many different username and password combinations, very quickly, until it finds one that works. The purpose is to break into an account or system by guessing the correct login details.
A brute-force attack uses automated software to systematically try large numbers of username/password combinations until the correct one is found. Its purpose is to gain unauthorised access to an account or system by guessing valid login credentials, rather than exploiting a technical flaw.
A brute-force attack automates the systematic testing of credential combinations (often at high speed and volume) to guess valid login details and gain unauthorised account or system access. Its effectiveness is reduced significantly by longer, more complex passwords, since the number of possible combinations to try increases sharply.

Denial of service attacks

A denial of service (DoS) attack tries to make a website or online service unavailable by flooding it with huge amounts of traffic all at once. The server becomes overwhelmed trying to respond to so many requests, so it slows down or stops working for real users.
A denial of service (DoS) attack aims to make a service unavailable to legitimate users by overwhelming a server with an excessive volume of traffic or requests in a short space of time. The server cannot cope with the load, causing it to slow down significantly or become completely inaccessible. A DoS attack targets a server or service, not an individual user's own device.
A denial of service attack disrupts availability by flooding a target server with an overwhelming volume of requests, exhausting its capacity to respond to legitimate traffic, resulting in severe slowdown or a full outage. Note: the attack targets a server/service; a common exam error is describing it as targeting a single individual's personal device instead.
Denial of service attackServerOverwhelmedA flood of requests at onceReal users can't get through

Data interception and theft

Data interception and theft happens when an attacker captures data while it is being sent across a network, without permission, often on unsecured (unprotected) networks. The attacker uses software that listens for data that hasn't been encrypted, such as passwords or card details, in order to steal it.
Data interception and theft occurs when an attacker captures data while it is being transmitted across a network, typically on unsecured networks, using software that listens for unencrypted data such as login details or payment card numbers. The purpose is to steal sensitive information for uses such as identity theft, fraud, or gaining unauthorised access to further systems.
Data interception and theft targets data in transit across a network, exploiting unsecured connections to capture unencrypted traffic (e.g. credentials, payment details). Because this happens during transmission, prevention methods that only protect a system's boundary (like a firewall) do not stop it, encryption of the data itself is what prevents intercepted data from being usable.

SQL injection

Many websites store data in a database, and use a language called SQL to work with that data. SQL injection is when an attacker types specially crafted code into a website's input box (like a login form or search bar) instead of normal text. If the website doesn't check the input properly, that code gets run by the database, letting the attacker see, change or delete data they shouldn't have access to.
SQL injection exploits a website's input fields (e.g. a login box or search form) by entering specially crafted SQL code instead of expected input. If the website does not properly validate/check that input, the malicious code is executed by the underlying database. The purpose is to gain unauthorised access to, or control over, the database, allowing the attacker to view, change or delete private data.
SQL injection targets websites that pass user input directly into database queries without adequately validating or sanitising it, allowing an attacker to insert their own SQL code via an input field, which the database then executes as if it were part of the intended query. This can expose, corrupt or destroy data the attacker should have no access to. You are only required to know the concept of SQL injection, not how to write or identify specific injection code.
Website input fieldNormal input:username: alex123↓ treated as data ↓DatabaseMalicious input (unchecked):' OR '1'='1(specially crafted SQL code)↓ runs as a command ↓Unauthorised data access

Exam Phrasing: Use These Exact Phrases

  • ✓A virus attaches to a file and spreads when the infected file is opened
  • ✓A trojan disguises itself as legitimate software to trick the user into installing it
  • ✓Spyware secretly gathers information about a user and sends it to the attacker
  • ✓Social engineering manipulates people into giving away confidential information
  • ✓People are described as the "weak point" of a secure system
  • ✓A brute-force attack automatically tries many username/password combinations to guess login details
  • ✓A denial of service attack floods a server with traffic so it cannot respond to real users
  • ✓Data interception and theft captures data without permission while it is being transmitted
  • ✓SQL injection enters malicious code into an input field to gain unauthorised access to a database
  • 💡When describing a threat, explain both how it works and its purpose, examiners want both, not just a definition.
  • 💡Don't confuse describing a threat with describing how to prevent it, if the question asks you to describe the threat, describe the attack itself.
  • 💡Remember a denial of service attack targets a server/service, not one person's individual device.
  • 💡A firewall does not stop data interception, since that happens to data already travelling across a network, encryption is what protects data in transit.
  • 💡A keylogger is a specific type of spyware, don't list both as if they were two separate, unrelated threats.

Wrong:

A firewall or penetration testing would stop data interception

Right:

Encryption protects data in transit; a firewall guards a system's boundary and penetration testing only finds weaknesses, so neither protects data already crossing a network

Why it matters: OCR examiners flagged this as a common misconception, data interception happens to data already travelling across a network, which a firewall does not monitor.

Wrong:

A denial of service attack targets one person's computer

Right:

A denial of service attack targets a server or online service, overwhelming it with traffic

Why it matters: Examiners noted candidates sometimes describe DoS as attacking an individual device rather than a server.

Wrong:

Describing how to prevent a threat when asked to describe the threat itself

Right:

Focus your answer on what the attack is and how it works, save prevention for a prevention question

Why it matters: Examiners noted some candidates answered "describe the threat" questions with prevention methods instead, which does not answer the question asked.

Question:

Explain what is meant by a brute-force attack. [2]

💡 Attempt this before revealing the answer, practice makes perfect!

Model Answer:

A brute-force attack uses automated software to try large numbers of different username and password combinations very quickly, in order to guess the correct login details and gain unauthorised access to an account or system.

Mark Scheme:

  • 1Automated software systematically tries many username/password combinations
  • 2The purpose is to guess valid login details and gain unauthorised access

Tap a card to flip it. Use the arrow keys to move and space to flip.

Known 0 Still learning 0
1 / 12

Exam-style questions. Have a go, then reveal the mark scheme to check your answer.

1.State what is meant by malware.

[1]

2.Explain why people are often described as the "weak point" of a secure system.

[2]

3.Describe how a denial of service attack works.

[2]

4.Explain how SQL injection could allow an attacker to access private data in a database.

[3]

5.A company's employees regularly send confidential files over public Wi-Fi. Explain the risk of data interception in this scenario, and why a firewall alone would not prevent it.

[3]

6.Describe the difference between a virus and a trojan, and state one thing they have in common.

[4]

7.Discuss the threats a small company's network faces, and explain why its own employees are often the weakest point in its security.

[8]

Extended response · marked in levels, not by counting points

2025Question paperMark schemeExaminers' report
2024Question paperMark schemeExaminers' report
2023Question paperMark schemeExaminers' report
2022Question paperMark schemeExaminers' report

The examiners' reports are the most useful and least read of the three: they say what candidates actually got wrong each year. All files are hosted by OCR.

Past-paper questions grouped by topic

The same OCR questions, sorted by topic rather than by year (via Physics & Maths Tutor).

2023
Paper 1

A common misconception was that a firewall and penetration testing could prevent data interception. Both methods mainly deal with access to a system, but data interception happens to data already being transmitted across a network (e.g. the internet), so neither method actually stops it, encryption of the data is what protects it in transit.

Paper 1

When asked to name another threat, common correct answers included denial of service and viruses. Some candidates listed a keylogger as if it were separate from spyware, when a keylogger is actually a specific type of spyware. Denial of service attacks were sometimes incorrectly described as targeting an individual's device rather than a server.

Paper 1

Some candidates answered a "describe the threat" question by describing how to prevent the threat instead, this does not answer the question asked and does not gain credit.

Previous

Wired and wireless networks, protocols and layers

Next

Identifying and preventing vulnerabilities