Cyber Security

Cyber security is the processes, practices and technologies used to protect computer systems, networks, programs and data from attack, damage and unauthorised access.

Cyber security threats can arise through social engineering, malicious code, pharming, weak or default passwords, misconfigured access rights, removable media and unpatched or outdated software.

Social engineering is the manipulation of people into revealing confidential information or carrying out actions that compromise security. Attackers often exploit trust rather than attacking the technology directly.

Blagging, also called pretexting, is a social engineering technique in which an attacker invents a believable situation or identity to persuade a victim to reveal information or perform an action.

Phishing is a social engineering attack in which fraudulent messages, commonly emails, are designed to trick users into revealing information, following malicious links or interacting with fake websites.

Shoulder surfing is obtaining confidential information by observing another person entering or viewing sensitive information, such as a password or PIN, over their shoulder or from another nearby position.

Malware is an umbrella term for malicious software designed to damage systems, interfere with their operation, steal information or gain unauthorised access. GCSE examples include computer viruses, Trojans and spyware.

A computer virus is malicious code that infects files or programs and can spread when infected software is executed or transferred between computer systems.

A Trojan is malware disguised as legitimate or useful software. When the user runs it, the Trojan can perform hidden malicious actions such as stealing information or allowing unauthorised access.

Spyware is malware that secretly monitors a user's activity or collects information without permission and sends that information to another person or system.

Pharming is a cyber attack that redirects a user from a genuine website to a fraudulent website, allowing attackers to collect information such as usernames, passwords or other sensitive data.

Weak and default passwords increase the risk of unauthorised access, while incorrect access rights can allow users to reach files or resources they should not be permitted to use. Strong password systems and correctly configured permissions help reduce these risks.

Removable media can introduce malicious software to a computer system or allow confidential data to be removed. Unpatched or outdated software can also contain known vulnerabilities that attackers may exploit, so software should be kept updated.

Penetration testing involves attempting to gain access to a computer system in order to identify security weaknesses. Testing may simulate an attack by someone with some internal knowledge or credentials, or by an external attacker with no prior knowledge of the system.

Cyber security measures include biometric authentication, secure password systems, CAPTCHA, email confirmation of identity and automatic software updates. These controls reduce unauthorised access, distinguish legitimate users from automated attacks and fix known security vulnerabilities.