1. Edexcel GCSE Cyber security threats Computer Science 1CP1
Unit 5 Communication and the Internet

2. Objectives
Understand different forms of cyberattack based on behaviour:
social engineering, such as phishing and shoulder surfing
Understand different forms of cyberattack based on technical weaknesses:
unpatched software
USB devices
digital devices
eavesdropping

3. Forms of cyber attack
Cybercrime can take many forms including planting viruses, acquiring and using personal or confidential data and disrupting a website or service
Cyber attacks take advantage of:
human weakness or gullibility
Technical weaknesses in computer systems, networks or digital devices

4. Social engineering Humans are often the weakest point in security
Social engineering is the art of manipulating or ‘conning’ individuals into giving away private information or login IDs and passwords
Two common techniques are:
Phishing
Shoulder surfing

5. Phishing – what’s this?
A phishing is one that tricks you into handing over sensitive or personal information (login details, bank details, etc.)
You receive what looks like a legitimate , for example from a bank or an organisation such as PayPal or eBay
The website urges you to visit a bogus website and enter your personal details, which are then captured by the phishers

6. Does it work?
Phishers send out hundreds of thousands of s that look as though they are from legitimate companies
For phishing to be successful, the criminals must get you to click on a link in the to go to a website
A successful phishing campaign has around a 5% response rate – meaning 5% of recipients are conned!

7. A typical phishing email

8. What to look out for
Greeting. The phishers don’t know your name – just your address, so the greeting is not personalised
The sender’s address is often a variation on a genuine address
Forged link. The link looks genuine, but it may not link to the website given. Roll your mouse over it to check
Request for personal information. Genuine organisations never do this
Sense of urgency. Criminals try to persuade you that something bad will happen if you don’t act fast
Poor spelling and grammar

9. How are your suspicions raised?
Would you click on the HTML link attachment?

10. Protecting yourself against email scams
Use a SPAM filter to prevent common scams ever reaching your inbox
Be suspicious! If you aren’t completely certain it’s genuine, NEVER click any links or download attachments

11. Shoulder surfing
Shouldering involves direct observation of a user entering their security details

12. Worksheet 5
Do the questions in Task 1 on the worksheet

13. Technical weaknesses
Technical weaknesses can make computer systems vulnerable to:
Malware
Denial of Service (DoS) attacks
Eavesdropping

14. Viruses
A computer virus is one type of malware (malicious software) which is installed without your knowledge, with the purpose of doing harm
A virus is a program which infects (embeds itself in) other programs or data files
It is easily spread if a user innocently sends an infected file to someone else
It is commonly found in attachments with macros

15. Worms A worm is another type of malware
It is a standalone program that does need to attach itself to an existing program in order to spread
It may scan the Internet looking for vulnerable computer to infect

16. How do systems become infected?
Technical weaknesses in a computer or a network can open the door to cybercrime
Common sources and forms of attack include:
unpatched software
USB devices
digital devices
eavesdropping

17. Software patches
A software patch is an update to a program to improve it or fix a bug
The patch may offer extra protection against malware
Many programs offer a free, auto-update facility to keep their security as up-to-date as possible

18. Consequences of unpatched software
New malware programs are constantly seeking flaws in system security
Keeping your operating system and applications software up-to-date helps to prevent potential attacks
Successful attacks can slow systems, steal sensitive information or even destroy data

19. Found – a USB stick!
Criminals sometimes leave a USB stick contaminated with a virus lying, for example, in the car park of a company that they wish to infect with a virus or steal data from
An unsuspecting employee may pick it up and insert it into their computer

20. Eavesdropping
“Eavesdropping” is used to intercept data packets as they move across networks
Packets are inspected for useful data that could be misused or sold
The practice is also carried out by some security agencies in information gathering
Eavesdropping is a modern day form of wiretapping

21. Digital stalking
Hackers can use your mobile device to access detailed information about your daily life
While you browse Facebook on your smartphone, someone could be tracking your every move, determining your GPS coordinates, the direction you are walking in and how fast you’re walking
This is also a form of eavesdropping

22. Threats from digital devices
Digital devices are often targeted by criminals
Loss of a mobile phone can lead to the loss of all the data stored on it, including passwords, account numbers and credit card details
Malware which targets digital devices may create “back doors” to give malicious users access to your device
Many apparently legitimate apps are malicious and may lead to fraudulent charges on your phone bill or theft of personal information
Technical measures like firewalls, antivirus protection and encryption are uncommon on mobile phones

23. Protect your mobile phone!
Use the password feature and choose a strong password
Do not follow links in suspicious s
Think carefully before posting your mobile phone number on public websites
Don’t install apps without researching them first – if they require extra permissions, don’t install them
Delete all information stored on your mobile before discarding

24. Denial of Service attacks
A DoS attack attempts to flood a website server with an overwhelming number of data requests
It may
flood the victim’s site with spam s (an “ bomb”) or
disrupt access to a victim’s website or entire geographical area by reconfiguring software to crash network sites
The motive is often revenge, blackmail or terrorism

25. Worksheet 5
Do Task 2 on the worksheet

26. Plenary Don’t underestimate the dangers of cyber attacks
Social engineering attacks may persuade unwary users to give away personal information
Malware such as viruses and worms may destroy data or slow down the performance of a hard disk or network
They can be spread through games or files downloaded from the Internet
Digital devices such as mobile phones are often not well-protected and can be hacked