Threats to computer systems and networks

A form of attack is a method used by an attacker to harm a computer system or the data on it. The systems and networks you use hold things worth having — school reports, orders, contact lists, photos — so there is always someone willing to try, and an attacker only needs one way in.

The six forms of attack

Each form has its own giveaway: software doing the guessing, a server swamped by fake traffic, a message that is not genuine, or data taken while it is travelling.

Attacks rarely arrive alone

One form of attack is often used to deliver another, so a single description can involve two of them. Suppose someone phones the office of a family-run garden centre, says they are from the company that supplies the till software, and asks an assistant to confirm the admin password so a fault can be fixed. Nothing is broken and nothing looks unusual, so nobody is suspicious — that evening the caller signs in and installs malware that locks every sales record. The social engineering did the getting in; the malware does the damage. In the same way, a denial of service attack can keep staff busy fixing a website while data is quietly being taken.

Malware is software written to cause harm once it is running on a device. It is installed in order to steal data, damage or delete it, lock it so the owner cannot open it, or hand control of the device to someone else. Malware is the umbrella name for the whole family of harmful programs.

How it gets onto a system

Most malware does not break in on its own: a person has to let it in, and that usually means running something. The file often looks perfectly ordinary — a homework document, a page of class notes, an add-on for a game — but hidden instructions are tucked inside it, and they start running the moment it opens. Installing a program can bring malware with it too, quietly adding extra software nobody asked for. A removable storage device that already carries malware can pass it on as soon as it is plugged in.

For example, you install a free drawing app called Star Sketcher that a friend sent you the link for. It draws perfectly well, but a hidden part of it lets a stranger in: they can switch on your webcam and read through your files whenever they choose. Nothing on the laptop has broken — it still switches on and runs every program exactly as before — but someone else is now in charge of it.

The threat it poses

Once it is running, malware does whatever it was written to do. It might send copies of your files to the attacker, hold them hostage until you pay, wipe them altogether, or simply hand control of the machine over so that the device follows their instructions rather than yours. Notice where the harm lands: on the data, or on who is in control of the device — not on the hardware itself.

Social engineering is the use of deception to trick people into giving away information or access. The attacker does not try to break the software or crack the encryption — they go after the person using it instead.

Why people are the weak point

A system can have strong passwords, encryption and a firewall, but all of that only works if the people using it behave safely. Social engineering gets around technical security entirely: if you can be talked into holding a locked door open for someone, no amount of good software protects the system. That is why people are described as the weak point in a system.

The attack only works because of ordinary human behaviour, so it plays on feelings rather than on software flaws:

• Trust — you believe someone who sounds official, so you answer their questions.
• Fear — you are told your account will be closed down unless you confirm your details.
• Urgency — you are pushed to act quickly, before you have time to check whether the request is genuine.
• Curiosity — an email from a stranger headed "photos from Saturday", or a link promising to show who has viewed your profile, is hard to ignore.

What the attacker wants

The purpose is to obtain information or access that the attacker should not have. That could be a door code, the name of the company's email provider, a delivery date, or one password. The gain is often small, but it is a way in: one password can lead to an email account, and an email account can lead to everything else.

Phishing is the best-known form of social engineering, but the trick works face to face or over the phone just as well.

Worked example

Your phone rings. The caller says they are from the school's IT support and that your account is about to be deleted, but they can save it if you confirm your username and password right now. There is nothing technical about the attack — no software is broken — but the story, the authority and the pressure of the deadline are designed to make you answer before you think about whether the call is real.

Phishing is a social engineering attack that uses fake messages — most often email — to persuade you to give away information or follow a link. It attacks the person rather than the technology: your device may be perfectly secure, but you can be talked into handing things over yourself. That is why people are called the weak point in a system.

How a phishing message works

A phishing message is disguised to look as though it comes from someone you trust — a parcel courier, a ticket website, your school's IT support team — copying real logos and wording.

It also pushes you to act before you have time to check:

• Urgency — your account will be closed by 5pm unless you respond.
• Fear — a warning that something has already gone wrong and only you can put it right.
• Curiosity or reward — a message saying you have won a prize and must claim it quickly.

For example, a message that looks like it comes from a games store says an order for £39.99 has just been placed on your account and will be charged within the hour unless you cancel it. You have never shopped there, so you click Cancel in a panic and land on a sign-in page. With no time to check, you type your details in — exactly the plan.

What happens when you follow the link

Following the link can lead to two outcomes, and both are a threat:

1. A fake login page that looks identical to the real one. Whatever you type into the boxes goes to the attacker, not the website, so your details are stolen.
2. A page that quietly plants malware. It may ask you for nothing at all: it simply loads harmful software onto your device while you look at it, giving the attacker a way in.

The aim is to obtain your data or access to your account by deceiving you, not by defeating the security software.

Phishing and malware are not the same thing: phishing is the con trick, malware is the harmful software the trick can leave behind. The two often arrive together.

A brute-force attack uses software to try many possible passwords until the correct one is found, so the attacker can gain unauthorised access to an account, device or network.

The software does the work, not a person. It can try a million combinations every second, working through every arrangement of letters, digits and symbols, or running through a list of common passwords such as qwerty or a favourite football club. A person typing guesses by hand could try only a few each minute; the software keeps going without tiring. The "brute force" in the name is this willingness to try every option rather than being clever about it.

Why length and variety matter

Every extra character multiplies the number of combinations the software must work through, and mixing upper case, lower case, digits and symbols widens the choices at each position. A short, simple password can fall in seconds; a long, mixed one would take so long that the attacker gives up and looks for an easier target.

So a password that is both long and varied is not uncrackable, just far too slow to be worth the attacker's time.

What the attacker is after

The aim is unauthorised access, not damage. Nothing is broken; the attacker simply becomes a logged-in user. From there they can read, change or steal whatever the account can reach, such as emails, homework files or photos, or use it as a way into other systems. Because they sign in with a real password, their activity can look like a normal user's, which is what makes the attack so useful to them.

A denial of service attack (DoS attack) floods a server or online service with so many requests that genuine users cannot use it. The attacker is not trying to steal anything: the aim is simply to make the service unavailable.

How the attack works

A server can only handle a certain number of requests at once. Each request, such as a page load, a search or a login attempt, uses a slice of the server's processing power and memory. In a DoS attack, a huge number of fake requests arrives at the same time, often sent by software rather than by a person. The server tries to answer every one, so its resources are used up on fake traffic. Real customers trying to buy a ticket or check their account get a slow page, a timeout, or nothing at all.

If the flood is big enough, the service can crash and stay offline until staff restart it or block the traffic. The attacker never needs a password or any inside knowledge: the attack works by volume alone.

Why a server is the target

The target is a server or service used by many people, such as a school's learning platform or a cinema's booking site. Taking one personal laptop offline would achieve almost nothing, because only its owner is affected. Knocking out a shared service causes real disruption, and one attack can affect thousands of people at once.

What the attacker gains

The purpose is disruption. A shop whose site goes down on a sale day loses sales while customers give up and go elsewhere, and it may have to pay staff to fix the problem. Repeated outages make customers lose trust, so the company's reputation suffers too. Because the aim is to stop the service working rather than to take data, a DoS attack has a different purpose from attacks such as data interception and theft.

Data interception and theft is the capturing of data while it travels between devices, or the stealing of a device that holds data, in order to obtain that data. The attacker is after the information itself, not the equipment.

Interception

Interception means capturing data while it is being transmitted across a network, without the sender knowing. Picture a small printing company sending its monthly payroll file from the office computer to the accountant's computer over the office network. An attacker who has plugged a laptop into a spare network socket copies the traffic as it passes, so the salary figures in the file are seen. Nothing looks wrong — the file arrives as normal — so nobody realises it was also read on the way.

Theft

Theft means stealing a device that holds data, such as a laptop, a phone or a USB flash drive, so that the files on it fall into the thief's hands. A memory stick holding a media project, taken from an open bag on a train, hands every file on it to a stranger. Interception is not the same thing: no device is taken, because the data is copied while it is being sent.

Encryption and purpose

Encryption cannot stop interception — the packets can still be copied. It stops the captured data from being understood, because without the key it is scrambled into nonsense rather than a readable password.

The purpose is to obtain the data, which can then be read, sold or used to carry out further attacks. A captured password might open other accounts, and a stolen file might be sold to someone else.

SQL injection is a form of attack where an attacker types SQL code into a web form so that a database runs it as part of its own command. The purpose is to reach data that the attacker should not be able to read, change or delete.

Many websites have a search box or an enquiry form. When you type into one, the page passes your text to a database using SQL, the language used to search and change stored data. A cinema booking site, for example, might send the film name you searched for so the database can return matching showings.

If the website does not check the text that arrives, the database cannot tell the difference between ordinary text and extra instructions. Whatever was typed becomes part of the SQL command and is run. An attacker can use this to view other customers' booking details, change every ticket price to almost nothing, or delete a table of bookings. The website hands the instructions to the database for them, so the attacker needs no account of their own.

Why it is a threat

The attack targets the database behind the website, not the website's appearance. One unchecked box can therefore expose or destroy every record the database holds, which may be far more data than the attacker could reach any other way.

You do not need to be a programmer or write a full SQL query to do this: a short piece of SQL typed into an ordinary form is enough, and the database does the rest.

A computer system can be attacked in many ways, and each attack can cause harm in more than one way. An attacker may copy data out and read it, alter records so they no longer match reality, wipe files, or lock data so that the owner cannot get to it. For example, a school's timetable system could be accessed and a room booking changed, so classes are sent to the wrong room all week. The data is still there, but it is no longer trustworthy.

Attacks also harm the services a system provides, by slowing them down or putting them out of action. If a coach company's booking system is out of action, passengers cannot reserve seats, and staff spend the day taking bookings on paper, so the company loses fares while it pays for repairs. The organisation can lose money in other ways too: stolen funds, refunds or compensation, and the cost of replacing equipment and restoring data. Customers who no longer trust the organisation may take their business elsewhere, so reputation matters. If personal data is not protected, the organisation can also face legal action.

Purpose and threat

The purpose of an attack is what the attacker is trying to achieve, such as finding out what will be on next week's science test. The threat is the harm the attack can cause to devices or systems: the test file being opened and copied, the computer holding it being unusable on the day, or the file being wiped altogether. The two are linked but not the same — two attacks might share a purpose but threaten a system in different ways.

Describing and recognising attacks

When you describe an attack, say how it is used and what it is intended to achieve. A good description does not stop at the name. If a scenario gives a method and a purpose, match it to the form of attack that matches both the method and the purpose. For example, if a scenario says a person was talked into revealing something that should have stayed private, the method is deception, and the form of attack that fits is social engineering.