Threat Spotter

Not all attacks want the same thing

It is tempting to learn six threats as six definitions. The useful question is what each one is actually after, because they are not interchangeable. Some are after **access**: a way in. Some are after **the data itself**, to read or change it. And some are after **availability**: making a service unusable without taking anything at all. That last group catches people out. A denial-of-service attack steals nothing, and calling it theft in an exam shows you have not understood what it does.

What this paper names

Six threats, described the way OCR asks for them.

Match each threat to what it is after

Name the threat

Staff receive an email that looks like it is from their own IT department, asking them to confirm their login details on a linked page. Which threat is this?

• Social engineering, because it works on the person rather than on the system
• Malware, because it arrived by email
• A brute-force attack, because it targets passwords
• Denial of service, because it disrupts the staff

Answer at the right level of detail

Most revision material online covers a much finer breakdown of threats than this specification uses: blagging, shouldering, pharming, viruses, trojans, spyware, worms. **That is a different board's taxonomy.** OCR groups them under umbrella terms. What this paper asks you to identify is **malware** or **social engineering**, not which sub-species of malware you are looking at. So an answer naming the category correctly is complete. Time spent memorising the finer list is time not spent on the six threats that ARE named, and one of those, SQL injection, is examined here and by neither of the other boards mapped so far.

How precisely should you name it?

A scenario describes software that installed itself and is now recording what a user types. How should you name the threat for this paper?

• As malware, and then say what it is doing in the scenario
• Using the precise sub-type from the finer threat taxonomy
• As social engineering, since a user was involved
• As "a virus", since that covers everything

Attacking the machine, attacking the person

Every threat on your list gets in one of two ways, and that division is worth having in your head before you meet a scenario.

True about social engineering

Select the TWO statements that describe social engineering accurately.

• It targets people rather than systems, so an organisation with excellent software can still fall to it
• It usually works by imitating something the victim already trusts, such as their own IT department or bank
• It requires specialist software to carry out
• Its aim is to make a server unavailable

The one only OCR names

A website asks for your username and passes what you type into a **database query**. The intention is that your input is treated as DATA: a value to look up. **SQL injection** is what happens when the system does not keep that separation, and part of the input is treated as **part of the query itself**. The attacker is not breaking in through a locked door; they are writing on a form that the system reads as instructions. The consequence is that data can be read, changed or deleted by somebody who should only have been able to look themselves up. Worth knowing precisely, because OCR is the only one of the three boards mapped so far that names it. How to prevent it belongs to the next topic.

Threats in a paragraph

Software written to damage a system or gain unauthorised access is grouped under the umbrella term _____. Persuading a person to hand over access instead is _____, of which phishing is the standard example. An attack that floods a server so genuine users cannot get through is a _____ attack, and importantly it takes _____. Input treated as part of a database query rather than as data is _____ injection.

Say what it does not do

Build a definition of a denial-of-service attack that would earn full marks.

A bad week for one company

Three separate things go wrong at an online retailer. Name each one at the level this paper asks for.

• On Monday the website becomes unreachable for four hours. Logs show an enormous volume of requests arriving at once from many machines. Nothing is missing afterwards.
• On Wednesday a member of the finance team is telephoned by someone claiming to be from the bank, and gives out account details.
• On Friday customer records are altered, and the change is traced to what somebody typed into a search box on the website.

Your turn: brief the staff

A small company has asked you to explain the main threats to its systems, in plain language, for a staff briefing.

• Explain the difference between a threat that attacks the technology and one that attacks the people
• Describe two named threats and say what each one is trying to obtain
• Explain why a denial-of-service attack is damaging even though nothing is taken
• Explain what SQL injection is, without describing how to carry one out