Cybersecurity threats are deliberate attacks on computer systems, networks, or data. At GCSE you must know the main categories — malware, network attacks, social engineering, and injection attacks — and for each one you should be able to explain how it works and describe at least one countermeasure.
What are the main categories of cybersecurity threat?
GCSE Computer Science groups threats into four broad categories:
| Category | Threats included | Primary target |
|---|---|---|
| Malware | Virus, worm, trojan, ransomware, spyware | Files, systems, users |
| Network attacks | Denial of service (DoS/DDoS), packet sniffing, man-in-the-middle | Availability, data in transit |
| Social engineering | Phishing, vishing, pretexting, baiting | Human users |
| Injection attacks | SQL injection, cross-site scripting (XSS) | Databases, web applications |
Understanding each category at a mechanistic level — not just the name — is what earns full marks in GCSE written questions.
How does malware work and what stops it?
Malware is any software designed to cause harm. The main types you must know:
- Virus — attaches itself to a legitimate file; spreads when the infected file is shared or run. Requires a host file and user action to propagate.
- Worm — self-replicating; spreads across networks without needing to attach to a file or require user action. Often exploits network vulnerabilities.
- Trojan — disguises itself as legitimate software to trick users into installing it; then creates a backdoor or steals data.
- Ransomware — encrypts the victim's files and demands a ransom for the decryption key.
- Spyware — monitors user activity (keystrokes, browsing, passwords) and transmits data to an attacker covertly.
Countermeasures: anti-malware software (detects and quarantines known threats), firewalls (block unauthorised traffic), regular software updates (patch the vulnerabilities malware exploits), user education (avoid opening unknown attachments).
How does a denial of service (DoS) attack work?
A denial of service attack overwhelms a server with so many requests that it cannot respond to legitimate users, effectively taking the service offline. A distributed DoS (DDoS) uses thousands of compromised computers (a botnet) to amplify the volume of requests.
The attack exploits the fact that every server has a finite capacity. A web server handling 1,000 requests/second may be unable to handle 10 million — even though each individual request looks legitimate.
Countermeasures: rate limiting (cap requests per IP address), traffic filtering, content delivery networks (CDN) that absorb traffic, and DoS mitigation services such as Cloudflare.
How does social engineering exploit humans rather than systems?
Social engineering attacks do not break through technical defences — they manipulate the person to bypass them voluntarily. The primary form at GCSE is phishing:
- Phishing — fraudulent emails or websites that impersonate a trusted organisation (a bank, HMRC, a delivery company) to steal credentials or install malware.
- Spear phishing — targeted phishing using personal details about the victim to make the message more convincing.
- Vishing (voice phishing) — phone calls impersonating bank staff or tech support to extract information.
Technical systems are often impenetrable; people are frequently not. Social engineering exploits trust, urgency, and authority — the email says "your account will be closed in 24 hours unless you verify your details NOW".
Countermeasures: user education, multi-factor authentication (so a stolen password alone is insufficient), email spam filters, and verification procedures (call back using a published number, not one from the suspicious email).
What is SQL injection and why is it so dangerous?
SQL injection occurs when an attacker enters malicious SQL code into a form field (such as a login box). If the application builds its database query by concatenating user input without sanitising it, the injected code executes as part of the query.
Classic example — a login query built as:
SELECT * FROM users WHERE username='INPUT' AND password='INPUT'
If the attacker enters ' OR '1'='1 as the username, the query becomes:
SELECT * FROM users WHERE username='' OR '1'='1' AND password=''
The condition '1'='1' is always true, so the query returns all users — the attacker gains access without a valid password.
Countermeasures: parameterised queries (prepared statements) — the database treats user input as data, never as SQL code; input validation and sanitisation; principle of least privilege (database accounts have only the permissions they actually need).
What is a brute force attack and what slows it down?
A brute force attack systematically tries every possible password or key until the correct one is found. With a four-digit PIN (0000–9999), a computer can try all 10,000 combinations in milliseconds. Against long, complex passwords this becomes computationally infeasible.
Countermeasures: account lockout policies (lock account after N failed attempts), CAPTCHA challenges, long passwords or passphrases, hashing passwords with a salt (so even a stolen database cannot be efficiently brute-forced), and multi-factor authentication.
What are the most effective general countermeasures?
Some defences apply across multiple threat categories:
| Defence | Threats it addresses |
|---|---|
| Strong passwords + MFA | Brute force, phishing, credential theft |
| Regular patching | Malware exploiting known vulnerabilities |
| Firewalls | Unauthorised network access, some DoS |
| Encryption (HTTPS/TLS) | Man-in-the-middle, packet sniffing |
| User education | Phishing, social engineering, inadvertent malware installation |
| Backups | Ransomware, data loss from any attack |
| Principle of least privilege | SQL injection, insider threats |
Frequently asked questions
Why do GCSE exam questions ask for both the threat and a countermeasure?
Because cybersecurity is about mitigation, not just identification. Knowing that phishing exists is useless without knowing what to do about it. The typical exam question structure is: "Describe one threat to a system and explain one way to protect against it." Students who only name the threat without explaining the countermeasure typically lose half the available marks.
Is ransomware a type of virus?
Ransomware is a type of malware, but not always a virus in the technical sense. A virus must attach to an existing file; ransomware may spread as a standalone program (making it more like a worm) or arrive as a trojan. At GCSE, it is accurate to call ransomware a type of malware. Avoid calling it a virus unless the exam question specifically provides that category.
What is the difference between DoS and DDoS?
A DoS (denial of service) attack comes from a single source — one computer sending overwhelming traffic. A DDoS (distributed denial of service) comes from many sources simultaneously, typically a botnet of thousands of compromised machines controlled by the attacker. DDoS attacks are far harder to block because the traffic appears to come from many different IP addresses, making simple IP-blocking ineffective.
Do these threats only affect large organisations?
No — individuals and small businesses are frequent targets, particularly for phishing, ransomware, and social engineering. Attackers often prefer small targets because their defences are weaker. Every internet-connected device is a potential target. Good cyber hygiene — strong unique passwords, MFA, software updates, and healthy scepticism about unsolicited messages — is essential for everyone.
Get to grips with every GCSE cybersecurity topic through Socratic dialogue and targeted revision with Professor Turing at aitutors.me.