ACARA Digital Technologies Years 9–10 Word Scramble: Cyber Security Threats and Vulnerabilities (Modules 782–809)
Name:
Date:
Class:
🔤
Word scramble
Unscramble the letters and write each key term on the line.
1
NIIATLTAGG NDA TAGINIB
Tricks that gain physical access: tailgating follows an authorised person through a secure door, and baiting leaves an infected USB drive for someone to plug in.
2
AADT LWOF RDGMAAI
A diagram showing how data moves between users, processes, data stores and external services, using labelled arrows to show what data flows where.
3
RIETDS SPMA OT IAC
Each STRIDE threat attacks at least one part of the CIA triad. Tampering hits integrity, denial of service hits availability, spoofing and information disclosure hit confidentiality.
4
EHTRAT NTEMEASTT
One sentence naming the actor, the vulnerability they use, the asset at risk and the impact, using because to link cause and effect.
5
TACATK RTEE
A diagram with the attacker's goal at the top, branching into the different ways to reach it. OR branches are alternatives; AND branches are steps that are all needed.
6
WREEVI ETH ERTHAT DMOLE
Check and update a threat model whenever the system, its users or the known threats change, for example after adding a new feature, a new dependency or a new control.
7
NTUIP IITLNOAADV
Checking that data a user enters is the expected type, length and format before the program uses it, so bad or harmful input is rejected.
8
QLS ENJTNIOIC
An attack where SQL commands typed into an input box run because the program joins the input straight into a query. Parameterised queries stop it by treating input only as data.
9
SSX
An attack where a page shows untrusted input, like a comment, without cleaning it, so the attacker's script runs in other users' browsers and can steal cookies. Escape output to stop it.
10
EFBRUF FOOVWLRE
When a program writes more data into a memory area (buffer) than it can hold, overwriting nearby memory. This can crash the program or let an attacker run their own code.
Answer Key
ACARA Digital Technologies Years 9–10 · Modules 782–809
1NIIATLTAGG NDA TAGINIB → tailgating and baiting — Tricks that gain physical access: tailgating follows an authorised person through a secure door, and baiting leaves an infected USB drive for someone to plug in.
2AADT LWOF RDGMAAI → data flow diagram — A diagram showing how data moves between users, processes, data stores and external services, using labelled arrows to show what data flows where.
3RIETDS SPMA OT IAC → STRIDE maps to CIA — Each STRIDE threat attacks at least one part of the CIA triad. Tampering hits integrity, denial of service hits availability, spoofing and information disclosure hit confidentiality.
4EHTRAT NTEMEASTT → threat statement — One sentence naming the actor, the vulnerability they use, the asset at risk and the impact, using because to link cause and effect.
5TACATK RTEE → attack tree — A diagram with the attacker's goal at the top, branching into the different ways to reach it. OR branches are alternatives; AND branches are steps that are all needed.
6WREEVI ETH ERTHAT DMOLE → Review the threat model — Check and update a threat model whenever the system, its users or the known threats change, for example after adding a new feature, a new dependency or a new control.
7NTUIP IITLNOAADV → input validation — Checking that data a user enters is the expected type, length and format before the program uses it, so bad or harmful input is rejected.
8QLS ENJTNIOIC → SQL injection — An attack where SQL commands typed into an input box run because the program joins the input straight into a query. Parameterised queries stop it by treating input only as data.
9SSX → XSS — An attack where a page shows untrusted input, like a comment, without cleaning it, so the attacker's script runs in other users' browsers and can steal cookies. Escape output to stop it.
10EFBRUF FOOVWLRE → buffer overflow — When a program writes more data into a memory area (buffer) than it can hold, overwriting nearby memory. This can crash the program or let an attacker run their own code.