Years 9–10 Digital Systems Definitions Worksheet: Controlling and securing access to data and Threats and software vulnerabilities (Modules 25–40)
Name:
Date:
Class:
✎
Key terms
Write what each term means, in your own words.
1
salt
2
brute-force attack
3
asset
4
threat
5
threat actor
6
vulnerability
7
exploit
8
attack surface
9
software vulnerability
10
input validation
Answer Key
Years 9–10 Digital Systems · Modules 25–40 · Student wording will vary for definitions
1salt — A random value added to a password before hashing, so identical passwords give different hashes. Each user gets their own salt, which defeats precomputed hash tables.
2brute-force attack — An attack that tries many passwords automatically until one works. A dictionary attack tries common words and leaked passwords first. Long passwords and lockouts slow it down.
3asset — Anything of value in a digital system that needs protecting, such as data, accounts, devices or services. Examples: a student database (data) or a school laptop (hardware).
4threat — Anything that could cause harm to an asset, such as an attacker, malware, human error or a power failure. Threats can be deliberate or accidental, and internal or external.
5threat actor — A person or group that carries out an attack on a system, described by their motive (why) and skill (how able). Examples: cybercriminals, hacktivists, insiders and nation-state groups.
6vulnerability — A weakness in software, hardware, a process or a person that a threat could use to harm an asset. A vulnerability is only a weakness, not an attack.
7exploit — A method or piece of code that takes advantage of a vulnerability (a weakness) to attack a system. The weakness is the open door; the exploit is the tool that gets through it.
8attack surface — All the points where an attacker could try to get into a system or take data out, such as open ports, running services and user accounts. A smaller attack surface means fewer ways in.
9software vulnerability — A flaw or bug in a program's code or settings, such as a coding mistake or an insecure default, that an attacker could use to get access or cause damage.
10input validation — Checking that data a user enters is the expected type, length and format before the program uses it, so bad or harmful input is rejected.