ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities Hangman

The 148 key terms

1cyber security

The protection of digital systems, accounts and data from attack, damage and unauthorised access, such as keeping accounts, files and devices safe.

2attacker motive

The reason an attacker targets accounts and data: they can be used or sold for money, identity theft or disruption, such as stealing cash, taking over social accounts or selling data.

3Confidentiality

Only authorised people or systems can read data. Everyone else is kept out, like student marks seen only by the student and teacher. A breach is when someone else sees them.

4Integrity

Data stays accurate and unaltered unless an authorised person changes it. Accidental or deliberate changes break it, such as a tampered bank balance.

5Availability

Authorised users can reach data and systems when they need them, such as a school network that stays up. Attacks and hardware failure can reduce it.

6asset

Anything of value in a digital system that needs protecting, such as data, accounts, devices or services. Examples: a student database (data) or a school laptop (hardware).

7threat

Anything that could cause harm to an asset, such as an attacker, malware, human error or a power failure. Threats can be deliberate or accidental, and internal or external.

8vulnerability

A weakness in software, hardware, a process or a person that a threat could use to harm an asset. A vulnerability is only a weakness, not an attack.

9exploit

A method or piece of code that takes advantage of a vulnerability (a weakness) to attack a system. The weakness is the open door; the exploit is the tool that gets through it.

10threat actor

A person or group that carries out an attack on a system, described by their motive (why) and skill (how able). Examples: cybercriminals, hacktivists, insiders and nation-state groups.

11attack surface

All the points where an attacker could try to get into a system or take data out, such as open ports, running services and user accounts. A smaller attack surface means fewer ways in.

12accidental threat

Harm to data caused by a mistake with no intent to cause damage, such as emailing the wrong person, deleting files by accident, misconfiguring sharing or losing a device.

13deliberate threat

An intentional action by an attacker or malicious insider to steal, damage, alter or block access to data, usually for profit or revenge.

14events-based threat

An event outside anyone's control, such as fire, flood, storm or power failure, that damages data or systems or blocks access to them.

15insider threat

Harm to data or systems caused by someone with legitimate access, either on purpose (malicious insider) or by mistake, like emailing the wrong person or setting a file to public.

16cyber security incident

An event that actually or potentially compromises the confidentiality, integrity or availability of an organisation's systems or data, such as a breach or malware infection.

17data breach

When attackers get into an organisation's stored data, such as usernames and passwords. Find out through alerts, then change your password and turn on MFA.

18individual impact

The harm a cyber attack causes a person, such as stolen money, identity theft, a locked-out account, lost private photos or messages, reputation damage and emotional distress.

19organisational impact

The harm a cyber attack does to a business or group, such as downtime, recovery costs, lost customer trust, a damaged reputation and fines for breaking privacy laws.

20Malware

Malicious software designed to damage, disrupt, or gain unauthorised access to a computer system

21Virus

Malware that attaches to a host file and spreads by replicating itself when a user runs the infected file

22Worm

Malware that spreads by replicating itself across a network without needing a host file or user action

23Trojan horse

Malware disguised as useful or harmless software. The user installs it willingly, then it secretly does harm, such as opening a back door or stealing data. It does not replicate itself.

24Spyware

Malware that secretly monitors a user's activity and collects information without their knowledge or consent

25adware

Software that shows unwanted adverts, such as pop-ups, often installed with free programs, to earn money for its creator. It can slow a device, redirect searches and track users.

26Ransomware

Malware that encrypts or locks a victim's files and demands payment to restore access

27social engineering

Tricking people, instead of hacking systems, into giving away access or information, often by pretending to be someone trusted or creating urgency. Phishing is one type.

28phishing

Sending many fake emails that look genuine to trick users into clicking a link or replying with personal details, so criminals can steal passwords and bank details.

29spear phishing

A phishing message aimed at one person or group that uses details like your name or school, or pretends to be a friend or teacher, to look more believable than mass phishing.

30smishing and vishing

Smishing is phishing by text message and vishing is phishing by phone call. Examples are a fake delivery text or a fake bank call that tries to trick you into sharing private details.

31pretexting

Inventing a believable story or fake identity, like IT support or a delivery driver, to build trust and talk someone into handing over information or access.

32tailgating and baiting

Tricks that gain physical access: tailgating follows an authorised person through a secure door, and baiting leaves an infected USB drive for someone to plug in.

33pharming

An attack that redirects a user to a fake website, even when they type the right address, using malicious code or DNS poisoning, so the site can steal their login and payment details.

34brute-force attack

An attack that tries many passwords automatically until one works. A dictionary attack tries common words and leaked passwords first. Long passwords and lockouts slow it down.

35Weak password

A password that is short, common, or predictable, making it easy for attackers to guess or crack.

36interception

When someone copies data as it travels across a network through routers and other devices, so unprotected data can be read by anyone who intercepts it, for example on public Wi-Fi.

37man-in-the-middle attack

An attack where someone secretly sits between two parties and can read or change the data passing between them, such as logins, session tokens or code sent over an unsecured network.

38Unsecured Wi-Fi

A network with no encryption, letting attackers intercept the data sent across it.

39Unauthorised access

Gaining entry to a network or system without permission, often to steal or damage data

40Denial of service attack

An attack that floods a target with traffic, overwhelming its resources and blocking legitimate users

41DDoS attack

A botnet of infected computers floods one server with requests at the same time, so it cannot respond to real users and the website goes offline.

42process and aim

Match a threat by finding its process (how it works) and its aim (why the attacker does it), e.g. phishing: fake emails trick users to steal login details.

43AI-powered attack

An attack where criminals use AI to work faster and fool people more easily, such as realistic phishing emails, deepfake voices and automated scanning for weaknesses.

44threat modelling

A structured way to work out what could go wrong with a system, before and during development, so risks are found, fixed and confirmed early and then reviewed again.

45data flow diagram

A diagram showing how data moves between users, processes, data stores and external services, using labelled arrows to show what data flows where.

46trust boundary

A line on a diagram where data passes between parts of a system with different levels of trust, such as from a user's device to a server. Threats often cluster here.

47STRIDE

A memory aid for six threat types: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. Use it to ask what could go wrong in a system.

48STRIDE maps to CIA

Each STRIDE threat attacks at least one part of the CIA triad. Tampering hits integrity, denial of service hits availability, spoofing and information disclosure hit confidentiality.

49risk = likelihood x impact

Risk is how likely a threat is to succeed combined with how much harm it would cause. Rate each as low, medium or high to decide which risks matter most.

50risk matrix

A grid that plots how likely a threat is against how bad its impact would be, giving each risk a priority rating (such as low, medium or high) so you know which to fix first.

51threat statement

One sentence naming the actor, the vulnerability they use, the asset at risk and the impact, using because to link cause and effect.

52threat model table

A table with one row per threat. Columns record the asset, threat, vulnerability, risk rating and chosen control, e.g. a school app storing student data.

53attack tree

A diagram with the attacker's goal at the top, branching into the different ways to reach it. OR branches are alternatives; AND branches are steps that are all needed.

54Review the threat model

Check and update a threat model whenever the system, its users or the known threats change, for example after adding a new feature, a new dependency or a new control.

55software vulnerability

A flaw or bug in a program's code or settings, such as a coding mistake or an insecure default, that an attacker could use to get access or cause damage.

56input validation

Checking that data a user enters is the expected type, length and format before the program uses it, so bad or harmful input is rejected.

57SQL injection

An attack where SQL commands typed into an input box run because the program joins the input straight into a query. Parameterised queries stop it by treating input only as data.

58XSS

An attack where a page shows untrusted input, like a comment, without cleaning it, so the attacker's script runs in other users' browsers and can steal cookies. Escape output to stop it.

59buffer overflow

When a program writes more data into a memory area (buffer) than it can hold, overwriting nearby memory. This can crash the program or let an attacker run their own code.

60zero-day

A zero-day is a software flaw that attackers know about before the maker has released a fix, so there is no patch yet. Defenders use workarounds and monitoring until one arrives.

61outdated software

Software that is missing the latest security patches, so its known flaws stay open for attackers to exploit.

62default credentials

The factory username and password a device or app ships with. If they are never changed, anyone who knows or guesses them can log in and take control.

63Improper credential management

Storing, sharing or reusing passwords, keys or tokens insecurely (in plain text, on shared accounts, or on many sites) so attackers can steal them and gain unauthorised access.

64hard-coded secret

A key, password or token written directly into source code. Anyone who can read the code or its repository can steal it, and deleting the file later does not remove it from the history.

65CVE

A public vulnerability report with a unique ID that names the affected software and versions, explains how the flaw is exploited, gives a severity score and links to a fix.

66patch management

The regular, planned process of finding, testing and installing updates that fix known vulnerabilities in software, including libraries and frameworks.

67password re-use

Using one password on many accounts. If a data breach leaks it, attackers try it on other sites and can unlock every account that shares it.

68phishing red flags

Warning signs that a message is a scam: an odd sender address, urgent or threatening tone, a generic greeting like 'Dear user', spelling errors, or requests for your details.

69Misleading link

A link whose shown text hides a different real web address. Hover to check the address before you click or log in, watch for look-alike names, or type the address yourself.

70oversharing

Posting personal details online, like pet or school names, which attackers use to guess passwords and write convincing targeted messages.

71Ask, Check, Think

Before you act online: Ask a trusted adult, Check that the sender or site is real, and Think about what could happen if you click or share.

72Multi-factor authentication

A login method that requires two or more independent proofs of identity, such as a password plus a one-time code.

73MFA fatigue

A trick where a scammer spams you with login prompts hoping you approve one, or talks you into sharing your code. Never share codes, never approve prompts you didn't start, and report them.

74software supply chain

Everything used to make and deliver software: code libraries, tools, build systems, suppliers and updates. Most of an app is other people's code, so every link must be trusted.

75third-party dependency

A library written by someone else that your program imports and relies on. A flaw in it affects every app that uses it, and it may pull in its own dependencies too.

76compromised software update

A software update from a trusted supplier that criminals have secretly infected with malicious code, so users install it believing it is safe.

77typosquatting

Publishing a malicious package or site with a name almost the same as a trusted one, like reqeusts for requests, hoping people use it by mistake.

78supply chain attack

An attack where hackers breach one trusted supplier and use its software update to reach many victims. A case study traces the supplier, how the update spread and who was hit.

79code signing

Adding a digital signature to software so a computer can check it came from the named publisher and has not been changed since it was signed.

80SBOM

A software bill of materials: a list of every component and library inside software, with version numbers, so each can be checked for known vulnerabilities.

81reduce supply chain risk

Lower the chance of a bad dependency: use fewer trusted ones, pin exact versions, verify their integrity with hashes, and scan them for known vulnerabilities.

82security control

A measure that reduces risk by preventing an attack, detecting it or helping recovery. Controls can be technical, physical or procedural, and layering several works best.

83principle of least privilege

Give every user, program and device only the minimum access it needs to do its job. This limits the damage if an account is stolen, and unneeded access should be removed.

84Firewall

A device or program that monitors and controls incoming and outgoing network traffic according to defined security rules.

85Antivirus software

A program that detects, blocks and removes malicious programs from a device.

86software update

A new version of a program that fixes security weaknesses so attackers cannot use them to reach your data. It covers operating system updates, app updates and automatic updates.

87Essential Eight

Eight baseline security strategies from the Australian government, like patching, MFA, backups and application control, that cut the risk of cyber incidents.

88countermeasure

A solution chosen to stop a specific threat, such as a firewall for hacking, SSL for interception or anti-malware for malware, plus an explanation of how it works.

89layered security

Using several protections together, such as a strong passphrase, MFA, updates and encryption, so if one fails the others still keep your account and data safe.

90access log

An automatic record of who accessed a system or file, what they did and when. It helps spot failed logins and misuse, and holds users accountable for their actions.

91log analysis

Reading a log in time order for patterns, like many failed logins then one success, odd times or unfamiliar places, to spot an attack.

92incident response

Set stages for handling a security incident: detect it, contain it, remove the cause, recover systems, then review what happened to improve future security.

93Respond to a compromise

If an account or device may be hacked, act fast: tell a trusted adult, change the password, turn on MFA and check for odd activity. Also report phishing, change shared passwords and scan for malware.

94Australian Privacy Principle 11

Requires organisations to protect personal information from misuse, loss, and unauthorised access, and to destroy it when no longer needed.

95apply protections

Read a scenario, name the threat, explain how it works, then suggest measures like MFA or encryption and say why they reduce the harm.

96awareness message

A poster, infographic or short video that tells an audience how to spot one cyber threat and what to do about it. It uses one clear message and is fact-checked before it is shared.

97encrypt

To scramble data so nobody can read it without the key. This keeps private things like messages, passwords and bank details safe if someone steals or intercepts them.

98Encryption

Turning a readable message into a scrambled, unreadable message using a key, so it can only be read again with decryption.

99plaintext

The original, readable data (text, file, image or message) before it is encrypted. Decrypting ciphertext with the correct key turns it back into plaintext.

100ciphertext

The scrambled, unreadable data made when plaintext is encrypted. It is what gets sent across a network and looks meaningless without the key.

101encryption key

A secret value used by the encryption algorithm to scramble data into ciphertext and unscramble it again. A different key gives different ciphertext, and a longer key is harder to guess.

102Caesar shift encryption

Move each plaintext letter forward along the alphabet by the key number. With a key of 3, A becomes D. Write the new letter and keep spaces unchanged.

103wrap around

When a shift goes past Z, the count carries on from A, so X shifted by 3 becomes A. The alphabet works like a circle of 26 letters, numbered 0 to 25.

104shift back by key

To decrypt a Caesar ciphertext, move each letter back along the alphabet by the key number to get the plaintext. A wraps back to Z. Then check the result is a real message.

105cipher wheel

A tool with two alphabet rings. Turn the inner ring to the key shift so each plaintext letter lines up with its ciphertext letter on the outer ring. ROT13 is a shift of 13.

106(position + shift) MOD 26

Caesar wrap-around rule: with A=0 to Z=25, add the shift then take MOD 26 so letters past Z loop back to A. Example: X (23) + 5 = 28, MOD 26 = 2, which is C.

107key space

The total number of different keys a cipher allows. A Caesar cipher has only 25 useful keys, so an attacker can try them all. More keys means a bigger key space and a stronger cipher.

109monoalphabetic substitution cipher

A cipher that swaps each letter for a different letter from one scrambled alphabet. That scrambled alphabet is the key, and it never changes during the message.

110frequency analysis

Counting how often each letter appears in ciphertext and matching the most common ones to common English letters like E, to work out a substitution cipher's key.

111=COUNTIF(range,A2)

Used in a frequency table: list each category in column A, then put this beside it to count how many times that category appears in the data range. Copy it down for every category.

112transposition cipher

A cipher that keeps the same letters but changes their order, like writing a message in a zigzag across rails and then reading each rail in turn.

113Polyalphabetic cipher

A cipher that uses a repeating list of shift numbers, so different letters in a message are shifted by different amounts.

114Vigenere cipher

A cipher that uses a keyword, where each keyword letter sets a different shift for the matching letter of the message.

115weak cipher

A cipher with few keys and letter patterns that show through, so a computer can break it fast. Modern encryption uses huge keys and complex steps. A Caesar cipher has only 25 keys.

116=CODE("A")

Gives the number code of a letter, so =CODE("A") returns 65. Its partner =CHAR(65) turns a code back into a letter. Capital letters start at 65 (A) and run to 90 (Z).

117=MOD(number, divisor)

Returns the remainder after division, so numbers wrap around. =MOD(27,26) gives 1, which is how a Caesar shift loops from Z back to A.

118=CHAR(MOD(CODE(A2)-65+$B$1,26)+65)

Shifts the capital letter in A2 forward by the key in locked cell $B$1, wrapping Z back to A, and returns the encrypted letter. Copy it across so each cell encrypts one letter.

119=CHAR(MOD(CODE(B2)-65-3,26)+65)

Shifts a letter back by the key (3) to decrypt it. Subtracting the key undoes adding it, and MOD 26 wraps A-Z around so the result stays a letter.

121ord() and chr()

ord("A") returns the number code of a character (65). chr(65) turns a number code back into its character ("A"). Ciphers use them to change letters to numbers and back.

123ch.isalpha()

Returns True if the character ch is a letter, so a Caesar loop can shift letters and leave spaces and punctuation unchanged. ch.isupper() checks for capitals.

124chr((ord(ch) - 65 + shift) % 26 + 65)

Shifts an upper-case letter ch along the alphabet by shift, wrapping past Z back to A. A for loop applies it to each letter and builds the ciphertext with +=, skipping spaces.

125caesar(cipher, -shift)

Decrypts by calling the same Caesar function with the negative of the original shift. Shifting back by the same amount undoes the encryption, and % keeps the letters wrapping.

126for shift in range(1, 26):

A loop that tries every Caesar shift from 1 to 25. Each pass decrypts the message and prints the shift beside the result, so you can spot the readable one.

127key[i % len(key)]

Picks the keyword letter for position i and wraps back to the start with %, so each message letter gets its own shift. This is how a Vigenere cipher loop cycles the keyword.

128XOR cipher

Encrypts by XOR-ing (^ in Python) each character code with a key number. XOR-ing the result with the same key again restores the original, so one key encrypts and decrypts.

129Base64

Rewrites data using 64 printable characters so it can be sent as text. It has no secret key, so anyone can reverse it. It is encoding, not encryption, and protects nothing.

130keep the key secret

Encryption is only as strong as its key. Never send the key with the message, share it in person or by another channel, and change it if it may have leaked.

131unreadable without the key

Encryption cannot stop data being intercepted, but the interceptor sees only ciphertext and cannot get the plaintext without the key, so passwords and bank details stay safe.

132Symmetric encryption

Using the exact same secret key to both lock and unlock a message.

133key interception

If an attacker intercepts a symmetric key while it is being shared, they can decrypt every message that uses that key, so the encryption is defeated.

134AES

A widely used method of symmetric encryption that uses one shared key, which can be 128, 192, or 256 bits long, to lock and unlock data.

135one-way function

A calculation that is easy to do forwards but practically impossible to reverse, like mixing paint. It is the idea behind hashing and public-key encryption.

136Asymmetric encryption

Encryption that uses a linked pair of keys: a public key to encrypt data and a private key to decrypt it, with no shared secret key needed.

137public key

The half of a key pair that the owner shares openly. Anyone can use it to encrypt data sent to the owner, but it cannot decrypt that data. Only the matching private key can.

138private key

The secret half of a key pair. Only the owner keeps it, never sends it, and uses it to decrypt data that was encrypted with their public key.

139Encrypt with public key, decrypt with private key

The receiver shares their public key, the sender encrypts with it, and only the receiver's private key can decrypt it. No secret key is shared, so an interceptor sees only ciphertext.

140ECDH

A method where two people each combine their own secret with the other's shared piece, ending up with the same matching result without sending the secret.

141RSA

A way of locking and unlocking messages using two matching keys: a public key anyone can have, and a private key kept secret by its owner.

142symmetric vs asymmetric

Symmetric: one shared secret key, fast but hard to share safely. Asymmetric: public and private key pair, no secret to share but slower. Often combined.

143HTTPS

A secure way for your browser to talk to a website. It encrypts the data you send and receive, and shows https:// and a padlock in the address bar. A padlock does not prove a site is trustworthy.

144SSL handshake

Browser asks the server for its digital certificate, checks it is genuine, then both agree an encryption key to begin a secure session.

145Encryption at rest and in transit

Encrypting data both while stored (databases, backups) and while moving over a network (TLS), so intercepted or stolen data stays unreadable without the key.

146hash function

A one-way function that turns any input into a fixed-length value. The same input always gives the same hash, a tiny change gives a very different one, and it cannot be reversed.

147hashlib.sha256(text.encode()).hexdigest()

Python code that turns text into bytes, hashes it with SHA-256 and returns a fixed-length hex string. Same input gives the same hash; one changed letter gives a new hash.

148hash comparison

Hash the file before and after transfer. If both hashes (checksums) match, the data is unchanged. A different hash shows the file was altered or tampered with, so its integrity is lost.

149hash

A one-way scrambled value made from a password. A system stores it instead of the real password and checks a login by hashing what you type and comparing. It can't be reversed.

150salt

A random value added to a password before hashing, so identical passwords give different hashes. Each user gets their own salt, which defeats precomputed hash tables.

151Match technique to job

Choose symmetric encryption for stored data, asymmetric keys to swap keys and sign, and hashing to check integrity and store passwords. Justify the choice.