IGCSE Computer Science 0478 — 5.3 Cyber Security Hangman

The 49 key terms

1threat

Anything that could cause harm to an asset, such as an attacker, malware, human error or a power failure. Threats can be deliberate or accidental, and internal or external.

2vulnerability

A weakness in software, hardware, a process or a person that a threat could use to harm an asset. A vulnerability is only a weakness, not an attack.

3Confidentiality

Only authorised people or systems can read data. Everyone else is kept out, like student marks seen only by the student and teacher. A breach is when someone else sees them.

4Integrity

Data stays accurate and unaltered unless an authorised person changes it. Accidental or deliberate changes break it, such as a tampered bank balance.

5Availability

Authorised users can reach data and systems when they need them, such as a school network that stays up. Attacks and hardware failure can reduce it.

6Malware

Malicious software designed to damage, disrupt, or gain unauthorised access to a computer system

7Virus

Malware that attaches to a host file and spreads by replicating itself when a user runs the infected file

8Worm

Malware that spreads by replicating itself across a network without needing a host file or user action

9Trojan horse

Malware disguised as useful or harmless software. The user installs it willingly, then it secretly does harm, such as opening a back door or stealing data. It does not replicate itself.

10Spyware

Malware that secretly monitors a user's activity and collects information without their knowledge or consent

11adware

Software that shows unwanted adverts, such as pop-ups, often installed with free programs, to earn money for its creator. It can slow a device, redirect searches and track users.

12Ransomware

Malware that encrypts or locks a victim's files and demands payment to restore access

13brute-force attack

An attack that tries many passwords automatically until one works. A dictionary attack tries common words and leaked passwords first. Long passwords and lockouts slow it down.

14interception

When someone copies data as it travels across a network through routers and other devices, so unprotected data can be read by anyone who intercepts it, for example on public Wi-Fi.

15Denial of service attack

An attack that floods a target with traffic, overwhelming its resources and blocking legitimate users

16DDoS attack

A botnet of infected computers floods one server with requests at the same time, so it cannot respond to real users and the website goes offline.

17Unauthorised access

Gaining entry to a network or system without permission, often to steal or damage data

18Ethical hacking

Authorised testing of a system to find security vulnerabilities before malicious attackers can exploit them.

19DNS server

A domain name server translates a domain name typed in a browser, such as example.com, into the IP address of the web server that holds the website.

20pharming

An attack that redirects a user to a fake website, even when they type the right address, using malicious code or DNS poisoning, so the site can steal their login and payment details.

21phishing

Sending many fake emails that look genuine to trick users into clicking a link or replying with personal details, so criminals can steal passwords and bank details.

22social engineering

Tricking people, instead of hacking systems, into giving away access or information, often by pretending to be someone trusted or creating urgency. Phishing is one type.

23smishing and vishing

Smishing is phishing by text message and vishing is phishing by phone call. Examples are a fake delivery text or a fake bank call that tries to trick you into sharing private details.

24process and aim

Match a threat by finding its process (how it works) and its aim (why the attacker does it), e.g. phishing: fake emails trick users to steal login details.

25username and password

A username identifies who you are and can be shared. A password proves it is really you, so keep it secret and never share it. You use both together when logging in.

26strong password

A password that is long and hard for others to guess. It avoids names, birthdays and common words like password123, and it mixes letters, numbers and symbols.

27Authentication vs authorisation

Authentication checks who you are, like logging in. Authorisation decides what you can do once you are known, like which files you can open. Authentication always comes first.

28biometric authentication

Proves who you are using a physical or behavioural trait, such as a fingerprint, face or voice, that is matched against stored data. It can wrongly accept or reject users.

29Multi-factor authentication

A login method that requires two or more independent proofs of identity, such as a password plus a one-time code.

30second factor

An extra proof of identity, like a code from your phone, needed after the password. A thief with only your stolen password can't log in without it.

31access levels

Settings that give each user different rights to data: no access, read only, read/write or full control. Users only see and change what their role needs, protecting confidentiality and integrity.

32permission

A rule that lets an account read, write or execute a file or resource. Read only views it, write can change or delete it, and execute runs it as a program.

33Antivirus software

A program that detects, blocks and removes malicious programs from a device.

34anti-spyware

Software that scans for and removes spyware, and blocks programs that secretly monitor the user, such as key loggers. It can scan on demand or protect in real time.

35Malware definition update

Refreshing the database used by security software so it can recognise and detect newly discovered threats.

36software update

A new version of a program that fixes security weaknesses so attackers cannot use them to reach your data. It covers operating system updates, app updates and automatic updates.

37phishing red flags

Warning signs that a message is a scam: an odd sender address, urgent or threatening tone, a generic greeting like 'Dear user', spelling errors, or requests for your details.

38Misleading link

A link whose shown text hides a different real web address. Hover to check the address before you click or log in, watch for look-alike names, or type the address yourself.

39Firewall

A device or program that monitors and controls incoming and outgoing network traffic according to defined security rules.

40privacy setting

A switch in an app or account that controls who can see your information, like making it private or friends only.

41proxy server

A server between a user's device and the internet. It receives the user's web requests, passes them to the web server for the user, then returns the response. Used in schools and companies.

43Encryption

Turning a readable message into a scrambled, unreadable message using a key, so it can only be read again with decryption.

44data in transit

Data moving across a network, such as email or web traffic. It is protected by encrypting it (e.g. HTTPS or a VPN) so intercepted data cannot be read.

45SSL

Secure Socket Layer: a security protocol that encrypts data between a browser and web server, so intercepted data cannot be read. Used for logins and payments. TLS is its successor.

46SSL handshake

Browser asks the server for its digital certificate, checks it is genuine, then both agree an encryption key to begin a secure session.

47HTTPS

A secure way for your browser to talk to a website. It encrypts the data you send and receive, and shows https:// and a padlock in the address bar. A padlock does not prove a site is trustworthy.

48security control

A measure that reduces risk by preventing an attack, detecting it or helping recovery. Controls can be technical, physical or procedural, and layering several works best.

49countermeasure

A solution chosen to stop a specific threat, such as a firewall for hacking, SSL for interception or anti-malware for malware, plus an explanation of how it works.

50threat + process + aim + solution

A full-mark answer names the threat, says how it works and what it aims to do, then names a solution and explains how it stops the threat, using 'because' to link each point.