WA Computer Science ATAR Year 11 — Cyber Security Hangman

The 181 key terms

1cyber security

The protection of digital systems, accounts and data from attack, damage and unauthorised access, such as keeping accounts, files and devices safe.

2asset

Anything of value in a digital system that needs protecting, such as data, accounts, devices or services. Examples: a student database (data) or a school laptop (hardware).

3Confidentiality

Only authorised people or systems can read data. Everyone else is kept out, like student marks seen only by the student and teacher. A breach is when someone else sees them.

4integrity

Data stays accurate, complete and unaltered unless an authorised person changes it. Tampering breaks integrity by altering data without permission.

5Availability

Authorised users can reach data and systems when they need them. Attacks like DDoS and hardware failure reduce it.

6threat

Anything that could cause harm to an asset, such as an attacker, malware, human error or a power failure. Threats can be deliberate or accidental, and internal or external.

7vulnerability

A weakness in software, hardware, a process or a person that a threat could use to harm an asset. A vulnerability is only a weakness, not an attack.

8exploit

A method or piece of code that takes advantage of a vulnerability (the weakness) to attack a system. The vulnerability is the flaw; the exploit is the tool that uses it.

9threat actor

A person or group that carries out a cyber attack, described by their motive (money, cause, grievance, spying) and skill, such as cybercriminals, hacktivists, insiders and nation-state groups.

10attack surface

All the points where an attacker could try to get into a system or take data out, such as open ports, running services and user accounts. A smaller surface means fewer ways in.

11risk = likelihood x impact

Risk is how likely a threat is to succeed combined with how much harm it would cause. Rate each as low, medium or high to decide which risks matter most.

12cyber security incident

An event that actually or potentially compromises the confidentiality, integrity or availability of data or systems, such as a data breach or a malware infection.

13LAN vs WAN

A LAN connects devices in one small area like a home or school. A WAN connects many LANs over a large distance. The internet is the largest WAN.

14network switch

A device that connects computers on the same network and sends data only to the device it is meant for, using its ports. A router links different networks.

15router

A device that directs data between networks, such as joining a home LAN to the internet and choosing the path data packets take. A home Wi-Fi router also shares the connection wirelessly.

16wireless access point

A device that connects to a wired network and broadcasts a Wi-Fi signal so wireless devices can join the network.

17IP address

A unique number that identifies a device on a network, like a postal address, so data knows where to go. IPv4 looks like 192.168.1.5.

18MAC address

A unique hardware address given to one network interface card (NIC). Each NIC has its own, so a device with Wi-Fi and Ethernet has two. It identifies the hardware, not the network.

19packet switching

Data is split into packets that are sent separately, each routed on its own from router to router, then joined back together in the right order at the destination.

20TCP/IP model

A four-layer plan for network communication: application (HTTP), transport (TCP, UDP), internet (IP) and network access (Ethernet, Wi-Fi). Each layer has its own job.

21TCP

Transmission Control Protocol. It sets up a connection, numbers packets, checks each one arrived and resends any missing, so data arrives complete and in order. Web pages and email use it.

22UDP

User Datagram Protocol: sends packets with no connection and no resending. It is faster than TCP but data may be lost, so it suits live video, voice calls and online games.

24DNS

Domain name server: stores a list of domain names with their matching IP addresses. Give it a domain name and it returns the IP address. Many DNS servers exist across the internet.

25HTTP

Hypertext Transfer Protocol: the set of rules a browser and web server use to request and send web pages. It is the default protocol for the web and is used only for web pages.

26wired transmission

Sending data as signals along a physical cable, such as a USB, Ethernet or fibre optic cable. Wired links are usually fast and reliable.

27wireless transmission

Sending data as radio signals through the air with no cables, like Wi-Fi, Bluetooth and mobile data. Range and interference can weaken the signal.

28wireless security

Wired data stays in the cable, but wireless signals travel through the air where anyone in range can try to pick them up, so they need a password and encryption.

29interception

When someone copies data as it travels across a network through routers and other devices, so unprotected data can be read by anyone who intercepts it, for example on public Wi-Fi.

30Unsecured Wi-Fi

A network with no encryption, letting attackers intercept the data sent across it.

31man-in-the-middle attack

An attack where someone secretly sits between two parties and can read or change the data passing between them, such as logins, session tokens or code sent over an unsecured network.

32Malware

Malicious software designed to damage, disrupt, or gain unauthorised access to a computer system

33Virus

Malware that attaches to a host file and spreads by replicating itself when a user runs the infected file

34Worm

Malware that spreads by replicating itself across a network without needing a host file or user action

35Trojan horse

Malware disguised as useful or harmless software. The user installs it willingly, then it secretly does harm, such as opening a back door or stealing data. It does not replicate itself.

36Spyware

Malware that secretly monitors a user's activity and collects information without their knowledge or consent

37adware

Software that shows unwanted adverts, such as pop-ups, often installed with free programs, to earn money for its creator. It can slow a device, redirect searches and track users.

38Ransomware

Malware that encrypts or locks a victim's files and demands payment to restore access

39social engineering

Tricking people, instead of hacking systems, into giving away access or information, often by pretending to be someone trusted or creating urgency. Phishing is one type.

40phishing

Sending many fake emails that look genuine to trick users into clicking a link or replying with personal details, so criminals can steal passwords and bank details.

41spear phishing

A phishing message aimed at one person or group that uses details like your name or school, or pretends to be a friend or teacher, to look more believable than mass phishing.

42smishing and vishing

Smishing is phishing by text message and vishing is phishing by phone call. Examples are a fake delivery text or a fake bank call that tries to trick you into sharing private details.

43pretexting

Inventing a believable story or fake identity, like IT support or a delivery driver, to build trust and talk someone into handing over information or access.

44tailgating and baiting

Physical social engineering: tailgating follows an authorised person through a secure door, while baiting leaves an infected USB drive for someone to plug in.

45pharming

An attack that redirects a user to a fake website, even when they type the right address, using malicious code or DNS poisoning, so the site can steal their login and payment details.

46Denial of service attack

An attack that floods a target with traffic, overwhelming its resources and blocking legitimate users

47DDoS attack

A botnet of infected computers floods one server with requests at the same time, so it cannot respond to real users and the website goes offline.

48Unauthorised access

Gaining entry to a network or system without permission, often to steal or damage data

49insider threat

Harm to data or systems caused by someone with legitimate access, either on purpose (malicious insider) or by mistake, like emailing the wrong person or setting a file to public.

50input validation

Checking that data a user enters is the expected type, length and format before the program uses it, so bad or harmful input is rejected.

51SQL injection

An attack where SQL commands typed into an input box run because the program joins the input straight into a query. Parameterised queries stop it by treating input only as data.

52XSS

An attack where a page shows untrusted input, like a comment, without cleaning it, so the attacker's script runs in other users' browsers and can steal cookies. Escape output to stop it.

53buffer overflow

When a program writes more data into a memory area (buffer) than it can hold, overwriting nearby memory. This can crash the program or let an attacker run their own code.

54zero-day

A zero-day is a software flaw that attackers know about before the maker has released a fix, so there is no patch yet. Defenders use workarounds and monitoring until one arrives.

55outdated software

Software that is missing the latest security patches, so its known flaws stay open for attackers to exploit.

56default credentials

The factory username and password a device or app ships with. If they are never changed, anyone who knows or guesses them can log in and take control.

57Improper credential management

Storing, sharing or reusing passwords, keys or tokens insecurely (in plain text, on shared accounts, or on many sites) so attackers can steal them and gain unauthorised access.

58software supply chain

Everything used to make and deliver software: code libraries, tools, build systems, suppliers and updates. Most of an app is other people's code, so every link must be trusted.

59compromised software update

A software update from a trusted supplier that criminals have secretly infected with malicious code, so users install it believing it is safe.

60organisational impact

The harm a cyber attack does to a business or group, such as downtime, recovery costs, lost customer trust, a damaged reputation and fines for breaking privacy laws.

61individual impact

The harm a cyber attack causes a person, such as stolen money, identity theft, a locked-out account, lost private photos or messages, reputation damage and emotional distress.

62encrypt

To scramble data so nobody can read it without the key. This keeps private things like messages, passwords and bank details safe if someone steals or intercepts them.

63plaintext

The original, readable data (text, file, image or message) before it is encrypted. Decrypting ciphertext with the correct key turns it back into plaintext.

64ciphertext

The scrambled, unreadable data made when plaintext is encrypted. It is what gets sent across a network and looks meaningless without the key.

65encryption key

A secret value used by the encryption algorithm to scramble data into ciphertext and unscramble it again. A different key gives different ciphertext, and a longer key is harder to guess.

66Caesar shift encryption

Move each plaintext letter forward along the alphabet by the key number. With a key of 3, A becomes D. Write the new letter and keep spaces unchanged.

67shift back by key

To decrypt a Caesar ciphertext, move each letter back along the alphabet by the key number to get the plaintext. A wraps back to Z. Then check the result is a real message.

68key space

The total number of different keys a cipher allows. A Caesar cipher has only 25 useful keys, so an attacker can try them all. More keys means a bigger key space and a stronger cipher.

69brute-force attack

Trying every possible key, such as all 25 Caesar shifts, then choosing the result that reads as sensible text. A short key leaves few shifts to try, so the cipher is weak.

70frequency analysis

Counting how often each letter appears in ciphertext and matching the most common ones to common English letters like E, to work out a substitution cipher's key.

71weak cipher

A cipher with few keys and letter patterns that show through, so a computer can break it fast. Modern encryption uses huge keys and complex steps. A Caesar cipher has only 25 keys.

72Base64

Rewrites data using 64 printable characters so it can be sent as text. It has no secret key, so anyone can reverse it. It is encoding, not encryption, and protects nothing.

73Encryption

Turning a readable message into a scrambled, unreadable message using a key, so it can only be read again with decryption.

74Symmetric encryption

Using the exact same secret key to both lock and unlock a message.

75AES

A widely used method of symmetric encryption that uses one shared key, which can be 128, 192, or 256 bits long, to lock and unlock data.

76key interception

If an attacker intercepts a symmetric key while it is being shared, they can decrypt every message that uses that key, so the encryption is defeated.

77keep the key secret

Encryption is only as strong as its key. Never send the key with the message, share it in person or by another channel, and change it if it may have leaked.

78Asymmetric encryption

Encryption that uses a linked pair of keys: a public key to encrypt data and a private key to decrypt it, with no shared secret key needed.

79public key

The half of a key pair that the owner shares openly. Anyone can use it to encrypt data sent to the owner, but it cannot decrypt that data. Only the matching private key can.

80private key

The secret half of a key pair. Only the owner keeps it, never sends it, and uses it to decrypt data that was encrypted with their public key.

81Encrypt with public key, decrypt with private key

The receiver shares their public key, the sender encrypts with it, and only the receiver's private key can decrypt it. No secret key is shared, so an interceptor sees only ciphertext.

82RSA

A way of locking and unlocking messages using two matching keys: a public key anyone can have, and a private key kept secret by its owner.

83ECDH

A method where two people each combine their own secret with the other's shared piece, ending up with the same matching result without sending the secret.

84ECDSA

A digital signature algorithm that uses a private key to sign a message and the matching public key to verify it.

85symmetric vs asymmetric

Symmetric: one shared secret key, fast but hard to share safely. Asymmetric: public and private key pair, no secret to share but slower. Often combined.

86hash function

A one-way function that turns any input into a fixed-length value. The same input always gives the same hash, a tiny change gives a very different one, and it cannot be reversed.

87hash comparison

Hash the file before and after transfer. If both hashes (checksums) match, the data is unchanged. A different hash shows the file was altered or tampered with, so its integrity is lost.

88hash

A one-way scrambled value made from a password. A system stores it instead of the real password and checks a login by hashing what you type and comparing. It can't be reversed.

89salt

A random value added to a password before hashing, so identical passwords give different hashes. Each user gets their own salt, which defeats precomputed hash tables.

90data at rest

Data stored on a device, server or backup, not moving. Protect it with encryption (disk or database) and access control, so a stolen laptop or backup is unreadable.

91data in transit

Data moving across a network, such as email or web traffic. It is protected by encrypting it (e.g. HTTPS or a VPN) so intercepted data cannot be read.

92unreadable without the key

Encryption cannot stop data being intercepted, but the interceptor sees only ciphertext and cannot get the plaintext without the key, so passwords and bank details stay safe.

93HTTPS

HTTP plus SSL/TLS encryption. Plain HTTP sends readable text that can be intercepted; HTTPS scrambles data so intercepted data can't be read, and a certificate shows the site is genuine.

94SSL

Secure Socket Layer: a security protocol that encrypts data between a browser and web server, so intercepted data cannot be read. Used for logins and payments. TLS is its successor.

95SSL handshake

Browser asks the server for its digital certificate, checks it is genuine, then both agree an encryption key to begin a secure session.

97VPN

A virtual private network creates an encrypted tunnel across a public network so a remote user can access a private network securely.

98WPA3

The newest Wi-Fi security standard. With a strong password it scrambles data in the air so outsiders can't read it. WPA2 is the older version. Open networks have no protection at all.

99error detection

Checking received data, because it can be damaged in transit and the receiver cannot see the original. Spotting the error is the first step to fixing it.

100checksum

A value calculated from a block of data by a set rule and sent with it. The receiver repeats the calculation and compares the results. If they differ, an error occurred.

101data integrity

Data has integrity when it arrives complete (nothing missing or extra) and correct (nothing changed) compared with what was sent.

102Authentication vs authorisation

Authentication checks who you are, like logging in. Authorisation decides what you can do once you are known, like which files you can open. Authentication always comes first.

103authentication factor

A type of proof that you are who you say you are: something you know (password, PIN), something you have (phone, key), or something you are (fingerprint, face).

104Multi-factor authentication

A login method that requires two or more independent proofs of identity, such as a password plus a one-time code.

105MFA fatigue

A trick where a scammer spams you with login prompts hoping you approve one, or talks you into sharing your code. Never share codes, never approve prompts you didn't start, and report them.

106Weak password

A password that is short, common, or predictable, making it easy for attackers to guess or crack.

108access levels

Settings that give each user different rights to data: no access, read only, read/write or full control. Users only see and change what their role needs, protecting confidentiality and integrity.

109principle of least privilege

Give every user, program and device only the minimum access it needs to do its job. This limits the damage if an account is stolen, and unneeded access should be removed.

110Role-based access control (RBAC)

A way to manage access by giving permissions to roles, like student, teacher or admin, then assigning each user a role. Changing a user's role changes what they can access.

111access control list (ACL)

A table attached to a resource, like a file or router, that lists which users or groups may access it and what they can do. If you are not listed, access is denied.

112access log

An automatic record of who accessed a system or file, what they did and when. It helps spot failed logins and misuse, and holds users accountable for their actions.

113log analysis

Reading a log in time order for patterns, like many failed logins then one success, odd times or unfamiliar places, to spot an attack.

114ISM segmentation guideline

A rule that tells organisations to divide their network into separate zones and limit access between them, so a breach stays contained.

115ISM access controls guideline

A rule that tells organisations to only give people access to the parts of the network they actually need, after checking who they are.

116Firewall

A device or program that monitors and controls incoming and outgoing network traffic according to defined security rules.

117network firewall

A device or router feature between a local network and the internet that filters inbound and outbound traffic for every device behind it, not just one.

118Firewall software

A program installed on a single device that filters its incoming and outgoing traffic using security rules.

119allow inbound TCP 443

A firewall rule with an action (allow), a direction (inbound) and a port (TCP 443). It lets incoming web traffic through. A deny rule on a port, such as 23, blocks it.

120deny from 192.168.1.50

A firewall rule that blocks traffic from one IP address. Use a range like 192.168.1.0/24 to match a whole network, and allow to let only trusted addresses, such as the school network, in.

121default deny

A firewall checks rules from the top and uses the first match. A final default deny rule blocks anything not allowed by an earlier rule.

122MAC filtering

A router setting that only lets devices with MAC addresses on an allowed list join. It is easy to set up but weak, because a MAC address can be copied (spoofed).

123proxy server

A server between a user and the internet that filters requests, blocks unsafe sites, hides the user's IP address, checks responses for malware and caches pages for speed.

124Intrusion detection system (IDS)

A system that monitors network traffic for suspicious activity and raises an alert when it finds it.

125Intrusion prevention system (IPS)

A system that sits inline in the traffic path, detects threats, and automatically blocks them before they reach the network.

126Antivirus software

A program that detects, blocks and removes malicious programs from a device.

127Operating system update

Installing the latest patches for the OS, fixing known security vulnerabilities and bugs.

128Backup system

A system that creates and retains separate copies of data so it can be recovered if the original is lost.

1293-2-1 rule

Keep 3 copies of data on 2 different types of media, with 1 copy stored offsite (such as cloud storage), so one disaster cannot destroy both the data and its backups.

130security control

A measure that reduces risk by preventing an attack, detecting it or helping recovery. Controls can be technical, physical or procedural, and layering several works best.

131layered security

Using several protections together, such as a strong passphrase, MFA, updates and encryption, so if one fails the others still keep your account and data safe.

132Zero Trust Architecture

A security model that trusts no user or device by default and verifies every request, even from inside the network.

133Essential Eight

Eight baseline security strategies from the Australian government, like patching, MFA, backups and application control, that cut the risk of cyber incidents.

134incident response

Set stages for handling a security incident: detect it, contain it, remove the cause, recover systems, then review what happened to improve future security.

135threat modelling

A structured way to work out what could go wrong with a system, before and during development, so risks are found, fixed and confirmed early and then reviewed again.

136trust boundary

A line on a diagram where data passes between parts of a system with different levels of trust, such as from a user's device to a server. Threats often cluster here.

137STRIDE

A memory aid for six threat types: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. Use it to ask what could go wrong in a system.

138countermeasure

A solution chosen to stop a specific threat, such as a firewall for hacking, SSL for interception or anti-malware for malware, plus an explanation of how it works.

139access control

Hardware like routers and firewalls moves and filters a request; software like protocols, login, permissions and encryption decides who may see the data and keeps it safe.

140penetration test

An authorised, simulated attack on a system by an ethical (white-hat) hacker to find vulnerabilities before real attackers (black-hat) do, so the weaknesses can be fixed.

141Ethical hacking

Authorised testing of a system to find security vulnerabilities before malicious attackers can exploit them.

142vulnerability scan vs penetration test

A vulnerability scan is an automated check that lists known weaknesses, some false positives. A penetration test is manual: testers try to exploit them to prove the real impact.

143penetration test phases

The ordered stages of a penetration test: planning, reconnaissance, scanning, gaining access, maintaining access, then reporting, with clean-up of any changes made.

144Black, grey and white box testing

Test approaches defined by what the tester knows beforehand: black box knows nothing (outsider view), grey box knows some (insider view), white box knows everything (full knowledge).

145written authorisation

Written permission from the system owner that sets the scope: which systems, methods and time window a tester may use. Testing outside it is illegal.

146penetration test report

A confidential document listing each finding with its risk rating, evidence and recommended fix, so the client can remediate the problems and then retest to confirm they are fixed.

147computer offence

A crime under the Cybercrime Act 2001 (Cwlth) and the WA Criminal Code: accessing, changing or impairing computer data or systems without authorisation. Authorisation is a defence.

148responsible disclosure

Privately reporting a vulnerability you found to its owner and giving them time to fix it before telling the public, so attackers can't exploit it.

149code of ethics

A set of rules for professional conduct, such as the ACS Code of Ethics: be honest, keep client data confidential, avoid harm, declare conflicts of interest and act in the public interest.

150Privacy Act 1988

Commonwealth legislation that sets rules for how organisations must collect, use, and store people's personal information.

151APP entity

An organisation or government agency that must follow the Australian Privacy Principles under the Privacy Act 1988, such as federal agencies, health providers and larger businesses.

152APP lifecycle groups

The 13 APPs grouped by what happens to data: openness (1-2), collection (3-5), use and disclosure (6-9), quality and security (10-11), access and correction (12-13).

153APP 3

Australian Privacy Principle 3: only collect personal information that is reasonably necessary for your functions, and collect it lawfully and fairly. Take extra care with sensitive information.

154Australian Privacy Principle 6

Requires organisations to only use or disclose personal information for the purpose it was originally collected for, unless consent or an exception applies.

155APP 8

Before sending personal information overseas, such as to a cloud server, an organisation must take reasonable steps to make sure the overseas recipient will also protect it.

156Australian Privacy Principle 11

Requires organisations to protect personal information from misuse, loss, and unauthorised access, and to destroy it when no longer needed.

157security measures

Controls such as passwords, access control, encryption and backups that protect personal information in a dataset from misuse, loss or unauthorised access.

158data breach

When attackers get into an organisation's stored data, such as usernames and passwords. Find out through alerts, then change your password and turn on MFA.

159Privacy Amendment (Notifiable Data Breaches) Act 2017

Amends the Privacy Act so covered organisations must tell the OAIC and affected people after an eligible data breach, so people can protect themselves.

160eligible data breach

Unauthorised access to, disclosure or loss of personal information that is likely to result in serious harm to the individuals it concerns (ss 26WE, 26WF).

161s 26WH assessment

If an entity suspects an eligible data breach, it must quickly and reasonably assess within 30 days whether serious harm is likely and whether a breach has occurred.

162Statement to the Commissioner

After an eligible data breach, the organisation must prepare a statement of required details and give it to the Australian Information Commissioner as soon as practicable.

163s 26WL

Organisation must tell individuals at risk of serious harm about an eligible data breach, what information was involved and what steps to take, directly or by publishing a notice.

164NDB scheme steps

Check if a breach is eligible (serious harm likely), then notify the OAIC and affected people as soon as practicable. Failing to notify risks penalties under the Privacy Act.

165OAIC

The Office of the Australian Information Commissioner: the government body that oversees the Privacy Act, gives guidance, handles privacy complaints and can act on APP breaches.

166Lack of transparency

When people are not told what data is collected, how it is used or how a conclusion was reached, such as hidden data collection, unexplained AI decisions or unclear privacy policies.

167Misuse of personal data

Using or sharing personal data in ways the person did not agree to or that harm them, such as selling it, identity theft, or using it for a different purpose.

169Ineffective security practices

An ethical issue: people whose data is held can be harmed by a breach the organisation could have prevented, so it has a duty of care to protect them and be open if it fails.

170Ethical data collection

Collecting only the data needed for security and using it as people expect. Over-collection or hidden monitoring of staff or customers, without clear consent, is an ethical issue.

171identity theft

Using someone's stolen personal information, such as from a data breach, to pose as them and commit fraud. Organisations have an ethical duty to protect people and warn them.

172Ethical issue analysis

Name the issue, identify the stakeholders affected and the harm done, link it to an APP, then recommend an action to fix it.

173legal and ethical consequences

Penalties under privacy law and ethical criticism faced when weak security exposes data, such as breaching privacy law or failing to notify. Link each to evidence in the case.

174Security recommendation

A specific improvement that is tied to a weakness found in the strategy and justified using the CIA criteria, legal obligations and its cost and practicality.

175privacy by design

Building privacy into a solution from the start: collect minimal data, use anonymous IDs, make settings private by default and plan how data will be deleted.

176development, testing and production

The three environments software moves through: development is where code is written, testing is where it is checked with test data, and production is where real users use live data.

177hard-coded secret

A key, password or token written directly into source code. Anyone who can read the code or its repository can steal it, and deleting the file later does not remove it from the history.

178secrets management

Keeping passwords, API keys and tokens in a protected vault or environment variable, not in source code, and rotating keys and scanning commits for leaks.

179peer code review

Another developer checks a change before it is merged, using a checklist that includes security checks, and approves it. The decision is recorded on the pull request.

180patch management

The regular, planned process of finding, testing and installing updates that fix known vulnerabilities in software, including libraries and frameworks.

181Information Security Manual

A document created by the Australian government that provides detailed guidance organisations can follow to protect their systems and data.

182ISM encryption guideline

A rule that tells organisations to encrypt sensitive data, both when stored and when sent, so it stays protected.

183copyright

The legal right of the person who writes original code to control who can copy, share or sell it. Others need the owner's permission, even for a classmate's code.

184software licence

A legal agreement stating how you may use, change and share code. Open-source licences allow reuse if you follow their terms, such as giving credit to the author.

185copyright infringement

Using someone else's code, including AI output that copies licensed work, without checking its source or licence. It can breach copyright and is an ethical issue for developers.