Cyber Security Threats (Years 7–11) — Computer Science

Common threats to computer systems: malware types, phishing and social engineering, SQL injection and brute-force attacks, and how to recognise them.

Wherever there is valuable data, there are people trying to steal or destroy it. A cyber attack might be a virus hidden in a download, a fake email that tricks you into typing your password, or a flood of guesses at your login. The attackers are clever — but almost every attack relies on a weakness you can understand and defend.

Why this matters: Businesses lose millions and people lose their identities to attacks that a little knowledge would have stopped. Knowing how malware, phishing and the rest actually work is the first step to spotting them — and the biggest weakness attackers exploit is usually the human, not the machine.

Phishing emails share tell-tale signs — learn to spot them.

Malware

A trojan looks useful, but hides harmful code you install yourself.

Malware (malicious software) is any program written to harm a system. A virus attaches itself to a file and spreads when that file is opened; a worm copies itself across a network with no help; a trojan disguises itself as something useful to get you to install it; and ransomware encrypts your files and demands payment for the key. Think of a trojan as the wooden horse — it looks like a gift, but the danger is hidden inside.

Tricking the human: phishing and social engineering

Phishing baits the person, not the machine — no firewall stops it.

Phishing uses fake emails or websites pretending to be a trusted organisation to trick you into handing over passwords or bank details. It's one form of social engineering — manipulating people rather than hacking machines. An attacker might phone pretending to be IT support, or "shoulder surf" your PIN. No firewall stops these; the defence is a trained, sceptical human.

Attacking the machine

A brute-force attack guesses password after password until one works.

SQL injection targets websites that build database queries from what you type. If a login box isn't protected, an attacker can type in special database code that tricks the site into revealing or changing data. A brute-force attack simply tries millions of password combinations until one works — which is why short, common passwords are so dangerous.

Threat	What it does	Main defence
Malware	Harmful software damages or hijacks a system	Anti-malware, updates
Phishing	Fake message steals your details	User training, caution
SQL injection	Malicious database code via a form	Input validation
Brute force	Tries many passwords rapidly	Strong passwords, lockouts

Scenario: An email says "Your bank account is locked — click here within 24 hours to restore it." The link goes to bank-secure-verify.example and the message asks for your full password. Red flags: false urgency, an odd address, and a request for a password no real bank makes. Correct action: do not click; contact the bank using the number on your card.

Common mistake: Believing anti-virus software makes you safe from everything. It can't stop you being tricked — phishing and social engineering bypass technology entirely by targeting the person at the keyboard.

Tip: Slow down when a message pressures you to act instantly. Urgency is the single most common trick — a real organisation will let you take your time and check.