3.6 - Cyber Security (2026)

Card 1.1: Define the term cyber security and state its main purpose.

• Cyber security is the processes, practices and technologies used to protect networks, computers, programs and data. • Its purpose is to protect them from attack, damage and unauthorised access.

Card 1.2: List the seven cyber security threats named in the AQA specification.

• Social engineering techniques. • Malicious code (malware). • Pharming. • Weak and default passwords. • Misconfigured access rights. • Removable media. • Unpatched and/or outdated software.

Card 2: Describe the function of a computer virus and how it works within a computer system.

• A virus is malware that attaches itself to a file or program. • It replicates when the infected file/program is run and can spread to other files or systems. • It may damage, delete or alter data, or disrupt the system.

Card 3: Explain how a Trojan piece of malware infects a computer system.

• A Trojan disguises itself as legitimate or useful software. • The user is tricked into installing or running it. • It can then carry out malicious actions, such as stealing data or allowing unauthorised access. • Unlike a virus, it does not need to copy itself into other files.

Card 4.1: Explain how removable media can create a cyber security threat.

• Devices such as USB drives can carry malware from one computer to another. • Malware may run when the device is connected or when an infected file is opened. • Removable media can also be lost or stolen, exposing stored data.

Card 6.1: Explain why weak or default passwords are a cyber security threat.

• Weak passwords are easier to guess or crack. • Default passwords may be publicly known and are often the same on many devices. • If an attacker obtains a password, they may gain unauthorised access to accounts, systems or data.

Card 6.2: Give three characteristics of a strong password.

• Long enough to be difficult to guess or crack. • Uses a mixture of character types where appropriate. • Not based on obvious personal information or common words. • Unique - not reused across different accounts.

Card 6.3: Explain how password systems can improve cyber security.

• Passwords authenticate a user before access is allowed. • Only users who know the correct password should be able to access the account or system. • Strong, unique passwords reduce the chance of unauthorised access.

Card 7: What are the three key selectable access rights that can be applied to files and folders?

• Read - view/open the file or folder. • Write - change, create or save data. • Execute - run a program/file. • Permissions should be limited to what each user actually needs.

Card 8: Explain the dangers of misconfigured access rights.

• Users may be given access to files or systems they should not be able to use. • They may be able to read, change, delete or copy sensitive data. • This can lead to data breaches, accidental damage or malicious misuse.

Card 9.1: Explain why unpatched or outdated software is a cyber security threat.

• Older software may contain known security vulnerabilities. • Attackers can exploit these weaknesses to gain access or install malware. • Patches fix known vulnerabilities, so delaying updates leaves the system exposed.

Card 9.2: Explain how automatic software updates improve cyber security.

• Updates can install security patches as soon as they are made available. • This fixes known vulnerabilities without relying on the user to update manually. • It reduces the amount of time a system remains vulnerable to attack.

Card 10: Describe how a pharming attack is carried out.

• Pharming redirects a website's traffic to a fake website. • A user may enter the correct web address but still be sent to the fraudulent site. • The fake site may then steal usernames, passwords, banking details or other personal data.

Card 11.1: Define the term social engineering.

• Social engineering is manipulating people into giving up confidential information or carrying out an action they would not normally perform. • It targets people rather than relying only on a technical weakness.

Card 11.2: Explain how organisations can protect against social engineering attacks.

• Train users to recognise suspicious requests and messages. • Verify identities before giving out confidential information or performing sensitive actions. • Use procedures such as reporting suspicious messages and checking links/senders before responding.

Card 12.1: Explain the social engineering technique called blagging (pretexting).

• The attacker invents a believable scenario or identity. • They use the story to gain the victim's trust. • The aim is to persuade the victim to reveal information or perform an action they would not normally do.

Card 12.2: Explain the social engineering technique called phishing.

• Phishing is a fraudulent attempt to obtain private information, often using email or SMS. • The message may appear to come from a trusted organisation or person. • It may direct the victim to a fake website or ask them to reveal information.

Card 12.3: Explain the social engineering technique called shouldering (shoulder surfing).

• The attacker observes a person's private information while they enter or view it. • For example, watching someone enter a PIN or password over their shoulder. • The stolen information can then be used for unauthorised access.

Card 13.1: Explain how CAPTCHA can improve the security of a website.

• CAPTCHA is designed to distinguish a human user from an automated program/bot. • It can reduce automated account creation, spam or repeated automated attempts. • This makes some automated attacks more difficult.

Card 13.2: Explain how email confirmations can improve the security of a website.

• A confirmation link or code is sent to the user's email address. • The user must access that email account to confirm an action or identity. • This provides an additional check before an account or request is accepted.

Card 14: Describe three features that could help you spot a phishing email or message.

• The sender address or domain looks unusual or does not match the organisation. • The message creates urgency, fear or pressure to act quickly. • It asks for private information or contains a suspicious link/attachment. • Poor spelling, unusual wording or unexpected contact can also be warning signs.

Card 16: Explain the purpose of spyware and how it could be used.

• Spyware is malware that secretly monitors a user's activity or collects information. • It may record browsing, passwords or other personal data. • The information can then be sent to an attacker without the user's permission.

Card 17.1: Define the term malware.

• Malware is an umbrella term for hostile or intrusive software. • Examples required by AQA include computer viruses, Trojans and spyware.

Card 17.2: Explain how a computer system can be protected against malware.

• Use anti-malware/anti-virus software to detect, quarantine or remove malicious software. • Keep software and security tools updated so known vulnerabilities are patched. • Avoid untrusted downloads, links and removable media, and scan files/devices where appropriate.

Card 20.1: Explain what penetration testing is and what it is used for.

• Penetration testing is an authorised attempt to gain access to resources without using the normal means of access. • It is used to identify security weaknesses before a real attacker can exploit them. • The findings can be used to improve the security of the system.

Card 20.2: Describe internal penetration testing.

• The tester has knowledge of the target system and may have basic credentials. • It simulates an attack from inside the organisation or system. • For example, it can model the threat from a malicious insider.

Card 20.3: Describe external penetration testing.

• The tester has no knowledge of credentials for the target system. • It simulates an attack from outside the organisation or system. • It tests whether an external attacker could gain unauthorised access.

Card 21: List the five security measures named in AQA Cyber Security section 3.6.3.

• Biometric measures. • Password systems. • CAPTCHA (or similar). • Email confirmations to confirm a user's identity. • Automatic software updates.

Card 24.1: Explain how biometric measures can improve cyber security.

• Biometrics authenticate a user using a physical or behavioural characteristic. • Examples include fingerprint or facial recognition, particularly on mobile devices. • They make access dependent on the authorised user's biometric data rather than only something the user knows.

Card 24.2: Give two reasons why biometric authentication can be more secure than password-only authentication.

• Biometric characteristics are harder to guess than a password. • Users cannot simply tell another person their fingerprint or face in the same way they can share a password. • Biometrics can reduce risks caused by weak, reused or written-down passwords. • However, no security measure is perfect, so biometrics may be combined with other authentication methods.