Loading...
Phishing manipulates a person into revealing information or taking an unsafe action. Malware includes malicious programs with different behaviours, such as ransomware encrypting files for extortion. Brute-force attacks try many credentials; denial-of-service attacks overwhelm a service’s resources. A vulnerability is a weakness and an attack exploits a route or weakness. Naming an attack without explaining how it affects confidentiality, integrity or availability is incomplete.
Video by Craig'n'Dave. The video’s own board label is retained; follow the specification reference and scope notes on this lesson for assessed content.
Viewing focus: Explain common attack mechanisms
After watching, attempt these questions before opening the answers. You can also use the written lesson below.
After watching 1: Which control adds a second independent account factor?
Multi-factor authentication. It adds proof beyond one credential.
After watching 2: What is a denial-of-service attack aimed at?
Availability. It tries to prevent legitimate service use.
What you'll be able to do
Phishing manipulates a person into revealing information or taking an unsafe action. Malware includes malicious programs with different behaviours, such as ransomware encrypting files for extortion. Brute-force attacks try many credentials; denial-of-service attacks overwhelm a service’s resources. A vulnerability is a weakness and an attack exploits a route or weakness. Naming an attack without explaining how it affects confidentiality, integrity or availability is incomplete.
Strong unique passwords and multi-factor authentication help protect accounts. Updates repair known software weaknesses, access controls limit permissions, firewalls filter traffic and anti-malware tools detect selected threats. Encryption protects information from readers without the key but does not itself stop a user being tricked into sending money. Backups support recovery and should be protected from the same event that damages the working copy.
No one control removes every threat. Staff training, secure configuration, logging, monitoring and a recovery plan complement technical controls. Penetration testing is authorised investigation within an agreed scope, not permission to attack unrelated systems. Evaluate a defence for the scenario: stronger access controls may add friction, and poorly designed recovery can lock out legitimate users. Explain the remaining risk after the proposed control rather than claiming perfect security.
Attempt these problems on paper before opening the worked reasoning. Explain your steps as well as giving a final answer.
Common mistakes to avoid
Key takeaways
Question 1: A user types their password into a convincing fake login page. What attack is this?
Phishing/social engineering.
Check the assessed scope and practical or mathematical requirements.
An external explanation or interactive activity to use alongside the lesson. It may include extension material.
Close the notes and answer from memory. Revisit any explanation you cannot yet reconstruct.
Test yourself
Answer a few questions, then review anything you missed.
Start with the quiz above to check the key ideas. You can also choose another topic from the practice library.