Security & Malware
Security Is Layered
No single protection solves every security problem. Strong answers match the threat to a suitable control and explain what the control can and cannot do.
Authentication
Checks that a user is who they claim to be.
Examples: password, PIN, biometrics, MFA, security token.
Encryption
Converts readable data into unreadable ciphertext unless the correct key is available.
Examples: HTTPS, VPN, disk encryption, encrypted backups.
Firewall
Filters network traffic according to rules.
Examples: blocking unauthorised inbound traffic or limiting outbound access.
Threats and Protections
| Threat | What it does | How it commonly reaches users | Suitable protections |
|---|---|---|---|
| Virus | Attaches to a host file or program and runs when the infected file runs. | Infected downloads, USB drives or shared files. | Anti-malware, updates, scanning downloads and avoiding suspicious files. |
| Worm | Self-replicates and spreads across networks without needing the user to open each copy. | Network vulnerabilities and unpatched systems. | Patching, firewalls, network segmentation and anti-malware. |
| Trojan | Pretends to be legitimate software while performing a hidden malicious action. | Fake installers, cracked software or convincing downloads. | Trusted sources, application control, user education and anti-malware. |
| Spyware | Secretly monitors user activity or collects information. | Bundled software, malicious links or compromised devices. | Anti-malware, permissions review, updates and safe browsing. |
| Ransomware | Encrypts files or systems and demands payment for recovery. | Phishing attachments, malicious links or exploited vulnerabilities. | Backups, patching, least privilege, anti-malware and user training. |
| Phishing | Tricks users into giving away credentials or sensitive information. | Fake emails, login pages, messages or phone calls. | MFA, user awareness, checking URLs and reporting suspicious messages. |
Protection Methods Explained
Passwords and MFA
Passwords prove knowledge of a secret. MFA adds another factor, such as a phone prompt, code, token or biometric. MFA reduces risk if a password is stolen because the attacker still needs the second factor.
Biometrics
Biometrics use physical characteristics such as fingerprint or face recognition. They are convenient, but the system still needs careful enrolment, device security and a backup authentication method.
Encryption
Encryption protects confidentiality by making data unreadable without a key. It is useful for data in transit and data stored on a device, but it does not stop a user from voluntarily giving away their password.
Backups
Backups help recover from accidental deletion, device failure or ransomware. They must be regular, tested and protected so malware cannot encrypt the backup copy as well.
Do and Don't
Do
- Match the protection to the threat in the scenario.
- Explain what the control actually does.
- Use layered security: prevention, detection and recovery.
- Distinguish virus, worm, trojan, spyware, ransomware and phishing.
Don't
- Say antivirus prevents all attacks.
- Say encryption stops phishing.
- Say a firewall removes malware already on a computer.
- Forget backups when discussing ransomware recovery.
Scenario: Layered Security Response
Scenario: A student reports an email that looks like Microsoft 365, but the link goes to a fake sign-in page. Another student opened a similar attachment and their files became unreadable.
Strong response: The fake sign-in page is phishing because it is trying to steal credentials. MFA, user education and checking URLs help reduce the risk. The unreadable files suggest possible ransomware, so recent protected backups are important for recovery. Anti-malware, software updates and restricted permissions also help reduce the chance of infection spreading.
Possible Theory Questions and Model Answers
Question 1
Explain the difference between a virus and a worm.
Model answer: A virus attaches to a host file or program and usually requires user action, such as opening the infected file, to spread. A worm is self-replicating and can spread automatically across networks without each user opening a host file.
Question 2
A student receives a fake email asking them to sign in to a copied Microsoft login page. Identify the threat and one suitable protection.
Model answer: The threat is phishing because the email is trying to trick the student into entering credentials into a fake site. MFA is a suitable protection because stolen passwords alone are less useful to the attacker, and user education helps students check links before signing in.
Question 3
Why are backups important for ransomware protection?
Model answer: Ransomware can encrypt files and make them unusable. Backups allow the organisation to restore clean copies of files without paying the ransom, provided the backups are recent, tested and protected from the ransomware.