Cyber Security¶

Exam-ready answer

Cyber security is the coordinated protection of computers, networks, software, services, data and users against unauthorized access, alteration, disclosure, disruption, destruction or theft. Its basic objectives are summarized by the CIA triad.

Example: an online billing system encrypts subscriber data and limits database roles for confidentiality; digitally signs software updates and logs transactions for integrity; and uses replicated servers, UPS power, monitoring and tested backups for availability. Improving one objective can affect another: strict checks may add delay, while unrestricted redundancy may create more copies to protect, so controls must follow risk and service requirements.

Related goals are authentication (verify identity), authorization (grant permitted actions), accountability (trace actions) and non-repudiation (strong evidence prevents a party from plausibly denying an action). No single product provides all goals; policy, trained people, secure processes and layered technical controls are required, followed by monitoring and incident response.

Practice target: 8–9 minutes; define cyber security, give meaning, failure and at least two controls for each CIA objective, then add the related goals.

Exam-ready answer

Malware is software or code intentionally designed to disrupt, damage, spy, steal or obtain unauthorized control. A virus inserts or attaches its code to a host file, program, document macro or boot area and normally spreads when the infected host is executed. A worm is a stand-alone, self-replicating program that automatically spreads between systems, commonly by exploiting a network vulnerability or weak credential. A Trojan horse pretends to be useful or legitimate software so that a user installs/runs it; it may open a backdoor or steal data but does not define itself by self-replication.

A virus may pass through dormant, propagation, triggering and execution/damage stages as shown; a worm often compresses propagation into rapid automated scanning, while a Trojan depends chiefly on deception. Example: an infected document macro is a virus vector, an exploit that copies itself to every vulnerable server is a worm, and a fake utility installing a backdoor is a Trojan.

Controls overlap: keep systems patched, use endpoint detection, least privilege, filtered email/web downloads, offline tested backups and network monitoring. Antivirus signatures alone may miss new or polymorphic malware, and labels can overlap when one campaign uses a Trojan to install a worm, so behavior, delivery and replication mechanism must all be examined.

Practice target: 8–9 minutes; define all three and compare host, user action, propagation, impact and one prevention focus.

5-mark answer and 10-mark extension

For 5 marks — write the digital-signature core¶

A digital signature is a public-key cryptographic value bound to a particular message and signer. Let message be \(M\), secure hash be \(H\), signer's private key be \(SK_A\), corresponding public key be \(PK_A\), and signature be \(S\). Creation is

The sender transmits \(M\), \(S\) and normally a certificate identifying \(PK_A\).

The receiver independently computes \(h_1=H(M)\) and runs the signature algorithm's public-key verification:

A valid result provides integrity because any message change alters the digest, origin authentication because only the holder of the private key should produce the signature, and evidence supporting non-repudiation when key ownership and procedures are trustworthy. A digital signature does not provide confidentiality: the message remains readable unless it is separately encrypted.

Add for a 10-mark variant — PKI and assurance¶

A cryptographic hash compresses arbitrary-length \(M\) to a fixed-length digest and should resist preimage and collision attacks. Signing the digest is efficient and binds the signature to every message bit. Algorithms such as RSA-PSS, ECDSA or EdDSA implement signing differently; "encrypt the hash with the private key" is only a simplified RSA-style explanation, not a general definition of every signature algorithm.

Verification procedure: (1) obtain the signer's certificate through a trusted channel; (2) validate the certification path, validity period, key usage and revocation status; (3) parse the signed data and algorithm parameters unambiguously; (4) hash exactly the received signed bytes; (5) verify \(S\) with \(PK_A\); and (6) accept only if both signature and policy/identity checks succeed.

Example: a software vendor publishes an update and signature. The customer verifies the vendor certificate and signature before installation. If one byte of the update is changed, \(H(M')\ne H(M)\) and verification fails. If an attacker substitutes both a malicious file and an untrusted public key, bare mathematics may verify, but certificate validation must reject the false identity.

Limitations are private-key theft, weak random numbers, expired/revoked certificates, compromised certificate authorities, ambiguous document formats and long-term algorithm aging. Hardware-backed keys, MFA for signing, revocation checking, trusted timestamps, secure canonical formats, key rotation and incident response reduce these risks. A valid signature proves the signed bytes and key relationship; it does not prove that the document is true, safe or willingly understood by the signer.

Practice target: 9 minutes for the five-mark core or 17–18 minutes for the full answer; draw both flows and explicitly write "no confidentiality by itself."

Exam-ready answer

Hacking broadly means exploring, modifying or testing computer systems and weaknesses; its legality and ethics depend on authorization, scope and intent. Cracking means unauthorized, malicious defeat of security or software protection to steal, damage, disrupt or bypass controls. Therefore an authorized penetration tester is a hacker in the neutral/ethical sense, while breaking an account password or licence protection without permission is cracking.

Spam is unsolicited bulk electronic communication, usually sent to many recipients for promotion, fraud or malware delivery. Phishing is deceptive communication impersonating a trusted party to make a victim disclose credentials/payment data, open malware or approve an action. Phishing may be bulk, spear-targeted or carried by email/SMS/voice; not every spam message is phishing, and a targeted phishing message need not be bulk spam.

Users should not conduct security tests without permission, click suspicious links or submit secrets after following an unsolicited prompt. Organizations should log authorized tests, restrict scope, filter messages and make reporting easy; filtering can have false positives and cannot replace user and identity controls.

Practice target: 8–9 minutes; devote one comparison to authorization/intent and one to bulk messaging versus deceptive credential/action theft.

5-mark answer and 10-mark extension

For 5 marks — write the attack-control core¶

A cyber attack is a deliberate attempt to violate confidentiality, integrity or availability by exploiting technology, configuration or people. Countermeasures should be selected for the attack mechanism rather than listed without a mapping.

No one control stops every attack; prevention, detection, response and recovery must work together.

Add for a 10-mark variant — layered defense and response¶

Defense in depth places independent controls at successive trust boundaries so failure of one layer does not expose the final asset. Internet traffic first meets edge filtering and DDoS protection; public services are isolated in a DMZ; an internal firewall/IDS/IPS separates trusted networks; endpoints use hardening/EDR; identity systems enforce least privilege and MFA; SIEM/logging detects anomalies; and isolated immutable backups support recovery.

Additional attack-control mappings are:

Example attack chain: a phishing email captures a reused password; the attacker logs in, moves laterally and launches ransomware. Email filtering may block delivery, MFA can stop password-only login, segmentation restricts lateral movement, EDR detects encryption behavior, and an offline immutable backup enables restoration. Logging across these layers supplies the timeline for containment and account/key rotation.

An incident procedure is: identify and triage alerts; contain affected accounts/hosts; preserve evidence; eradicate malware and close the exploited weakness; recover from known-good backups; monitor for recurrence; notify required parties; and incorporate lessons into controls. Recovery point objective (RPO) limits acceptable data loss, while recovery time objective (RTO) limits acceptable service-restoration time.

Controls have limitations: signatures miss unknown malware, firewalls cannot correct authorized misuse, MFA can be phished or fatigue-abused, encryption does not protect a compromised endpoint, and backups fail if untested or reachable by ransomware. Continuous asset inventory, patching, exercises, metrics, user reporting and risk review are therefore necessary. Layering should reduce common-mode failure, not merely duplicate products with the same blind spot.

Practice target: 9 minutes for the five-mark mapping or 18 minutes for the full answer; show the layered figure, one attack chain and the complete incident-response sequence.