A-Level Computer Science / Unit 6: Protecting Data and Ensuring Accuracy

6.1.2 Threats to Computer Systems and Data

🔒 Lesson slides are available to signed-in users. Sign in

6.1.2 Threats to Computer Systems and Data

Connecting computers to networks makes communication and shared access possible, but it also creates routes through which attackers and malicious software may reach a system. This section focuses on the threats named in the syllabus: viruses, spyware, hackers, phishing, and pharming.

You will learn to recognise how each threat begins, what it targets, and how it may affect the system or the data stored within it. Protective measures are covered in the next section.

By the end of this section, you should be able to:

  • Explain why network and Internet connections increase exposure to security threats.
  • Describe malware and distinguish a virus from spyware.
  • Explain how a hacker may threaten a computer system or its data.
  • Distinguish phishing from pharming using the route taken by each attack.
  • Trace a threat from its starting point to its likely effect on data or system operation.

Why Connected Systems Face More Threats

A stand-alone computer can still be harmed through local actions, such as running an infected program. Once a device is connected to a network, however, it can also exchange data with other devices and remote services. Every permitted connection, message, download, login page, and shared resource becomes a possible route that an attacker may try to misuse.

Attack surface: the collection of possible routes through which a system could be reached or misused.
Feature of a connected system Useful purpose Possible security exposure
Email and messaging Fast communication A deceptive message may contain a harmful link or request.
Web access Use of online services A user may be directed to a fraudulent website.
File sharing and downloads Easy distribution of software and documents An infected file may introduce malware.
Remote login Access from another location Stolen credentials may be used without permission.
Common misconception: A network does not automatically make a system unsafe. The risk increases because there are more possible routes into the system and more interactions that must be trusted or checked.

Following a Threat Pathway

A strong explanation does more than name a threat. It shows the sequence from the initial route of attack to the final consequence.

Threat pathway: the sequence showing how a threat reaches a system, performs an action, and causes harm.
Stage Question to ask Example
Entry or approach How does the threat reach the user or system? A message links to a false account page.
Action What does the attacker or malicious software do? The user enters a username and password.
Effect What happens to the system or data? The stolen details are used to access private records.
Exam tip: Build explanations with a clear chain: route → action → consequence. This is stronger than listing isolated keywords.

Malware: Viruses and Spyware

Malware is software created or used for a harmful purpose. The syllabus requires you to understand viruses and spyware. These are both malware, but they behave differently.

Malware: software intended to damage, disrupt, monitor, steal from, or gain unauthorised control over a computer system.
Threat How it operates Possible effect Recognition clue
Virus Attaches to a host file or executable program and can replicate when the infected code is run. Files may be altered, deleted, corrupted, or used to spread the infection. Look for attachment to other executable code and replication.
Spyware Secretly observes activity or collects information without the user’s informed permission. Passwords, browsing activity, account details, or other private data may be exposed. Look for hidden monitoring and unauthorised collection of information.

Original scenario: event-management laptop

A community festival coordinator installs a free scheduling utility from an unverified source. The downloaded package contains spyware that records login details for the ticketing portal. The spyware does not need to damage the laptop visibly; its purpose is to collect information quietly and send it elsewhere.

Common misconception: Malware does not always announce itself by crashing the computer. Spyware is often designed to remain unnoticed.

Hackers and Unauthorised Access

In this syllabus context, a hacker is a person who attempts to gain access to a computer system without permission. The hacker is the person carrying out the attack, rather than a type of malware.

Unauthorised access: use of a system, account, file, or service by someone who has not been given permission.

After gaining access, a hacker might copy private data, change stored values, delete files, create new accounts, or interfere with the normal operation of the service. A single incident can therefore affect privacy, integrity, and availability at the same time.

Original scenario: climbing-centre booking system

An attacker obtains the password for a staff account and enters the centre’s booking system. They download member contact details and change the capacity of several sessions. The first action breaches privacy; the second damages data integrity.

Exam tip: When describing a hacker, state both the unauthorised access and a realistic consequence for the system or data.

Phishing and Pharming

Phishing and pharming both try to make a user trust a false destination or request. The important difference is the route by which the victim is deceived.

Attack Main route Typical sequence Key distinction
Phishing A deceptive email, text message, or other electronic communication A message appears trustworthy → the user follows a link or provides information → credentials or other data are captured The attack begins with a misleading communication.
Pharming Redirection to a fraudulent website The user attempts to reach a legitimate service → traffic is redirected or the false site imitates the real one → information is entered at the wrong destination The attack centres on sending the user to a false website.

Original comparison

A theatre treasurer receives a message claiming that the payment portal must be verified before midnight. The message contains a link to a false sign-in page. This is phishing. In a different attack, users type the correct address for the theatre’s payment service but are redirected to a fraudulent copy. This is pharming.

Common misconception: Phishing is not simply “a fake website”. A fake page may be involved, but phishing is identified by the deceptive message used to approach the user.

How Threats Affect Systems and Data

The same threat can produce more than one kind of harm. When analysing a scenario, identify the immediate action and then connect it to a specific consequence.

Possible consequence What it means Example
Loss of privacy Information becomes available to an unauthorised person. Spyware captures customer login details.
Loss of integrity Stored values are changed, corrupted, or no longer trustworthy. An attacker alters delivery addresses in an order database.
Loss of availability Users cannot access data or services when required. Important files are deleted and a service stops operating.
System disruption The computer or network no longer performs its intended tasks reliably. An infection consumes resources and repeatedly closes an application.
Exam tip: Avoid vague statements such as “it is dangerous”. Name the effect: data may be copied, changed, deleted, exposed, or made unavailable.

Interactive: Trace the Threat

Select a threat to follow its route from the source, through the attack action, to a likely consequence. The cards update in sequence so that you can practise explaining a complete pathway.

Source or route Infected executable

A user runs a program that contains malicious code attached to it.

Threat action Replication

The virus copies itself into other executable files or code.

Possible result Files or system affected

Data may be altered or corrupted and the infection may spread further.

Keyword host code
Original example An infected lighting-control utility is copied between theatre laptops.
Exam focus Mention attachment to executable code and replication.

Worked Scenario Analysis

Scenario

A wildlife survey organisation uses an online portal to upload field observations. A team member receives a message that appears to come from the portal administrator. The message warns that the account will be closed and provides a link. The team member follows the link and enters their username and password. The attacker then signs in and changes several recorded locations.

Analysis step Answer
Identify the threat Phishing
Evidence from the scenario A deceptive message creates urgency and directs the user to a false sign-in page.
Immediate result The attacker obtains valid account credentials.
Effect on data Changing stored locations damages data integrity.
Model structure: identify the threat, quote or paraphrase the clue, explain the action, and finish with the consequence.

Common Mistakes and Misconceptions

  • Calling every threat a virus. A virus is one specific form of malware.
  • Describing spyware only as software that damages files. Its main purpose is hidden monitoring or data collection.
  • Calling a hacker a piece of software. A hacker is the person attempting unauthorised access.
  • Treating phishing and pharming as identical.
  • Writing “the data is hacked” without explaining whether it is viewed, changed, deleted, or made unavailable.
  • Listing threats without explaining the pathway from route to consequence.

Practice

Try these original questions

  1. Explain why an Internet-connected booking system has a larger attack surface than an isolated computer.
  2. Describe how a virus may spread after an infected program is executed.
  3. Explain why spyware may remain unnoticed while still causing serious harm.
  4. Describe two different actions a hacker might take after gaining unauthorised access.
  5. Explain one difference between phishing and pharming.
  6. A volunteer receives a message asking them to “confirm” a cloud-storage password using a supplied link. Identify the threat and explain the likely pathway.
  7. Users enter the correct address for a parcel-tracking website but are sent to an imitation page. Identify the threat and explain what the attacker may gain.
  8. For each of the following, state the most direct effect: copied customer records, altered stock quantities, deleted timetable files, and a repeatedly crashing application.

Review

Term Strong recall statement
Malware Software intended to harm, monitor, steal from, disrupt, or control a system.
Virus Malicious code that attaches to host code and can replicate when it runs.
Spyware Software that secretly monitors activity or collects information.
Hacker A person who attempts to gain access to a system without permission.
Phishing A deceptive communication used to trick a user into revealing data or following a harmful route.
Pharming Redirection of a user to a fraudulent website that imitates a legitimate service.
Final exam tip: Use the pattern name the threat → explain how it operates → state the effect.