Know and understand characteristics and effect of threats to data including hacking, phishing, pharming, smishing, vishing, viruses, malware, card fraud

Safety and Security – Threats to Data

This set of notes covers everything required for the Cambridge IGCSE ICT (0417) syllabus on e‑Safety – Data protection & personal data and Security of data – Threats, prevention and mitigation. It explains the legal framework for data protection, the main threats to data, the technical and procedural controls that can be used, and the steps to follow when an incident occurs.

1. Data‑Protection Legislation (e‑Safety)

  • Core legal framework (UK example): Data Protection Act 2018 / GDPR. The same principles apply in most other jurisdictions (e.g., Australia’s Privacy Act, US state privacy laws).

Key Principles (applicable in any national framework)

  • Lawful, fair and transparent processing

  • Purpose limitation

  • Data minimisation

  • Accuracy

  • Storage limitation

  • Integrity & confidentiality

  • Accountability

Data‑subject Rights

  • Right to be informed

  • Right of access

  • Right to rectification

  • Right to erasure (“right to be forgotten”)

  • Right to restrict processing

  • Right to data portability

  • Right to object to processing

Personal vs. Sensitive Data – examples

Type of dataDefinitionSchool‑related exampleNon‑school example
Personal dataAny information that can identify a living individualStudent name, pupil ID, school email, home addressCustomer name and contact details in an online shop
Sensitive dataSpecial‑category data that requires higher protection (e.g., health, ethnicity, religious belief)Medical history, special educational needs, religious affiliationPatient medical records, employee health information

2. Common Threats to Data

For each threat the table below lists the definition, typical technical indicators (what students should be able to recognise), delivery method, typical effects and at least two preventive measures.

ThreatDefinition & Typical Technical IndicatorsDelivery MethodTypical EffectsCommon Prevention Measures
HackingUnauthorised access to a system or network.
Indicators: use of default admin passwords, unpatched services (e.g., SMB v1), open ports, suspicious login from unknown IP.		Network, remote desktop, web‑applicationLoss of confidentiality, data alteration, reputational damage, financial loss.Strong, unique passwords + password manager; regular OS & application patching; firewalls; IDS/IPS; least‑privilege accounts.
PhishingDeceptive email or web page that pretends to be from a trusted source to steal credentials.
Indicators: mismatched URLs, urgent language, miss‑spelled domain, spoofed logos.		Email, web linkIdentity theft, unauthorised transactions, compromise of corporate accounts.Email‑filtering & anti‑phishing software; user education on checking sender & URLs; DMARC/DKIM/SPF records for school domains.
PharmingRedirects users from a legitimate site to a fraudulent one without their knowledge.
Indicators: DNS records changed, hosts‑file entries altered, HTTPS certificate mismatch.		DNS manipulation, compromised hosts fileMass credential theft, financial fraud.Secure DNS (DNSSEC); keep hosts file read‑only; enforce HTTPS with valid certificates; regular anti‑malware scans.
SmishingPhishing via SMS text messages.
Indicators: short URL, unknown short‑code, request for personal data.		SMS (mobile phone)Identity theft, unauthorised account access.Do not click links in texts; verify requests via official website or phone number; install mobile anti‑phishing apps.
VishingVoice phishing – fraudulent phone call pretending to be a trusted organisation.
Indicators: caller asks for passwords, uses urgent/authority tone, caller ID spoofed.		Telephone (landline or mobile)Direct financial loss, data compromise.Never give personal details on unsolicited calls; call‑back verification using official numbers; staff training on social‑engineering.
Social‑media social‑engineeringFake friend requests, impersonated profiles or direct messages that lure users into revealing information.
Indicators: newly created profile with few friends, urgent request for help, link to a “survey”.		Social‑media platforms (e.g., Instagram, TikTok)Credential theft, bullying, reputational damage.Privacy‑settings review; educate pupils to verify friend requests; avoid clicking unknown links; report fake accounts.
Insider threat / Accidental data lossData is disclosed, altered or destroyed by a trusted user, either deliberately or by mistake.
Indicators: email sent to wrong address, use of removable media without encryption, excessive access rights.		Internal email, USB drives, cloud sharingLoss of confidentiality, breach of GDPR principles, financial penalties.Least‑privilege access; data‑loss‑prevention (DLP) tools; staff training; clear data‑handling policies.
VirusesMalicious programmes that attach to legitimate files and execute when the file is opened.
Indicators: unexpected file size increase, suspicious executable attached to documents.		Email attachment, removable media, downloaded fileData corruption, system slowdown, loss of productivity.Up‑to‑date antivirus/anti‑malware; disable autorun on removable media; avoid opening unknown attachments.
WormsSelf‑replicating malware that spreads across a network without user interaction.
Indicators: sudden network traffic spikes, exploitation of unpatched services (e.g., SMB, RDP).		Network propagationNetwork congestion, widespread data loss, denial‑of‑service.Patch management; network segmentation; intrusion‑prevention systems (IPS).
TrojanSoftware that appears legitimate but contains hidden malicious functions.
Indicators: unsigned installer, unexpected behaviour after installation, additional processes running.		Downloaded software, bundled free appsUnauthorised access, data theft, system compromise.Application whitelisting; verify digital signatures; regular anti‑malware scans.
RansomwareEncrypts a victim’s files and demands payment for the decryption key.
Indicators: ransom note on desktop, sudden file extension change, use of strong encryption algorithms.		Email attachment, compromised website, exploit kitLoss of data availability, financial extortion, service disruption.Regular offline backups (3‑2‑1 rule); keep software patched; restrict macro execution; application control.
SpywareCollects information about a user’s activities without consent.
Indicators: unexpected browser redirects, high CPU usage, unknown processes.		Bundled software, drive‑by downloadPrivacy invasion, data leakage, possible identity theft.Anti‑spyware tools; install software only from trusted sources; enable browser anti‑tracking settings.
Card fraudUnauthorised use of credit/debit‑card details for purchases or cash withdrawal.
Indicators: unfamiliar transactions, skimming device residue, data breach notifications.		Skimming devices, phishing, data breach, malwareMonetary loss, credit‑rating damage, dispute costs.Chip‑and‑PIN cards; PCI‑DSS compliant payment gateways; regular statement checks; virtual card numbers where available.

3. Technical & Procedural Controls

  • Encryption

    • At‑rest: AES‑256 encryption of files on laptops, external drives, or cloud storage.

    • In‑transit: TLS/SSL (HTTPS) for web traffic, VPN encryption for remote connections.

  • SSL/TLS & HTTPS – encrypts data between a browser and a server; look for the padlock icon.

  • Digital certificates – issued by a trusted Certificate Authority to verify the identity of a website or server.

  • Firewalls – hardware or software that filters incoming/outgoing traffic based on defined rules.

  • Biometric authentication – fingerprint, facial recognition, iris scan.

  • Two‑factor authentication (2‑FA) – requires two independent verification methods (e.g., password + one‑time code).

  • Access controls & least‑privilege – role‑based permissions; users receive only the rights they need.

  • Patch management & software updates – regular installation of security patches for OS, browsers, and applications.

  • Anti‑malware solutions – real‑time scanning, scheduled full system scans, and heuristic detection.

  • Data‑loss‑prevention (DLP) – monitors and blocks unauthorised transfer of sensitive data.

4. Incident‑Response Steps (as described in the syllabus)

  1. Detect – identify that an incident has occurred (alerts, logs, user reports).

  2. Contain – isolate affected systems to stop further spread (disconnect from network, disable accounts).

  3. Eradicate – remove malware, close vulnerabilities, change compromised credentials.

  4. Recover – restore data from clean backups, bring systems back online, verify integrity.

  5. Review – analyse the cause, update policies, and improve controls to prevent recurrence.

5. Summary Table – Threats, Characteristics, Effects & Prevention

ThreatKey CharacteristicsTypical EffectsCommon Prevention Measures
HackingUnauthorised system access; exploits weak passwords, default credentials, unpatched services.Data loss, confidentiality breach, reputational & financial damage.Strong passwords + manager; regular patching; firewalls; IDS/IPS; least‑privilege accounts.
PhishingDeceptive emails/websites; urgent language, spoofed URLs, mismatched domains.Identity theft, unauthorised transactions.Email filtering; user education; DMARC/DKIM/SPF; verify sender before clicking.
PharmingDNS or hosts‑file manipulation; redirects to fraudulent sites.Mass credential theft, financial fraud.DNSSEC; read‑only hosts file; enforce HTTPS with valid certificates; anti‑malware scans.
SmishingSMS with malicious links or data‑request.Identity theft, unauthorised account access.Do not click links in texts; verify via official channels; mobile anti‑phishing apps.
VishingPhone call impersonating a trusted organisation; uses authority & urgency.Financial loss, data compromise.Never give details on unsolicited calls; call‑back verification; staff training.
Social‑media social‑engineeringFake profiles or messages that lure users into revealing info.Credential theft, bullying, reputational harm.Privacy‑settings; educate pupils; avoid unknown links; report fake accounts.
Insider threat / accidental lossDeliberate or accidental disclosure by a trusted user.Confidentiality breach, GDPR violations.Least‑privilege access; DLP; clear handling policies; regular training.
VirusesAttach to legitimate files; spread when opened.Data corruption, system slowdown.Updated antivirus; disable autorun; avoid unknown attachments.
WormsSelf‑replicating; spreads via network vulnerabilities.Network congestion, data loss, DoS.Patch management; network segmentation; IPS.
TrojanMasquerades as legitimate software; creates back‑doors.Unauthorised access, data theft.Application whitelisting; verify signatures; anti‑malware scans.
RansomwareEncrypts files and demands payment.Loss of availability, financial extortion.Regular offline backups (3‑2‑1); patching; restrict macros; application control.
SpywareCollects user activity without consent.Privacy invasion, data leakage.Anti‑spyware tools; install only trusted software; browser anti‑tracking.
Card fraudUnauthorised use of card details; data obtained via skimming, phishing, breaches.Monetary loss, credit‑rating damage.Chip‑and‑PIN; PCI‑DSS compliant gateways; regular statement checks; virtual card numbers.

6. General Good Practices (Technical & Procedural)

  • Apply regular patch management for operating systems, browsers and all network services.

  • Keep anti‑malware software up to date and run scheduled scans.

  • Implement network segmentation to limit spread of malware.

  • Follow the 3‑2‑1 backup rule: three copies of data, on two different media types, with one copy stored off‑site.

  • Develop and test an incident‑response plan using the detect‑contain‑eradicate‑recover‑review steps.

  • Enforce the principle of least privilege – give users only the access they need.

  • Educate staff and pupils on recognising social‑engineering attacks (phishing, smishing, vishing, fake social‑media requests).

  • Use strong, unique passwords and store them in a reputable password manager.

  • Enable two‑factor authentication wherever possible.

  • Secure physical access to devices (lock screens, cable locks, secure storage cabinets).

Suggested diagram: Flowchart of a phishing attack – from receipt of the deceptive email, through clicking the fake link, credential capture, and final data loss.

7. Key Points for Revision

  1. Identify the delivery method for each threat (email, SMS, phone, network, removable media, social‑media).

  2. Recall the social‑engineering techniques used (urgency, authority, fear, curiosity).

  3. Link each threat to the CIA triad – what aspect of confidentiality, integrity or availability is most at risk?

  4. State at least two specific preventive measures for every threat.

  5. Describe the incident‑response steps (detect, contain, eradicate, recover, review) and how a compromised system is restored.

  6. Explain the main data‑protection principles and give examples of personal vs. sensitive data in both school and non‑school contexts.

  7. Remember the difference between encryption at rest and encryption in transit, and why both are required.

  8. Know the purpose of regular backups and the 3‑2‑1 rule.