Security Aspects

A network that lets you share files and reach any website also lets harmful software and people reach you. This chapter names the threats — the different kinds of malicious software and how each spreads, unwanted mail, cookies that track, attackers who break in and attacks that knock a service offline — and the defences against them: antivirus software and how it detects malware, encrypted connections with HTTPS, and firewalls. Questions are mostly "which threat fits this description", and the descriptions are close, so learn the one feature that separates each from its neighbours.

Malware and Its Kinds

Malware — malicious software — is any program written to disrupt a computer, steal data or gain unauthorised access. The kinds differ in how they spread and what they do:

Kinds of malware
KindWhat sets it apart
Virusattaches itself to a host program or file and spreads when that file is run or shared — it needs a host and human action
Worma standalone program that copies itself and spreads across a network on its own, with no host file and no user action
Ransomwarelocks the user out of the system or encrypts their files and demands a payment (ransom) to restore access; WannaCry, in 2017, was a widely reported attack
Trojandisguises itself as useful or legitimate software; it does not replicate, but once installed it can damage data or open a backdoor for an attacker
Spywaresecretly records the user's activity and information and sends it to someone else
Adwarefloods the user with unwanted advertisements, often while also tracking their browsing
Keyloggerrecords every key pressed, capturing passwords and card numbers; it may be software, or a small hardware device placed between keyboard and computer
⚠️ Virus, worm or Trojan?
Ask two questions. Does it need a host file? A virus does; a worm and a Trojan do not. Does it copy itself? A virus and a worm do; a Trojan does not — it relies on the user installing it because it looks harmless.

How Malware Spreads, and How It Is Fought

  • Downloaded from the Internet — from unsafe sites, pirated software or fake updates.
  • Spam e-mail — attachments or links in unwanted bulk mail. Spam itself is unsolicited messages sent in bulk; it wastes time and storage and is a common carrier of malware and fraud.
  • Removable storage — infected pen drives and memory cards moved between computers.
  • Network propagation — worms that move from one vulnerable computer to the next on their own.

The defences follow: keep antivirus software and the operating system updated, avoid opening attachments or links from unknown senders, scan removable drives before opening them, download only from trusted sources, use a firewall, and back up important data. To defeat a software keylogger when entering a password on a shared computer, an on-screen (virtual) keyboard clicked with the mouse can be used, since no keys are pressed.

How antivirus software detects malware
MethodHow it works
Signature-based detectioncompares files with a database of patterns (signatures) of known malware; fast and accurate for known threats, but blind to new malware until the database is updated
Sandbox detectionruns a suspicious program in an isolated virtual environment and watches what it does, without risk to the real system
Heuristicsexamines a program's code and behaviour for features typical of malware, so it can flag new variants with no signature yet
Data mining techniquesclassify a file as harmful or not from patterns learnt across large numbers of known files
Real-time protectionscans files continuously as they are opened, downloaded or run, rather than only during a scheduled scan

HTTP and HTTPS, Firewalls, and Cookies

With HTTP, data between the browser and the website travels as plain text, so anyone who intercepts it can read it — a password included. HTTPS (HTTP Secure) encrypts the data using SSL/TLS, and the website proves its identity with a digital certificate; browsers show a padlock beside such an address. HTTPS matters wherever a password, payment or personal detail is entered.

A firewall is a network security system that monitors incoming and outgoing traffic and allows or blocks it according to a set of rules — a guard at the boundary between a trusted network and an untrusted one such as the Internet. A network firewall sits between networks, as hardware or software, protecting every computer behind it; a host-based (personal) firewall is software on a single computer, protecting that machine alone.

A cookie is a small text file that a website stores on the user's computer through the browser, so that it can remember the visitor — keeping them logged in, remembering preferences or the items in a shopping cart. Cookies are data, not programs, and are not harmful in themselves, but they raise privacy concerns: third-party cookies, set by a domain other than the site being visited, can be used to track a person's browsing across many sites, and a stolen session cookie can let someone impersonate a logged-in user.

Hackers, Crackers and Network Threats

  • White hat hackers (ethical hackers) find weaknesses in a system with the owner's permission so that they can be fixed.
  • Black hat hackers (crackers) break into systems without permission for malicious ends — theft, damage or ransom.
  • Grey hat hackers probe systems without permission but without malicious intent, often reporting what they find.

A Denial of Service (DoS) attack floods a server or network with so many requests that genuine users cannot be served; it attacks availability, not secrecy. In a Distributed DoS (DDoS) attack the flood comes from many compromised computers at once — a botnet of "zombie" machines whose owners usually do not know — which makes it far harder to block than traffic from a single source. An intruder may also attack confidentiality. Snooping is gaining unauthorised access to another person's data or communication, which may be examined later. Eavesdropping is secretly listening to a private communication as it happens — intercepting a call or a chat in real time.

Key takeaways

  • A virus needs a host file and spreads when it is run; a worm spreads by itself over networks; a Trojan looks legitimate and does not replicate.
  • Ransomware encrypts or locks data for a payment; spyware steals information; adware pushes ads; a keylogger records keystrokes.
  • Malware spreads through downloads, spam attachments, removable drives and network propagation.
  • Signature-based detection misses new malware; sandboxing and heuristics catch what has no signature yet.
  • HTTPS encrypts what HTTP sends as plain text; a firewall filters traffic by rules; cookies are small text files that can threaten privacy.
  • White hats hack with permission, black hats (crackers) with malice; DoS floods a service, DDoS does it from many machines; eavesdropping intercepts in real time.

Practice questions (8)

Attempt each one before opening the answer. Every explanation names the tempting wrong option as well as the right one, because that is where marks are lost.

  1. A malicious program copies itself from one computer to another across a network on its own, without attaching to any file and without the user doing anything. What is it?

    1. Virus
    2. Trojan
    3. Worm
    4. Adware
    Show answer

    Answer: C — Worm

    Self-replication across a network with no host file and no user action is what defines a worm. A virus also copies itself but needs a host file and spreads when that file is run or shared. A Trojan does not replicate at all — it depends on the user installing it — and adware displays unwanted advertisements.

  2. An office finds all its files encrypted and a message demanding payment for the key to unlock them. Which kind of malware is responsible?

    1. Spyware
    2. Ransomware
    3. Keylogger
    4. Adware
    Show answer

    Answer: B — Ransomware

    Ransomware blocks access to data, typically by encrypting it, and demands a ransom for its release — WannaCry in 2017 worked this way. Spyware and keyloggers steal information quietly and want to stay unnoticed, the opposite of announcing themselves with a demand. Adware shows advertisements and does not lock files.

  3. A free "photo editor" downloaded from an unknown site works as advertised, but it has also quietly opened a backdoor for an attacker. It does not copy itself to other files. What is it?

    1. Worm
    2. Virus
    3. Cookie
    4. Trojan
    Show answer

    Answer: D — Trojan

    A Trojan disguises itself as useful software so that the user installs it willingly, then carries out a hidden harmful task such as opening a backdoor; it does not replicate. A worm and a virus both copy themselves, which the question rules out. A cookie is a small text file stored by a website, not a program that can open anything.

  4. Why should a password be entered only on a website whose address begins with https rather than http?

    1. HTTPS encrypts the data between browser and server, while HTTP sends it as plain text
    2. HTTPS pages load faster because they are stored on the user's computer
    3. HTTPS blocks every virus on the user's computer
    4. HTTPS stops the website from storing any cookies
    Show answer

    Answer: A — HTTPS encrypts the data between browser and server, while HTTP sends it as plain text

    Over HTTP the password travels as readable text that anyone intercepting the connection can see; HTTPS encrypts it with SSL/TLS and the site proves its identity with a certificate. HTTPS protects data in transit only — it does not remove malware already on the computer, does not make pages local, and does not prevent a site from setting cookies.

  5. What is the main function of a firewall?

    1. To remove viruses that have already infected files on the disk
    2. To speed up the network by compressing data
    3. To monitor incoming and outgoing traffic and allow or block it according to rules
    4. To translate domain names into IP addresses
    Show answer

    Answer: C — To monitor incoming and outgoing traffic and allow or block it according to rules

    A firewall stands at the boundary of a network or computer and filters traffic in both directions against a set of rules, stopping unauthorised connections. Removing infections from files is the job of antivirus software, which works on what is already inside. A firewall does not compress data, and translating names into addresses is what DNS does.

  6. Which statement about cookies is correct?

    1. They are programs that run on the user's computer and can spread like viruses
    2. They are small text files stored by websites in the browser, and third-party cookies can track browsing
    3. They are stored on the website's server and never on the user's computer
    4. They encrypt the connection between browser and server
    Show answer

    Answer: B — They are small text files stored by websites in the browser, and third-party cookies can track browsing

    A cookie is a small text file a website saves on the user's computer through the browser, to remember logins, preferences or a cart; third-party cookies, from domains other than the site visited, can follow a person across sites, which is the privacy concern. Cookies are data, not programs, so they cannot run or replicate. They live on the user's side, and encryption is the work of HTTPS.

  7. A website becomes unreachable because thousands of compromised computers around the world flood it with requests at the same moment. What is this attack called?

    1. Eavesdropping
    2. Snooping
    3. Phishing through spam
    4. Distributed Denial of Service (DDoS)
    Show answer

    Answer: D — Distributed Denial of Service (DDoS)

    Overwhelming a service so that genuine users cannot reach it is denial of service, and when the flood comes from many compromised machines at once — a botnet — it is distributed DoS, much harder to block than a single source. Eavesdropping and snooping attack secrecy by intercepting or accessing data, not availability, and spam-based phishing tricks individual users rather than flooding a server.

  8. Assertion (A): Signature-based antivirus software may fail to detect a newly created virus. Reason (R): Signature-based detection identifies malware by matching files against a database of patterns of already known malware.

    1. Both A and R are true, and R is the correct explanation of A
    2. Both A and R are true, but R is not the correct explanation of A
    3. A is true, but R is false
    4. A is false, but R is true
    Show answer

    Answer: A — Both A and R are true, and R is the correct explanation of A

    A new virus has no signature in the database yet, so a method that works only by matching known signatures cannot recognise it until the database is updated. R states exactly that mechanism, so it explains A. This is why antivirus software adds sandboxing and heuristics, which judge a program by its behaviour or code rather than by a stored pattern.