Predict: Security Threats

Answer: Phishing (Social Engineering)

Warning signs:

• Fake domain: "barclays-alerts.net" is not the real Barclays domain (barclays.co.uk)
• Urgency and threats: Creates panic with "24 hours" deadline and "suspended" threat
• Generic greeting: Doesn't use Emma's name
• Requesting action: Asks user to click a link (likely to a fake login page)

What Emma should do: Don't click the link. Go directly to barclays.co.uk and log in there to check her account.

Answer: DDoS (Distributed Denial of Service)

How it works:

• Attackers control a botnet (network of infected computers)
• All infected computers send requests simultaneously
• The website's servers become overwhelmed
• Legitimate customers cannot access the site

Purpose: The attackers may be trying to extort money, damage the company's reputation, or cause financial losses during a busy sales period.

Answer: Baiting (Social Engineering) + Malware Delivery

How it works:

• Attacker leaves USB drives in places where targets will find them
• Tempting labels exploit curiosity ("Exam Answers", "Payroll", "Private Photos")
• When plugged in, malware automatically installs on the computer

What could happen:

• Trojan could give attackers remote access
• Ransomware could encrypt Tom's files
• Spyware could steal passwords and personal data
• Worm could spread through the school network

What Tom should do: Never plug in unknown USB drives. Give it to IT staff to investigate safely.

Answer: Ransomware

How it works:

• Malware encrypts all files on the system
• Victims cannot access their own data
• Attackers demand cryptocurrency payment (hard to trace)
• May or may not provide decryption key after payment

Why hospitals are targeted:

• Patient lives depend on access to medical records
• Urgency means they may pay quickly
• Often have older, vulnerable systems
• Large organisations with resources to pay

Answer: Brute-Force Attack (Dictionary/Hybrid)

Type of technique:

• Dictionary attack: Using common passwords ("password")
• Hybrid attack: Combining dictionary words with numbers and symbols

Why this works: Many people use simple, predictable passwords. The attack tries common variations automatically.

Protection measures:

• Account lockout after failed attempts
• CAPTCHA to prevent automated attempts
• Two-factor authentication
• Using strong, unique passwords

Answer: Data Interception / Man-in-the-Middle Risk

Risks:

• Fake hotspot: The WiFi might not be the coffee shop's - it could be an attacker's
• Unencrypted traffic: Data on public WiFi can potentially be intercepted
• Man-in-the-middle: Attacker could be positioned between Sarah and her bank

Potential consequences:

• Banking credentials could be captured
• Session could be hijacked
• Financial data could be stolen

What Sarah should do: Use mobile data for banking, or ensure she's using HTTPS (padlock icon) and consider a VPN.

Answer: Social Engineering (Pretexting)

How it works:

• Attacker creates a believable scenario (the "pretext")
• Impersonates authority figure (IT department)
• Creates urgency ("this weekend")
• Requests sensitive information (login credentials)

Red flags:

• Legitimate IT never asks for passwords over the phone
• Email migrations don't require sharing passwords
• The caller initiated contact (not the teacher)

What the teacher should do: Hang up and call the IT department directly using the official number to verify the request.

Answer: Multiple Types of Malware

Likely infections:

• Trojan: The "free video converter" was disguised malware
• Adware: Causing the pop-up advertisements
• Browser hijacker: Redirecting searches to malicious sites
• Possibly spyware: May be monitoring James's activity in the background

Why the computer is slow: Multiple malware programs running in the background consuming resources.

What James should do:

• Run a reputable antivirus/anti-malware scan
• Uninstall the suspicious software
• Only download software from official sources in future

Answer: SQL Injection Vulnerability

The vulnerability: User input is directly inserted into SQL queries without validation or sanitisation.

What an attacker could do:

• Extract data: Get customer details, passwords, credit card numbers
• Modify data: Change prices, modify user accounts
• Delete data: Drop tables, destroy records
• Bypass login: Access admin accounts without passwords

Example attack: An attacker could enter: ' OR '1'='1' -- to bypass authentication or extract all data.

Answer: Email Worm

How it spreads:

• User clicks malicious link or opens attachment
• Worm installs itself on the computer
• Worm accesses the user's email contacts
• Sends copies of itself to all contacts
• Recipients trust emails from known contacts, so they click too
• Cycle repeats, spreading exponentially

Why worms are dangerous:

• Self-replicating - spreads without user action after initial infection
• Can overwhelm networks with traffic
• Exploits trust between colleagues
• Often carries additional malware payloads

Answer: Spyware (Keylogger)

How keyloggers work:

• Records every keystroke made on the computer
• Captures passwords, emails, documents as they're typed
• Sends recorded data back to the attacker
• Runs invisibly in the background

Purpose in this case: Corporate espionage - stealing trade secrets and competitive intelligence

What the attacker gained:

• Product development plans
• Launch dates and strategies
• Possibly login credentials for company systems
• Internal communications and decisions

Answer: Tailgating + Physical Access Attack

Tailgating explained:

• Following an authorised person through a secure entrance
• Exploits politeness - people hold doors for others
• Coffee cups suggest the person belongs and is just busy
• Bypasses electronic access controls entirely

What the device might do:

• Install malware or a backdoor
• Capture network traffic
• Steal login credentials
• Provide remote access to the network

Prevention: Always verify unknown people, don't hold doors for strangers, report suspicious behaviour.