HookThe attack that shut down a third of NHS trusts started with one unpatched machine
At around 08:00 on Friday 12 May 2017, screens across dozens of NHS trusts froze on the same red message: your files have been encrypted, pay $300 in Bitcoin. The malware was WannaCry, a piece of ransomware that spread on its own from computer to computer using a Windows networking flaw that Microsoft had actually patched two months earlier. The trusts that were hit had one thing in common — machines that had never installed the update. Roughly 19,000 appointments and operations were cancelled, and NHS England later put the cost at about £92 million. Not a single nurse clicked a dodgy link. The door was simply left unlocked.
That is the whole of section 1.4 in one story. A threat is any way an attacker can get in — through the software (malware, SQL injection), through the network (brute-force, denial of service, interception), or through the person at the keyboard (social engineering). A vulnerability is the weakness the threat exploits — an unpatched system, a reused password, a form that trusts whatever you type. And prevention is the layered set of locks — patching, firewalls, anti-malware, access levels, encryption, physical security — that closes those gaps. OCR wants you to name the threat, explain precisely how it works, and match it to the defence that actually stops it. Vague answers such as "a firewall keeps you safe" earn almost nothing; "a firewall inspects packets against a rule set and blocks traffic on ports the organisation has not authorised" earns the mark.
ModelMalware — the families and what makes them different
Malware (malicious software) is any program written to damage, disrupt or gain unauthorised access to a system. OCR expects you to distinguish the families, because the defence differs for each. A virus attaches itself to a file or program and only spreads when a human runs that infected file. A worm is the dangerous cousin: it self-replicates across a network with no human action at all — WannaCry was a worm, which is exactly why it tore through hospital after hospital in hours. A trojan disguises itself as something desirable — a free game, a cracked app, an invoice attachment — and does its damage once you willingly install it. Ransomware encrypts your files and demands payment for the key. Spyware hides and records what you do — keystrokes, passwords, screenshots — and sends it back to the attacker.
The examiner's favourite distinction is virus versus worm, because it decides how fast an outbreak spreads and how you contain it. A virus outbreak is limited by how many people open the file; a worm outbreak is limited only by the network. That single difference is why the strongest defence against worms is patching and network segmentation, while the strongest defence against trojans is user education and not installing untrusted software.
Classify three incidents. (1) A pupil downloads a "free" copy of an expensive design program; it installs the software but also opens a hidden backdoor for the attacker — that is a trojan, because it relied on the victim choosing to install it. (2) A file server locks every document and displays a countdown demanding cryptocurrency — ransomware. (3) A program copies itself to every other PC on the school network overnight without anyone opening anything — a worm, self-replicating across the network. Same word "malware" in each headline; three different mechanisms, three different fixes.
MechanismSocial engineering — attacking the human, not the machine
The cheapest way past a firewall is to persuade someone on the inside to open the door for you. Social engineering is manipulating people into giving up information or access. The headline form is phishing: a fake email or message, dressed up as a bank, a delivery company or your own IT department, that pushes you to click a link and type your credentials into a convincing clone of the real login page. Related tricks include blagging (inventing a scenario — "I'm calling from the helpdesk, I just need your password to fix your account"), pharming (redirecting you to a fake site even when you type the correct address), and shouldering (simply watching someone enter a PIN or password over their shoulder).
What makes social engineering so effective is that it bypasses every technical control. Your anti-malware, firewall and encryption are all working perfectly at the exact moment you type your password into a fraudulent form — because you authorised it. This is why the only real defence is human: training staff to check sender addresses, to distrust urgency ("act within 24 hours or your account is closed"), and to verify unexpected requests through a second channel.
Read the link before you click. A phishing email claims to be from a bank and the button says www.hsbc-secure-login.com. The trick is in the structure of a web address: the real domain is the part immediately before the final .com — here that is hsbc-secure-login, a domain the attacker registered, not hsbc.co.uk. Compare it with a genuine address such as accounts.hsbc.co.uk, where the real domain is hsbc.co.uk and "accounts" is only a subdomain the bank controls. Reading a URL from the right way in — final domain first — is the single habit that defeats most phishing links.
DataBrute-force, denial of service and data interception
Some attacks skip trickery and simply overpower the system. A brute-force attack tries every possible password until one works — automated software can test millions of guesses per second, so the only thing standing in its way is the sheer number of combinations. That number is called the keyspace, and it grows explosively with both the length of the password and the range of characters allowed, which is precisely why length and character variety are demanded.
A denial of service (DoS) attack does not steal anything — it floods a server with so many requests that it cannot answer legitimate users, knocking the service offline. A distributed denial of service (DDoS) does it from thousands of hijacked machines at once. In October 2016 the Mirai botnet — an army of hacked webcams and home routers — aimed a DDoS at the DNS provider Dyn and took Twitter, Reddit, Spotify and Netflix offline across much of the US. Data interception is the third: capturing data as it travels across a network ("packet sniffing" on unencrypted Wi-Fi), which is exactly the risk that encryption is designed to remove.
Work out why length beats cleverness. A 6-character password using only lowercase letters has a keyspace of 26^6 = 308,915,776 combinations — under 310 million, which fast hardware clears in seconds. Extend it to 8 lowercase characters and the keyspace becomes 26^8 = 208,827,064,576 — about 209 billion, roughly 676 times harder just from two more letters. Now allow uppercase, lowercase and digits (62 possible characters) at 8 characters: 62^8 ≈ 2.18 × 10^14 — around 218 trillion, roughly a thousand times harder again than the lowercase version. Each extra character multiplies the keyspace; each extra character type raises the base it multiplies. That is the mathematics behind every "use 12+ characters with symbols" rule.
MechanismSQL injection — when a website trusts what you type
A database-driven website builds a database query out of whatever a user enters into a form. SQL injection exploits sites that paste that input straight into the query without checking it, letting an attacker smuggle in database commands of their own. It is not a niche flaw: in October 2015 a teenager used SQL injection against the broadband provider TalkTalk, exposing the personal data of around 157,000 customers. The Information Commissioner's Office fined TalkTalk £400,000 — a record penalty at the time — and the root cause was a public web page that had never been secured against exactly this attack.
The defence is input validation and, more robustly, parameterised queries (also called prepared statements), which keep the user's input strictly as data and never let it be executed as a command. OCR does not require you to write secure SQL, but it does expect you to explain that the vulnerability is trusting unvalidated input, and that validating or sanitising input closes it.
See the trick in one line. Suppose a login page builds this query, pasting the username straight in: SELECT * FROM Users WHERE Username = '[input]' AND Password = '[input]'. A normal user types jsmith and the query checks that row. An attacker instead types ' OR '1'='1 into the username box. The query becomes … WHERE Username = '' OR '1'='1' AND … — and because '1'='1' is always true, the condition passes for the very first row in the table, often logging the attacker straight in as an administrator without ever knowing a password. The fix is to reject or escape characters like the apostrophe so input can never change the shape of the query.
ModelPreventing vulnerabilities — defence in layers
OCR's prevention list (1.4.2) is best remembered as layers, because no single control is enough. Penetration testing is paying ethical hackers to attack your own systems and report the holes before a criminal finds them. Anti-malware software scans files against known signatures and suspicious behaviour and quarantines threats. A firewall sits between your network and the outside world and permits or blocks traffic according to rules — for example, blocking every port except the ones a service genuinely needs. User access levels enforce "least privilege": a classroom account cannot install software or read the payroll, so a compromised pupil login cannot do administrator-level damage. Strong passwords (and better, multi-factor authentication) defeat brute-force by making the keyspace impractically large. Physical security — locked server rooms, swipe cards, CCTV — matters because an attacker with physical access can bypass most software controls.
Encryption is the last line: it scrambles data using a key so that even if it is intercepted or stolen, it is unreadable without that key. This is why interception of encrypted Wi-Fi yields gibberish, and why a stolen encrypted laptop is a lost asset rather than a data breach. Match each control to the threat it counters and you have answered almost any 1.4.2 question.
Encryption, by hand. A simple Caesar cipher shifts every letter along the alphabet by a fixed key. With a key of +3, encrypt the word HELLO: H→K, E→H, L→O, L→O, O→R, giving the ciphertext KHOOR. Anyone intercepting KHOOR without the key of 3 sees nonsense; the recipient shifts back by 3 to recover HELLO. Real systems use keys far too large to brute-force rather than a shift of three, but the principle the exam wants is identical: without the key, the intercepted data is meaningless.
VocabularyKey terms the mark scheme pays for
TrapsMisconceptions that cost marks
ExamWhat examiners want
OCR J277 assesses this content in Component 01 (Computer systems), and the marks split across the three assessment objectives. AO1 wants precise recall: name the threat and state what it is — write "a worm self-replicates across a network without user action", not "a worm is bad malware". AO2 wants you to apply it to the scenario in the question: if the stem describes staff receiving fake IT-department emails, name it as phishing (social engineering) and say why that specific control — staff training and sender verification — is the right defence, rather than listing every security measure you know.
The higher marks live in AO3, the extended-response questions (often 8 marks, marked on levels of response). These usually ask you to discuss or evaluate the security measures a named organisation should take. A Level 3 answer does three things a list cannot: it links each threat to a specific, appropriate countermeasure (SQL injection to input validation, brute-force to strong passwords and MFA, interception to encryption); it weighs trade-offs (strict access levels and physical security cost money and can slow staff down); and it ends with a justified recommendation — "the priority is patching and staff training, because the WannaCry and phishing routes account for most real breaches." Two habits secure marks students routinely drop: always pair a threat with the matching defence rather than describing them in separate lists, and quote a real number or case (WannaCry's £92m, TalkTalk's £400,000 fine) to anchor the point in evidence.