OCR J277 Mark Scheme - System Security

OCR	GCSE (9-1) Computer Science Mark Scheme J277/01: Unit 1.4 System Security

Question	Answer	Marks	Guidance
1	Row 1: Data Interception Row 2: SQL Injection Row 3: Brute-force Row 4: Phishing	4	AO1 (Knowledge) Award 1 mark for each correct tick. If more than one box is ticked in a row, award 0 marks for that row.
2a	Manipulating people... (1) ...into giving up confidential information / breaking security procedures. (1)	2	Do not allow: "Hacking" (too vague). Must focus on the human element, not just technical software exploits.
2b	Phishing uses emails/SMS (1) whereas Pharming uses fake websites/code. (1) OR Phishing requires the user to click a link (1) whereas Pharming redirects the user automatically. (1)	2	Answers must clearly distinguish the mechanism (email vs website/redirect).
2c	Looking over someone's shoulder/watching someone... (1) ...to see them enter their PIN / Password / sensitive data. (1)	2	Do not allow: "Stealing a laptop" (this is theft, not shoulder surfing).
3a	Denial of Service / DoS / DDoS	1	Do not allow: "Hacking". Allow: "Flooding attack".
3b	The attacker floods the server with useless traffic/requests. (1) This uses up the server's bandwidth / processing power / memory. (1) The server cannot respond to legitimate requests / slows down to a halt. (1)	3	Simply saying "it slows down the computer" is NE (Not Enough). Must reference resources (bandwidth, CPU, RAM) or volume of traffic.
4a	Virus: Software that replicates/copies itself (1). Attaches to files/damages data/corrupts the system (1). Spyware: Software that runs in the background/hidden (1). Records key presses / monitors activity / sends data to a third party (1).	4	Do not accept: "malware" as a description. For Spyware, "steals passwords" is okay but "records key presses" (Keylogger) is stronger.
4b	It encrypts / locks the data files. (1) The user must pay money/a fee to get the decryption key/access back. (1)	2	Do not allow: "Deletes the data" (Ransomware encrypts it; deletion is typical of viruses).
5a	Malicious SQL code/commands are entered... (1) ...into a web form / input box. (1) To trick the database into running the code / bypassing validation. (1)	3	Candidates must mention input forms and database commands.
5b	Any one: Unauthorised access to data / view private data. Modify / Delete / Drop tables in the database. Bypass login screens.	1	Do not allow: "Crash the website" (This is usually DoS).
6a	Trial and error method. (1) Uses software to try all possible combinations of characters/passwords. (1)	2	"Guessing" implies a human; "Software/Program" implies the automated nature of a true Brute-force attack.
6b	It limits the number of attempts a hacker can make. (1) Brute-force requires thousands/millions of tries, so this makes the attack take too long to be feasible. (1)	2	The key point is time. Brute force relies on speed; locking an account removes the speed advantage.
6c	Software: Strong Password / 2-Factor Authentication / Firewall / User Access Levels. Physical: Locked doors / Biometrics / CCTV / Security Guards.	2	Ensure "Software" isn't just "Antivirus". Do not allow "Encryption" (protects storage, not access).
6d	Why: Public Wi-Fi is often unencrypted / uses shared connections (1). Packet sniffing / Data interception software can easily read traffic (1). What to check: Check for HTTPS / Padlock icon (1). To ensure the connection is encrypted (1).	4	Ideally, the student identifies that HTTPS uses encryption to stop the interception threat.