O-LevelComputer ScienceThe Internet and its uses2210/11 · May/June 2015 · Q610 Marks

Viruses, pharming and phishing are all examples of potential Internet security issues.

(a)Explain what is meant by each of these three terms. Virus Pharming Phishing[6]
(b)(i)An online bank requires a client to supply an 8-digit code each time they wish to access their account on the bank's website. Rather than ask the client to use a keyboard, they are requested to use an on-screen keypad (shown on the right) to input the 8-digit code. [Figure showing an on-screen keypad with digits 2, 5, 1, 6, 8, 3, 9, 0, 4, 7 in a 3x3 + 1 layout] The position of the digits on the keypad can change each time the website is visited. The client uses a mouse or touch screen to select each of the 8 digits. Explain why the bank has chosen to use this method of entering the 8 digits.[2]
(b)(ii)Name and describe another measure that the bank could introduce to improve the security of their website. Name Description[2]

This question uses a diagram from the original paper, which isn't shown here. Open the full paper from the past papers archive to see it.

Mark scheme

Marking points from the official mark scheme (May/June 2015). The mark or mark type is shown in brackets.

[(a) virus] [1] program/software that replicates/copies itself
[(a) virus] [1] can delete or alter files/data stored on a computer
[(a) virus] [1] can make the computer "crash"/run slow
[(a) pharming] [1] malicious code/software installed on a user's hard drive/actual web server
[(a) pharming] [1] this code redirects user to a fake website (without their knowledge)
[(a) pharming] [1] to obtain personal/financial information/data
[(a) phishing] [1] legitimate-looking emails sent to a user
[(a) phishing] [1] as soon as recipient opens/clicks on link in the email/attachment ...
[(a) phishing] [1] the user is directed to a fake website (without their knowledge)
[(a) phishing] [1] To obtain personal/financial information/data
[(b)(i)] [1] spyware/key logging software can only pick up key presses
[(b)(i)] [1] using mouse/touchscreen means no key presses to log
[(b)(i)] [1] the numbers on the key pad are in random/non-standard format, which makes it more difficult to interpret
[(b)(ii) Name and Description (1 mark each)] chip and PIN reader / only the user and the bank know which codes can be generated
[(b)(ii) Name and Description (1 mark each)] request user name / additional security together with password/PIN
[(b)(ii) Name and Description (1 mark each)] anti-virus / removes/warns of a potential virus threat which can't be passed on to customers
[(b)(ii) Name and Description (1 mark each)] firewall / (helps) to protect bank computers from virus threats and hacking
[(b)(ii) Name and Description (1 mark each)] encryption / protects customer data by making any hacked information unreadable
[(b)(ii) Name and Description (1 mark each)] security protocol / governs the secure transmission of data
[(b)(ii) Name and Description (1 mark each)] Biometric / to recognise user through the use of, e.g. facial/retina/finger print
[(b)(ii) Name and Description (1 mark each)] Alerts / users IP/MAC address is registered and user is alerted through, e.g. SMS if account is accessed through an unregistered address