7. Videos

35 videos: the MrBrownCS revision series, Computerphile deep dives, and films from TED, Cisco and IBM. Watch, then answer the “watch and think” questions.

Videos play from YouTube in privacy-enhanced mode, only when you press play. If YouTube is blocked, ask your teacher for the copies on Teams.

S1 Confidential information and why it must be protected

Open the lesson →

Why attackers target organisations, and what they are after.

Watch and think:

  • Which kinds of confidential information would each attacker want?

Open on YouTube ↗

T1 Malware, botnets and denial of service

Open the lesson →

Viruses, worms, trojans, ransomware and spyware compared.

Watch and think:

  • How does a worm spread without anyone opening a file?

Open on YouTube ↗

How infected devices are combined to knock services offline.

Watch and think:

  • Why are DDoS attacks hard to block?

Open on YouTube ↗

Stretch: a close look at the ransomware worm that hit hospitals in 2017.

Watch and think:

  • Which two controls would have limited the damage most?

Open on YouTube ↗

T2 Malicious hacking

Open the lesson →

How brute-force password attacks work.

Watch and think:

  • Why does a longer password take so much longer to crack?

Open on YouTube ↗

SQL injection, DoS and interception in one short video.

Watch and think:

  • What makes a website vulnerable to SQL injection?

Open on YouTube ↗

Stretch: a real SQL injection demonstrated on a test site.

Watch and think:

  • How do parameterised queries stop this attack?

Open on YouTube ↗

Stretch: how a script typed into a page can run in other people’s browsers.

Watch and think:

  • What could the attacker steal with the script?

Open on YouTube ↗

Stretch: how cracking tools guess hashed passwords.

Watch and think:

  • Why do salted hashes slow attackers down?

Open on YouTube ↗

T3 Social engineering

Open the lesson →

The main social engineering attacks and how to spot them.

Watch and think:

  • What is the difference between phishing and pharming?

Open on YouTube ↗

More social engineering methods and their impact on organisations.

Watch and think:

  • Which attack would work best against a busy receptionist, and why?

Open on YouTube ↗

T4 DNS attacks, insecure APIs, man-in-the-middle and open Wi-Fi

Open the lesson →

How an attacker sits between you and a website, and a real case where laptops shipped with the problem.

Watch and think:

  • Why do certificate warnings matter?

Open on YouTube ↗

Stretch: how a DNS server can be tricked into sending users to the wrong site.

Watch and think:

  • Which users are affected when a DNS cache is poisoned?

Open on YouTube ↗

Stretch: a real weakness found in Wi-Fi security and why patches mattered.

Watch and think:

  • Why did this attack need devices to be updated?

Open on YouTube ↗

V1 Technical vulnerabilities

Open the lesson →

Technical and human vulnerabilities in organisations.

Watch and think:

  • Which vulnerabilities are caused by out-of-date components?

Open on YouTube ↗

A security researcher shows how cars, pacemakers and phones can be attacked.

Watch and think:

  • Why are embedded devices often left unpatched?

Open on YouTube ↗

An attack through an unsecured smart thermostat on an unsegmented network.

Watch and think:

  • Which vulnerabilities did the attacker exploit?
  • Which lesson M5 control would have stopped it?

Open on YouTube ↗

V2 Human threats

Open the lesson →

Accidental and deliberate threats from inside an organisation.

Watch and think:

  • How should an organisation respond when a malicious employee is dismissed?

Open on YouTube ↗

V3 Physical vulnerabilities and the impact of threats

Open the lesson →

Locks, access control and biometrics.

Watch and think:

  • Which physical controls stop tailgating?

Open on YouTube ↗

More physical protection for sites and equipment.

Watch and think:

  • Pick one control for each layer: perimeter, building, server room.

Open on YouTube ↗

M1 Technical defences: settings, anti-malware, detection, hardening and updates

Open the lesson →

Anti-malware, updates and other defences.

Watch and think:

  • What actions can anti-malware take when it finds a threat?

Open on YouTube ↗

Detecting and preventing attacks on systems.

Watch and think:

  • What is the difference between detection and prevention?

Open on YouTube ↗

A tour of prevention measures used by organisations.

Watch and think:

  • Which measures are physical, which technical, and which people-based?

Open on YouTube ↗

M2 Encryption: hashing, symmetric and asymmetric

Open the lesson →

One key or a key pair: how each works.

Watch and think:

  • Why is asymmetric encryption used to share a symmetric key?

Open on YouTube ↗

What a hash is and why it is used for passwords.

Watch and think:

  • Why can’t a hash be reversed?

Open on YouTube ↗

The colour-mixing explanation of agreeing a key in public.

Watch and think:

  • What does the eavesdropper see, and why is it not enough?

Open on YouTube ↗

M3 People and access: policies, vetting, training, MFA, VPNs and APIs

Open the lesson →

How two-factor authentication works and why it helps.

Watch and think:

  • Which factor types does an authenticator app use?

Open on YouTube ↗

A clear case for turning on 2FA everywhere.

Watch and think:

  • What happens to a stolen password when 2FA is on?

Open on YouTube ↗

What a password manager stores and how it is protected.

Watch and think:

  • What is the biggest risk of a password manager, and how is it reduced?

Open on YouTube ↗

M4 Backups, port scanning and penetration testing

Open the lesson →

Full, incremental and differential backups and where to keep them.

Watch and think:

  • Which backup type gives the fastest restore?

Open on YouTube ↗

What penetration testers do and why it must be authorised.

Watch and think:

  • What makes hacking ‘ethical’?

Open on YouTube ↗

M5 Firewalls, network segregation and monitoring

Open the lesson →

How firewalls filter traffic with rules.

Watch and think:

  • Give one inbound and one outbound rule for a school.

Open on YouTube ↗

How an attack unfolds, and where monitoring and segregation help.

Watch and think:

  • At which point could network monitoring have spotted the attacker?

Open on YouTube ↗

C1 The CIA triad

Open the lesson →

Confidentiality, integrity and availability explained by a security architect.

Watch and think:

  • Give an attack that mainly affects each element.

Open on YouTube ↗

C2 Identification, authentication, authorisation and accountability (IAAA)

Open the lesson →

Stretch: how identity, authentication, authorisation and accounting work in real networks.

Watch and think:

  • Which part of IAAA do audit logs support?

Open on YouTube ↗