# Threats to security

> Computer Science · 9618
> Source: https://www.owlsprep.com/study/cie-9618-u6-threats-to-security/

This sub-topic introduces the full range of intentional and accidental threats to computer system security, including malware, social engineering, and network-based attacks. You will learn to identify and describe each threat for CIE exam responses.

**Prerequisites:** [Basic understanding of computer networks and data storage](https://www.owlsprep.com/study/cie-9618-u2-networks-and-data-transfer/)

## Learning objectives

- Classify threats as intentional or accidental
- Distinguish between common types of malware
- Describe different social engineering and network-based threats
- Correctly use threat terminology in exam responses

## 1. Classification of Threats

Threats to system security are any events or circumstances that can compromise the confidentiality, integrity, or availability of data or systems. They are broadly split into two core categories: intentional and accidental.

**Security Threat** — Any event or action that has the potential to compromise the confidentiality, integrity, or availability of a computer system or stored data

*Example:* A fraudulent phishing email sent to company employees is a common security threat.

**Worked example:** Classify each of the following as accidental or intentional threat: (a) An employee deletes the wrong customer database by mistake (b) A hacker sends malicious traffic to take a company website offline

1. Recall the core difference between the two categories: intentional threats are deliberate acts of harm, while accidental threats are unintended events.
2. Evaluate (a): The deletion is unintended, caused by human error. This is an accidental threat.
3. Evaluate (b): The attack is a deliberate act to disrupt the website. This is an intentional threat.

## 2. Malicious Software (Malware) Threats

Malware is the most common category of intentional technical threat, consisting of software designed to cause harm, steal data, or gain unauthorised access to systems. There are several distinct types of malware tested regularly in CIE exams.

**Malware** — Short for malicious software: any software intentionally created to cause damage, disruption, or unauthorised access to a computer system

*Notation:* Commonly abbreviated as malware

- **Virus**: Malware that attaches to a legitimate program and replicates only when the program is run, usually corrupting or deleting files.
- **Worm**: Self-replicating malware that spreads automatically across networks without any human action, often consuming bandwidth and crashing systems.
- **Trojan Horse**: Malware disguised as legitimate software that creates a hidden backdoor for unauthorised remote access.
- **Ransomware**: Malware that encrypts a user's or organisation's data and demands a ransom payment to restore access.
- **Spyware**: Malware that secretly collects user information and activity without consent.

**Worked example:** A user downloads what appears to be a free photo editing app. After installation, the attacker can remotely access the user's private files. Name and describe the type of malware in this scenario.

1. Identify the key characteristics of the attack: the malware is disguised as a legitimate program and creates a backdoor for remote access.
2. Match the characteristics to the correct malware type: this is a Trojan Horse.
3. Write the full exam response: This is a Trojan Horse, a type of malware that disguises itself as legitimate software. Once installed, it creates a backdoor that allows the attacker to gain unauthorised access to the user's private files.

> **Exam tip:** CIE questions almost always ask you to distinguish between different malware types, so remember the unique defining feature of each type instead of just giving a general description.

## 3. Social Engineering Threats

Social engineering is a category of non-technical threat that relies on psychological manipulation of people, rather than technical exploits, to gain access to sensitive information or systems. It is one of the most common attack vectors used today.

**Social Engineering** — A method of attack that uses human interaction and psychological manipulation to trick people into revealing confidential information or granting unauthorised access.

- **Phishing**: Sending fraudulent emails or messages that mimic legitimate organisations to trick users into revealing passwords or financial details.
- **Spear Phishing**: A targeted phishing attack aimed at a specific individual or organisation, often with personalised details to seem more legitimate.
- **Baiting**: Leaving a malware-infected USB drive labelled with a tempting name (e.g. "Salaries 2024") to trick an employee into plugging it into their work computer.
- **Tailgating**: Gaining physical access to a secured building by following an authorised employee through a locked access door.

**Worked example:** An attacker sends an email to a company's CEO pretending to be from their bank, asking for the CEO's online banking password to "verify account details". Name this threat and explain why it is a form of social engineering.

1. Identify key features: the attack is targeted at a specific individual and uses deception to trick the victim into revealing a password.
2. This attack is spear phishing, a specific type of social engineering attack.
3. It is social engineering because it relies on psychological manipulation (pretending to be the bank to gain trust) rather than a technical exploit to obtain the password, not on breaking into the bank's system directly.

## 4. Network and Insider Threats

Network-based threats target the availability and integrity of networked services and communication. Insider threats are a separate category that originates from within the target organisation.

- **Distributed Denial of Service (DDoS)**: An attack that uses thousands of compromised devices to flood a target server or network with traffic, overwhelming it and making the service unavailable to legitimate users.
- **Man-in-the-Middle (MitM)**: An attack where the attacker intercepts communication between two parties, allowing them to steal sensitive data or alter communication in transit.
- **Insider Threat**: A threat originating from an employee, contractor, or other person with internal access, which can be intentional (data theft) or accidental (clicking a phishing link).

**Worked example:** A small business's website becomes completely unresponsive after being flooded with thousands of fake requests from compromised devices across the world. What type of attack is this, and what is its goal?

1. Identify key details: the website is overwhelmed by fake traffic from multiple compromised devices.
2. This is a Distributed Denial of Service (DDoS) attack.
3. The primary goal of the attack is to overwhelm the website's server with more traffic than it can handle, denying access to the website for all legitimate users. Attackers may also use DDoS attacks to extort money or distract from other malicious activity.

## Common pitfalls

- **Wrong:** Claiming worms require human action to spread, same as viruses.
  - Why it fails: Viruses require a user to run an infected program to replicate, while worms self-replicate automatically across networks.
  - Correct: Remember: Worms spread Without human action, Viruses need User action to run.
- **Wrong:** Stating that Trojan horses are self-replicating malware.
  - Why it fails: Trojans do not replicate; they rely on social engineering to trick users into installing them.
  - Correct: Trojans are disguised malware that create backdoors, and do not replicate on their own.
- **Wrong:** Classifying phishing as a type of malware.
  - Why it fails: Phishing is a social engineering technique that may deliver malware, but it is not malware itself.
  - Correct: Phishing is a social engineering attack that manipulates users into revealing sensitive information.
- **Wrong:** Claiming all insider threats are intentional acts of harm.
  - Why it fails: Most insider threats are accidental, caused by employee error rather than malicious intent.
  - Correct: Insider threats include both intentional malicious acts and accidental errors that compromise security.
- **Wrong:** Saying DDoS attacks originate from a single source.
  - Why it fails: The 'D' in DDoS stands for distributed, meaning the attack comes from many distributed compromised devices.
  - Correct: DDoS = Distributed Denial of Service, originating from hundreds or thousands of devices across the world.

## Cheatsheet

| Threat Type | Category | Key Defining Feature |
| --- | --- | --- |
| Accidental threat | General | Unintended harm from error or failure |
| Intentional threat | General | Deliberate act to compromise security |
| Virus | Malware | Needs user action to replicate, attaches to programs |
| Worm | Malware | Self-replicates automatically across networks |
| Trojan Horse | Malware | Disguised as legitimate software, creates backdoor |
| Ransomware | Malware | Encrypts data and demands ransom for access |
| Phishing | Social Engineering | Generic fraudulent messages to steal data |
| Spear Phishing | Social Engineering | Targeted attack on a specific person |
| DDoS | Network Threat | Floods target from many devices to take it offline |
| MitM | Network Threat | Intercepts communication to steal or alter data |

## What's next

Now that you understand the full range of threats to computer security, you are ready to learn how organisations counter these threats with technical and administrative security measures. Recognising different threats is the foundation for designing effective security systems, a topic tested in both Paper 1 and Paper 2 of CIE 9618. You will also need this knowledge to answer case study questions that ask you to evaluate security risks for a given scenario, which make up a large portion of your exam grade. This understanding also underpins upcoming topics around encryption, privacy, and data integrity in this unit.

- [Data Integrity](https://www.owlsprep.com/study/cie-9618-u6-data-integrity/)
- [Encryption](https://www.owlsprep.com/study/cie-9618-u6-encryption/)
- [Access Control](https://www.owlsprep.com/study/cie-9618-u6-access-control/)

---

From [OwlsPrep](https://www.owlsprep.com) — free study guides for A-Level, IB, AP and IGCSE, written against the official syllabus. Canonical page: https://www.owlsprep.com/study/cie-9618-u6-threats-to-security/