Threats to security
Computer ScienceΒ· 7 min read
1. 1. Classification of Threatsβ β ββββ± 15 min
Threats to system security are any events or circumstances that can compromise the confidentiality, integrity, or availability of data or systems. They are broadly split into two core categories: intentional and accidental.
Security Threat
Any event or action that has the potential to compromise the confidentiality, integrity, or availability of a computer system or stored data
Example:
A fraudulent phishing email sent to company employees is a common security threat.
Classify each of the following as accidental or intentional threat: (a) An employee deletes the wrong customer database by mistake (b) A hacker sends malicious traffic to take a company website offline
- 1
Recall the core difference between the two categories: intentional threats are deliberate acts of harm, while accidental threats are unintended events.
- 2
Evaluate (a): The deletion is unintended, caused by human error. This is an accidental threat.
- 3
Evaluate (b): The attack is a deliberate act to disrupt the website. This is an intentional threat.
2. 2. Malicious Software (Malware) Threatsβ β ββββ± 20 min
Malware is the most common category of intentional technical threat, consisting of software designed to cause harm, steal data, or gain unauthorised access to systems. There are several distinct types of malware tested regularly in CIE exams.
Malware
Short for malicious software: any software intentionally created to cause damage, disruption, or unauthorised access to a computer system
Virus: Malware that attaches to a legitimate program and replicates only when the program is run, usually corrupting or deleting files.
Worm: Self-replicating malware that spreads automatically across networks without any human action, often consuming bandwidth and crashing systems.
Trojan Horse: Malware disguised as legitimate software that creates a hidden backdoor for unauthorised remote access.
Ransomware: Malware that encrypts a user's or organisation's data and demands a ransom payment to restore access.
Spyware: Malware that secretly collects user information and activity without consent.
A user downloads what appears to be a free photo editing app. After installation, the attacker can remotely access the user's private files. Name and describe the type of malware in this scenario.
- 1
Identify the key characteristics of the attack: the malware is disguised as a legitimate program and creates a backdoor for remote access.
- 2
Match the characteristics to the correct malware type: this is a Trojan Horse.
- 3
Write the full exam response: This is a Trojan Horse, a type of malware that disguises itself as legitimate software. Once installed, it creates a backdoor that allows the attacker to gain unauthorised access to the user's private files.
Exam tip:
CIE questions almost always ask you to distinguish between different malware types, so remember the unique defining feature of each type instead of just giving a general description.
3. 3. Social Engineering Threatsβ β β βββ± 20 min
Social engineering is a category of non-technical threat that relies on psychological manipulation of people, rather than technical exploits, to gain access to sensitive information or systems. It is one of the most common attack vectors used today.
Social Engineering
A method of attack that uses human interaction and psychological manipulation to trick people into revealing confidential information or granting unauthorised access.
Phishing: Sending fraudulent emails or messages that mimic legitimate organisations to trick users into revealing passwords or financial details.
Spear Phishing: A targeted phishing attack aimed at a specific individual or organisation, often with personalised details to seem more legitimate.
Baiting: Leaving a malware-infected USB drive labelled with a tempting name (e.g. "Salaries 2024") to trick an employee into plugging it into their work computer.
Tailgating: Gaining physical access to a secured building by following an authorised employee through a locked access door.
An attacker sends an email to a company's CEO pretending to be from their bank, asking for the CEO's online banking password to "verify account details". Name this threat and explain why it is a form of social engineering.
- 1
Identify key features: the attack is targeted at a specific individual and uses deception to trick the victim into revealing a password.
- 2
This attack is spear phishing, a specific type of social engineering attack.
- 3
It is social engineering because it relies on psychological manipulation (pretending to be the bank to gain trust) rather than a technical exploit to obtain the password, not on breaking into the bank's system directly.
4. 4. Network and Insider Threatsβ β β βββ± 15 min
Network-based threats target the availability and integrity of networked services and communication. Insider threats are a separate category that originates from within the target organisation.
Distributed Denial of Service (DDoS): An attack that uses thousands of compromised devices to flood a target server or network with traffic, overwhelming it and making the service unavailable to legitimate users.
Man-in-the-Middle (MitM): An attack where the attacker intercepts communication between two parties, allowing them to steal sensitive data or alter communication in transit.
Insider Threat: A threat originating from an employee, contractor, or other person with internal access, which can be intentional (data theft) or accidental (clicking a phishing link).
A small business's website becomes completely unresponsive after being flooded with thousands of fake requests from compromised devices across the world. What type of attack is this, and what is its goal?
- 1
Identify key details: the website is overwhelmed by fake traffic from multiple compromised devices.
- 2
This is a Distributed Denial of Service (DDoS) attack.
- 3
The primary goal of the attack is to overwhelm the website's server with more traffic than it can handle, denying access to the website for all legitimate users. Attackers may also use DDoS attacks to extort money or distract from other malicious activity.
5. Common Pitfalls
Wrong move:
Claiming worms require human action to spread, same as viruses.
Why:
Viruses require a user to run an infected program to replicate, while worms self-replicate automatically across networks.
Correct move:
Remember: Worms spread Without human action, Viruses need User action to run.
Wrong move:
Stating that Trojan horses are self-replicating malware.
Why:
Trojans do not replicate; they rely on social engineering to trick users into installing them.
Correct move:
Trojans are disguised malware that create backdoors, and do not replicate on their own.
Wrong move:
Classifying phishing as a type of malware.
Why:
Phishing is a social engineering technique that may deliver malware, but it is not malware itself.
Correct move:
Phishing is a social engineering attack that manipulates users into revealing sensitive information.
Wrong move:
Claiming all insider threats are intentional acts of harm.
Why:
Most insider threats are accidental, caused by employee error rather than malicious intent.
Correct move:
Insider threats include both intentional malicious acts and accidental errors that compromise security.
Wrong move:
Saying DDoS attacks originate from a single source.
Why:
The 'D' in DDoS stands for distributed, meaning the attack comes from many distributed compromised devices.
Correct move:
DDoS = Distributed Denial of Service, originating from hundreds or thousands of devices across the world.
6. Quick Reference Cheatsheet
Threat Type | Category | Key Defining Feature |
|---|---|---|
Accidental threat | General | Unintended harm from error or failure |
Intentional threat | General | Deliberate act to compromise security |
Virus | Malware | Needs user action to replicate, attaches to programs |
Worm | Malware | Self-replicates automatically across networks |
Trojan Horse | Malware | Disguised as legitimate software, creates backdoor |
Ransomware | Malware | Encrypts data and demands ransom for access |
Phishing | Social Engineering | Generic fraudulent messages to steal data |
Spear Phishing | Social Engineering | Targeted attack on a specific person |
DDoS | Network Threat | Floods target from many devices to take it offline |
MitM | Network Threat | Intercepts communication to steal or alter data |
When this came up on past exams
AI-estimated based on syllabus patterns β cross-check with official past papers for accuracy. Use only as revision-focus signals.
- 2022 Β· 1
Classify types of malware
- 2023 Β· 2
Describe social engineering threats
- 2024 Β· 1
Distinguish accidental vs intentional threats
Going deeper
What's Next
Now that you understand the full range of threats to computer security, you are ready to learn how organisations counter these threats with technical and administrative security measures. Recognising different threats is the foundation for designing effective security systems, a topic tested in both Paper 1 and Paper 2 of CIE 9618. You will also need this knowledge to answer case study questions that ask you to evaluate security risks for a given scenario, which make up a large portion of your exam grade. This understanding also underpins upcoming topics around encryption, privacy, and data integrity in this unit.