Common Security Threats

Introduction

Every digital system faces security threats. A threat may come from a malicious
attacker, harmful software, a dishonest insider, a technical failure, or even
an innocent human mistake.

As a cyber security professional, one of the first things you must learn is how
to recognize common threats and understand how they can affect information
systems.

A threat does not necessarily mean that an attack has already happened. A threat
represents the possibility that something could cause harm.

What Is a Security Threat?

A security threat is a potential event, action, person, condition,
or circumstance that could negatively affect the confidentiality, integrity, or
availability of information or systems.

For example, an attacker attempting to steal a student’s login credentials is a
security threat because the action could lead to unauthorized access.

Other examples include:

• Malware infection
• Phishing messages
• Stolen passwords
• Unauthorized access
• Data theft
• Ransomware
• Denial-of-service attacks
• Insider misuse
• Software vulnerabilities
• Physical theft of devices

Threat, Vulnerability, and Risk

Three terms that every cyber security student should understand are:

• Threat
• Vulnerability
• Risk

Threat

A threat is something that has the potential to cause harm.

Example:

An attacker attempting to gain unauthorized access to an LMS is a threat.

Vulnerability

A vulnerability is a weakness that could be exploited by a threat.

Example:

A website using an outdated software component with a known security weakness
may have a vulnerability.

Risk

Risk describes the possibility and potential impact of a threat
exploiting a vulnerability and causing harm.

A simple relationship can be represented as:

Threat + Vulnerability + Potential Impact = Security Risk

This is a simplified learning model. Real-world risk assessment can involve
many additional factors.

Major Categories of Security Threats

Common security threats include:

1. Malware
2. Phishing
3. Social engineering
4. Password attacks
5. Credential theft
6. Ransomware
7. Denial-of-service attacks
8. Insider threats
9. Data breaches
10. Unpatched software
11. Man-in-the-middle attacks
12. Physical security threats

Let us examine these threats individually.

1. Malware

Malware is short for malicious software.
It refers to software designed to perform harmful or unauthorized activities.

Malware can affect computers, smartphones, servers, websites, networks, and
other digital systems.

Common malware categories include:

• Viruses
• Worms
• Trojans
• Spyware
• Ransomware
• Adware
• Rootkits
• Keyloggers

Viruses

A computer virus is malicious code that can attach itself to legitimate files
or programs and replicate when the infected file is executed.

Depending on its design, a virus may damage files, disrupt operations, or
perform other malicious activities.

Worms

A worm is malware capable of spreading between systems without
requiring the same type of user interaction traditionally associated with a
file-infecting virus.

Worms can spread rapidly across networks and consume system or network resources.

Trojans

A Trojan is malicious software that disguises itself as
legitimate or useful software.

For example, a user may download what appears to be a useful application only
to discover that the application contains malicious functionality.

Spyware

Spyware is software designed to monitor or collect information
about a user or system without appropriate authorization.

Depending on the spyware, it may collect browsing information, credentials,
keystrokes, or other sensitive information.

2. Phishing

Phishing is a form of deception in which an attacker attempts
to trick a person into revealing information, opening a malicious attachment,
visiting a harmful website, or performing another unsafe action.

Phishing commonly uses:

• Email messages
• Text messages
• Fake login pages
• Social media messages
• Phone calls
• Fake websites

The attacker may pretend to represent a bank, school, employer, government
organization, technology company, or another trusted entity.

Example of Phishing

Imagine a student receives an email saying:

“Your Dwallnet LMS account will be suspended today. Click here immediately to
verify your password.”

The message contains a link leading to a fake login page.

If the student enters a username and password, the attacker may capture the
credentials.

This is an example of a phishing attack.

Signs of a Phishing Message

Common warning signs include:

• Unexpected requests for passwords or financial information.
• Urgent or threatening language.
• Suspicious links.
• Unexpected attachments.
• Unusual sender addresses.
• Requests for secrecy.
• Messages containing suspicious spelling or formatting.
• Offers that appear unusually attractive or unexpected.

Not every phishing message contains all of these signs, so users should verify
unexpected requests through trusted channels.

3. Social Engineering

Social engineering is the use of psychological manipulation or
deception to influence people into revealing information or performing actions
that may compromise security.

Instead of attacking a computer directly, an attacker may attempt to manipulate
a person who has access to the system.

Examples include:

• Phishing
• Pretexting
• Impersonation
• Baiting
• Tailgating

Pretexting

Pretexting occurs when an attacker creates a false story or
identity to convince someone to provide information or perform an action.

For example, an attacker may pretend to be a technical support employee and
ask a user to provide account information.

Baiting

Baiting uses something attractive or interesting to encourage
a person to perform an unsafe action.

For example, a malicious file may be presented as a valuable document,
application, or other attractive resource.

Tailgating

Tailgating is a physical security technique in which an
unauthorized person attempts to follow an authorized person into a restricted
area.

This demonstrates that cyber security also involves physical security.

4. Password Attacks

Passwords remain an important security control, but weak or stolen passwords
can create significant risk.

Password-related attacks can include:

• Brute-force attacks
• Password guessing
• Credential stuffing
• Password spraying
• Phishing for passwords
• Use of previously exposed credentials

Brute-Force Attacks

A brute-force attack involves repeatedly attempting different
password combinations or credentials until a valid combination is found.

Strong passwords and appropriate authentication controls can make brute-force
attacks more difficult.

Credential Stuffing

Credential stuffing occurs when attackers use previously
stolen username and password combinations to attempt access to other services.

This is one reason users should avoid reusing the same password across multiple
accounts.

5. Ransomware

Ransomware is malicious software that can prevent access to
files or systems, often by encrypting data, and may be associated with demands
for payment.

Ransomware can affect:

• Personal computers
• Business networks
• Servers
• Cloud-connected environments
• Schools
• Hospitals
• Government organizations

A major security lesson from ransomware is the importance of reliable backups,
strong access controls, software updates, monitoring, and security awareness.

6. Denial-of-Service Attacks

A Denial-of-Service (DoS) attack attempts to make a service,
application, server, or network unavailable to legitimate users.

A distributed version is called a Distributed Denial-of-Service
(DDoS) attack, where traffic or requests may originate from many
systems.

These attacks primarily threaten the availability principle
of the CIA Triad.

7. Insider Threats

An insider threat involves a person who has legitimate access
to an organization’s systems or information but uses that access in an
unauthorized or harmful way.

An insider threat can be:

• Intentional
• Accidental
• Negligent
• Compromised

For example, an employee may intentionally copy confidential company files,
or an employee may accidentally send sensitive information to the wrong person.

8. Data Breaches

A data breach occurs when protected or sensitive information
is accessed, disclosed, or exposed without appropriate authorization.

A breach may involve:

• Personal information
• Passwords
• Financial records
• Customer information
• Student records
• Business documents
• Source code

Data breaches can occur because of technical vulnerabilities, stolen credentials,
misconfigured systems, malicious insiders, phishing, or other security failures.

9. Unpatched Software

Software developers regularly release updates to fix bugs and security
vulnerabilities.

When organizations continue using outdated software containing known
vulnerabilities, attackers may have opportunities to exploit those weaknesses.

Regular patching and update management are therefore important security practices.

10. Man-in-the-Middle Attacks

A Man-in-the-Middle (MitM) attack occurs when an attacker
interferes with communication between two parties or systems.

The attacker may attempt to observe, manipulate, or redirect communication.

Secure communication protocols, encryption, certificate validation, and
proper network security can help reduce this type of risk.

11. Physical Security Threats

Cyber security is not limited to software.

Physical threats can also affect information systems.

Examples include:

• Theft of laptops
• Unauthorized access to server rooms
• Device destruction
• Power failure
• Fire
• Flooding
• Unauthorized removal of storage devices

Physical security is therefore an important part of protecting digital assets.

Threats Can Affect the CIA Triad

Different threats can affect different security objectives.

A single attack can affect more than one part of the CIA Triad.

Common Warning Signs of a Security Threat

Users should pay attention to unusual behavior on their devices and accounts.

Possible warning signs include:

• Unexpected login notifications.
• Unknown applications appearing on a device.
• Unusual account activity.
• Unexpected password reset messages.
• Files becoming inaccessible.
• Unusual network activity.
• Unexpected browser changes.
• Security software generating warnings.
• Messages sent from an account that the owner did not send.
• Unexpected requests for sensitive information.

A warning sign does not automatically prove that an attack has occurred.
It should instead trigger further investigation.

Basic Controls for Reducing Security Threats

Organizations can reduce security risks through multiple layers of protection.

Strong Authentication

Use strong passwords and multi-factor authentication where appropriate.

Software Updates

Keep operating systems, applications, plugins, frameworks, and security tools
properly updated.

Backups

Maintain reliable backups and regularly verify that important data can be restored.

Access Control

Users should receive only the access required for their legitimate responsibilities.

Security Awareness

Train users to recognize phishing, social engineering, suspicious links,
unsafe attachments, and other common threats.

Monitoring

Monitor systems, accounts, networks, and logs for suspicious activity.

Incident Response

Organizations should have procedures for identifying, containing, investigating,
and recovering from security incidents.

Defense in Depth

Defense in depth means using multiple layers of security
rather than depending on a single security control.

For example, a Dwallnet LMS could use:

1. Strong passwords.
2. Multi-factor authentication.
3. Role-based permissions.
4. Secure coding practices.
5. Web application protection.
6. Regular updates.
7. Backups.
8. Security monitoring.
9. Incident response procedures.

If one security control fails, other controls may still reduce the impact.

Threats Against a Dwallnet LMS

Consider a Dwallnet Learning Management System containing student accounts,
course materials, assignments, grades, and administrator functions.

Threats Are Constantly Changing

Cyber security threats do not remain exactly the same.

Attackers continually develop new techniques, exploit new vulnerabilities,
abuse legitimate technologies, and target new digital services.

This means cyber security professionals must continue learning.

Security teams should continuously:

• Monitor new threats.
• Update systems.
• Review vulnerabilities.
• Improve security controls.
• Train users.
• Test incident response procedures.
• Review security logs.

Human Behavior and Security Threats

People are an important part of every security environment.

Human mistakes can contribute to security incidents.

Examples include:

• Using the same password everywhere.
• Clicking suspicious links.
• Installing untrusted software.
• Sharing passwords.
• Leaving devices unlocked.
• Sending sensitive information to the wrong person.

Security awareness training can help users recognize and avoid many of these
risks.

Practical Exercise

Create a simple threat analysis for an imaginary Dwallnet student account.

Identify:

1. Three possible threats.
2. One vulnerability associated with each threat.
3. The possible impact of each threat.
4. One security control for each threat.

Example:

Class Discussion

1. What is a security threat?
2. What is the difference between a threat and a vulnerability?
3. What is malware?
4. How does phishing work?
5. What is social engineering?
6. Why are strong passwords important?
7. What is ransomware?
8. What is a DDoS attack?
9. What is an insider threat?
10. Why are software updates important?
11. How can security awareness reduce risk?
12. Why is defense in depth useful?

Code Example

The following PHP example demonstrates how a simple application could organize
common security threats:

<?php

$threats = array(
	'Phishing'      => 'Deceptive messages used to trick users.',
	'Malware'       => 'Malicious software designed to cause harm.',
	'Ransomware'    => 'Malware that can deny access to data or systems.',
	'Weak Password' => 'Credentials that are easy to guess or compromise.'
);

foreach ( $threats as $threat => $description ) {
	echo '<strong>' . $threat . ':</strong> ';
	echo $description;
	echo '<br><br>';
}

?>

Key Takeaways

• A security threat is a potential source of harm to an information asset or system.
• A vulnerability is a weakness that may be exploited by a threat.
• Risk involves the possibility and potential impact of harm.
• Malware is malicious software designed to perform harmful or unauthorized activities.
• Phishing uses deception to trick users into unsafe actions.
• Social engineering targets human behavior.
• Weak or stolen credentials can lead to unauthorized access.
• Ransomware can prevent access to files or systems.
• DDoS attacks can affect availability.
• Insider threats can be intentional or accidental.
• Regular updates, backups, access controls, monitoring, and security awareness help reduce risk.
• Defense in depth uses multiple layers of security.

Lesson Summary

Cyber security threats can come from many sources. Attackers may use malicious
software, phishing, social engineering, stolen credentials, vulnerabilities,
or other techniques to target systems and information.

Understanding common threats is one of the first steps toward effective defense.
Security professionals must understand what they are protecting, what threats
could affect those assets, which vulnerabilities may exist, and what controls
can reduce the associated risks.

Cyber security is not based on one tool or one security product. Strong security
requires multiple layers involving people, processes, and technology.

As you continue through this course, you will learn more about specific threats,
operating systems, networks, web security, monitoring, defense, and ethical
security practices.