UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 2.2 Free with a free account
Recognizing the Different Types of Dangers That Target Information Systems
Ethics in Technology · Chapter 2: The Pillars of Security and Your First Line of DefenseSection 2.2 · lesson 6 of 11611 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: Practical Measures You Can Take Right Now to Defend Your Computer Against Attacks →← Confidentiality, Integrity, and Availability — The Three Pillars Every Security Professional Lives ByNext lesson: Practical Measures You Can Take Right Now to Defend Your Computer Against Attacks →
In this lesson
Separate cause, source, and attack family.
- Distinguish a threat from a weakness and a risk
- Classify natural, accidental, and intentional causes
- Compare insider and outsider threats
- Recognize 4 broad attack families
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,423 words). Read along, or search it.
The Pillars of Security and Your First Line of Defense
Recognizing Information-System Threats
An information-system threat is something that could harm data, devices, services, or their users. It need not be a person, and it need not involve a deliberate intention. A flood and a stolen password can both create serious harm, through different causes. This lesson separates the cause of a threat, from its source and its method. Natural, accidental, and intentional describe why the harmful situation arises. Insider and outsider describe the relationship between the source and the organization's access arrangements. Malware, social engineering, network attacks, and physical theft describe four broad attack families. These labels work together, rather than competing to supply one single name for an incident. We apply them to scenarios, including a deceptive message followed by harmful software. Clear classification helps choose appropriate defenses, and recognize several points where harm can be interrupted.
Precise Vocabulary
Threat, Vulnerability, and Risk
A burglar in the neighborhood represents a threat, because theft is possible. An unlocked back door is a vulnerability, because that weakness creates a route into the house. Risk combines the chance of entry, and the consequences of valuable property being taken. The threat, weakness, and resulting exposure are related ideas, but they are not interchangeable words. In a digital example, criminals sending fake messages create a threat to the organization. Staff who have never learned to recognize those messages represent a weakness that may be exploited. The likelihood of someone revealing a password, and the resulting damage, describe the risk. Recognizing the threat tells us what could happen, while recognizing the weakness identifies what can change. The risk judgment then helps decide how urgently to act, and what protection is worthwhile. Security conversations improve when people describe these parts separately, before selecting a tool.
Natural Causes
Prepare for Environmental Harm
Natural threats arise from environmental events, rather than an intention to misuse information. Floods, earthquakes, hurricanes, lightning, fire, and extreme heat can damage equipment or interrupt its operation. Power may fail, hardware may be destroyed, or the building may become unusable. No criminal needs to enter the network, for these losses to remove access to information. Organizations generally prepare for the consequences, rather than imagining they can prevent the natural event itself. Backups in another location reduce the chance of one event destroying the originals and every copy. Choosing a data-center location with environmental exposure in mind can also reduce vulnerability. Disaster-recovery plans organize restoration, while fire-suppression measures can limit damage. The lesson is to include environmental harm in the inventory of threats. A program concerned only with attackers can remain unprepared for an entirely different route to loss.
Accidental Causes
Honest Mistakes Can Cause Serious Loss
Accidental threats come from human mistakes, without a deliberate intention to harm the organization. An employee might delete an important folder, believing the contents are no longer needed. A technician might set cloud storage incorrectly, allowing anyone online to read its records. Someone might also send a customer list, or a patient's information, to the wrong recipient. The absence of bad intent does not remove the consequences for people whose information is exposed. Training helps people recognize sensitive situations, and understand how routine actions can create harm. Clear procedures reduce ambiguity, particularly when people are tired, rushed, or dealing with unfamiliar systems. Confirmation prompts can interrupt a mistaken action, before it becomes a completed loss. Automatic backups provide recovery when an error still occurs, despite preventive safeguards. Prepare for fallibility, rather than assuming trusted people will never make a damaging mistake.
Intentional Causes
A Thinking Opponent Adapts to Defenses
Intentional threats involve people who deliberately seek to steal, disrupt, deceive, or damage. Their motives can include money, revenge, political beliefs, spying, or the challenge of bypassing protection. Criminal intruders, fraudsters, thieves, and saboteurs can create different versions of that intentional harm. Because these opponents think, they can change their approach when a defense blocks the current route. That makes protection an ongoing task, rather than a setting completed once and forgotten. Access controls restrict opportunities, while monitoring helps reveal activity that warrants investigation. Security tools can block some methods, and deterrence can discourage some attempts. Legal consequences also form part of the response, without replacing practical protection of the system. The relevant question is what the opponent can reach, and what they are trying to achieve. Understanding intent helps select defenses, while keeping natural and accidental threats in the wider picture.
Source of the Threat
Insiders Already Have a Route to the Data
An outsider has no authorized access, and must obtain some route into the system. An insider already has, or recently had, legitimate access through work or another relationship. Employees, contractors, and vendors can be insiders, as can former staff whose accounts remain active. Insiders often know where useful data is stored, and how ordinary organizational routines operate. Their harmful activity may resemble legitimate work, making it difficult to distinguish through simple boundary checks. Outsiders often need to learn the target's systems, and some of their activity may look unusual. Neither category guarantees that every incident will be easy or difficult to detect. Insider harm can also be accidental, as when a trusted employee falls for a false message. That mistake can enable an outsider, linking two sources within the same incident. Limited access, prompt account removal, and attention to behavior matter alongside barriers against unfamiliar strangers.
Combine the Questions
Source and Intent Need Separate Answers
Source and intent answer separate questions, so both should be considered when describing harm. An insider who sends a sensitive file mistakenly creates accidental insider harm. An insider who deliberately takes the client list creates intentional insider harm. An outsider can also act accidentally, although the source gives fewer examples of that situation. A criminal sending deceptive messages represents an intentional outside threat. Training and clear procedures help reduce careless insider mistakes, without relying on punishment after the event. Monitoring and restricted permissions help address misuse by someone who already has a legitimate access route. Technical barriers and cautious handling help obstruct entry attempted from outside the organization. These responses overlap, because an incident can cross the categories as it develops. Keep asking who acted, and with what intent, rather than assuming one answer proves the other.
Attack Families
4 Broad Ways of Reaching the Target
Malware is harmful software that damages, spies on, or takes control of a device. Ransomware that locks files illustrates the family, because the harmful software creates the disruption. Social engineering manipulates people into revealing information, granting access, or taking a harmful action. A false message pretending to come from a bank illustrates that use of apparent trust. Network attacks target the connections that carry information between devices and services. A website flooded with traffic may become unavailable to legitimate users. Physical theft takes hardware holding information, or tampers with equipment that supports it. A laptop containing customer records, stolen from a car, illustrates that physical route. The families provide a broad map of methods, rather than one exclusive label for every possible incident. Recognizing the method helps defenders connect the danger with controls suited to the route being used.
Combined Attacks
Recognize Each Link in the Chain
A criminal may begin with a deceptive message, persuading an employee to open an attachment. That first part is social engineering, because the message works through the person's judgment. The attachment may then install harmful software, bringing malware into the same incident. If the software reaches connected systems, network protections become relevant to limiting its spread. The outside attack is intentional, even when the employee's enabling action was an honest mistake. Calling the whole event simply a user error would hide the adversary and the technical pathways. Calling it only malware would hide the deception that supplied its initial opportunity. Each recognized link provides a separate chance to interrupt the harmful sequence. Training and reporting can stop the message, device protection can block software, and network controls can limit movement. Layered protection gains value because one failure need not allow every later part of the attack to succeed.
Scenario Classification
Ask Cause, Source, and Method
Classify a scenario by cause first, then source, and then attack method where one applies. A storm flooding a server basement is natural, without an insider, outsider, or attack family to identify. A nurse faxing a record to the wrong clinic is accidental insider harm, rather than an intentional attack. A departing employee taking the client list is intentional insider data theft. The scenario does not establish malware or a network attack, so do not invent that method. False messages from supposed technology staff, asking for passwords, are intentional outside social engineering. Taking an unattended laptop is intentional physical theft, but the source could be inside or outside. Use the evidence given, rather than forcing a more specific conclusion than the facts support. Threat categories guide action when they preserve differences in cause, access, and method. They are most useful together, revealing what should be prevented, detected, contained, or recovered.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About Recognizing the Different Types of Dangers That Target Information Systems
What are the main types of threats to information systems?
What is the difference between an insider threat and an outsider threat?
What are the four broad categories of attack methods?
How do you classify a threat scenario in information security?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →