Threats to Data
External Threats
Contents
An external threat is a danger to a digital system or its data that comes from outside the organisation. An internal threat, by contrast, comes from someone inside it, such as a member of staff misusing their access.
Systems become far more vulnerable when they can be reached from an external network such as the internet. Once a service is online, anyone in the world can try to connect to it, so an attacker no longer needs to be in the building or know a member of staff. A college's internal student records database is only reachable from its own network, but the booking system for parents' evening sits on the internet, so it can be probed by anyone at any time.
The main external threats
- Unauthorised access, also called hacking: someone tries to get into a system when they are not permitted to do so. When this is done with criminal intent it is black hat hacking — for example, repeatedly guessing passwords on a small business's login page from a bedroom to reach its customer records.
- Malware: software written to damage a system, steal data or take control of it.
- Denial-of-service attacks: flooding a service with requests so genuine users cannot use it.
- Phishing: fake messages sent by email, text or phone call to trick people into giving away details.
- Pharming: redirecting a user to a fake website without their knowledge, even when they typed the correct address.
- Social engineering: deceiving people into revealing information.
- Shoulder surfing: watching someone's screen or keyboard to read data such as a PIN.
- Man-in-the-middle attacks: intercepting communication between two devices.
A threat does not have to be deliberate
A natural disaster counts as an external threat too, even though it is not trying to attack anyone. High winds during a storm can bring down a power line, and the resulting surge can destroy a server and corrupt the files stored on it, yet the cause is still outside the organisation. The danger comes from the environment around the organisation, not from a person working inside it.
Malware (short for malicious software) is any program written to damage a device, steal data or make a system carry out actions the owner never agreed to. It is an external threat because it arrives from outside the organisation, and it is usually created for money or to break into systems.
Types of malware
| Type | What it does |
|---|---|
| Virus | Attaches itself to a file or program and runs when that file is opened, copying itself into other files |
| Worm | Spreads by itself across a network, infecting device after device without anyone opening a file |
| Botnet | Links many infected computers into one network that the attacker controls remotely |
| Rootkit | Hides itself and other malware deep inside the operating system so it is very hard to detect |
| Trojan | Disguises itself as a genuine, useful program so you install it willingly |
| Ransomware | Encrypts your files or whole drive and demands payment to unlock them |
| Spyware | Secretly records what you do, such as keystrokes, passwords and the sites you visit |
Ransomware is one of the most damaging types. Imagine a small bakery whose till computer holds every order and supplier record: the files are scrambled, a message appears demanding payment for the decryption key, and trading stops until the data is restored. Paying does not guarantee you get the key back, which is why regular backups matter.
How malware hides and spreads
Malware rarely announces itself. A rootkit buries itself in the system files, and a Trojan looks like an innocent download, so an infected machine may keep working normally. Once inside, many types spread to other devices on the same network, so one careless download can affect a whole office.
Malware can reach a device by any route that lets files or data arrive: infected removable media, open or unencrypted Wi-Fi, downloads from an untrusted website, or a malicious email attachment or link. Just receiving a message is not enough, because the harmful program only runs once you open the attachment or click the link. Any device that runs software can be affected, including desktop computers, laptops, phones and smart TVs.
A denial-of-service (DoS) attack is an attempt to stop a service from working by flooding it with traffic. The attacker sends huge amounts of data or requests to a server, so its CPU is always busy dealing with the junk and its network bandwidth is completely full. The attacker is not usually trying to steal data; the aim is to deny access to anyone else.
Imagine a small online shop that prints custom phone cases. If thousands of requests hit its web server every second, real customers just watch a loading spinner and then get an error page. Their orders never go through, so the shop loses sales and looks unreliable, even though nothing was actually broken.
Distributed attacks
In a DDoS (distributed denial-of-service) attack, a botnet is used: many compromised computers are commanded to send requests simultaneously to one target. A botnet is many infected machines working together, not a single computer.
The owners of those computers usually have no idea. Their machines were infected with malware that quietly sits in the background and waits for instructions from the attacker, who controls the whole botnet remotely. A school laptop, a home PC and a smart TV could all be part of the same botnet.
Why DDoS is harder to stop
With a single-source DoS attack, a technician can often spot the one address sending all the traffic and block it. In a DDoS attack the requests arrive from hundreds or thousands of different addresses in different locations, so blocking one makes almost no difference. The technician cannot block every address, so the server stays overwhelmed and the attack is much more likely to succeed.
| Feature | DoS | DDoS |
|---|---|---|
| Where traffic comes from | Usually one computer or connection | A botnet of many compromised computers |
| Easier or harder to stop | Easier: the single source can be identified and blocked | Harder: traffic comes from many addresses in many places |
| Effect on users | Slow responses or no access at all | Slow responses or no access at all |
A man-in-the-middle (MITM) attack is when an attacker secretly places themselves between two devices that are communicating. The attacker receives the data travelling in both directions, so the two devices believe they are talking directly to each other.
For example, imagine you send a message to a friend saying "meet at 4pm". If an attacker is in the middle, they can read that message and change it to "meet at 6pm" before passing it on. Neither you nor your friend knows the message was intercepted or altered. The attacker may also tamper with the data in other ways, such as changing a file or a login request, without either party knowing.
Reducing the risk
Encryption scrambles data so that it becomes unreadable without the correct key. It does not stop an attacker intercepting the data, but it stops them being able to decode and read it, so anything they capture is useless to them.
A VPN (virtual private network) creates an encrypted tunnel between your device and the VPN server. Even if your data is intercepted, it cannot be decoded and read. Both measures therefore make a man-in-the-middle attack harder to carry out successfully: the attacker may still capture the data, but it is useless to them.
Shoulder surfing is watching someone's screen or keyboard to see what they are typing or reading. The attacker can be standing close by, or watching from further away with a clear line of sight.
The aim is to read sensitive data such as a password, a PIN or a username as it appears on screen or is keyed in. Once the attacker has those details they can sign in as that person, and the victim has no idea their details have been seen.
Why it works
- Nothing is broken into and no software is used, so there is nothing for security software to detect.
- People often type openly in public places, in queues or in shared rooms, without checking who can see.
- The attacker only needs a moment: a PIN is a few digits and a password is typed in seconds.
Shoulder surfing is not hacking. A hacker uses technical skill and tools to break into a system, whereas a shoulder surfer simply uses their eyes, so a strong password and a firewall do nothing to stop them seeing what is typed.
Worked example
Arun taps his four-digit PIN into the keypad of a locker at a leisure centre. Someone nearby pretends to read the pool timetable but watches the digits being entered. While Arun is swimming, that person opens the locker and takes his wallet.
The same risk appears when a password is shown on a tablet screen at a busy youth club, or when a school login is displayed on a monitor that faces a corridor.
Social engineering is tricking a person into revealing sensitive information, such as usernames, passwords or personal details. Instead of attacking the technology, the attacker tricks a person into handing over a way in.
It works because people are helpful and because they trust anyone who sounds official or who appears to be in trouble. A social engineer often impersonates someone — a delivery driver with a parcel for a named member of staff, a contractor checking fire alarms, or a quiz organiser collecting entry forms. A small request from someone who seems to belong is hard to refuse, especially if it is framed as urgent.
How it reaches you
| Method | What it might look like |
|---|---|
| A message pretending to be from a teacher asks you to reply with your timetable. | |
| Direct message | A chat message from an account posing as a club coach asks for a player's contact details. |
| Telephone | A caller claims to be from the leisure centre and asks for your date of birth to confirm a booking. |
| Face to face | A visitor says they are repairing the photocopier and asks for the Wi-Fi password to run a test. |
Phishing is a type of social engineering.
The victim may not notice
If social engineering succeeds, the victim often does not realise they have revealed anything. No lock was forced and no password was guessed, because the details were handed over willingly and the request seemed ordinary. Often the person only finds out later, when an account starts being used by someone else or a payment appears that they never made. That delay gives the attacker time to use the information before the password is changed.
Tailgating
Tailgating, also called piggybacking, is a face-to-face social engineering technique in which an unauthorised person follows an authorised person into a restricted area. For example, at a leisure centre, a swimmer without a coloured wristband walks through the poolside gate behind a family who scanned theirs. The gate records one family entry, so the system shows nothing unusual, and nobody questions a person who is already inside.
Phishing is a very common form of social engineering: the attacker sends a spoof message that looks as though it comes from somebody you trust, such as your school, a game's support team or a delivery firm. It is fake, but it is designed to look genuine so that you act without stopping to check.
The aim is to make you click a link and land on a fake website that copies the real one. Anything you type in, such as a username, password or card number, goes to the attacker, not the real organisation. A text might say that photos from a school trip are ready and ask you to sign in with your school account; the page looks exactly like the normal school login, so your password goes to the sender.
How it reaches you
Phishing is not only an email problem: it can also arrive as a text message, as a phone call from someone claiming to be a company, or face to face.
Warning signs
- Spelling and grammar errors, because real organisations check their messages.
- Website addresses that are slightly wrong, perhaps with an extra word or a different ending.
- Link text that does not match the address the link really points to.
- A greeting addressed to "customer" rather than to you by name, showing it was sent to many people at once.
- Pressure to act quickly, such as a warning that your account will be locked unless you sign in again.
Check the sender's address, and if you are unsure, contact the organisation using details you look up yourself. A genuine organisation is unlikely to ask for your password by email.
Reducing the risk
Spam filters catch many phishing emails before they reach an inbox, but some always get through. If one does, do not open attachments or click links. Scan any file with anti-virus software, then delete the message and report it.
Phishing is not malware: the message itself does not infect your device. It works by tricking you into giving information away, so spotting the signs is your best defence.
Pharming is a cyberattack that redirects you to a fake website which looks just like the real one. You might type the correct address of a site you trust, yet still land on a copy made by an attacker. The fake site is convincing, so you enter your username, password or card details without suspecting anything. Pharming is similar to phishing, because both trick you into typing personal details into a website that only looks legitimate. The difference is how you get there: with phishing you are usually persuaded to click a link, whereas with pharming you are sent to the fake site even when you typed the right address.
How the redirection works
A DNS server is part of the Domain Name System, which translates a website name into its IP address, the number computers use to find each other. When you type a name such as bookbarn.example, your device asks a DNS server for the matching IP address, then connects to it. If an attacker compromises a DNS server, they can change the answers it gives.
For example, suppose a college's DNS server is altered so that requests for the student portal are answered with the IP address of an attacker's server. Every student who types the correct name is taken to the attacker's copy of the login page. The address bar shows the real name, so nothing looks wrong, and the students type their logins into the fake page. The attacker collects them and can then sign in as those students.
Why it is called DNS spoofing
Pharming is also called DNS spoofing because the DNS server is made to give a false answer that pretends to be genuine. You cannot spot pharming by checking the web address carefully, because the address shown is correct. Pharming is not a kind of malware: it is a technique that relies on a compromised DNS server, set up so that many users are redirected at once rather than one person at a time.