External Threats

An external threat is a danger to a digital system or its data that comes from outside the organisation. An internal threat, by contrast, comes from someone inside it, such as a member of staff misusing their access.

Systems become far more vulnerable when they can be reached from an external network such as the internet. Once a service is online, anyone in the world can try to connect to it, so an attacker no longer needs to be in the building or know a member of staff. A college's internal student records database is only reachable from its own network, but the booking system for parents' evening sits on the internet, so it can be probed by anyone at any time.

The main external threats

• Unauthorised access, also called hacking: someone tries to get into a system when they are not permitted to do so. When this is done with criminal intent it is black hat hacking — for example, repeatedly guessing passwords on a small business's login page from a bedroom to reach its customer records.
• Malware: software written to damage a system, steal data or take control of it.
• Denial-of-service attacks: flooding a service with requests so genuine users cannot use it.
• Phishing: fake messages sent by email, text or phone call to trick people into giving away details.
• Pharming: redirecting a user to a fake website without their knowledge, even when they typed the correct address.
• Social engineering: deceiving people into revealing information.
• Shoulder surfing: watching someone's screen or keyboard to read data such as a PIN.
• Man-in-the-middle attacks: intercepting communication between two devices.

A threat does not have to be deliberate

A natural disaster counts as an external threat too, even though it is not trying to attack anyone. High winds during a storm can bring down a power line, and the resulting surge can destroy a server and corrupt the files stored on it, yet the cause is still outside the organisation. The danger comes from the environment around the organisation, not from a person working inside it.