By the end of this lesson you will be able to
- Explain the difference between a threat, a vulnerability and a risk using an everyday example.
- Name the main kinds of malware and say what each one does to you.
- Describe the three or four most common ways a computer gets infected.
- Spot the warning signs of a phishing message and explain why social engineering works.
- Use the phishing detective lab to judge simulated messages and give reasons.
Most people picture a computer attack as a stranger typing furiously in a dark room. In real life the attacker is usually an automated programme or a scammer who simply asks you to open the door. Knowing the few ideas in this lesson lets you see where danger really comes from, so that you can spend your attention on the things that matter and stop worrying about the things that do not.
Threat, vulnerability and risk
Security people use three words that sound alike but mean different things. Getting them straight makes everything else in this module easier. Think of a house. A {{threat|threat}} is anything that could cause harm: a burglar, a flood, a fire. A {{vulnerability|vulnerability}} is a weakness that the threat could use: a window that does not lock, a roof that leaks. A {{risk|risk}} is the chance that harm will really happen, together with how bad it would be.
On a computer the same three ideas apply. The threat might be a criminal sending fake emails. The vulnerability might be a web browser that has not been updated, so it has a known flaw, or a person who does not yet know what a fake email looks like. The risk is how likely it is that the criminal succeeds and how much it would cost you: lost photos, an emptied bank account, a stolen identity.
- Step 1: ThreatSomething that could cause harm: a scammer, a virus
- Step 2: VulnerabilityA weakness it can use: old software, an untrained eye
- Step 3: HarmWhat you lose if it works: money, photos, accounts
Read this figure as text
Flow of three steps: a threat, a vulnerability it can use, and the harm that follows, with risk described as likelihood and impact.
Step 1, Threat: something that could cause harm, for example a scammer sending a fake email. Step 2, Vulnerability: a weakness the threat can use, for example an out-of-date browser or someone who has never been shown how to spot fake emails. Step 3, Harm: what is lost if it works, for example money, photos or an account. Risk is how likely step 3 is and how serious it would be. You reduce risk by removing vulnerabilities (updating, learning) because you cannot remove the threats.
Malware: software that works against you
Malware is short for malicious software: any programme made to harm you or to work for someone else without your permission. The word covers several families. The names describe how they spread or what they do, and a single piece of malware can be a mix of them.
- A virus attaches itself to a file or programme and spreads when that file is shared. Real viruses are now rarer than the word suggests; people often say “virus” for any malware.
- A worm spreads on its own across a network without anyone opening anything, by using a weakness in other computers.
- A trojan pretends to be something useful, such as a free game or a “PDF viewer”, but does something harmful once you install it. Named after the wooden horse.
- Ransomware locks your files with encryption and demands money to unlock them. Paying does not guarantee you get your files back.
- Spyware secretly watches what you do. A keylogger is one kind: it records what you type, including passwords.
- Adware floods you with unwanted adverts or changes your browser's home page. It is more annoying than dangerous, but often arrives with other malware.
- Looks like a useful free tool
- You install it yourself
- Opens a door for attackers
Defence: install only from trusted sources.
- Locks your files
- Demands money
- Paying is not a guarantee
Defence: a backup you can restore.
- Hides inside other software
- Records typing and activity
- Sends it to someone else
Defence: trusted apps, few permissions.
- Travels across networks
- Uses unpatched weaknesses
- Needs no click from you
Defence: install updates promptly.
Read this figure as text
Four columns comparing trojan, ransomware, spyware and worm by how they arrive and what harm they do.
Trojan: arrives disguised as a useful programme such as a free tool; once installed it lets an attacker in or installs more malware. Ransomware: arrives through a bad attachment, a fake installer or a weakness; it locks your files and demands payment, and the safest protection is a backup you can restore. Spyware: arrives hidden inside other software or a fake app; it quietly records what you type, see and do, and sends it to someone else. Worm: arrives over a network by using a weakness in software that has not been updated; it copies itself from machine to machine with no click needed.
How infections really happen
Films show attackers breaking through clever defences. Reality is plainer. Most infections arrive because somebody chose to do something: open an attachment, click a link, install a programme from a doubtful website, or plug in an unknown USB drive. The criminals do not need to be clever if you are willing to press the button for them.
| Way in | What it looks like | Habit that blocks it |
|---|---|---|
| Email attachment | An “invoice” or “CV” from someone you do not know, or an unexpected file from someone you do | Do not open it. Check with the sender using another method. |
| Bad link | A message saying your parcel is held or your account is locked, with a link | Do not click. Type the real address yourself or use the official app. |
| Fake installer | A “free” version of paid software or a “codec” you must install to watch a video | Install only from the official site or your system's app store. |
| Software weakness | Nothing at all: it happens in the background on an out-of-date machine | Install updates. See the next lesson. |
| Unknown USB drive | A drive found in a car park or handed to you | Do not plug it in. |
Social engineering: attacking the person, not the machine
Social engineering means tricking a person into doing something, instead of forcing a way into a computer. It works because it is cheaper to fool a person than to break software. The best known form is phishing: a message that looks like it comes from a bank, a courier, an employer or a friend, designed to make you click a link, open a file or give away a password.
Phishing messages share a pattern. They create urgency (“within 24 hours”), they use fear or reward (“your account will be closed”, “you have won”), they ask for something unusual (a password, a payment, an urgent gift card), and they contain small mismatches: a sender address that does not match the company, a greeting like “Dear customer” instead of your name, or a link whose real address differs from the words shown.
Dear customer,
Your parcel could not be delivered. Pay a 99 shilling fee within 24 hours or it will be sent back.
Pay now: http://pay.parcel-check.example/fee
FastCourier Support Team
- Marker 1: Sender address does not match a courier you know
- Marker 2: Generic greeting: no name
- Marker 3: Urgent deadline and a small payment
- Marker 4: Link goes to an unrelated address
Read this figure as text
A simulated email window showing a fake delivery message with numbered markers on the sender, greeting, urgent wording and link.
A simulated email. Marker 1 points at the sender address, support@parcel-help.example, which does not belong to any real courier you use. Marker 2 points at the greeting “Dear customer”, which shows the sender does not know your name. Marker 3 points at the urgent wording: your parcel will be returned in 24 hours unless you pay a small fee. Marker 4 points at the link, whose real address, not the friendly words, is a different, unrelated domain. This is an educational simulation and the company, address and link are fictional.
Scammers also use the phone (vishing) and text messages (smishing). The pattern is the same: pressure, a story and a request. The best defence is to slow down. A real bank or courier is happy for you to hang up and ring them back on the number printed on your card.
Practise: phishing detective
You will look at simulated emails and messages and decide which are safe and which are phishing, giving a reason each time. Everything is fictional and runs in your browser: nothing is sent and nothing on your computer is changed.
Loading lab…
When you finish, notice which clues you used most. A sender address that does not match, a request for a password and an urgent deadline are the three most reliable. A message with none of these clues can still be fake, so treat the clues as a guide and not as proof.
Common mistakes
✖ Instead of: Thinking only careless people or rich people get targeted.
✔ Do this: Most attacks are automated and sent to millions of people. Anyone with an account, a phone number or a bank card is a target, so habits matter more than who you are.
✖ Instead of: Judging an email by how professional it looks or whether it has the logo.
✔ Do this: Logos are easy to copy. Check the sender address, the real destination of links and whether the message pushes you to act fast.
✖ Instead of: Calling every problem “a virus”.
✔ Do this: Slowness and pop-ups can have many causes. Learn the families so that you describe the problem accurately and choose the right response.
If something goes wrong
- I am not sure whether a message is real.
- Do not use anything inside the message. Open the company's official app or type its address yourself, or phone the number on your card, and ask whether they sent it.
- I clicked a link in a message and then felt worried.
- Close the page without typing anything. If you entered a password anywhere, change it at once from a trusted device, then follow the steps in the lesson on what to do when something goes wrong.
- The phishing lab does not match what I see in my own email.
- The lab simplifies messages so that the clues are clear. Real scams vary more, so use the same questions: who sent it, what does it want, and is it hurrying me?
Key terms
- Threat
- Something or someone that could cause harm to you or your data.
- Vulnerability
- A weakness that a threat can use to cause harm.
- Risk
- The chance that a threat will use a weakness, together with how bad the harm would be.
- Malware
- Any software made to harm your device, steal your information or spy on you.
- Trojan
- Malware disguised as something useful or harmless so that you install it yourself.
- Ransomware
- Malware that locks your files and demands money to unlock them.
- Social engineering
- Tricking people, rather than computers, into giving away secrets or access.
- Phishing
- A trick message that pretends to be from a trusted source to make you give away passwords or money.
Practise it for real
Reading is not the same as being able to do it. Complete these on your own computer, then tick only what you have actually done. These ticks are your own honest record: nothing checks them for you.
Spot the red flags in a real inbox
Open your email and look at the spam or junk folder, or at the last five promotional messages. Do not click any links or open attachments. For three messages, write down the sender address, the greeting, whether there is pressure to act quickly and whether it asks for money or a login. Decide for each whether you would trust it and why.
Challenge: threat, vulnerability, risk for your own life
Choose one thing you care about, such as your email account, your photos or your phone. Without looking back at the lesson, write one threat to it, one vulnerability that threat could use and the harm if it worked. Then write one habit that would close that vulnerability.
Knowledge check
7 questions. You need 80% to pass. Mistakes here are part of learning, and you can retry as often as you like.
Summary
- A threat is a source of harm, a vulnerability is a weakness, and risk is the chance and cost of harm. You lower risk by closing vulnerabilities.
- Malware is an umbrella word: viruses, worms, trojans, ransomware, spyware and adware behave differently.
- Most infections happen because a person opened, clicked or installed something.
- Social engineering attacks people. Urgency, fear, reward and unusual requests are the warning signs.
- Slowing down and checking through a second, trusted route beats any clever trick.
Checklist: can you do these?
Marking a lesson as read does not prove you can do it. Skills count as demonstrated when you pass the quiz (not yet) and complete the practical tasks (not yet).
Related lessons
References and further reading
Official sources for details that can change between versions.
- Phishing: spot and report scam emails, texts, websites and calls (National Cyber Security Centre (UK))
- Protect yourself from phishing (Microsoft Support)