Cybersecurity Foundations (Grades 6–8) · lesson 3 of 48 · 20 min
Why Understanding Threats Matters
Every day, millions of cyberattacks happen around the world. Schools, hospitals, banks, game servers, and personal devices are all targets. Before you can defend against an attack, you need to understand what kinds of attacks exist and who is carrying them out.
Think of it like this: a doctor cannot treat a disease without knowing what the disease is. A cybersecurity professional cannot protect a network without knowing what threats are out there. This lesson gives you the vocabulary and mental models to start thinking like a defender.
By the end of this lesson you will be able to name the major categories of threat actors, describe six common attack types, explain the difference between ethical and criminal hacking, and apply that knowledge to real-world scenarios.
Real-world scale
In 2023, the FBI’s Internet Crime Complaint Center received over 880,000 cybercrime complaints with losses exceeding $12.5 billion. Ransomware attacks hit schools, hospitals, and city governments across the US. Understanding threats is not just academic — it is a life skill.
Who Are the Attackers? Threat Actor Categories
A threat actor is any person or group that intentionally causes harm to a computer system, network, or data. Threat actors differ in their motivation, skill level, and resources. Understanding who is attacking helps defenders prioritise what to protect.
Script kiddies are often teenagers or beginners who download hacking tools from the internet without understanding how they work. They are not highly skilled, but they can still cause real damage because the tools they use are powerful.
Hacktivists believe they are fighting for a cause. Groups like Anonymous have attacked government websites to protest policies they disagree with. Whether you agree with their cause or not, their methods are illegal in most countries.
Cybercriminals are the most common threat most people face. They run phishing campaigns, sell stolen data on dark web markets, and deploy ransomware to extort money from victims. This is a multi-billion dollar criminal industry.
Nation-state actors are the most dangerous and sophisticated. They have government funding, teams of expert hackers, and long-term strategic goals. They may spend months inside a network before anyone notices.
Insider threats are particularly dangerous because they already have legitimate access. A disgruntled employee who copies customer data before quitting, or a contractor who accidentally clicks a phishing link, are both insider threats — one intentional, one accidental.
The hacker hat system
White hat hackers (ethical hackers) are paid to find vulnerabilities with full permission from the organisation. They write reports and help fix problems. Black hat hackers attack without permission for personal gain. Grey hat hackers find vulnerabilities without permission but usually disclose them rather than exploit them — still illegal in most jurisdictions, but less malicious. The cybersecurity industry needs white hats — it is a legitimate, well-paying career.
Activity 1 — Match the Attacker
Before moving on, test your understanding of threat actor categories. Match each description on the left to the correct attacker type on the right.
Threat Actor Matching
The Six Major Attack Types
Knowing who attacks is only half the picture. You also need to know how they attack. Here are the six most important attack types for you to understand at this level.
1. Malware (Malicious Software)
Malware is an umbrella term for any software designed to harm a system or steal data. There are many types:
2. Phishing
Phishing is a social engineering attack — it exploits human psychology rather than technical vulnerabilities. An attacker sends a fake email, text, or creates a fake website that looks legitimate. The goal is to trick you into entering your password, clicking a malicious link, or downloading malware.
Phishing is the number one way attackers get into organisations. Even technically sophisticated companies get breached because one employee clicked a convincing phishing email. Variants include spear phishing (targeted at a specific person), whaling (targeting executives), and smishing (via SMS text message).
3. Ransomware
Ransomware deserves its own spotlight because of how devastating it has become. Once ransomware infects a system, it silently encrypts every file it can reach — documents, photos, databases, backups. Then it displays a ransom note demanding payment (usually in cryptocurrency) for the decryption key.
In 2021, a ransomware attack on Colonial Pipeline shut down fuel supplies to the US East Coast for days. In 2020, a German hospital had to divert emergency patients because ransomware took down its systems. Schools, police departments, and city governments have all been hit. The average ransom payment in 2023 exceeded $1.5 million.
4. DDoS — Distributed Denial of Service
A DDoS attack does not steal data — it makes a service unavailable. Attackers control thousands or millions of compromised computers (called a botnet) and direct them all to send requests to one target simultaneously. The server gets overwhelmed and crashes, denying service to legitimate users.
DDoS attacks are commonly used against gaming servers, news websites, and financial institutions. They are also used as a distraction — while defenders are busy fighting the DDoS, attackers quietly break in through another door.
5. Man-in-the-Middle (MitM) Attack
In a MitM attack, the attacker secretly positions themselves between two communicating parties — for example, between you and your bank’s website. They intercept, read, and sometimes modify the messages passing between you without either party knowing.
This is especially dangerous on public Wi-Fi networks. An attacker can set up a fake Wi-Fi hotspot called “Free Airport WiFi” and intercept everything you do on it. This is why HTTPS (the padlock in your browser) is so important — it encrypts your connection so even a MitM attacker cannot read the content.
6. SQL Injection
Websites often use databases to store user information. They query those databases using a language called SQL. In a SQL injection attack, an attacker types malicious SQL code into a login form or search box. If the website is not properly secured, that code gets executed by the database — potentially exposing every user’s data, allowing the attacker to log in as any user, or deleting the entire database.
SQL injection has been responsible for some of the largest data breaches in history, including the 2008 Heartland Payment Systems breach that exposed 130 million credit card numbers.
Attack chain: how they combine
Real attacks rarely use just one technique. A typical attack might start with a phishing email that tricks an employee into downloading a Trojan. The Trojan gives the attacker a foothold, which they use to deploy ransomware across the network. Meanwhile, a DDoS distracts the security team. Understanding how attacks chain together is what separates a good defender from a great one.
Activity 2 — Sort the Threats
Each item below describes an attack behaviour. Sort it into the correct attack category.
Attack Type Classifier
- Fake email from “your bank” asking you to verify your password
- phishing
This is a classic phishing attempt — impersonating a trusted institution to steal credentials.
- Software that silently records every key you press
- malware
A keylogger is a type of spyware — malware that captures keystrokes to steal passwords.
- 50,000 infected computers all sending requests to one server
- ddos
A botnet flooding a server is the definition of a DDoS attack.
- Attacker intercepts your login on a fake coffee shop Wi-Fi
- mitm
Intercepting traffic between you and a server on a rogue Wi-Fi is a MitM attack.
- All your files get encrypted and a ransom note appears
- malware
Ransomware is a category of malware that encrypts files and demands payment.
- Text message claiming you won a prize — click here to claim
- phishing
SMS phishing (smishing) — a fake prize notification designed to steal your information.
- Gaming website goes offline because it is flooded with traffic
- ddos
Overwhelming a server with traffic to take it offline is a DDoS attack.
- Attacker reads your unencrypted messages on public Wi-Fi
- mitm
Reading unencrypted traffic between two parties is a man-in-the-middle attack.
How Attacks Actually Happen — The Attack Lifecycle
Professional attackers do not just randomly try things. They follow a structured process. Understanding this process helps defenders know where to place their defences.
Why this matters for defenders
If defenders can stop an attack at phase 1 or 2, the damage is zero. The further an attack progresses, the more expensive and difficult it becomes to stop. This is why prevention (training, patching, filtering) is always cheaper than response (incident response, recovery, legal costs).
Activity 3 — Scenario Decision Lab
Read each real-world scenario and decide what type of attack is happening and what the best response is.
Threat Response Scenarios
Real-World Case Studies
Reading about abstract attack types is useful, but seeing how they played out in real incidents makes the lessons stick. Here are three landmark cases.
Case 1: WannaCry Ransomware (2017)
WannaCry was a ransomware worm that spread to over 200,000 computers in 150 countries in a single day. It exploited a vulnerability in Windows called EternalBlue. The UK’s National Health Service was hit hardest — hospitals cancelled thousands of appointments, ambulances were diverted, and patient records were inaccessible. The attack caused an estimated $4–8 billion in damages globally. The lesson: patch your software. The Windows vulnerability WannaCry exploited had a patch available for two months before the attack — organisations that had applied it were unaffected.
Case 2: Target Data Breach (2013)
Attackers stole 40 million credit and debit card numbers from Target stores. How? They did not attack Target directly. They sent a phishing email to a small HVAC (heating and cooling) contractor that did work for Target. That contractor had remote access to Target’s network for billing purposes. The attackers used the contractor’s stolen credentials to get into Target’s network, then moved laterally to the payment systems. The lesson: your security is only as strong as your weakest vendor. Third-party access must be tightly controlled.
Case 3: Colonial Pipeline (2021)
A ransomware group called DarkSide attacked Colonial Pipeline, which supplies 45% of the fuel to the US East Coast. The attack started with a single compromised password — an employee’s VPN credentials that had been leaked in a previous data breach. The company shut down its pipeline operations out of caution, causing fuel shortages across six states. The company paid a $4.4 million ransom. The lesson: use multi-factor authentication. A single password should never be enough to access critical infrastructure.
Activity 4 — Flashcard Review
Flip through these cards to lock in the key vocabulary from this lesson. Mark each card as “Got it” or “Still learning” to track your progress.
Threats and Attackers — Key Terms
Threat Actor Any person or group that intentionally causes harm to a computer system, network, or data. Includes criminals, nation-states, insiders, and hacktivists.
- People
- Malware
Malicious software — any program designed to harm a system or steal data. Includes viruses, worms, trojans, ransomware, spyware, and adware.
- Attack Type
- Ransomware
A type of malware that encrypts the victim’s files and demands payment (ransom) for the decryption key. Has caused billions in damages to hospitals, schools, and businesses.
- Attack Type
- Phishing
A social engineering attack using fake emails, texts, or websites to trick victims into revealing credentials or downloading malware. The #1 way attackers gain initial access.
- Attack Type
- DDoS
Distributed Denial of Service — attackers use a botnet (thousands of infected computers) to flood a server with traffic until it crashes and becomes unavailable to legitimate users.
- Attack Type
- Man-in-the-Middle (MitM)
An attack where the attacker secretly intercepts communication between two parties, reading or modifying messages without either party knowing. Common on unsecured Wi-Fi.
- Attack Type
- SQL Injection
An attack where malicious SQL code is inserted into a web form input. If the site is vulnerable, the database executes the code — potentially exposing all user data.
- Attack Type
- Botnet
A network of computers infected with malware and controlled remotely by an attacker without the owners’ knowledge. Used to send spam, conduct DDoS attacks, or spread more malware.
- Concept
- Insider Threat
A security risk originating from within an organisation — an employee, contractor, or partner who misuses their legitimate access, either intentionally or accidentally.
- People
- White Hat Hacker
An ethical security professional who tests systems for vulnerabilities with explicit permission from the owner. Also called a penetration tester. A legitimate and in-demand career.
- People
- Spear Phishing
A targeted phishing attack aimed at a specific individual or organisation. Uses personalised information (name, job title, recent activity) to appear more convincing than generic phishing.
- Attack Type
- Reconnaissance
The first phase of an attack — the attacker researches the target to find useful information: employee names, email formats, software versions, and potential vulnerabilities. Concept
Defending Against These Threats — What You Can Do Now
You do not need to be a security professional to protect yourself. Here are concrete actions that defend against every threat type covered in this lesson:
The most important thing
Security awareness is your most powerful defence. Most successful attacks exploit human behaviour, not technical vulnerabilities. A well-trained person who knows what phishing looks like, who questions unexpected requests, and who reports suspicious activity is worth more than any piece of security software.
Knowledge Check — Final Quiz
Incident Analysis: Westbrook School District
Security Incident — Westbrook Unified School District On Monday morning, the IT team at Westbrook School District received reports that the student information system was inaccessible. A ransom note appeared on the server demanding $200,000 in cryptocurrency. Investigation revealed the attack began Friday evening after an administrator clicked a link in an email that appeared to come from the superintendent. The phishing email used the superintendent’s name but came from “superintendent@westbrook-edu.net” (not the real domain “westbrook.edu”)
- The administrator’s account had no multi-factor authentication enabled
- The ransomware encrypted 847 GB of student records, grades, and financial data
- Backups existed but had not been tested — 40% of backup files were found to be corrupted
The attack spread from the administrator’s workstation to the server via a shared network drive
What was the initial attack vector (how did the attacker first get in)?
- SQL injection on the student portal
- Phishing email targeting an administrator
- DDoS attack on the school network
- Physical theft of a server
Answer: Phishing email targeting an administrator
The attack began when an administrator clicked a link in a phishing email impersonating the superintendent. This gave the attacker access to the administrator’s credentials.
Which security control, if in place, would most likely have prevented the initial compromise?
- A stronger firewall
- Multi-factor authentication on the administrator account
- A newer version of Windows
- Faster internet connection
Answer: Multi-factor authentication on the administrator account
Even if the attacker stole the administrator’s password via phishing, MFA would have required a second factor (phone code, authenticator app) that the attacker did not have — blocking the login.
The ransomware spread from the workstation to the server via a shared network drive. What principle, if applied, would have limited this spread?
- Least privilege — users only have access to what they need
- Faster backup speed
- Better antivirus software
- Stronger passwords
Answer: Least privilege — users only have access to what they need
The principle of least privilege means accounts only have access to the resources they need for their job. If the administrator’s account could not write to the server, the ransomware could not have spread there.
The backups were 40% corrupted. What backup practice would have caught this before the incident?
- Making more frequent backups
- Storing backups on the same server
- Regularly testing backups by attempting a restore
- Encrypting the backups
Answer: Regularly testing backups by attempting a restore
A backup you have never tested is not a backup — it is a hope. Regularly performing test restores verifies that backups are complete and functional before you need them in an emergency.
What is the recommended response when you receive an urgent email asking you to click a link, even if it appears to come from someone you know?
- Click the link quickly to resolve the issue
- Verify by contacting the sender through a separate, known channel before clicking
- Forward it to colleagues to see if they got it too
- Reply to the email asking if it is legitimate
Answer: Verify by contacting the sender through a separate, known channel before clicking
Always verify unexpected requests through a separate channel — call the person, send a new email to their known address, or walk to their office. Never use contact information provided in the suspicious email itself.
Previous lesson: The CIA triad: Confidentiality, Integrity, Availability
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Password strength and uniqueness