Cyber Defender!
Understand Cyber Crime

What is cyber crime?

Cyber crime is any crime where a computer, network or the internet is used as the tool, as the target, or as both. It can be run by one person or a large group, and it can happen to anyone: a person, a business, or a whole country.

Common examples include:

• 1Hacking getting into a system that is not yours
• 2Malware viruses, spyware and ransomware
• 3Phishing fake emails or messages that trick you into giving details
• 4Identity theft pretending to be someone else to steal money or data
• 5Online fraud scams, fake shops and stolen card details

Why do people do it? (motives)

Most cyber crime is about money, but it is not the only reason. Attackers are often motivated by:

• 1Financial gain stealing money, selling data, or demanding a ransom
• 2Espionage stealing secrets from a company or a country
• 3Ideology or activism pushing a political or moral message
• 4Thrill or status proving they can, or earning respect in a group
• 5Revenge lashing out at a person or company they are angry with

A threat actor is the person or group who carries out a cyber attack. Knowing the type of threat actor helps you guess their motive and how they work.

• 1An individual a lone attacker, often working alone for money or the challenge
• 2A company one business spying on another to steal ideas or customers
• 3A nation a country attacking another country, its government or its infrastructure
• 4A hacker someone with strong technical skills who breaks into systems
• 5A hacktivist an attacker driven by a political or moral cause, not money

External threat

An external threat comes from outside the organisation. It is usually a criminal, a competitor, a nation, or a hacking group with no legitimate access.

Typical motives: money, stealing data, causing disruption, or spying. The Col-Tech attacker was an external threat actor.

Insider threat

An insider threat comes from inside the organisation: an employee, a contractor, or a former member of staff who already has access.

• 1Malicious insider uses their access on purpose, often for revenge or money
• 2Accidental insider makes a mistake, like clicking a phishing link or losing a device
• 3Negligent insider ignores the rules, like reusing a weak password

Targeted attack

A targeted attack is aimed at one specific victim. The attacker does their homework first: they research the company, learn names, and write a message that fits. It takes more effort, but it is far more likely to work.

The Col-Tech attack was targeted. The attacker knew how the company operated and how to reach its staff.

Untargeted attack

An untargeted attack is sent out widely and hopes someone falls for it. The same fake email goes to thousands of people. It is cheap and random, like a spam text or a mass ransomware email.

An individual

• 1Weak or reused passwords, and no second step of sign-in
• 2Oversharing personal details that help a scammer
• 3Devices that have not been updated or backed up

A business

• 1Unpatched software and no staff cyber training
• 2Weak access control, so too many people can see too much data
• 3No backups, and no plan for what to do if an attack happens

This also applies to charitable ventures and large multi-organisation services such as the NHS, where a breach can affect many organisations at once and even spread internationally.

A nation

• 1Attacks on power, water, transport and banking systems
• 2Spying on government and defence secrets
• 3Attacks through shared supply chains and connected systems

An individual

• 1Lost money and stolen identity
• 2Stress, worry and a damaged reputation
• 3Time spent fixing accounts and passwords

A business

• 1Financial loss, downtime and repair costs
• 2Fines and legal trouble if customer data is mishandled
• 3Lost customers, lost trust and damage to reputation

A nation

• 1Disruption to vital services such as power or the NHS
• 2Economic damage and stolen secrets
• 3Loss of public confidence and national security

If something looks wrong, the worst thing you can do is stay quiet. Reporting quickly is a skill, and it is one of the best defences a person or company has.

• 1Contain the damage the sooner it is known, the sooner accounts can be locked and systems isolated
• 2Protect other people a fast warning can stop the same attack hitting colleagues, friends or customers
• 3Meet the law companies must report serious data breaches to the ICO within 72 hours
• 4Keep the evidence early reports preserve clues that help find the attacker
• 5Protect trust handling it well shows customers you take their data seriously

Key organisations

• 1NCSC the National Cyber Security Centre gives advice to UK organisations and helps during major incidents
• 2ICO the Information Commissioner's Office enforces data protection law and can fine organisations that mishandle data
• 3Action Fraud the UK national reporting centre for fraud and cyber crime
• 4International bodies such as INTERPOL and ENISA help countries work together on cyber crime

General job functions

• 1Monitoring watching networks for suspicious activity, often in a Security Operations Centre
• 2Testing ethical pen testers deliberately attack a system to find weak spots first
• 3Responding incident responders handle an attack while it is happening
• 4Investigating digital forensics analysts examine devices and logs after an attack
• 5Leading a Chief Information Security Officer sets the security strategy

Hacking means gaining unauthorised access to a computer system or network. Although people often picture a criminal, hacking is also done legally by security experts, who are paid to find problems before criminals do.

• 1White-hat an ethical hacker with permission. They test systems and report the flaws so they can be fixed
• 2Black-hat a criminal hacker. They break in without permission for money or harm
• 3Grey-hat they break in without permission, but usually with no bad intent, and may report the problem afterwards

Key skills

• 1Communication explaining a risk so anyone can understand it
• 2Analytical skills spotting patterns and solving problems step by step
• 3Digital skills understanding networks, systems and tools
• 4Teamwork working with IT, management and sometimes the police
• 5Attention to detail and a strong sense of ethics and honesty

Your defence plan for Col-Tech

Leah asked for one page of advice. Tick the actions you would recommend, then take the final quiz.