Most attacks rely on a reused password, a missed update or one rushed click. This guide explains how malware, phishing and weak passwords work, and which defences matter most, with diagrams, worked examples and a quiz.
Every phone, laptop and online account holds something worth protecting: photos, messages, school work, money, or simply the ability to use the device at all. Cybersecurity is the practice of protecting those things from people who try to steal, change, or lock them. The good news is that most attacks are not clever. They rely on a reused password, a missed update, or one rushed click. This guide explains what is being protected, how the common attacks work, and which defences matter most, so the advice you hear ("use a strong password", "don't click that link") becomes something you understand rather than a rule you memorise. Everything here is defensive: it is about protecting yourself, not about attacking anyone.
Helpful background: What Is the Internet, Really? explains how data travels, and Search Engines & Web Browsers explains how web addresses work, which helps with the section on suspicious links.
Security professionals describe the goals of protection using three words, often called the CIA triad (nothing to do with any agency):
For each incident, decide which goal is mainly affected.
One incident can break more than one goal, so it helps to ask the question for each of the three.
Thinking in terms of risk helps you decide what to fix first, because you cannot fix everything at once.
A simple method is to score likelihood from 1 (very unlikely) to 5 (very likely) and impact from 1 (minor) to 5 (severe), then multiply: risk = likelihood × impact. The scores below are judgements made for teaching, not measurements.
| Situation | Likelihood | Impact | Risk |
|---|---|---|---|
| Same password used on five sites, including email | 4 | 5 | 20 |
| Phone with no screen lock is lost | 3 | 4 | 12 |
| Phone updates ignored for months | 3 | 3 | 9 |
| A classmate glimpses your lock-screen notification | 2 | 1 | 2 |
Conclusion: fix the password reuse first (20), then add a screen lock (12), then turn on updates (9). The last item is worth ignoring for now. The numbers are subjective, but the habit of ranking is useful.
Attackers have different motives, and most are criminals looking for money. Most attacks on ordinary people are opportunistic: huge numbers of messages are sent or passwords tested, to see who falls for it. That is why "nobody would want to hack me" is not a good defence. Automated attacks do not choose targets by name.
Malware (short for malicious software) is any program designed to damage a system, steal from it, or take control of it. Common types are:
| Type | What it does |
|---|---|
| Virus | Attaches itself to a legitimate file and spreads when that file is shared or opened |
| Worm | Spreads on its own across networks, without needing a file to attach to |
| Trojan | Pretends to be useful software so that a person installs it willingly |
| Ransomware | Locks (encrypts) a victim's files and demands payment for the key |
| Spyware | Secretly records activity and sends it to an attacker; a keylogger records what is typed |
| Botnet | A group of infected devices controlled together, often used to send spam or flood websites |
Malware usually arrives through ordinary routes: an email attachment or link, a fake or pirated download, a malicious advertisement or website, an infected USB drive, or a weakness in software that has not been updated. Warning signs include unexpected pop-ups, programs you did not install, a device that is suddenly much slower or hotter, a battery that drains unusually fast, or security tools that have been switched off. None of these proves infection by itself, but together they are worth checking.
On 12 May 2017, a ransomware worm called WannaCry spread rapidly around the world and disrupted many organisations, including services in the National Health Service in England. It used a flaw in Windows for which Microsoft had already released a fix in March 2017. Computers that had not applied that update were exposed. The lesson was clear and still applies: updates matter because attackers actively use known flaws, and a patch only protects the devices on which it is installed.
Many successful attacks never break any software. Instead, they trick a person. This is called social engineering. The best known form is phishing: a message, usually an email or text, that pretends to be from a trusted source to get you to click a link, open a file, or enter a password on a fake page. Related forms include smishing (by text message), vishing (by phone call) and spear phishing, which targets one person using details found about them, so the message looks far more convincing than a mass email.
Phishing works by pressing human buttons: urgency ("act in 24 hours"), fear ("your account will be closed"), greed ("you have won") or authority ("this is your headteacher/bank"). The aim is to make you act before you stop to think.
The link in Figure 2 reads www.mybank.example.verify-login.example. The words "example" are used here because it is a name reserved for teaching, so no real site is involved.
Step 1: Find where the address ends. The address part finishes at the first single "/" (or at the end if there is none). Here there is no "/", so the whole thing is the address.
Step 2: Read from the right. The real website is the last two parts, the domain: verify-login.example. Everything to the left (www.mybank.example.) is only a prefix chosen by whoever owns that domain.
Step 3: Compare. The genuine bank's domain would be mybank.example, with nothing after it before the first "/". Here the bank's name appears only as part of the prefix, to look familiar.
Conclusion: this link goes to verify-login.example, not the bank. Do not click it. Instead, open the bank's app or type its address yourself.
Note: some countries use two-part endings such as .co.uk, so the rule is "the name just before the ending", but the habit of reading from the right still works.
What to do with a suspicious message: do not click links or open attachments, do not reply, check the claim by going to the real website or app yourself, report it (most email and messaging services have a report option), and delete it. In school or at work, tell the person responsible for IT.
A password protects an account only if an attacker cannot guess it or find it elsewhere. There are two main dangers:
The number of possible passwords is (number of possible characters) raised to the power of (length). Suppose an attacker can test 10 billion guesses per second against a stolen file. That figure is only an illustration. Real speeds vary hugely depending on how the website stored the password, so treat these as comparisons, not promises.
What this shows: each extra character multiplies the work, so a few extra characters make a huge difference. A long passphrase of random words can match a short, tricky-looking password but is easier for a person to remember.
Important limit: these figures assume the characters or words are chosen truly at random. Passwords made of names, dates or familiar patterns such as "Summer2026!" are guessed much faster because attackers try those first. Random choice is what makes the arithmetic work.
Modern guidance, including the United States' NIST Digital Identity Guidelines (SP 800-63B) and the CISA "Secure Our World" campaign, points the same way: use long passwords, make them unique for every account, and use a password manager, which is a program that creates and stores strong passwords for you so you only remember one strong master password. NIST also advises that services should not force strange symbol rules or force people to change passwords on a timetable. Changing a password is needed when there is evidence it may be compromised, for example after a breach. Making people change passwords constantly tends to produce weaker, more predictable ones.
Authentication means proving you are who you say you are. There are three kinds of proof:
Multi-factor authentication (MFA), also called two-step verification, requires proof from at least two different kinds. If someone steals your password, they still cannot log in without the second factor. Not all second factors are equally strong. A code from an authenticator app is generally safer than a code sent by text message, and a physical security key resists phishing even better. Any form of MFA is still much better than none. Turn it on first for your email, because email can be used to reset other accounts.
Passkeys are a newer way to log in. Instead of a password, your device holds a secret cryptographic key and proves possession of it, usually after you unlock the device with a fingerprint, face or PIN. Because there is no password to type, there is nothing for a fake website to steal in the usual way. Many major services now support passkeys, though support varies.
If you get a login approval request or code you did not ask for, do not approve it. Someone may have your password, so change it.
Encryption scrambles data using a mathematical key so that only someone with the right key can read it. The original readable data is called plaintext and the scrambled version is ciphertext.
The Caesar cipher is named after the Roman general Julius Caesar, who is said to have used something similar. It shifts each letter forward by a fixed number. The key is the shift. Let us use a shift of 3.
Encrypt "CYBER": C→F, Y→B (after Z the alphabet wraps back to A), B→E, E→H, R→U. The ciphertext is FBEHU.
Decrypt: shift each letter back by 3: F→C, B→Y, E→B, H→E, U→R, giving CYBER again.
Why it is weak: there are only 25 possible shifts, so anyone can try them all in moments. Modern encryption works on the same idea (a key scrambles the data) but uses keys with so many possibilities that trying them all is impossible. For example, a 128-bit key has 2128 (about 3.4 × 1038) possible values.
You rely on encryption every day:
A VPN (virtual private network) encrypts your connection between your device and the VPN company's server. It can protect against snooping on the local network and hide your address from the sites you visit, but it does not make you anonymous. Instead, you are trusting the VPN company with the data your internet provider would otherwise see.
No single protection is perfect, so security uses layers. This idea is called defence in depth. If one layer fails, another can still stop the attack, just as a castle has a moat, walls and guards.
Here are the main tools and what each one does:
Ransomware shows why backups are a security tool and not just a convenience. If a clean copy of your files exists somewhere the attacker cannot reach, a ransomware attack becomes an inconvenience rather than a disaster. A widely used rule of thumb is 3-2-1: keep 3 copies of important files, on 2 different kinds of storage, with 1 kept off-site or offline. Remember that an always-connected synced folder is not a true backup, because deletions and encrypted files can sync too (see Cloud Computing for the difference).
If ransomware strikes, disconnect the device from the network to limit the spread, tell the responsible adult or IT team, and do not rush to pay. Law-enforcement and security agencies generally advise against paying, because payment does not guarantee that the files will be returned and it encourages further attacks.
For more on what you leave behind online, see Digital Footprint & Online Privacy.
Mistakes happen to careful people too. The most important rule is to act quickly and tell someone instead of hiding it. If you think an account has been taken over:
If money was sent, contact the bank or payment provider immediately. If a message or photo is being used to threaten you, keep the evidence, do not give in, and talk to a trusted adult.
Getting into someone else's computer, account or network without permission is illegal in most countries, even "just to see". Security is a respected career, and ethical hackers test systems only with the owner's clear permission. If you are curious, practise on systems you own or on environments built for learning.
Try each question first, then tap it to reveal the answer. A scored multiple-choice quiz follows below.
Confidentiality (only the right people can see data), Integrity (data is accurate and not wrongly changed) and Availability (data can be used when needed).
A threat is something that could cause harm, such as a scammer. A vulnerability is a weakness that the threat could use, such as an out-of-date app or a reused password.
www.shop.example.cheap-deals.example/login?The address ends at the first single "/", so read from the right: the domain is cheap-deals.example. The "shop.example" part is only a prefix.
Each extra character multiplies the number of possible passwords, so the work needed to guess it grows enormously. Random choice is also essential, because predictable passwords are tried first.
The attacker also needs the second factor, such as a code from your authenticator app or a security key, so the password alone is not enough to log in.
Because the encrypted or deleted files can sync too, so every copy may be damaged. A separate backup, ideally off-line or off-site, can survive an attack.
Spot the phish (no accounts needed): print several made-up messages, some genuine-looking and some fake, and have pairs mark every warning sign. Use only invented addresses such as the reserved ".example" names.
Password arithmetic: ask students to recalculate Worked Example 4 with their own password-length ideas, using a calculator, and discuss why random choice is necessary.
Safety note: please keep all practice to invented examples. Do not test real passwords, scan other people's networks or try to access accounts that are not your own. Tell students to speak to a trusted adult if they are being threatened or pressured online.
This article is original EDUSAMBAM writing. It follows widely accepted public guidance, listed below, and all diagrams are original EDUSAMBAM schematics. The password calculations are plain arithmetic using an illustrative guess rate, all example names and addresses are invented, and the risk scores are teaching judgements. Where this article states a historical event, it is from the documented record.
Threats and best practice change over time, so check the current advice from your school, your service providers and national cybersecurity agencies. If you are in immediate danger or being threatened online, contact your local emergency services and a trusted adult.
10 questions. Select an answer for each, then submit to see your score instantly.