Computer security

Computer security—also called cybersecurity, digital security, or IT security—is a branch of information security. Its job is to keep computer software, systems, and networks safe from threats that could cause unauthorized access, theft, or damage to hardware, software, or data, as well as disrupt or misdirect the services those systems provide.

Why does this matter more than ever? Because we rely heavily on computers, the Internet, and wireless networks—and that reliance has only grown with the rise of smart devices like phones, TVs, and other Internet of Things (IoT) gadgets. As digital infrastructure becomes woven into daily life, cybersecurity has become a critical issue. Modern information systems are complex, and the essential services they support—like power grids, elections, and finance—are especially vulnerable to breaches.

Not all computer security is digital. While things like passwords and encryption are key, physical measures—such as metal locks—still help prevent tampering. That said, IT security isn’t a perfect subset of information security, so it doesn’t fit neatly into the security convergence schema.

**Vulnerabilities and attacks**

A vulnerability is a flaw in a system’s design, code, operation, or oversight that weakens its security. Most known vulnerabilities are listed in the Common Vulnerabilities and Exposures (CVE) database. A vulnerability is exploitable if there’s a working exploit for it. A threat is a potential negative action or event made possible by a vulnerability. The person or agent who exploits a vulnerability is often called a hacker in popular media. Vulnerabilities can be researched, reverse-engineered, hunted, or exploited using automated tools or custom scripts.

Different groups face different types of attacks. In April 2023, the UK Department for Science, Innovation & Technology surveyed 2,263 businesses, 1,174 charities, and 554 educational institutions about cyberattacks over the previous year. They found that 32% of businesses and 24% of charities recalled any breaches or attacks. That number jumped to 59% for medium businesses, 69% for large businesses, and 56% for high-income charities (those with £500,000 or more in annual income). While larger companies have improved their defenses over the past decade, small and midsize businesses (SMBs) are increasingly vulnerable because they often lack advanced tools. SMBs are most likely to face malware, ransomware, phishing, man-in-the-middle attacks, and denial-of-service (DoS) attacks.

Regular internet users are most often hit by untargeted attacks—where attackers indiscriminately go after as many devices, services, or users as possible. These attacks exploit the openness of the Internet and typically involve phishing, ransomware, water holing, and scanning.

To secure a system, you need to understand the attacks it might face. These threats generally fall into categories like:

**Backdoor** A backdoor is a secret way to bypass normal authentication or security controls in a computer system, cryptosystem, or algorithm. These weaknesses can come from original design or poor configuration. Backdoors are a bigger concern for companies and databases than for individuals. They may be added by an authorized party for legitimate access or by an attacker for malicious reasons. Criminals often use malware to install backdoors, giving them remote administrative control—allowing them to modify files, steal personal information, install unwanted software, or take over the entire computer. Backdoors are hard to detect because they hide in source code or system firmware and may require deep knowledge of the operating system to spot.

**Denial-of-service attack** Denial-of-service (DoS) attacks aim to make a machine or network resource unavailable to its intended users. Attackers can lock a single victim’s account by repeatedly entering the wrong password, or they can overwhelm a machine or network to block everyone at once. A single-IP attack can be blocked with a firewall rule, but distributed denial-of-service (DDoS) attacks—coming from many points—are much harder to defend against. These attacks can come from zombie computers in a botnet or from techniques like distributed reflective denial-of-service (DRDoS), where innocent systems are tricked into sending traffic to the victim. The amplification factor means the attacker needs little bandwidth themselves. (For why attackers do this, see the section on attacker motivation.)

**Physical access attacks** A direct-access attack occurs when an attacker gains physical access to a system.