1.3 What Could Go Wrong: Identifying the Security Needs of My Device

Your phone, laptop, and tablet hold a huge amount of your life: bank apps, medical records, photos, saved passwords, school work. That makes them targets. Attackers use both physical tricks (watching your screen, grabbing your device) and digital ones (phishing emails, malware) to get in. This topic is about what actually happens when an attack succeeds, and which security controls you can put in place to lower the damage.

What Attacks Actually Do to Your Device

Pretty much every physical or digital attack has the same goal: getting unauthorized access to your accounts, your data, or the device itself. Once an attacker is in, the fallout can get ugly fast.

Exposing Personal and Sensitive Data

When someone gets unauthorized access, they can see things you definitely don't want public. That includes:

• Financial records (bank statements, credit card info)
• Health-related data (medical history, prescriptions)
• Personally identifiable information (PII): stuff that can identify you specifically, like your full name, Social Security number, address, or date of birth

Once that data is exposed, it doesn't just sit there. Attackers often sell it on shady marketplaces or leak it publicly. From there, anyone can grab it.

How Stolen Info Gets Used Against You

If an attacker gets your credentials (like a username and password) or takes over an account, they can use those details to:

• Commit fraud (pretending to be you)
• Make purchases on your cards or accounts
• Apply for loans in your name

The long-term consequences hit hard. Victims can watch their credit score tank, end up in serious debt, or deal with identity theft that drags on for years. Fixing a wrecked credit report or proving a loan wasn't actually yours takes months, sometimes longer.

Impact on Small Businesses and Organizations

It's not just individuals. When a small business or organization gets breached, the damage spreads in different ways:

• Reputation harm: once customers hear about a breach, trust drops
• Operational disruption: systems might go down, orders can't be processed, employees can't work
• Leaked client information: customer names, addresses, or payment info getting out
• Unprofessional communication: attackers sometimes send messages from hijacked accounts, making the business look sketchy
• Service interruptions: websites or apps going offline

The result is often lost customers, bad press, and trust that takes years to rebuild (if the business survives at all).

What Malware Does Once It's In

Malware is any software designed to do harm. When it infects a device, a few things can happen:

• The device starts acting abnormally: weird pop-ups, programs opening on their own
• It runs slowly, crashes, or becomes totally unusable
• Attackers can reach your files, watch your activity (keystrokes, screen, webcam), or remotely control the device

One sneaky thing about malware: an infected device can spread it to other systems. Your laptop connects to your home Wi-Fi, which connects to your family's phones, which connect to your school network. One infected machine can become a launching pad for attacks on everything it touches.

Picking the Right Security Control for the Job

Security controls are the protections you put in place to reduce vulnerabilities. Picking a good one isn't random. You have to know what specific weaknesses a device has and what harm each weakness could cause. A control that stops phishing won't do much against someone peeking at your screen on the bus.

Here's how to match controls to common attacks.

Weak Authentication

Authentication is how a system confirms you're actually you. Weak authentication means it's easy for someone else to pass the check, usually because passwords are short, obvious, or reused everywhere. Controls that counter this:

• Strong passwords: long, mixed characters, not based on your name or birthday. They're harder to guess or crack.
• Multifactor authentication (MFA): adds extra layers on top of your password. Even if someone steals your password, they'd still need a code from your phone or an authenticator app to get in.
• Biometric verification: uses unique physical traits like fingerprint scans or facial recognition. Someone can steal a password, but copying your fingerprint is a lot harder.

Think of MFA like a door with two locks. Even if the attacker picks one, they're still stuck.

Phishing

Phishing is when an attacker sends deceptive content to trick you into handing over credentials or downloading malware. Common forms:

• Spoofed emails that look like they're from your bank or school
• Fake websites that mimic real login pages
• Urgent messages ("Your account will be closed in 24 hours. Click here!") designed to make you panic and click without thinking

Controls that can reduce phishing's impact:

• Email filtering: your email provider (or an add-on tool) blocks harmful messages before they ever hit your inbox
• User training: teaching people to spot red flags (weird sender addresses, misspelled URLs, pressure tactics) and report suspicious messages instead of clicking

Phishing works because it targets humans, not machines. That's why training matters so much, even with filters in place.

Shoulder Surfing

Shoulder surfing is when someone without authorization watches or records your screen or keyboard to grab information. It's low-tech but surprisingly effective. Someone standing behind you at a coffee shop can see your password or read a private message.

Controls that can reduce shoulder surfing's impact:

• Privacy screens: physical filters that fit over your display and narrow the viewing angle. Only someone sitting directly in front of the screen can see it clearly. From the side, it looks black.
• Screen placement: put your screen away from high-traffic areas. If your back is against a wall, nobody can lurk behind you.

Simple, but these controls stop a whole category of attack that no amount of antivirus can help with.

Malware

Since malware can do everything from slowing your device to handing it to a remote attacker, you need controls that both block it and clean it up.

• Antivirus and antimalware software: scans for known threats and removes them. The key is updating it regularly, because new malware comes out constantly and outdated software won't recognize it.
• Keeping operating systems and applications up to date: software updates often include patches for known vulnerabilities. If you skip updates, you're leaving open doors that attackers already know about.

A lot of successful malware attacks target devices running old, unpatched software. The vulnerability is public, the patch exists, the user just didn't install it.

Matching the Control to the Vulnerability

The big picture: security isn't one-size-fits-all. You pick controls based on what the specific device is vulnerable to and how bad the damage could be. A public library computer probably needs a privacy screen and strong antivirus. A phone with your banking app needs MFA and biometric lock. A small business laptop handling customer data probably needs all of the above plus email filtering and consistent updates.

None of these controls are the only options out there. They're the common, effective ones you should know. Stacking multiple controls (layered defense) is almost always stronger than relying on just one. If phishing gets past the email filter, user training catches it. If the password gets stolen, MFA blocks the login. If malware sneaks in, antivirus flags it. Each layer buys you another chance to stop an attack before real harm happens.