TryBench
Why Attackers Target Accounts
Understand the CIA triad and why attackers seek credentials to siphon money and corporate data.
Why this matters
Most attacks start with a trick on a person, not a clever hack. If you can tell a real request from a fake one, you stop most attacks yourself.
The Three Goals of Security
Security protects three things. Confidentiality: private things stay private. Integrity: information is not changed. Availability: systems work when needed.
In real life: A bank keeps your money secret (confidentiality), keeps the balance correct (integrity), and lets you use your card when you need it (availability). Security protects all three.
A Stolen Password Is a Master Key
Attackers rarely break through firewalls. They log in with a stolen password. Then they redirect payments and copy your contacts.
In real life: A thief with a copy of your house key does not need to break a window. A stolen password is that key. They walk in and look around quietly.
Credential theft -> Session hijack -> Fraudulent wire transfer
Your practice task
Four requests reach you on a busy Monday. Decide which ones are safe to act on and which are attacks.
How to do it
- Read the security rule in the box above.
- Read each of the four requests.
- Choose LEGITIMATE or MALICIOUS for each one.
- Press Run proof.
Practice it for free in the app. You get instant checks that show what you got right and what to fix. A lesson takes about two minutes and you can try as many times as you like.
Quick reference: Threat Actor Intent
Immediately classify any password request as malicious.
Legitimate IT never requests passwords or BVN credentials via chat or SMS.
More lessons in this course
- Passphrases & Multi-Factor ArmorReplace weak passwords with long passphrases and upgrade from SMS OTPs to authenticator apps.
- Phishing Email Red Flags: How to Spot a FakeIdentify manipulative urgency, spoofed headers, and fake penalties in phishing communications.
- Inspecting Links & DomainsSeparate deceptive display text from actual web addresses and understand padlock limitations.