Discuss various security threats to computer system. Also, describe the measures to protect against those threats. Distinguish between firmware and cache memory.

A computer security threat is any event, actor or malicious program capable of compromising the confidentiality, integrity or availability of a computer system and its data. Threats may originate outside an organization, arise from insiders, or occur accidentally. Effective protection therefore requires several complementary controls rather than one security product.

Major security threats

1. Malware: Malicious software includes viruses, worms, Trojan horses, spyware, ransomware and rootkits. A virus attaches to a host file, a worm can spread automatically through networks, and a Trojan appears legitimate but performs a hidden harmful action. Spyware steals information, while ransomware encrypts files and demands payment.

2. Social engineering: Attackers manipulate people rather than directly breaking technology. Phishing emails, fake login pages, fraudulent support calls, malicious QR codes and baiting can persuade a user to reveal a password, open an attachment or install malware.

3. Credential and access attacks: Weak, reused or stolen passwords allow unauthorized access. Brute-force attacks try many passwords; credential stuffing tests passwords leaked from another service. Excessive user privileges increase the damage possible after an account is compromised.

4. Network and service attacks: Eavesdropping on insecure networks, man-in-the-middle attacks, spoofing and denial-of-service attacks can intercept, alter or block communication. Unpatched services may also be exploited remotely.

5. Application and data attacks: Vulnerable applications may permit unauthorized commands, malicious input or data theft. Accidental deletion, incorrect sharing permissions and uncontrolled removable media can expose or destroy information even without a sophisticated attacker.

6. Physical and insider threats: Theft of a laptop, fire, power problems, hardware damage, careless employees or a malicious insider can compromise systems. An authorized person can also misuse legitimate access.

Measures for protection

• Patch and harden systems: Keep the operating system, browser, applications, router and device firmware updated. Remove unused software and services, change default passwords, and use secure configuration.
• Use anti-malware and firewalls: Reputable, updated endpoint protection can detect known malicious behaviour. Host and network firewalls restrict unnecessary connections. Email and web filtering reduce exposure to malicious links and attachments.
• Strengthen authentication and access control: Use long, unique passwords, a password manager and multi-factor authentication. Apply the principle of least privilege, separate administrator accounts, disable unused accounts and review permissions regularly.
• Protect data: Encrypt sensitive data at rest and in transit, use secure HTTPS or VPN connections, control USB devices, and classify information according to sensitivity.
• Maintain tested backups: Follow a method such as the 3-2-1 rule—three copies, on two media, with one copy off-site or offline. A backup is useful only if restoration is tested. Offline or immutable copies are especially important against ransomware.
• Train users: Teach staff to examine sender addresses and links, verify unusual requests through another channel, avoid pirated software, and report incidents promptly. No legitimate administrator should ask for a user's password.
• Monitor and prepare: Use logs, intrusion detection, alerts and periodic security assessments. Maintain an incident-response plan covering isolation, evidence preservation, recovery and notification.
• Provide physical and environmental protection: Lock equipment rooms, control entry, use screen locks, securely erase retired storage, and use surge protection or UPS equipment.

These measures form defence in depth: if one layer fails, another layer may prevent, detect or limit the attack.

Firmware and cache memory

Basis	Firmware	Cache memory
Nature	Low-level software embedded in a hardware device	Small, very high-speed semiconductor memory
Main purpose	Controls, initializes or provides operating instructions for specific hardware	Holds copies of frequently or recently used data and instructions to reduce CPU waiting time
Location	Stored in ROM, EEPROM or flash memory in a motherboard, router, printer or other device	Located inside or very close to the CPU; commonly organized as L1, L2 and L3 cache
Volatility	Normally non-volatile; retained without power	Normally volatile; contents disappear when power is removed
Change or update	Updated occasionally with a manufacturer-approved firmware update	Filled and replaced automatically by processor hardware; users do not save files in it
Example	BIOS/UEFI firmware or printer firmware	L1 instruction cache or shared L3 CPU cache

Therefore, firmware is executable control code that makes hardware operate, whereas cache is temporary high-speed storage that improves processing performance.