Phishing deceives a user into revealing information or performing an unsafe action; malware is malicious software that executes on a system; and a man-in-the-middle attack intercepts communication between two parties. They differ mainly in what they target: human trust, computer systems, or network communications.
How Each Attack Works
Phishing is a form of social engineering. An attacker impersonates a trusted organization or person through an email, message, website, or call, attempting to obtain credentials or persuade the victim to download a file. For example, a fake school login page may capture a student's username and password.
Malware is software intentionally designed to damage, disrupt, monitor, or gain unauthorized access to a computer system. Types include viruses, worms, trojans, ransomware, and spyware. Malware may be delivered through phishing, but the two terms are not interchangeable.
In a man-in-the-middle (MITM) attack, an attacker secretly positions themselves between two communicating parties. The attacker may eavesdrop, steal data, or alter messages while each party believes it is communicating directly with the other. This may occur through a compromised network, rogue Wi-Fi access point, or falsified network information.
| Attack | Main mechanism | Typical defence |
|---|---|---|
| Phishing | Manipulates a user into trusting a fraudulent request | User education, checking URLs, spam filters, and multi-factor authentication |
| Malware | Executes malicious instructions on a device | Anti-malware software, updates, access controls, and avoiding untrusted files |
| Man-in-the-middle | Intercepts or modifies data in transit | Encryption, authenticated protocols such as HTTPS, certificates, and secure networks |
A common misconception is that phishing is a type of malware. Phishing is an attack method based on deception, although it can be used to deliver malware. Similarly, an MITM attack does not necessarily install software on the victim's device.
IB Exam Technique
For A2.4 Network security, define each attack by its mechanism, then apply it to the scenario. If asked to distinguish them, identify the target and process rather than merely listing examples or security measures.
