Threats to information systems are typically categorized into two types. Which pair represents these types?

Threats to information systems are typically categorized into two types. Which pair represents these types?

• A. Cyber Threats and Infrastructure Threats
• B. Insider Threats and External Threats
• C. Jamming and Spoofing
• D. Pipes and Processes

Answer: (B)

Threats to information systems fall into two broad categories: those that originate from inside the organization and those that originate from outside. Insider threats come from trusted users—employees, contractors, or partners who misuse privileges, mishandle data, or fall victim to social engineering. External threats come from outside the organization—hackers, criminals, or other actors trying to breach defenses or disrupt services. This dichotomy is fundamental because it guides how you apply controls: monitoring and limiting access for insiders, coupled with strong perimeter defenses and threat intelligence for outsiders. The other pairings mix concepts that aren’t standard threat sources—for example, labeling threats as generic “cyber” versus “infrastructure,” or naming specific techniques like jamming or spoofing, or using terms like pipes and processes that describe data flows rather than threat origins. Therefore, the pairing of insider threats and external threats best captures the two main sources of information-system risk.

Threats to information systems fall into two broad categories: those that originate from inside the organization and those that originate from outside. Insider threats come from trusted users—employees, contractors, or partners who misuse privileges, mishandle data, or fall victim to social engineering. External threats come from outside the organization—hackers, criminals, or other actors trying to breach defenses or disrupt services. This dichotomy is fundamental because it guides how you apply controls: monitoring and limiting access for insiders, coupled with strong perimeter defenses and threat intelligence for outsiders. The other pairings mix concepts that aren’t standard threat sources—for example, labeling threats as generic “cyber” versus “infrastructure,” or naming specific techniques like jamming or spoofing, or using terms like pipes and processes that describe data flows rather than threat origins. Therefore, the pairing of insider threats and external threats best captures the two main sources of information-system risk.