Which of the following is a common threat to cybersecurity?

Phishing is a type of social engineering attack where malicious actors attempt to deceive individuals into divulging sensitive information, such as usernames, passwords, and credit card details, by masquerading as a trustworthy entity in electronic communication. It is one of the most widespread and effective methods used by cybercriminals to gain unauthorized access to systems and data, making it a primary and common threat to cybersecurity. The attack preys on human psychology rather than technical vulnerabilities, allowing it to bypass many traditional security defenses.

A. Software updates: These are a fundamental security measure used to patch vulnerabilities and protect systems from threats, not a threat itself.

B. Data encryption: This is a protective security control that renders data unreadable to unauthorized parties, safeguarding its confidentiality.

C. User authentication: This is a core security process that verifies a user's identity to control access to systems and resources.

1. Cisco Official Documentation: In the article "What Is Phishing?", Cisco defines it as "a type of social engineering attack often used to steal user data... Phishing is a common type of cyber attack that everyone should learn about to protect themselves." This source explicitly identifies phishing as a common threat.

Source: Cisco, "What Is Phishing?", Section: "How Phishing Works", Paragraph 1. (Accessible on the official Cisco website).

2. Academic Publication: A study on cybersecurity threats highlights that social engineering, particularly phishing, remains a dominant threat vector. The authors state, "Phishing is a fraudulent attempt, usually made through email, to steal your personal information... It remains one of the most common forms of cyber-attacks."

Source: O. A. Osho, A. P. Singh, and A. J. Onumanyi, "Analysis of Phishing Attacks and Countermeasures," 2019 International Conference on Computational Science and Computational Intelligence (CSCI), Las Vegas, NV, USA, 2019, pp. 1219-1224, doi: 10.1109/CSCI49370.2019.00231. (Section I. Introduction, Paragraph 2).

3. University Courseware: Course materials for introductory computer security frequently contrast threats with countermeasures. Phishing is consistently categorized as a threat, while encryption, authentication, and patching (software updates) are presented as essential defensive mechanisms.

Source: MIT OpenCourseWare, 6.858 Computer Systems Security, Fall 2014. Lecture 1: "Threat models," which categorizes different types of attacks, including social engineering like phishing.