← Years 9–10 Digital Systems

Insider threats and human error

Harm to data or systems caused by someone with legitimate access, either on purpose (malicious insider) or by mistake, like emailing the wrong person or setting a file to public.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 62, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 38, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 10, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 15, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 26, WA Computer Science ATAR Year 11 — Cyber Security — Module 49

Understanding Insider threats and human error in Years 9–10 Digital Systems

What it does: The sender has legitimate access to the file but a typo in the address sends it to an outsider. This is human error, not an attack. A wrong sharing setting exposes data to people who should not see it. An insider made the mistake, so it is an insider threat. An insider threat comes from someone with legitimate access. Doing harm on purpose makes them a malicious insider. Insider threats include honest mistakes, like sending a file to the wrong person, as well as deliberate harm. An insider already has permission to use the system. Hackers who break in are outsiders.

Common mistakes: A single = assigns a value. To check whether the user has the staff role you need the comparison operator ==. It should be if user_role == "staff":. The warning should appear when the typed address does NOT match the intended one, so a typo like emailing the wrong person is caught. It should be if typed != intended:.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Insider threats and human error to a class →

This module's key terms are also in a printable crossword (Modules 41–69) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
An employee with a valid login deliberately copies customer data to sell it. Is this an insider threat?
Yes, a malicious insiderNo, only outsiders are threats
Matches
Only outside hackers can cause a data breach, so we do not need to worry about our own staff.
↓
This ignores insider threats. People with legitimate access can also cause harm, on purpose or by mistake.
Applying
Meanings
Term
insider threat
Meaning
Harm to data or systems caused by someone with legitimate access, either on purpose (malicious insider) or by mistake, like emailing the wrong person or setting a file to public.
Practice
access <- "legitimate"
Testing
Gaps
insider = hasAccess causesHarm
Check Answer
Spots
1user_role = "staff"
2if user_role = "staff":

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Gulper Eel' badge — Deep Streak, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. An employee with a valid login deliberately copies customer data to sell it. Is this an insider threat?
A. No, only outsiders are threats
B. Yes, a malicious insider ✓
An insider threat comes from someone with legitimate access. Doing harm on purpose makes them a malicious insider.
2. Which situation is an accidental insider threat?
A. Emailing a private spreadsheet to the wrong person ✓
B. A stranger guessing a password online
Emailing the wrong person is human error by someone with legitimate access. A stranger guessing a password is an outside attacker.
3. Which statement about insider threats is true?
A. They can happen by mistake, with no bad intent ✓
B. They only happen when someone means to cause harm
Insider threats include honest mistakes, like sending a file to the wrong person, as well as deliberate harm.
4. A student sets a shared folder of class marks to 'Anyone with the link can view'. What type of problem is this?
A. A misconfigured sharing setting ✓
B. A denial of service attack
Setting sharing to public by mistake can expose private data. It is human error, not an attack that floods a system.
5. What makes someone an 'insider' in an insider threat?
A. They have hacked into the system
B. They have legitimate access to data or systems ✓
An insider already has permission to use the system. Hackers who break in are outsiders.

Match the Pairs

insider threat → Harm to data or systems caused by someone who has legitimate access, on purpose or by mistake
malicious insider → A trusted person who deliberately misuses their access to steal, leak or damage data
Accidental disclosure: a staff member sends a private file to the wrong person by mistake → To: sam.lee@gmail.com (meant: sam.lee@school.vic.edu.au)
Misconfigured sharing: a private document is left open to anyone who has the link → sharing = "Anyone with the link"
Only outside hackers can cause a data breach, so we do not need to worry about our own staff. → This ignores insider threats. People with legitimate access can also cause harm, on purpose or by mistake.
An insider threat only happens when a person plans to cause harm on purpose. → Insider threats include accidents too, such as emailing the wrong person or sharing a file publicly by mistake.

Key Term

insider threat
Harm to data or systems caused by someone with legitimate access, either on purpose (malicious insider) or by mistake, like emailing the wrong person or setting a file to public.

Fill in the Blanks

1. insider = hasAccess AND causesHarm
Hint: Type the logical operator that needs both conditions to be true
2. IF recipient != intended THEN blockEmail() END IF
Hint: Type the operator that checks two values are not equal
3. IF downloads > 100 THEN alert("Possible malicious insider") END IF
Hint: Type the comparison operator meaning greater than
4. file.visibility = "public" // Misconfigured: anyone can open it
Hint: Type the property that controls who can view the file
5. IF file.isSensitive THEN file.visibility = "private" END IF
Hint: Type the keyword that closes the block, matching the one that opened it

Spot the Error

Question 1
A user_role = "staff"
B if user_role = "staff":
C print("Open records")
Line B — A single = assigns a value. To check whether the user has the staff role you need the comparison operator ==. It should be if user_role == "staff":
Question 2
A intended = "ms.lee@school.edu"
B typed = "ms.lea@school.edu"
C if typed == intended:
D print("Wrong recipient!")
Line C — The warning should appear when the typed address does NOT match the intended one, so a typo like emailing the wrong person is caught. It should be if typed != intended:
Question 3
A sharing = private
B if sharing == "public":
C print("Anyone can view!")
Line A — Text values must be in quotes. Without quotes, Python treats private as a variable name that does not exist. It should be sharing = "private"
Question 4
A staff_leaving = True
B if staff_leaving
C revoke_access("Jo")
Line B — An if statement must end with a colon. Without it the program has a syntax error and access is never removed for a leaving staff member. It should be if staff_leaving:
Question 5
A log = ["tax.csv", "pay.csv"
B for f in log:
C print("Logged access:", f)
Line A — The list is missing its closing square bracket, so the program has a syntax error and the access log is never built. It should end with ].

Student with a class code? Join your class →