Common Threats and Attacks

Know your adversary

To defend systems, you must understand the threats they face. This chapter surveys the major types of cyber attacks — not to teach you to carry them out, but so you recognise them, understand how they work, and know how to defend against them. A defender who understands the attacker's playbook is far more effective. We'll see that many attacks exploit not just technology, but human psychology.

Malware: malicious software

Malware (malicious software) is any program designed to cause harm. It comes in several forms, each with a different behaviour worth knowing:

• Viruses — attach to legitimate files and spread when those files are shared and run.
• Worms — spread by themselves across networks without needing a host file, exploiting vulnerabilities to replicate rapidly.
• Trojans — disguise themselves as legitimate, useful software, but carry a hidden malicious payload (named after the Trojan horse).
• Ransomware — encrypts a victim's files and demands payment for the key. One of the most damaging modern threats, hitting hospitals, companies, and governments.
• Spyware — secretly monitors and steals information (keystrokes, passwords, activity).

Defending against malware involves layered protection: keep software updated (patches close the holes malware exploits), use reputable antivirus/endpoint protection, don't run software from untrusted sources, and maintain good backups (especially against ransomware — if your files are backed up, an encryption demand loses its power). Understanding how each type spreads tells you how to block it.

Phishing: the most common attack

Here's a surprising and important truth: the most successful attacks often target people, not technology. Phishing is the technique of tricking someone into revealing sensitive information (passwords, financial details) or taking a harmful action, usually through deceptive emails, messages, or fake websites that impersonate a trusted source.

A classic phishing email pretends to be from your bank, warns of a problem, and links to a fake login page that steals your credentials when you "log in". Phishing works because it exploits human trust, urgency, and fear rather than any software flaw — which is exactly why it's so effective and so common. Defending against it is partly technical (spam filters, link checking) but mostly about awareness:

• Be suspicious of unexpected messages creating urgency ("act now or your account is locked!").
• Check sender addresses and hover over links to see where they really go before clicking.
• Never enter credentials on a page you reached via an emailed link — navigate to the site directly.
• When in doubt, verify through a separate, trusted channel.

Because people are often the weakest link, security awareness training is one of the most cost-effective defences any organisation can invest in.

Social engineering: hacking the human

Phishing is one form of a broader category: social engineering — manipulating people into breaking security procedures or revealing information. Instead of attacking systems, social engineers attack human psychology, exploiting trust, helpfulness, authority, and fear. Examples include impersonating IT support to get a password, "tailgating" through a secure door behind an employee, or pretexting (inventing a believable scenario to extract information).

The famous reality of security is that the human is often the easiest target — you can have perfect technology and still be breached if an employee is tricked into handing over access. Defence relies on a security-aware culture: verify identities, follow procedures even when inconvenient, be wary of unusual requests, and foster an environment where people feel safe double-checking rather than blindly complying. Recognising manipulation is a genuine security skill.

Attacks on availability: DoS

Some attacks aim not to steal but to disrupt. A Denial of Service (DoS) attack overwhelms a system with traffic or requests until it can no longer serve legitimate users — directly attacking the "availability" leg of the CIA triad. A Distributed Denial of Service (DDoS) uses many machines at once to amplify the flood. Defences include traffic filtering, rate limiting, and specialised DDoS-protection services that absorb and filter malicious traffic before it reaches the target.

Other key threats to recognise

A few more threats round out your awareness. You'll meet some in depth later:

• Man-in-the-Middle (MITM) — an attacker secretly intercepts communication between two parties (a key reason encryption like HTTPS matters — it makes intercepted data unreadable).
• Password attacks — guessing or cracking passwords (covered in the cryptography chapter, with defences).
• Web application attacks — exploiting flaws in websites (the entire focus of the next chapter).
• Zero-day exploits — attacks using a vulnerability that's unknown to the software maker, so no patch exists yet — among the most dangerous, defended through layered security and rapid response.

The unifying lesson of this chapter: threats target both technology and people, and effective defence must address both. You can't patch human psychology with software, and you can't train your way out of an unpatched server. Knowing the full range of threats is the foundation of building real defences. Next, we'll go deep on the attacks that target web applications — where so much of today's security action happens.