Security awareness starts with threat literacy. Before you can prioritize controls, evaluate risk, or respond to an incident, you need a clear picture of what attackers actually do and how those techniques work at a structural level. This is not about memorizing a list. It is about understanding the patterns behind the threats so that defenses make sense rather than feeling arbitrary.
Malware
Malware is software designed to damage, disrupt, or gain unauthorized access to a system. The word is short for malicious software, and it covers a broad family of attack tools. The most common types include:
- Viruses: code that attaches itself to a legitimate file and spreads when that file is executed.
- Ransomware: malware that encrypts the victim's data and demands payment for the decryption key. Ransomware has become one of the most disruptive threat categories facing organizations of every size.
- Trojans: programs that appear legitimate but carry a malicious payload, often used to establish a backdoor.
- Spyware: software that collects data from an infected system, typically credentials or browsing behavior, without the user's knowledge.
- Worms: self-replicating malware that spreads across networks without needing user interaction to propagate.
Malware typically enters a system through phishing emails, malicious downloads, unpatched software vulnerabilities, or removable media. Endpoint protection, software patching, and user awareness all play a role in reducing malware exposure.
Phishing
Phishing is a social engineering attack that tricks users into revealing credentials, clicking malicious links, or downloading malware by impersonating a trusted entity. It is consistently one of the most prevalent initial access techniques in real-world breaches.
CISA identifies phishing as one of the most common methods attackers use to gain a foothold. Variants include:
- Spear phishing: targeted messages crafted for a specific individual or organization using personal or professional details to appear credible.
- Smishing: phishing delivered via SMS.
- Vishing: phishing conducted over voice calls.
The structural problem phishing exploits is that humans are often the most accessible point of entry into a system. Technical controls like email filtering and link scanning reduce exposure, but they do not eliminate it. User training matters precisely because phishing succeeds when people do not recognize what they are looking at.
Credential-Based Attacks
Once an attacker has a username, they have a target. Credential attacks are attempts to obtain or guess the associated password. Common methods include:
- Brute force: systematically trying every possible password combination until one works. Account lockout policies and strong password requirements reduce this risk.
- Credential stuffing: using username and password pairs leaked from one breach to attempt access on other services, exploiting the common practice of password reuse.
- Password spraying: trying a small set of commonly used passwords across many accounts to avoid triggering lockout thresholds.
MFA is the most effective control against credential-based attacks. Even if an attacker obtains a valid password, a second authentication factor limits what they can do with it.
Denial-of-Service Attacks
A denial-of-service (DoS) attack floods a system, server, or network with more traffic or requests than it can handle, making it unavailable to legitimate users. A distributed denial-of-service (DDoS) attack scales this up by using a network of compromised machines, often called a botnet, to generate the traffic from many sources simultaneously.
DoS attacks do not usually aim to steal data. Their goal is availability: taking a service offline, disrupting operations, or creating a distraction while another attack proceeds in the background. Availability is one of the three pillars of the CIA triad, and DoS attacks target it directly.
Man-in-the-Middle Attacks
A man-in-the-middle (MitM) attack occurs when an attacker secretly intercepts and potentially alters communication between two parties who believe they are communicating directly with each other. Common scenarios include intercepting unencrypted traffic on a public network, ARP poisoning on a local network, or SSL stripping attacks that downgrade encrypted connections.
Encryption is the primary defense. When traffic is encrypted end-to-end using protocols like TLS, an attacker who intercepts it cannot read or modify its contents without detection. This is why HTTPS matters and why certificate validation should never be bypassed.
Insider Threats
Not every threat comes from outside the organization. Insider threats involve people who already have authorized access, whether employees, contractors, or partners, misusing that access either intentionally or through negligence. Malicious insiders may exfiltrate data or sabotage systems. Negligent insiders may accidentally expose data through misconfiguration, weak credential practices, or falling for phishing.
The principle of least privilege, access logging, and separation of duties are the standard controls for reducing insider threat exposure. Access control structure matters as much as perimeter defenses.
How These Threats Relate
These categories are not mutually exclusive. A phishing email delivers malware. A malware infection exfiltrates credentials. Those credentials enable unauthorized access. A disgruntled insider uses legitimate access to assist an external actor. Attacks chain techniques together, and defenses need to account for that.
NIST defines a threat as any circumstance or event with the potential to adversely impact organizational operations through unauthorized access, destruction, disclosure, or modification of information. Understanding threat types is the first step toward mapping them to controls, and mapping them to controls is what risk management is actually about.