1.2Common threats and vulnerabilities

The first skill demanded on the support and security floor is to quickly tell what kind of attack the event in front of you is. "I opened a suspicious email," "my files were encrypted and a ransom was demanded," "someone on the phone impersonated my manager and drew out information"—each has a different technique and response. This section organizes malware and its variety ransomware, the service-halting DoS and botnet, the psychology-exploiting techniques of social engineering, the traffic-interception of a man-in-the-middle attack, and IoT weaknesses, insider threats, and APT—learned not by rote but through the lens of identifying an attack from its symptoms.

1.2.1Malware, ransomware, DoS, and botnets

• Malware is the umbrella term for software that behaves maliciously, including a virus (parasitizes legitimate files and spreads), a worm (self-replicates and spreads on its own), a Trojan horse (disguised as legitimate to get in), and spyware (steals information).
• Ransomware is malware that seizes access—typically by encrypting files—and demands a ransom for recovery. It threatens both availability and confidentiality. Paying does not guarantee recovery, so regular backups and isolation are the best preparation.
• DoS (Denial of Service) makes a service unusable with a flood of traffic or malformed requests. When launched from many devices at once it is a DDoS. The pool of hijacked devices used as launchpads is a botnet, controlled remotely by the attacker (a bot master). DoS targets the availability property of CIA.

1.2.2Social engineering techniques

• Social engineering exploits human psychology (helpfulness, deference to authority, urgency) rather than technology to draw out information or actions. Its name changes by medium: phishing uses email broadly to lure victims to fake sites, while spear phishing is a targeted deception aimed at a specific individual or organization.
• Vishing is phishing over voice/telephone (posing as a support desk or a manager). Smishing is phishing over SMS (text message). Tailgating is following a legitimate person through a door to enter a facility physically without authorization—a physical form of social engineering rather than a cyber one.
• The recognition pattern: is the medium email, phone, SMS, or physical, and is it a broad audience or a specific target. Impersonating a sender, rushing with urgency, and requesting information or action via a link, attachment, or spoken word—spotting these shared signs lets you identify the same "deceive-the-human attack" even as the medium changes.

One morning an accountant tells you: "Someone claiming to be a supplier called and pressed me—'the payment account has changed, please urgently switch to this account.' They knew our internal affairs oddly well and even named my manager." Brushing this off as "a phone call, so not malware, and no harm yet, so wait and see" is a dangerous judgment. This is social engineering that exploits human psychology rather than technology, and because it uses the phone (voice) it is vishing; moreover, by targeting a specific person—the accountant—and researching internal affairs, it also carries the targeted character of spear phishing. The shared signs are impersonating a sender, pressure through urgency, and a request—"change the payment account"—that directly moves money or information. The correct response is not to change the account on a phone instruction alone, and to call back a pre-registered legitimate contact to verify (not the number the caller gave). Had the same content arrived by email it would be phishing (generic if untargeted, spear phishing if aimed), and by SMS it would be smishing; the name changes with the medium, but the judgment pattern—see through it by the shared signs of "impersonation + urgency + request for information/action"—is the same. And if a stranger tries to follow an employee through the door without badging, that must be stopped with the same vigilance as physical tailgating. At the introductory stage, more than deep analysis, building this habit—naming the technique from medium and target, and pausing on the shared signs—is the shortest path to preventing harm.

1.2.3Section summary

• The malware variety ransomware encrypts and demands ransom (paying does not guarantee recovery); DoS/DDoS seizes availability, and the launchpad pool is a botnet
• Social engineering is named by medium: email = phishing / specific target = spear / phone = vishing / SMS = smishing / physical = tailgating
• A man-in-the-middle attack intercepts traffic, IoT devices are targeted for weak defaults, an insider threat comes from within, and an APT is advanced, persistent, and targeted