Why you should know the attacks, not just the defenses
Security advice like "use a strong password" or "keep your software updated" sounds abstract until you understand exactly what it's protecting you from. This article walks through the most common categories of attacks, in the order regular users and companies most often encounter them in practice, adding a concrete defense to each one.
1. Phishing and social engineering
Phishing remains the most common entry point for attacks on organizations — it's cheap, it scales, and it targets the human rather than the technology. An attacker poses as a trusted entity (a bank, a colleague, the IT department) and tries to get the victim to click a link, enter credentials, or open a malicious attachment.
- Spear phishing — a targeted attack on a specific person, personalized using information from LinkedIn, social media, or data breaches.
- Business Email Compromise (BEC) — an attacker poses as a superior or a supplier and requests an urgent money transfer or a change to payment details.
- Vishing / smishing — the same principle over the phone (voice phishing) or SMS.
Verifying the sender and domain before clicking, multi-factor authentication (MFA) turned on — even a stolen password is mostly useless without a second factor — regular security awareness training, and a clear process for verifying unusual financial requests (e.g., a phone confirmation).
2. Malware: viruses, trojans, and ransomware
Malware (malicious software) is an umbrella term for harmful software. It differs in how it spreads and what it targets:
- Virus — attaches itself to legitimate files and spreads when they're run or shared.
- Worm — spreads on its own across a network without needing any human interaction, often by exploiting an unpatched vulnerability.
- Trojan horse — disguises itself as a legitimate program while carrying out malicious activity in the background.
- Ransomware — encrypts the victim's data and demands a ransom for the decryption key; modern variants also steal the data before encrypting it and threaten to leak it (so-called double extortion).
- Spyware / keylogger — quietly collects sensitive information (keystrokes, passwords, browsing history).
Regular backups kept separate from the production network (offline or immutable backups that ransomware can't encrypt), up-to-date endpoint protection with behavioral detection, the principle of least privilege, and rapid deployment of security patches.
3. DDoS attacks
DDoS (Distributed Denial of Service) floods a target server, service, or network infrastructure with a massive volume of requests from many sources at once (often from a botnet — a network of infected devices), with the goal of knocking it offline for legitimate users.
- Volumetric attacks — flood bandwidth with sheer data volume (e.g. UDP flood, DNS/NTP amplification).
- Protocol attacks — exploit weaknesses in protocols, e.g. the SYN flood mentioned earlier, targeting the TCP handshake.
- Application-layer attacks — target a specific application layer, e.g. repeated, resource-intensive HTTP requests that exhaust a server's compute resources.
Traffic-filtering and load-distribution services (CDN, provider-level DDoS protection), rate limiting, scalable infrastructure, and a ready incident response plan — during a massive attack, this relies mainly on the provider's capacity, not just your own server.
4. Man-in-the-Middle (MITM)
In an MITM attack, an attacker inserts themselves between two communicating parties and eavesdrops on or alters the data being transmitted, while both parties believe they're communicating directly with each other. On a local network, this is typically achieved via ARP spoofing (see our article on TCP/IP); on a public Wi-Fi network, for example, via a fake access point (an evil twin).
Consistent use of HTTPS/TLS (checking the certificate, not just the padlock icon in the browser), avoiding sensitive operations on public Wi-Fi networks without a VPN, and on the network side, dynamic ARP inspection and segmentation via VLANs.
5. SQL injection and web attacks (XSS)
These attacks target the application layer of web applications directly:
- SQL injection — an attacker inserts malicious SQL code into an input field (e.g. a login form), which the application incorrectly processes as part of a database query, potentially leading to data leaks, modification, or deletion.
- Cross-Site Scripting (XSS) — an attacker injects malicious JavaScript code that runs in another victim's browser, e.g. to steal session cookies or credentials.
Parameterized queries (prepared statements) instead of assembling raw SQL strings, thorough input validation and sanitization, escaping output rendered as HTML, a Content Security Policy (CSP), and regular penetration testing.
6. Brute-force, dictionary attacks, and credential stuffing
These attacks target authentication directly:
- Brute-force — systematically trying every possible password combination.
- Dictionary attack — trying common passwords and their variations instead of every combination, which is significantly faster.
- Credential stuffing — automatically trying username/password combinations leaked from other services, banking on the fact that people reuse the same password across multiple sites.
MFA (again — the single most effective defense against this category), rate limiting and temporary account lockout after repeated failed attempts, a policy of unique passwords per service (practically achievable only with a password manager), and monitoring for data breaches (e.g. services like Have I Been Pwned).
7. Zero-day vulnerabilities and supply chain attacks
A zero-day is a vulnerability the software vendor doesn't yet know about, or hasn't yet released a patch for — so classic patch management fails to defend against it until a patch exists. Supply chain attacks are a related, increasingly common threat: instead of attacking the target directly, the attacker compromises a trusted supplier (e.g. a library, an update server, or a software tool) that the target routinely uses, letting malicious code in through the "back door" disguised as a legitimate update.
These attacks bypass most traditional defenses because they arrive from a trusted source. This is exactly why the Zero Trust principle is gaining traction — never implicitly trust anything, not even the internal network, and verify every access attempt anew — combined with network segmentation that limits how far an attacker can move after a breach (so-called lateral movement).
Cross-cutting measures that reduce risk across every category
- Multi-factor authentication (MFA) everywhere it's available — pound for pound, the single highest-value security measure there is.
- Regular patch management — most successful attacks exploit vulnerabilities that are months to years old, for which a patch has long existed.
- Backups following the 3-2-1 rule — three copies of your data, on two different types of media, one of them off-site/offline.
- Network segmentation — limits the damage from a breach and makes it harder for an attacker to move across the network.
- The principle of least privilege — users and systems only have the access they strictly need.
- Security awareness training — ongoing, not one-off, since phishing techniques keep evolving.
- Monitoring and an incident response plan — the question isn't "if" an incident will happen, but "when," and how fast you detect and stop it.
Summary
The overwhelming majority of successful cyberattacks don't rely on advanced techniques, but on predictable weaknesses — an unpatched system, a reused password, a careless click on a phishing link. Understanding how each attack works is the first step toward defensive measures no longer feeling like arbitrary rules, and instead becoming a logical response to a specific threat.