Hi! I am a student of information security. This page is my reflection journal for class. It is best viewed in 800x600 with a 56k modem and a hot beverage.

Know Thy Enemy (It Might Be You)

Going into this discussion, my mental picture of a "threat" was a hooded hacker typing green text into a black screen — the kind of person this very website is pretending to be. By the end, that picture had been replaced by a long, boring, and much scarier list: a careless coworker, a flooded server room, an unpatched printer, an expired software license, and a polite stranger on the phone who just needs your password "to fix something real quick."

1. New Insights

Threats come in categories, and most of them are not attackers. Seeing the threats sorted into categories was the first thing that reframed it for me. Some are deliberate acts: espionage or trespass, information extortion, sabotage or vandalism, theft, and software attacks like malware and denial of service. Others are not deliberate at all: human error or failure, forces of nature, technical hardware and software failures, deviations in quality of service from providers (power, ISP), technological obsolescence, and compromises to intellectual property. Half of the list has no villain in it. A typo in a configuration file and a typhoon can take down a system just as well as a hacker can.

Threat, vulnerability, and risk are not synonyms. I used these words interchangeably before. Now I understand a threat as anything that can cause harm, a vulnerability as a weakness it can exploit, and an attack as the act of actually exploiting it. A threat with no matching vulnerability is mostly noise. A vulnerability with no plausible threat is a lower priority. The danger lives where the two meet.

Social engineering hacks the person, not the machine. This was the part that stuck the most. Phishing, spear phishing, pretexting, baiting, quid pro quo, tailgating, vishing and smishing are all variations of the same move: manipulate a human into doing the attacker's work for them. They lean on very ordinary instincts — wanting to be helpful, respecting authority, fear of getting in trouble, curiosity, and urgency. None of these are flaws. They are the things that make people good coworkers, and attackers turn them into openings.

The attacker does homework. I assumed phishing emails were all obvious, badly spelled "you won a prize" messages. Spear phishing and business email compromise showed me the opposite: an attacker can scroll through a target's public social media, learn their boss's name, their schedule, and the way the office writes emails, and then send something that looks completely normal. The more we post online, the easier the pretext becomes.

2. Concepts I Want to Read More On

• Advanced Persistent Threats (APTs). We only touched on long-term, well-funded attackers who stay inside a network for months. I want to understand how they stay hidden and how organizations eventually find them.
• Ransomware as a business model. Information extortion has become an industry with affiliates, customer support, and leak sites. I want to read about how it is organized and why paying the ransom keeps it alive.
• AI-assisted social engineering. Deepfake voices and perfectly written phishing emails remove the typos and accents we were trained to spot. I want to know what defenses actually still work when the message looks flawless.
• Insider threats. A disgruntled or careless insider already has legitimate access. I want to read about how organizations detect misuse without treating every employee like a suspect.
• Measuring security awareness. Phishing simulations are common, but do click rates really show whether people have become safer, or just better at spotting the training emails?

3. Confusions and Challenges

The categories bleed into each other. If an employee falls for a phishing email and malware encrypts the files, is that human error, a software attack, or information extortion? The honest answer seems to be "all three," and I am still learning how to classify an incident that crosses categories without double-counting it.

Keeping the social engineering terms straight. Phishing versus spear phishing versus whaling, vishing versus pretexting, baiting versus quid pro quo — the differences are real (target, channel, and what is offered) but they blur when a real attack mixes several. A phone call pretending to be IT support that offers to "fix" your laptop is pretexting, vishing, and quid pro quo at once.

Where training ends and blame begins. We say "the human is the weakest link," but that phrase bothers me. If a system is designed so that a single click ruins everything, the design is also at fault. I am still figuring out how to balance holding people accountable with building systems that forgive honest mistakes.

The list never stops growing. Every new technology adds a new entry to the threat landscape. Trying to memorize all of it feels impossible, so I am learning to focus on the patterns — exploit trust, exploit weakness, exploit neglect — instead of the brand names.

Where I landed: the threat landscape is less like a battlefield and more like weather. Some of it is malicious, a lot of it is accidental, and all of it is constant. You cannot stop the rain; you can only build a roof, check it often, and teach everyone inside not to open the door to a stranger who says they are from the roofing company.