Cybersecurity Fundamentals: Common Attacks and Defences
CybersecurityLesson 2 of 45 min read
What you'll learn
- Describe how phishing, malware, credential attacks and denial of service work at a conceptual level
- Match each attack category to the defences that reduce it
- Spot warning signs in a suspicious message using a simple triage routine
- Explain why layered, boring controls beat any single clever tool
On this page
Picture a six-person accounting firm on a Tuesday morning. At 9:02 the office manager gets an email that looks like it is from the payroll provider: urgent, a link, a login page that looks right. At 9:05 she types her password. Nothing visibly breaks. That quiet, ordinary sequence is how a large share of real breaches begin, which is why this lesson is organised by attack category rather than by tool. For each category you will see what it relies on, and what reliably makes it harder.
Phishing and social engineering
Phishing tricks a person into handing over a credential, running a file or approving a payment. It works because it targets attention and trust, not software. Messages use urgency ("within 24 hours"), authority ("from the CEO"), or fear ("your account will be suspended"). Variants include spear phishing (aimed at a named person, using real details about them), smishing (SMS), vishing (phone calls) and business email compromise, where an attacker impersonates a supplier and asks for changed bank details.
Defences work at three levels. Technically, mail filtering and the email authentication standards SPF, DKIM and DMARC make forging your own domain harder. Procedurally, require a second channel for money or credential changes: a call-back to a known number before any bank detail is edited. For people, short regular practice with realistic examples works better than a yearly slideshow, and a no-blame way to report "I clicked something" matters more than any filter, because the first 30 minutes decide how bad it gets.
A triage routine can be partly automated. This small script flags look-alike sender domains and pressure language. It is a teaching sketch, not a replacement for a real mail gateway.
import re
# A tiny rule set for spotting look-alike sender domains in a phishing triage tool.
TRUSTED = {"acme-payroll.com", "acme.com"}
def sender_domain(address: str) -> str:
return address.rsplit("@", 1)[-1].lower()
def triage(address: str, subject: str) -> list[str]:
reasons = []
domain = sender_domain(address)
if domain not in TRUSTED:
reasons.append(f"sender domain {domain!r} is not on the trusted list")
if re.search(r"urgent|immediately|within 24 hours", subject, re.I):
reasons.append("subject applies time pressure")
if re.search(r"payment details|bank|password", subject, re.I):
reasons.append("subject asks for money or credentials")
return reasons
print(triage("hr@acme-payro11.com", "URGENT: confirm bank details immediately"))
print(triage("hr@acme-payroll.com", "Your March payslip is ready"))Output
["sender domain 'acme-payro11.com' is not on the trusted list", 'subject applies time pressure', 'subject asks for money or credentials'] []
Notice the look-alike domain uses the digits 11 in place of the letters ll. People read shapes, not letters, which is exactly why an allow-list of known domains beats eyeballing.
Malware and ransomware
Malware is software written to do something its victim did not agree to: steal data, spy, mine cryptocurrency, join a botnet, or encrypt files and demand payment (ransomware). It arrives through attachments, downloads from untrusted sites, pirated software, compromised updates or unpatched flaws in internet-facing services. The defences are unglamorous: keep operating systems and apps patched, run endpoint protection, remove local administrator rights from everyday accounts, block macros and executables from email, and install software only from sources the company approves.
For ransomware, the most important defence is not prevention but recovery. Backups that are offline or immutable, and that you have actually restored from, turn a crisis into an expensive afternoon. You will return to this in the incident response lesson.
Credential attacks
Rather than breaking in, attackers log in. Credential stuffing takes username and password pairs leaked from one site and tries them on others, betting that people reuse passwords. Password spraying tries a few very common passwords across many accounts so no single account trips a lockout. Brute force tries many guesses against one account. All three are cheap and automated, and all three get weaker when you add friction and unique secrets.
Defences: unique passwords per site (a password manager), multi-factor authentication, rate limiting with growing delays, and checking new passwords against lists of known-leaked ones. Here is a growing delay in code. Notice it does not lock the real owner out permanently; it just makes automated guessing expensive.
import math
def delay_after_failures(failures: int, base: float = 1.0, cap: float = 300.0) -> float:
"""Seconds a login form should make the next attempt wait."""
if failures <= 2:
return 0.0
return min(cap, base * math.pow(2, failures - 3))
for n in range(1, 13):
print(f"{n:>2} failed attempts -> wait {delay_after_failures(n):>5.0f}s")Output
1 failed attempts -> wait 0s 2 failed attempts -> wait 0s 3 failed attempts -> wait 1s 4 failed attempts -> wait 2s 5 failed attempts -> wait 4s 6 failed attempts -> wait 8s 7 failed attempts -> wait 16s 8 failed attempts -> wait 32s 9 failed attempts -> wait 64s 10 failed attempts -> wait 128s 11 failed attempts -> wait 256s 12 failed attempts -> wait 300s
Denial of service
A denial-of-service attack targets availability: it tries to make a service too busy to answer real users. A distributed version (DDoS) uses many machines at once. Some attacks flood the network pipe with traffic, others send requests that are individually cheap to make but expensive to handle, such as a search with a huge date range. Defences include a content delivery network or DDoS-mitigation provider in front of the site, caching, rate limits per client, timeouts and queue limits so one slow request cannot hold resources forever, and enough capacity headroom to absorb ordinary spikes. See rate limiting for the algorithms behind per-client limits.
| Attack category | What it exploits | Best first defences |
|---|---|---|
| Phishing | Human trust and urgency | Second-channel verification, MFA, reporting culture, email authentication |
| Malware / ransomware | Unpatched software, risky downloads | Patching, least privilege, tested offline backups |
| Credential attacks | Weak and reused passwords | Password manager, MFA, throttling, leaked-password checks |
| Denial of service | Finite capacity | CDN/mitigation, caching, per-client limits, headroom |
Common mistakes
- Relying on awareness training alone. Symptom: one tired person clicks, and nothing else stops the damage. Fix: assume someone will click and add MFA, least privilege and alerting behind them.
- Backups on the same network share as the files. Symptom: ransomware encrypts the originals and the backups together, and the restore has nothing to restore. Fix: keep an offline or immutable copy and test a restore.
- Hard lockout after N failed logins. Symptom: an attacker deliberately locks out your real users, turning a credential attack into a denial of service. Fix: use growing delays and alert on patterns instead.
- Skipping patches because "nothing is wrong". Symptom: a service on the public internet is compromised through a flaw that had a fix for months. Fix: a patch schedule with an owner.
How this shows up in real projects and interviews
Security questions in job interviews usually take a scenario form: "an employee reports clicking a link, what do you do?" A good answer is calm and ordered: isolate, reset credentials, check for rule changes in their mailbox, look at logs, tell the right people. In a real company, nearly everyone ends up near these four categories, even in non-security roles. A developer sees them as rate limits and password rules. An operations engineer sees them as patching and backup jobs. Browse open roles tagged with security to see which of these defences employers actually list.
Try it yourself
Take a recent suspicious email or text (or find a public phishing example). Write down the trust signal it tried to exploit, three details that give it away, and the one process change that would stop the damage even if someone clicked.
Show a hint
Look at the sender domain character by character, whether the link host matches the brand, and whether the request tries to move you to a different channel such as a phone number in the message.
Key takeaways
- Phishing attacks people, malware attacks software and habits, credential attacks use leaked or weak passwords, and DoS attacks capacity.
- No single control stops an attack category, so stack: policy, technology and a way to recover.
- Make high-risk actions (bank-detail changes, admin logins) require a second channel or factor.
- Backups only count if they are isolated from the originals and you have tested a restore.
- Throttle with growing delays rather than hard lockouts, so defenders are not the ones denied service.
Test yourself
A trick from this lesson's ride: Stuffing reuses leaked pairs; spraying spreads few guesses wide; brute force pounds one door. Four more tricks like it wait along the route, each followed by a question.
Frequently asked questions
What are the most common types of cyber attacks?
Phishing and other social engineering, malware including ransomware, credential attacks such as password reuse and spraying, and denial-of-service attacks are among the most common categories. Many real incidents chain two of them, for example a phishing email that steals a password.
How can I tell if an email is phishing?
Check the sender domain closely, be wary of urgency or requests for money, passwords or changed bank details, and hover over links to see the real host. When in doubt, contact the sender through a number or app you already trust, not the one in the message.
Does multi-factor authentication stop phishing?
It stops many credential attacks because a stolen password is not enough, but some phishing pages relay codes in real time. Hardware keys and passkeys are resistant to that, so prefer them for important accounts.