Thinking like an attacker
Security starts with a clear picture of what you are protecting and from whom. Learn the CIA triad, the language of threats, vulnerabilities and risk, and a simple threat-modelling habit every engineer can use.
In this lecture you will
- Describe security goals using confidentiality, integrity and availability
- Distinguish assets, threats, vulnerabilities and risk
- Estimate risk from likelihood and impact and choose proportionate controls
- Apply a lightweight threat-modelling routine to a feature
Most security failures aren’t caused by genius hackers. They come from a stolen password, a storage bucket left public, a server nobody patched, or a convincing email to the finance team. To defend well, you need to see your systems the way an attacker does: not as features, but as opportunities.
What are we protecting? The CIA triad
Security goals are usually described with three properties:
- Confidentiality
- Only authorized people and systems can read the data — customer records, source code, salaries.
- Integrity
- Data and systems are changed only in authorized ways — prices, balances, bank details, software releases.
- Availability
- Systems and data are there when needed — the website is up, the ledger is reachable, backups can be restored.
Every attack breaks at least one of these. Naming which one helps you pick the right defence: encryption protects confidentiality, but does nothing for availability; backups restore availability, but leak nothing less if they are stolen.
The vocabulary of risk
- An asset is anything of value: data, systems, money, reputation.
- A threat is something that could cause harm: a criminal group, a careless insider, a flood.
- A vulnerability is a weakness a threat could exploit: an unpatched server, a weak password, an over-permissive role.
- Risk is the combination of likelihood and impact — how probable a harmful event is, and how bad it would be.
Security budgets are finite, so teams prioritize by risk. A likely, high-impact risk (ransomware on the file servers) deserves more attention than an unlikely, low-impact one.
Explore real threats
Pick a threat to see which properties it breaks, where it sits on a simple risk matrix, and the controls that reduce it.
Likelihood and impact are illustrative for a typical mid-sized company; your own assessment depends on your systems and data.
How attackers actually get in
Attackers are economical. They take the easiest path, and the same few routes appear again and again in incident reports:
- People — phishing emails, fake login pages, a phone call pretending to be IT support.
- Stolen or weak credentials — passwords reused from another breach, no multi-factor authentication.
- Unpatched software — known vulnerabilities in internet-facing systems, exploited within days of disclosure.
- Misconfiguration — public storage buckets, default passwords, overly broad permissions.
Notice what is missing: brand-new, never-seen “zero-day” exploits are real, but rare and expensive. Getting the basics right blocks most attacks.
Phishing is still the most common first step. Find the warning signs in this message:
A fictional email for a fictional company. Real phishing is often better written than this, so the strongest defences are technical — filtering, phishing-resistant MFA — with training as a backstop. When in doubt, report rather than delete: one report can protect everyone who received the same message.
Follow one realistic intrusion from start to finish, and notice how few of its steps needed anything clever:
- ResearchThe attacker studies the company from the outside: employees and roles from professional networks, the email address format from the website.
- PhishingA convincing email about mailbox quotas leads one employee to a fake login page, where they type their password.
- Logged inWith no second factor, the stolen password opens webmail and the VPN. To every system, the attacker now looks like a normal employee.
- Spreading and impactAn old spreadsheet of admin passwords on a shared drive unlocks the file servers. Data is copied out and ransomware encrypts everything it can reach.
- Breaking the chainEach step has an ordinary defence. None is perfect alone, but together they force the attacker to succeed several times in a row — which is what defence in depth means.
Threat modelling in fifteen minutes
Threat modelling means thinking about attacks while designing, not after a breach. You don’t need a heavyweight process. For each new feature, answer four questions:
- What are we building? Sketch the components and where data flows.
- What can go wrong? Walk through each flow: who could read, change or block it?
- What are we going to do about it? Choose controls for the risks that matter.
- Did we do a good job? Revisit after testing and after launch.
Next, we look at why no single control is ever enough — and how layered defences stop attacks that get past the first line.
Key takeaways
- Confidentiality, integrity and availability describe what an attack can break.
- Risk combines how likely a threat is with how much damage it would do.
- Attackers look for the easiest path — often people, misconfiguration or unpatched software, not exotic hacks.
- Asking “what could go wrong here?” during design is the cheapest security control there is.
Check your understanding
3 questions · answers explainedQ1An attacker changes the bank account number on a supplier invoice. Which property is broken?
Q2What is the difference between a threat and a vulnerability?
Q3Which question is part of a basic threat model for a new feature?