Security need to know

Virus

Malicious code that attaches to a host file/program and requires user action to spread

Worm

Self-replicating malware that spreads across networks without user interaction

Trojan

Malware disguised as legitimate software to trick users into installing it

Ransomware

Malware that encrypts a victim’s files/system and demands payment for the decryption key

Spyware

Malware that secretly monitors and collects user activity/data without consent

Keylogger

Malware (or hardware) that records keystrokes to capture credentials and sensitive data

Rootkit

Malware that gains privileged (root/admin) access and hides its presence deep in the OS

Adware

Software that automatically displays or downloads unwanted advertisements

Bot/Botnet

A network of infected devices (bots) remotely controlled by an attacker, often via a C2 server

Logic Bomb

Malicious code that lies dormant until triggered by a specific condition or date

Fileless Malware

Malware that runs in memory/uses legitimate system tools (e.g., PowerShell) instead of writing files to disk

Social Engineering / Human-Based Attacks

Phishing

Fraudulent emails designed to trick users into revealing information or clicking malicious links

Spear Phishing

Phishing targeted at a specific individual or organization using personalized info

Whaling

Phishing targeted specifically at high-level executives

Vishing

Voice/phone-based phishing

Smishing

SMS/text-based phishing

Pretexting

Creating a fabricated scenario to trick a victim into giving up information

Baiting

Luring a victim with something enticing (e.g., a USB drive) to trigger a malicious action

Tailgating/Piggybacking

Following an authorized person through a secure door without credentials

Shoulder Surfing

Observing someone’s screen or keystrokes to steal information

Dumpster Diving

Searching through trash to find sensitive discarded information

War Chalking

Marking physical locations (chalk symbols) to indicate nearby open/vulnerable Wi-Fi networks

Evil Twin

A rogue Wi-Fi access point disguised as a legitimate one to intercept traffic

Rogue Access Point

An unauthorized wireless AP installed on a network, creating a security hole

Bluejacking

Sending unsolicited messages to a Bluetooth-enabled device

Bluesnarfing

Unauthorized access/theft of data from a Bluetooth device

On-Path Attack (MITM)

Attacker secretly intercepts and possibly alters communication between two parties

DNS Poisoning

Corrupting DNS cache/records to redirect users to malicious sites

ARP Poisoning

Sending falsified ARP messages to associate the attacker’s MAC with a legitimate IP, enabling traffic interception

MAC Spoofing

Changing a device’s MAC address to impersonate another device or bypass filtering

IP Spoofing

Forging the source IP address in packets to disguise the sender’s identity

DoS

A single-source attack that floods a target to make a service unavailable

DDoS

A DoS attack launched from multiple distributed sources (often a botnet)

Brute Force

Systematically trying every possible password combination

Dictionary Attack

Trying passwords from a precompiled list of common words/phrases

Credential Stuffing

Using stolen username/password pairs from one breach to log into other sites

Rainbow Table Attack

Using precomputed hash tables to reverse password hashes quickly

SQL Injection

Inserting malicious SQL code into input fields to manipulate a database

Cross-Site Scripting (XSS)

Injecting malicious scripts into a trusted website to run in other users’ browsers

Buffer Overflow

Sending more data than a buffer can hold to overwrite memory and execute malicious code

Zero-Day

An attack exploiting a vulnerability before a patch/fix exists

Script Kiddie

Low-skill attacker using existing tools/scripts without deep technical knowledge

Hacktivist

Attacker motivated by political or social causes

Nation-State/APT

Highly skilled, well-funded attacker (often government-backed) conducting advanced persistent threats

Insider Threat

A current/former employee or contractor who misuses authorized access to cause harm

Organized Crime

Attackers motivated by financial gain, often operating as coordinated groups

Red Team

Offensive team that simulates real-world attacks to test an organization’s defenses (penetration testers/ethical hackers)

Blue Team

Defensive team responsible for monitoring, detecting, and responding to attacks; hardens systems and defends the network

Purple Team

Facilitates collaboration between Red and Blue teams, sharing insights to improve overall security posture

White Team

Neutral team that oversees and referees red vs. blue exercises, sets rules of engagement, and judges the outcome

Yellow Team

Builders — developers/engineers who design and construct systems with security built in from the start (secure coding, DevSecOps)

Green Team

Works with Yellow Team to fold security lessons and Red/Blue feedback back into the development lifecycle