Chapter 3: Threats, Attackers, and Ethics

Threats, Attackers, and Ethics 🎭

Permission is the difference

A security guard who checks every door in a building and a burglar who checks every door in a building are doing almost the same thing. The difference is permission, and what they do with what they find.

Cybersecurity works the same way. Defenders have to understand how attacks happen, or they can’t stop them. In this chapter you’ll meet the people behind attacks and what drives them, learn how vulnerabilities in software and operating systems turn into real damage, and see the common attacks on networks. Then you’ll learn the line that separates ethical hackers from criminals, and the laws, licenses, and agreements that draw that line. Everything here is about recognizing and defending, never about attacking.

3.1 — Who Are the Threat Actors? 🎭

A threat actor is anyone who tries to harm computers, networks, or data. Movies show a lone hacker in a hoodie, but real threat actors come in very different shapes, and defenders categorize them so they can predict what each one will do.

Three Questions for Every Attack

Security analysts sort threat actors with three questions:

Target: Who or what are they going after?
Method: How are they doing it?
Apparent motive: Why do they seem to want it?

The word apparent matters. Attackers often hide their real goals or pretend to be someone else, so analysts describe the motive the evidence suggests, and stay ready to change their minds.

The Main Categories

Threat Actor	Typical Targets	Typical Methods	Apparent Motive
Cybercriminals	Anyone with money or data: businesses, hospitals, schools, individuals	Ransomware, phishing, fraud, selling stolen data	Money
Nation-state groups	Governments, defense companies, power grids, research labs	Long, patient, well-funded intrusions	Spying, gaining an advantage, disruption
Hacktivists	Organizations they disagree with	Defacing websites, leaking documents, flooding sites	A political or social cause
Insiders	Their own employer or school	Misusing access they already have	Revenge, money, or simple carelessness
Thrill-seekers	Whatever is easy to reach	Ready-made tools they don’t fully understand	Attention, curiosity, bragging

Insiders deserve a second look. Not every insider means harm. An employee who emails a spreadsheet of student information to the wrong person causes a breach without any bad intent. That’s why organizations protect against careless mistakes, not only villains.

Why Categories Help

If a school district’s analysts see an email campaign asking staff to “update payroll details,” the target (staff paychecks), method (phishing), and motive (money) point to cybercriminals. That tells them what to protect next: the payroll system and staff logins. Categorizing turns a scary unknown into a problem with a plan.

3.2 — Threats and Vulnerabilities 🐛

Three words get mixed up all the time. Security professionals keep them separate:

A threat is something that could cause harm, like a cybercriminal or a flood.
A vulnerability is a weakness that a threat could use, like an unpatched app or a reused password.
Risk is the chance that a threat will use a vulnerability, and how bad it would be if it did.

A threat with no vulnerability to use can’t do much. That’s why most security work is closing vulnerabilities.

For Individuals and for Organizations

	Common Vulnerabilities	Likely Threats
Individuals	Reused passwords, oversharing online, skipped updates, no screen lock	Phishing, account takeover, scams
Organizations	Unpatched servers, too much access for too many people, untrained staff, old systems	Ransomware, data breaches, insider mistakes

Software Updates Close the Door

Software is written by people, so it contains mistakes. When a company discovers a security flaw, it releases a patch. The dangerous window is the time between “the patch exists” and “the patch is installed,” because once a fix is public, attackers can study it to learn where the weakness was.

Real events show how much this matters:

In 2017, a vulnerability in a web software tool was publicly fixed in March, but the credit company Equifax did not patch one of its systems in time. Attackers broke in that May and stole personal information about roughly 147 million people.
Also in 2017, the WannaCry ransomware spread around the world through Windows computers that had not installed a security update Microsoft had released about two months earlier. It disrupted businesses and hospitals, including parts of the United Kingdom’s National Health Service.

A flaw that attackers find before the company knows about it is called a zero-day, because the company has had zero days to fix it. Zero-days are rare and valuable. Most real attacks use old, known flaws that simply weren’t patched.

Outdated Operating Systems

The operating system controls everything on a device, so an outdated one is especially risky. Every operating system eventually reaches end of support, after which the maker stops releasing security fixes. Microsoft ended regular support for Windows 10 in October 2025, for example. A device on an unsupported operating system collects new vulnerabilities that will never be fixed, and its apps eventually stop getting updates too.

Every App Can Have Vulnerabilities

Every application, from a calculator to a browser, is code, and any code can have flaws. Risk grows with apps from unofficial download sites, browser extensions that ask for broad permissions, and apps nobody updates.

3.3 — Network Attacks and Scripts ⚔️

Networks connect everything, which makes them a favorite target. Here are the malicious actions defenders watch for, described so you can recognize and stop them.

Malicious Actions Against Networks

malware is software built to cause harm. It comes in several forms: viruses attach to files, worms spread across networks on their own, trojans pretend to be something useful, spyware watches what you do, and ransomware locks files and demands payment.

Attack	What Happens	Threat to the Triad	Defense
Malware	Harmful software runs on a device and may spread	All three	Updates, security software, careful downloads
Denial-of-service	A service is flooded with traffic until it collapses	Availability	Protection services that absorb floods, extra capacity
On-path (eavesdropping)	An attacker positions themselves between two devices to read or change traffic	Confidentiality, integrity	HTTPS and other encryption
Rogue access point	A fake Wi-Fi network with a trusted-sounding name collects traffic	Confidentiality	Use known networks, check for HTTPS, avoid sensitive logins on public Wi-Fi
Unauthorized devices	An unknown device is plugged into a network jack	All three	Locked closets, disabled unused ports, network monitoring

A denial-of-service attack doesn’t steal anything. It just makes a service unavailable. When thousands of hijacked devices attack together, it’s a distributed denial-of-service, or DDoS. Many of those hijacked devices are poorly secured cameras and routers, which connects back to the default-password problem from Chapter 1.

The Role of Scripting

A script is a short program that automates a task. Scripts are neutral tools: IT teams use them to install updates on a thousand laptops overnight. Attackers use them to do in seconds what would take a person years. Each category of script-powered attack has a matching defense:

Attack Category	How Scripts Are Involved	Defense
Automated login attacks	Scripts try leaked passwords on many accounts	MFA, passkeys, limiting login attempts
Malicious web scripts	Harmful code is slipped into a web page others visit	Developers check all user input; browsers stay updated
Malicious document macros	A file asks you to “enable content” so a hidden script can run	Block macros by default; don’t enable content in unexpected files
Botnets	Scripts control thousands of infected devices at once	Patch devices, change default passwords, DDoS protection
Automated scanning	Scripts search the internet for unpatched systems	Patch quickly, close unused services

Notice the pattern: scripts make attacks fast and large, so defenses must be automatic too. Defenders write scripts to patch, monitor logs, and block suspicious activity at the same speed.

3.4 — Ethical vs. Malicious Hacking 🎩

“Hacking” originally meant clever problem solving with technology. Today the word covers both people who break into systems to cause harm and people who test systems to protect them. The skills can be similar. The difference is permission, purpose, and what happens with the results.

ethical hacking follows clear rules:

Permission first. The owner agrees, in writing, before anything is tested.
Stay in scope. The agreement says exactly which systems can be tested and how. Anything outside it is off limits.
Do no harm. Don’t damage data, read private information you don’t need, or disrupt real users.
Report everything. Findings go privately to the owner so they can be fixed.

	Ethical Hacker	Malicious Hacker
Permission	Written, before starting	None
Goal	Find and fix weaknesses	Steal, damage, or control
Results go to	The system’s owner	The attacker, or criminals who pay
Legal?	Yes, within the agreement	No

People sometimes describe hackers by hat color: white hats are ethical, black hats are malicious, and gray hats break in without permission but claim good intentions. Gray-hat hacking is still unauthorized access, which is against the law, no matter how good the intentions are.

Legal Ways to Use Hacking Skills

Penetration testers are hired to attack a company’s systems, within a contract, and write a report about how to fix what they found.
Bug bounty programs invite the public to find flaws in a company’s products. A bug bounty publishes its rules and scope and often pays rewards for reports.
Responsible disclosure means telling a company privately about a flaw and giving it time to fix it before anyone talks publicly.
Competitions let students practice on systems built to be attacked. picoCTF, from Carnegie Mellon University, is a free capture-the-flag competition designed for middle and high school students, and CyberPatriot challenges teams to secure computer systems.

3.5 — Laws, Licenses, and Agreements ⚖️

Online actions have real-world rules. Some are laws written by governments. Others are agreements you accept when you use a service.

Laws at Three Levels

Level	Law or Rule	What It Does
Federal	Computer Fraud and Abuse Act (CFAA)	Makes unauthorized access to computers a crime
Federal	Children’s Online Privacy Protection Act (COPPA)	Requires parental consent before most websites collect personal data from children under 13
Federal	Family Educational Rights and Privacy Act (FERPA)	Protects the privacy of student education records
Federal	Children’s Internet Protection Act (CIPA)	Requires many schools and libraries to filter harmful content
State	Data breach notification laws	Every state requires organizations to tell people when their personal data is breached
State	Consumer and student privacy laws	California’s Consumer Privacy Act and many newer state laws let people see and delete data companies hold; many states also limit what education apps can do with student data
Local	School district policies and city rules	Your district’s technology policies; some cities limit how their own agencies may use surveillance tools like facial recognition

Federal laws apply everywhere in the country, state laws vary from state to state, and local rules are the most specific of all. When they overlap, the stricter protection usually wins.

Intellectual Property and Licenses

Intellectual property is ownership of creations of the mind.

Type	Protects	Example
Copyright	Creative works: writing, music, art, code	A song, a game’s code
Trademark	Names and logos that identify a brand	A company logo
Patent	New inventions	A new kind of battery
Trade secret	Valuable private business information	A secret recipe or algorithm

Creators choose how others may use their work through licenses: all rights reserved (ask first), Creative Commons (reuse allowed under listed conditions, such as giving credit), open-source licenses for code, and the public domain (free for anyone). fair use applies to copyrighted work: limited use for commentary, teaching, news, or parody can be allowed, judged by the purpose, the kind of work, how much is used, and the effect on the market. Fair use doesn’t apply to patents, and trademark law only allows naming a brand to describe or discuss it. Licenses like Creative Commons grant permissions beyond fair use, and public domain work needs no permission at all.

User Agreements

Agreement	What It Is
Terms of service	The rules for using a website or app
Privacy policy	What data is collected and how it’s used
End-user license agreement	How you may use installed software
Acceptable use policy	Your school’s rules for its devices and network

Some provisions protect you: limits on how data is shared, the right to delete your account, age requirements, and bans on harassment. Others protect the provider: limits on what they owe you if something breaks, the right to close your account, a license to use what you upload, and rules that disputes go to private arbitration instead of court. Many apps require users to be at least 13 because of COPPA, which is why younger students use school accounts set up by teachers.

Chapter 3 Activity: The Security Analyst’s Casebook 📁

Your Mission: Work as an analyst reviewing incident files for an imaginary town. Use paper or a school-approved document. Do not test any real system.

Part 1: Profile the Actors

Your teacher will give you (or you can write) four short scenarios, such as a ransomware note at a dental office or a leaked memo from a city agency. Fill in a table with target, method, apparent motive, and the best-fitting threat actor category.

Part 2: Vulnerability Hunt

For each scenario, name the vulnerability the attacker used, whether it was in software, settings, hardware, or human behavior, and the update, patch, or habit that would have closed it.

Part 3: Permission Check

Decide whether each is ethical or malicious hacking, and explain using the four rules from 3.4: (a) a student finds a bug in a game and reports it through the company’s bug bounty page; (b) a student tries to log in as a teacher “to prove the system is weak”; (c) a hired tester attacks a server that wasn’t listed in the contract.

Part 4: Read the Fine Print

With your teacher, pick a school-approved app and read its terms of service and privacy policy. List three provisions that protect users and three that protect the provider, and name one law from 3.5 that applies to it.

Key Concepts Checklist

I can categorize a threat actor by target, method, and apparent motive
I can explain the difference between a threat, a vulnerability, and risk
I can analyze why unpatched software and outdated operating systems are dangerous
I can describe malware, denial-of-service, on-path attacks, and rogue Wi-Fi, with a defense for each
I can explain how scripts are used in attacks and name a defense for each category
I can distinguish ethical hacking from malicious hacking using permission and scope
I can compare federal, state, and local laws about cybersecurity and privacy
I can compare copyright, trademark, patent, and trade secret, and explain fair use and user agreements