One of the biggest changes in information security over the past two decades has been with the attackers. Rather than the old stereotype of a hoodie-wearing loner in the basements with Mountain Dew, Twinkies and old computers, today's attacker is typically trained, smart and well-funded. Instead of defacing websites for fun and notoriety, attacks today are a business.
It's a simple risk/reward equation. There is a cost to any attack. Email-based attacks are very inexpensive to launch. Developing sophisticated malware is expensive. And the more expensive an attack is pull off, the higher the potential gains need to be to make a profit.
Information security is very complex. It's as much an art as it is a science. There are basic things that everyone should do, like patching systems and using strong, long passwords. And then there are complex solutions to complex problems that need to be artfully implemented to compliment the way people do their work.
There are so many high profile breaches in the news. Some of these are the result of highly skilled and motivated attackers going after a specific target. But many more are "crimes of opportunity".
As I see it, there are basically three kinds of online attacks:
