Cybersecurity Series, Part 1: How Modern Cyberattacks Really Work
Forget the hoodie-wearing genius. Today's cyberattacks are run like businesses. Learn what security protects, who the attackers are, how a breach unfolds step by step, and why layered defenses work.
Ask someone to picture a hacker and you will probably hear about a lone genius in a dark room, typing green code at impossible speed until a screen flashes "Access granted." It makes a good movie scene. It is also misleading.
Much of today's cybercrime looks less like a heist and more like a business. Criminal groups divide the work, rent out their tools, buy stolen passwords in bulk and use automated programs that scan the internet for weak devices day and night. Most victims are not chosen because they are important. They are chosen because they were easy.
This post opens a cybersecurity series on this blog. I work in the treasury service and build software on the side, and both jobs have taught me the same lesson: what protects public money and public records is not one strong lock but many good habits. The series is written for everyone: parents, students, office workers, small business owners and anyone who uses a phone. In Part 1, we map the ground: what security protects, who the attackers are, how a typical breach unfolds, and how we fight back.
What Security Protects: The CIA Triad
Security professionals sum up their work in three words, known as the CIA triad. (It has nothing to do with the spy agency.)
Confidentiality. Only the right people can see the information. When a list of taxpayers' names and addresses leaks online, confidentiality has failed.
Integrity. Information stays accurate and unaltered. If someone quietly changes the bank account number on a supplier's invoice, integrity has failed, even if no one notices yet.
Availability. Systems and data are there when people need them. When ransomware locks an office's computers or a website is knocked offline, availability has failed.
Every security tool you have heard of, from antivirus to backups to encryption, exists to protect one or more of these three. When you are unsure whether something is a security issue, ask: does it threaten who can see the data, whether it can be trusted, or whether it is there when needed?
Who Is on the Other Side?
Attackers have different goals, and knowing their goals helps you understand their methods.
Cybercriminals. The largest group, motivated by money. They steal passwords, card numbers and bank details, run scams and deploy ransomware. Many use ransomware-as-a-service, renting ready-made malware from its developers and sharing the ransom with them.
State-sponsored groups. Teams backed by governments that spy, steal secrets or prepare to disrupt power, telecommunications and other critical services. They are patient and may hide inside a network for months.
Hacktivists. People driven by a political or social cause. They deface websites, leak documents or flood a site with traffic to take it offline, aiming for attention.
Insiders. People who already have access. Some act out of anger or greed, but many insider incidents are honest mistakes: an email sent to the wrong person, or a shared folder left open to anyone with the link.
How a Breach Unfolds
A serious attack is rarely a single event. It is a chain of steps, and each step is a chance to stop it. Security teams describe this chain with models such as Lockheed Martin's Cyber Kill Chain and the MITRE ATT&CK knowledge base, which catalogs the techniques real attackers use. In plain terms, most intrusions follow a path like this:
1. Reconnaissance. The attacker gathers information: staff names from social media, email formats, leaked passwords from old breaches, and devices exposed to the internet.
2. Initial access. They get a foothold, often by logging in rather than breaking in: a phishing email that captures a password, a password bought from a criminal market, or a known flaw in a device that was never updated.
3. Persistence. They make sure they can return, by creating hidden accounts or installing remote-control tools that survive a restart.
4. Privilege escalation and lateral movement. The first computer is rarely the prize. They collect more passwords, gain administrator rights and move from machine to machine toward servers, databases and backups.
5. Action on objectives. Finally, they do what they came for: copy data out, transfer money, plant ransomware or disrupt services.
Verizon's 2025 Data Breach Investigations Report, one of the industry's largest yearly studies, shows what the first doors look like. Stolen credentials were the most common way in, at 22% of breaches, followed closely by the exploitation of software flaws, at 20%. Third parties such as suppliers and service providers were involved in 30% of breaches, double the year before. In other words: weak passwords, missing updates and trusted partners.
Why One Wall Is Not Enough
For a long time, organizations treated security like a castle. They built a strong wall, a firewall, around the office network and trusted everyone inside. That model has aged badly. Our data now lives in cloud services, our staff work from home and from their phones, and a single stolen password can carry an attacker across the drawbridge. Once inside a flat, trusting network, they can often move freely.
This does not mean firewalls are useless. It means they cannot be the only defense.
How We Fight Back: Layers
The answer is defense in depth. Safety experts often explain it with the Swiss cheese model, first described by the psychologist James Reason to show how accidents happen. Picture each defense as a slice of Swiss cheese. Every slice has holes. Spam filters miss some emails. People get tired and click. Antivirus does not recognize every new threat. But when you stack several slices, the holes rarely line up.
Suppose a phishing email slips past the filter and you type your password into a fake page. Multi-factor authentication stops the attacker from logging in. If they get past that, up-to-date software and endpoint protection may block their tools. If those fail, limited access rights keep them from reaching everything. And if the worst happens, offline backups let you recover without paying anyone.
Treasury work runs on the same principle. We do not rely on one honest person; we use separation of duties, official receipts, daily reports of collections and deposits, and regular audits. No single control is perfect, but together they make errors and fraud hard to hide. Good cybersecurity works the same way.
You do not need to be impossible to hack. You need to be too costly, too slow and too noisy to be worth the trouble.
Four Myths That Help Attackers
Let us also clear away a few beliefs that make attackers' work easier.
Myth: I am not important enough to be targeted. Most attacks are automated. A program that tries leaked passwords or scans for unpatched devices does not care who you are. Your account, your phone number and your computer's power are all worth something to a criminal.
Myth: I have antivirus, so I am safe. Antivirus is one useful slice of cheese, not the whole block. It cannot stop you from typing your password into a fake page or sending money to a scammer.
Myth: Phones and Macs do not get hacked. Every device can be attacked, and phones carry our banking apps, our one-time PINs and our private chats. Scams do not care which brand you use.
Myth: Security is the IT office's job. IT teams build the walls, but each of us holds a key. One rushed click can undo the best technology, and one careful pause can stop an attack that technology missed.
A Note for the Philippines
Cybercrime is not a distant problem. Text scams, fake e-wallet links and account takeovers are part of daily life, and government agencies have suffered serious attacks. The country has laws to respond: the Cybercrime Prevention Act of 2012 (Republic Act No. 10175), the Data Privacy Act of 2012 (Republic Act No. 10173) and, more recently, the Anti-Financial Account Scamming Act of 2024 (Republic Act No. 12010). Laws punish criminals after the fact, though. Habits protect us before.
Your Part 1 Action Plan
Check your exposure. Visit haveibeenpwned.com and enter your main email address. The free service shows which known data breaches included your address. If a password you still use was exposed, change it.
Turn on automatic updates. On your phone, computer and browser. Many attacks use flaws that were fixed months earlier, betting that people keep pressing "Remind me later."
Name your three most important accounts. Usually your main email, your bank or e-wallet, and your work login. Your email matters most, because it can reset the passwords of almost everything else.
Start with these three steps this week. They take less than an hour, and they close the doors that attackers try first.
Which cybersecurity topic would you like this series to explain next? Email me.
