Threats are exploited with a variety of attacks, some technical, others not so much.
Organizations that focus on the technical attacks and neglect items such as policies and
procedures or employee training and awareness are setting up information security for failure. The mantra that the IT department or even the security department, by themselves,
can secure an organization is as antiquated as black-and-white television. Most threats
today are a mixed blend of automated information gathering, social engineering, and
combined exploits, giving the perpetrator endless vectors through which to gain access.
Examples of attacks vary from a highly technical remote exploit over the Internet, socialengineering
an administrative assistant to reset his password, or simply walking right through
an unprotected door in the back of your building. All scenarios have the potential to be
equally devastating to the integrity of the organization. Some of the most common attacks are
briefly described in the sidebar titled “Common Attacks.” [10]