Ghosts in the machine: The who, why, and how of attacks on information security

Information Security is the field devoted to maintaining the confidentiality, integrity and availability of information [Harris]. Organizations from small home offices to multinational conglomerates have information that needs protected, not to mention the secrecy needs of nations and the bureaucracies that govern them. Billions of dollars are spent to provide the needed security every year. But who are we protecting ourselves against? What is the threat we face? Why are we being attacked? How can we use this knowledge to protect ourselves? To better secure an organization, one should know something about the opposition. To provide the best security one, needs to know the enemy: who they are, why they are attacking, and how they attack. Even better would be using knowledge of the adversary to develop better defenses against such attacks.