The Villains

These four "V" words shape the software security story: Villains, Victims, Vendors, and Visionaries.

The Villains are the attackers who exploit product defects. We give them catchy names and marvel at their techniques. Vendors build twelve-foot statues of them for the trade show floor, with placards listing their powers.

A mythic attacker sells product. A defect class from 1998 does not. Study adversaries closely (see C-08), and notice who profits when they look superhuman.

Discussion prompts

• Why do we focus so heavily on attacker names and techniques rather than the conditions that make attacks possible (even inevitable)?
• Where does your organization's security narrative center — attackers or product quality?
• What would change if we treated every incident as a product defect rather than a clever attack?