Day 1: Threats & Attacks | Security+ in 5 Days

What You'll Cover Today

Day 1 of Security+ in 5 Days lays the foundation. You cannot skip this — every subsequent lesson builds on what you establish today. Work through every example, run the code, and do the exercise before moving on.

ℹ️

Topics today: malware, phishing, threat actors. Each section has code you can copy and run immediately.

malware

Understanding malware is the core goal of Day 1. The concept is straightforward once you see it in practice — most confusion comes from skipping the mental model and jumping straight to implementation. Start with the model, then write the code.

malware

# malware — Working Example
# Study this pattern carefully before writing your own version

class malwareExample:
    """
    Demonstrates core malware concepts.
    Replace placeholder values with your real implementation.
    """
    
    def __init__(self, config: dict):
        self.config = config
        self._validate()
    
    def _validate(self):
        required = ['name', 'type']
        for field in required:
            if field not in self.config:
                raise ValueError(f"Missing required field: {field}")
    
    def process(self) -> dict:
        # Core logic goes here
        result = {
            'status': 'success',
            'topic': 'malware',
            'data': self.config
        }
        return result


# Usage
example = malwareExample({
    'name': 'my-implementation',
    'type': 'malware'
})
output = example.process()
print(output)

💡

Key insight: When working with malware, always start with the simplest possible case that works end-to-end. Complexity is easier to add than simplicity is to recover.

phishing

phishing is the practical application of malware in real projects. Once you understand the underlying model, phishing becomes the natural next step.

💡

Pro tip: When working with phishing, always read the official documentation for the exact version you're using. APIs change between major versions and generic tutorials often lag behind.

threat actors

threat actors rounds out today's lesson. It connects malware and phishing into a complete picture. You'll use all three concepts together in the exercise below.

Common Mistakes on Day 1

Skipping the fundamentals — malware requires understanding the underlying model before you can apply it correctly. Read the section twice if needed.
Ignoring error messages — error messages for phishing are usually precise. Read them carefully before searching online.
Hard-coding values — anything that might change between environments belongs in configuration, not in your source code.
Not testing edge cases — the happy path is not enough. What happens with empty input? With unexpected types? With network failures?

📝 Day 1 Exercise

Threats & Attacks — Hands-On

Set up your environment for today's topic: install required tools and verify the basics work before writing any logic.
Implement a minimal working version of malware using the code example in this lesson as your starting point.
Extend your implementation to incorporate phishing — this is where the two concepts connect.
Test your implementation with both valid and invalid inputs. What happens at the boundaries?
Review your code: is there anything you'd name differently? Any function doing more than one thing? Refactor one thing.

Day 1 Summary

malware is the foundation of today's lesson — understand it before moving on.
phishing is how you apply it in real projects.
threat actors ties the day's concepts together into a complete pattern.
Error handling and input validation belong in the first version, not as an afterthought.
Read error messages carefully — they usually tell you exactly what's wrong.

Challenge

Extend today's exercise by adding one feature that wasn't in the instructions. Document what you built in a comment at the top of the file. This habit of going one step further is what separates engineers who grow fast from those who stay stuck.

Day 2: Security Architecture

→