Unless you're locked in a room with some guy from a three-letter government agency, chances are that anything you've heard about a targeted attack on an organization is strictly hypothetical. Details are scarce and what you hear usually involves theories about a phishing scheme, zero-day exploits or crimeware. That's all well and good, but all of that is too far after the fact to really get a grip on the issue.

The real insight comes when the topic turns to the reconnaissance cybercriminals conduct against a target.