• Which part of a program/system are we attacking?

  • Find where user data is (untrusted data)

  • Find where inputs are assumed

  • Asymmetry - hard to defend, easy to attacks