Overview of Threats and Attacks

Name some examples of threats:

• Individuals

• Insider threats

• organized crime

• hacktivist groups

• terrorists

• nation states

• industrial espionage

Threats have varying levels of what?

Skill, access, and resources

Skill

Adversary’s technical expertise and understanding

Access

How closely the adversary is associated with the target

Resources

Refer to the funding, time, technology, etc. at the adversary’s disposal

Threats vary in their level of ___ and ___

structure and complexity

Unstructured threats

Individuals or loosely affiliated groups with low level of experience and or resources

They may be unaware of what exactly they are attacking, or how the attack actually works

What are script kiddies?

Novice hackers who rely on existing software for cyberattacks, which are simple and widely recognized

Unstructured threats choose targets based on ___

opportunity

Structured Threats

• Well-funded, coordinated groups of attackers

• May have access to experienced individuals, insider connections, or government support

• Organized crime, major hacktivist groups, and nation states may fall into this categroy

• attacks are more sophisticated; they tend to have specific goals and targets, with attacks based on newly-discovered exploits or vulnerabilities

When modelling a threat, it is important to keep in mind the adversary’s ___ and ___

goals and capabilities

Goals

• Why might the adversary attack the system

• what resources do they have

• what level of access do they have to our system

Capabilities

• How structured is the adversary

• what resources do they have

• what level of access do they have to our system

Attacks can be ___ or ___

active or passive

Active attacks

• involves directly interfering with the system, such as obstructing access to a resource or modifying data

  • They are more over and will be quickly noticed, producing observable consequences

  • They are more likely to affect integrity and availability since they cannot be easily violated through passive means

Passive Attacks

• involves monitoring communications, gaining information about system resources, employees, etc.,. without directly interfering with the system

  • They are more covert and may go unnoticed as they might produce no observable consequences

  • More likely to affect confidentiality as they focus on gathering information

Zero-Day Attacks

Rely on unknown vulnerabilities that have yet to be mitigated or exploited

When is a threat no longer considered a zero-day attack?

Once a threat is successfully discovered and patched

Attack Surface

• collection of all possible areas of a target where an attack might occur

  • This may include software, hardware, physical controls, and people

Attack Tree

• represents the goals and subgoals of an attack as nodes in a tree

  • it is similar to a decision chart, showing the different paths that an attack might take and what steps are necessary for those attacks to succeed

  • will be informed by the attack surface