Testout Security Pro Chapter 2 - Threats, Attacks, and Vulnerabilities

5.0(1)
studied byStudied by 1 person
learnLearn
examPractice Test
spaced repetitionSpaced Repetition
heart puzzleMatch
flashcardsFlashcards
Card Sorting

1/64

flashcard set

Earn XP

Description and Tags

Notecards for Testout Security Pro Chapter 2 - Threats, Attacks, and Vulnerabilities, 2023.

Study Analytics
Name
Mastery
Learn
Test
Matching
Spaced

No study sessions yet.

65 Terms

1
New cards

Targeted attack

A type of threat in which threat actors actively pursue and compromise a target entity's infrastructure while maintaining anonymity

2
New cards

Opportunistic attack

An attack in which the threat actor is almost always trying to make money as fast as possible and with minimal effort

3
New cards

Insider

A threat agent who has authorized access to an organization and either intentionally or unintentionally carries out an attack

4
New cards

Competitor

A threat agent who carries out attacks on behalf of an organization and targets competing companies

5
New cards

Hacker

Any threat agent who uses technical knowledge to bypass security, exploit a vulnerability, and gain access to protected information

6
New cards

Cybercriminal

A subcategory of hacker threat agents. They are willing to take more risks and use more extreme tactics for financial gain

7
New cards

Nation state

A sovereign state threat agent that may wage an all-out war on a target and have significant resources for the attack

8
New cards

Internal threat

A threat from authorized individuals (insiders) who exploit assigned privileges and inside information to carry out an attack

9
New cards

External threat

A threat from individuals or groups not associated with the organization, who seek to gain unauthorized access to data

10
New cards

Persistent threat

A threat that seeks to gain access to a network and remain there undetected

11
New cards

Non-persistent threat

A threat that focuses on getting into a system and stealing information. It is usually a one-time event, so the attacker is not concerned with detection

12
New cards

Open-source intelligence (OSINT)

Information that is readily available to the public and doesn't require any type of malicious activity to obtain

13
New cards

White hat

A skilled hacker who uses skills and knowledge for defensive purposes only. This hacker interacts only with systems for which express access permission is given

14
New cards

Black hat

A skilled hacker who uses skills and knowledge for illegal or malicious purposes

15
New cards

Gray hat

A skilled hacker who falls in the middle of white hat and black hat hackers. They may cross the line of what is ethical, but usually has good intentions and isn't malicious like a black hat hacker

16
New cards

Malware

Software designed to take over or damage a computer without the user's knowledge or approval

17
New cards

Virus

A program that attempts to damage a computer system and replicate itself to other computer systems

18
New cards

Worm

A self-replicating malware program

19
New cards

Trojan horse

A malicious program that is disguised as legitimate or desirable software

20
New cards

Zombie

A computer that is infected with malware and is controlled by a command and control center called a zombie master

21
New cards

Botnet

A group of zombie computers that are commanded from a central control infrastructure

22
New cards

Rootkit

A set of programs that allows attackers to maintain hidden, administrator-level access to a computer

23
New cards

Logic bomb

Malware designed to execute only under predefined conditions. It is dormant until the predefined condition is met

24
New cards

Spyware

Software installed without the user's consent or knowledge and is designed to intercept or take partial control of the user's computer

25
New cards

Adware

Malware that monitors a user's personal preferences and sends pop-up ads that match those preferences

26
New cards

Ransomware

Malware that denies access to a computer system until the user pays a ransom

27
New cards

Scareware

A scam to fool a user into thinking there is some form of malware on the system

28
New cards

Crimeware

Malware designed to perpetrate identity theft. It allows a hacker access to online accounts at financial services, such as banks and online retailers

29
New cards

Crypto-malware

Ransomware that encrypts files until a ransom is paid

30
New cards

Remote access Trojan (RAT)

Malware that includes a back door to allow a hacker administrative control over the target computer

31
New cards

Hacker

A person who commits crimes through gaining unauthorized access to computer systems

32
New cards

Cracker

A person actively engaged in developing and distributing worms, Trojans, and viruses; engaging in probing and reconnaissance activities; creating toolkits so that others can hack known vulnerabilities; and/or cracking protective measures

33
New cards

Script kiddy

A less-skilled hacker who often relies on automated tools or scripts written by crackers to scan systems and exploit weaknesses

34
New cards

Potentially unwanted program (PUP)

…is a software inadvertently installed that contains adware, installs toolbars, or has other objectives

35
New cards

Fileless virus

…uses legitimate programs to infect a computer

36
New cards

Social engineering

An attack involving human interaction to obtain information or access

37
New cards

Footprinting

Uses social engineering to obtain as much information as possible about an organization

38
New cards

Pretexting

A fictitious scenario to persuade someone to perform an action or give information

39
New cards

Elicitation

A technique to extract information from a target without arousing suspicion

40
New cards

Preloading

Influencing a target thoughts, opinions, and emotions before something happens

41
New cards

SMiShing

Doing phishing through an SMS message. Tricking a user to download a virus, Trojan horse, or malware onto a cell phone

42
New cards

Impersonation

Pretending to be somebody else and approaching a target to extract information

43
New cards

SPIM

…is similar to spam, but the malicious link is sent to the target over instant messaging instead of email

44
New cards

Hoax

A type of malicious email with some type of urgent or alarming message to deceive the target

45
New cards

Hacktivist

A hacker with a political motive

46
New cards

Ignorance

…means the target is not educated in social engineering tactics and prevention, so the target doesn't recognize social engineering when it is happening

47
New cards

Shoulder surfing

Looking over someone's shoulder while that person works on a computer or reviews documents

48
New cards

Eavesdropping

An unauthorized person listening to private conversations between employees or other authorized personnel when sensitive topics are being discussed

49
New cards

Keyloggers

A device used to steal data through by capturing what the user types

50
New cards

Feigning ignorance

Make a wrong statement and then admit to not knowing much about the subject in hopes the target will reveal the needed information

51
New cards

Spear phishing

Gathers information about the victim, such as the online bank

52
New cards

Whaling

…is another form of phishing. It targets senior executives and high-profile victims

53
New cards

Vishing

…is like phishing, but instead of an email, the attacker uses Voice over IP (VoIP) to gain sensitive information. The term is a combination of voice and phishing

54
New cards

Pharming

Executing malicious programs on the target's computer so that any URL traffic redirects to the attacker's malicious website

55
New cards

Social networking

Many attackers are turning to applications such as Facebook, Twitter, Instagram, to steal identities and information. Also, many attackers use social media to scam users. These scams are designed to entice the user to click a link that brings up a malicious site the attacker controls. Usually, the site requests personal information and sensitive data, such as an email address or credit card number

56
New cards

Zero-day vulnerability

…is a software vulnerability that is unknown to the vendor

57
New cards

Data loss

The loss of files and documents either accidentally or through malicious acts

58
New cards

Data breach

The exposure of confidential or protected data, either accidentally or through malicious acts

59
New cards

Data exfiltration

The unauthorized transfer of information or files from a computer

60
New cards

Identity theft

A crime in which an attacker commits fraud by using someone else's name or existing accounts to obtain money or to purchase items

61
New cards

Availability loss

Loss of access to computer resources due to the network being overwhelmed or crashing

62
New cards
63
New cards
64
New cards
65
New cards