Cybersecurity chapter 2

Threat actor

A person or entity responsible for an event that has been identified as a security incident or as a risk

Internal/external

The degree of access that a threat actor possesses before initiating an attack. An external threat actor has no standing privileges, while an internal actor has been granted some access permissions.

Level of sophistication/capability

A formal classification of the resources and expertise available to a threat actor

Resources/funding

The ability of threat actors to draw upon funding to acquire personnel, tools, and development of novel attack types.

Service disruption

A type of attack that compromises the availability of an asset or business process.

Data exfiltration

The process by which an attacker copies data from a private network to an external network.

Disinformation

A type of attack that falsifies an information resource that is normally trusted by others.

Blackmail

Demanding payment to prevent the release of information.

Extortion

Demanding payment to prevent or halt some type of attack.

Fraud

Falsifying records, such as an internal fraud that involves tampering with accounts.

Hacker

Often used to refer to someone who breaks into computer systems or spreads viruses. Ethical hackers prefer to think of themselves as experts on and explorers of computer security systems.

Unauthorized hacker

A hacker operating with malicious intent.

Authorized hacker

A hacker engaged in authorized penetration testing or other security consultancy.

Unskilled attacker

An inexperienced attacker that typically uses tools or scripts created by others.

Hacktivist

A threat actor that is motivated by a social issue or political cause.

Advanced persistent threat (APT)

An attacker's ability to obtain, maintain, and diversify access to network systems using exploits and malware.

Nation-state actors

A type of threat actor that is supported by the resources of its host country's military and security services.

Organized crime

A type of threat actor that uses hacking and computer fraud for commercial gain.

Internal threat

A type of threat actor who is assigned privileges on the system that cause an intentional or unintentional incident.

Unintentional or inadvertent insider threat

A threat actor that causes a vulnerability or exposes an attack vector without malicious intent.

Shadow IT

Computer hardware, software, or services used on a private network without authorization from the system owner.

Vulnerable software

Weakness that could be triggered accidentally or exploited intentionally to cause a security breach.

Unsupported systems

Product life cycle phase where mainstream vendor support is no longer available.

Unsecure network

Configuration that exposes a large attack surface, such as through unnecessary open service ports, weak or no authentication, use of default credentials, or lack of secure communications/encryption.

Lure

An attack type that will entice a victim into using or opening a removable device, document, image, or program that conceals malware.

Supply chain

The end-to-end process of supplying, manufacturing, distributing, and finally releasing goods and services to a customer.

Perform reconnaissance

Reconnaissance is the process of gathering information about an organization, including:

• System hardware information

• Network configuration

• Individual user information

Use social engineering

Social engineering is the process of manipulating others into providing sensitive information. Social engineering tactics include:

• Intimidation

• Sympathy

Use technical approaches

A technical approach to obtaining information includes using software or utilities to find vulnerabilities in a system. Methods often used by hackers are:

• Port scan

• Ping sweep

Breach the system

A breach is the penetration of system defenses. It is often achieved by using information gathered through reconnaissance.

Escalate privileges

Escalating privileges is a primary objective of an attacker. Once an attacker has breached the system, obtaining higher privileges allows the attacker to access more information and gain greater control within the system.

Create a backdoor

Creating a backdoor is an alternative method of accessing an application or operating system for troubleshooting. Hackers often create backdoors to exploit a system without being detected.

Stage computers

Staging a computer involves preparing it to perform additional tasks in the attack, such as installing software designed to attack other systems. This is an optional step.

Exploit vulnerabilities

An exploitation takes advantage of known vulnerabilities in software and systems. Once a vulnerability has been exploited, an attacker can often:

• Steal information

• Deny services

• Crash systems

• Modify/alter information

Layering

Layering involves implementing multiple security strategies to protect the same asset. Defense in depth or security in depth is based on the premise that no single layer is completely effective in securing assets. The most secure system/network has many layers of security and eliminates single points of failure.

Principle of least privilege

The principle of least privilege states that users or groups are given only the access they need to do their jobs and nothing more. When assigning privileges, be aware that it is often easier to give a user more access when it is needed than to take away privileges that have already been granted.

Variety

Defensive layers should incorporate a variety of methods. Implementing multiple layers of the same defense does not provide adequate protection against attacks.

Randomness

Randomness in security is the constant change in personal habits and passwords to prevent predictable behavior.

Simplicity

Security measures should provide protection but not be so complex that it is difficult to understand and use.