2: Compare Threat Types

What is risk?

Risk is the measure of the likelihood and impact of a threat actor being able to exploit a vulnerability.

What is a vulnerability?

A weakness that could be triggered accidentally or exploited intentionally to cause a security breach.

What is a threat?

The potential for someone or something to exploit a vulnerability.

What is the relationship between a threat, vulnerability, and risk?

A threat is the potential source of harm, a vulnerability is the weakness that can be exploited, and risk measures the likelihood and impact of the threat exploiting that vulnerability.

What determines the level of risk?

Risk is based on the likelihood that a threat actor can exploit a vulnerability and the impact that exploitation would have.

What does internal versus external mean when describing an attacker?

It refers to the degree of access that a threat actor possesses before initiating an attack.

What is an internal threat actor?

A threat actor that possesses some degree of access to the environment before initiating an attack.

What is an external threat actor?

A threat actor that does not already possess the same degree of access to the environment before initiating an attack.

What is an attack surface?

All the points at which a malicious threat actor could try to exploit a vulnerability.

What is a threat vector?

The path that a threat actor uses to execute a vulnerability or attack.

What is the difference between an attack surface and a threat vector?

The attack surface represents the possible points where an attacker could attempt exploitation, while the threat vector represents the path used to carry out the attack.

What is social engineering?

The psychological manipulation of people to trick them into giving away private information, sending money, or breaking security rules.

What is another way to describe social engineering?

“Hacking the human” because the attacker targets human behavior rather than relying solely on technical vulnerabilities.

Why is social engineering considered a security threat?

It manipulates people into voluntarily providing information, transferring money, or violating security rules.

What is impersonation?

Pretending to be someone else.

What is pretexting?

Inventing a fabricated backstory or scenario to try to trick a victim.

What is the key characteristic of pretexting?

The attacker creates a believable fabricated scenario or backstory to persuade the victim to take an action or provide information.

What is phishing?

An attempt by an attacker to pretend to be a reputable source and get a victim to click on a link; it can be performed through email or text.

What communication methods can be used for phishing according to the lesson?

Email or text messages.

What is the primary deception used in phishing?

The attacker pretends to be a reputable or trusted source to convince the victim to interact with a malicious link.

What is pharming?

An attack that redirects a user from a reputable website to a malicious one and relies on manipulating DNS entries or Internet resolution.

What is the key difference between phishing and pharming?

Phishing attempts to trick the victim into interacting with a malicious link or message, while pharming redirects the user from a legitimate website to a malicious site through manipulated DNS or Internet resolution.

What is typosquatting?

An attack where someone registers a domain name that is very similar to a real domain, hoping users will not notice the difference and will click on it.

What is the goal of typosquatting?

To take advantage of users failing to notice a small difference between a malicious domain and a legitimate domain.

What is business email compromise (BEC)?

A sophisticated campaign where an attacker targets a specific individual within a company, typically upper management or an executive.

Who is commonly targeted in a business email compromise attack?

A specific individual within a company, typically upper management or an executive.

What distinguishes business email compromise from a general phishing attempt?

Business email compromise is described as a sophisticated campaign targeting a specific individual within a company, typically an executive or upper-management employee.

What is brand impersonation?

An attack where a threat actor invests resources into accurately duplicating a company's logos, formatting, and other visual elements to make a phishing or pharming attack visually compelling.

Why does brand impersonation make phishing or pharming more convincing?

The attacker duplicates recognizable company branding, logos, formatting, and other visual characteristics to make the malicious communication or website appear legitimate.

What is a watering hole attack?

A targeted cyberattack where hackers infect a legitimate website that is frequently visited by a specific group of people, such as employees of a company.

What makes a watering hole attack targeted?

The attacker chooses a legitimate website that a specific group of intended victims is known to visit.

How does a watering hole attack differ from phishing?

A watering hole attack compromises a legitimate website frequently visited by the target group, whereas phishing attempts to deceive victims through messages or links.

What is defense-in-depth?

A strategy that uses multiple, overlapping layers of security controls so that if one control fails, another barrier will still persist.

Why is defense-in-depth important?

It prevents a single failed security control from leaving the system completely exposed because additional overlapping security barriers remain.

How does defense-in-depth relate to vulnerabilities?

Because vulnerabilities can exist even when security controls are present, multiple overlapping controls can provide additional protection if one control fails or is bypassed.

How do attack surface and defense-in-depth relate?

The attack surface represents the points an attacker could potentially exploit, while defense-in-depth provides multiple security layers intended to prevent or limit successful exploitation.

A threat actor identifies a weakness that could be intentionally exploited to cause a security breach. What concept describes the weakness?

Vulnerability.

An attacker has the potential to exploit a weakness, but the question asks about the potential source of harm rather than the weakness itself. What concept is being described?

Threat.

A security question asks you to consider both how likely an attack is and how much damage it could cause. What concept is being described?

Risk.

An attacker discovers multiple possible points where a system could be attacked. What concept describes all of those possible points?

Attack surface.

An attacker chooses a specific path through which to carry out an attack. What concept describes that path?

Threat vector.

An attacker calls an employee while pretending to be another person. What social engineering technique is being used?

Impersonation.

An attacker creates a believable fictional story about why they need information from an employee. What technique is being used?

Pretexting.

An attacker sends a message pretending to come from a reputable source and attempts to get the victim to click a link. What attack is this?

Phishing.

A user enters what appears to be a legitimate website address but is redirected to a malicious website because Internet resolution has been manipulated. What attack is this?

Pharming.

An attacker registers a domain that closely resembles a legitimate company's domain and hopes users fail to notice the difference. What attack is this?

Typosquatting.

An attacker specifically targets a company executive with a sophisticated campaign. What attack is this?

Business email compromise (BEC).

An attacker duplicates a company's branding and formatting to make a malicious communication or website appear legitimate. What attack technique is this?

Brand impersonation.

An attacker compromises a legitimate website that a particular company's employees frequently visit. What attack is this?

Watering hole attack.

An organization uses multiple overlapping security controls so that one failed control does not leave the environment unprotected. What security strategy is being used?

Defense-in-depth.