Domain 2 Test Notes

Chapter 5 Compare and contrast common threats actors and motivations:

Nation state: These are government sponsored entities that engage in cyber operations to further national security interests.

Advanced Persistent Threat (APT): are typically nation backed agents or organized cybercriminal groups. Are recognized for their ability to to break into specific systems or networks, stay hidden for a long time. quietly steal data little by little over time.

Unskilled attacker: usually use tools from the dark web, lack technical prowess. Motivations might range from personal gain to desire for notoriety.

Hacktivist: driven by ideological, political, or social motives. They promote a cause, raise awareness or enact change. Defacing websites, leaking sensitive information. Seen as a digital protest.

Insider threat: Can be challenging to detect. Misuse access to compromise data. It can also be unintentional such as employees falling for fishing attacks. Or can be intentional attacks for revenged or financial gain.

Organized crime: have been recognized the potential for profit in digital realm. Engage in ransomware attacks, credit card fraud. identity theft. Organized by a hierarchical structure, division of labor, and focus on monetary gains.

Shadow It: technology used within an organization without proper approval or oversight from the it department. (not with malicious intent)

Resources/funding availability: the extent of resources and funding at the disposal of threat actors is a pivotal determinant of their operational power.

level of sophistication/capability: threat actors directly impacts the complexity and potential success of their attacks.

MOTIVATION:

Data Exfiltration: Revolves around stealing financial information selling it on the dark web, leads to breaches of customer data and results in tarnished reputations.

Espionage: nation states and other entities engage in cover activities to gather intelligence. Revolves around infiltrating networks, systems, databases, sensitive information.

Service Disruption: disrupting essential services, like public services, communication networks, or critical infrastructures.

blackmail: exploit stolen data, personal information, or compromising content to extort victims. Ransomware attacks

Chapter 6 Common Threat vectors and attacks surfaces

client based scanning: operates as a tool for automating vulnerability discovery and classification and reporting it to central management server.

agentless scanning: preferred method for threat actors, is employed to scan hosts without necessitating any installations.

Legacy and third party software are prime targets for threats

Service set identifier(SSID) acts as the network name, by disabling this broadcast network administrators obscure the network presence. making it less visible to casual attackers.

Mac filtering: secures the network by ensuring that only an approved users mac address is added to the wireless access point

Supply Chain: the transformation of raw material into finished products and making them available to consumers.

Managed service providers(MSP): is a third party organization that fulfills all of company it needs.