Explain common threat vectors and attack surfaces
Message-based, image-based, file-based, removable device, supply chain, and human vectors including phishing and pretexting.
- Reading time
- 22 min read
- Flashcards
- 20 cards
- Practice questions
- 10 questions · 3 PBQs
A vector is the route in. The attack surface is the sum of all routes. This objective is a vocabulary list, but a heavily tested one — the social engineering terms in particular come up repeatedly and are easy to confuse.
Message-based vectors
The most common route in, by a wide margin.
Phishing
Fraudulent email at scale, aiming to steal credentials or deliver malware.
Spear phishing
Phishing targeted at a specific person or group, using researched detail to be convincing.
Whaling
Spear phishing aimed at a senior executive — the "big fish".
Vishing
Voice phishing. Over the phone.
Smishing
SMS phishing. Text messages.
Check yourself
An attacker researches a CFO on LinkedIn, then emails them impersonating the CEO requesting an urgent wire transfer. What is this?
Other technical vectors
Image-based — malicious content embedded in image files. File-based — malicious documents and executables. Voice call — see vishing. Removable device — the classic dropped USB drive left in a car park, relying on curiosity. Vulnerable software — client-based (an agent installed on the endpoint) or agentless. Unsupported systems and applications — no patches available, so every new vulnerability is permanent. The legacy pattern again. Unsecure networks — wireless, wired, and Bluetooth. Open service ports — every listening service is a potential way in, which is why hardening (4.1) closes what is not needed. Default credentials — publicly documented for essentially every product.
Supply chain
Three routes, and the exam distinguishes them:
- Managed service providers (MSPs) — compromise the provider, reach every client they manage.
- Vendors — compromise a software vendor, and their update mechanism distributes your malware for you.
- Suppliers — hardware or components tampered with before delivery.
Human vectors and social engineering
The largest sub-list, and where most marks sit.
Pretexting
- Inventing a scenario to justify the request
- 'I'm from IT, I need to verify your password'
- Underpins most other techniques
Impersonation
- Pretending to be a specific person or role
- Posing as a named executive or a vendor
The tellPretexting is the invented story. Impersonation is claiming a specific identity. Most real attacks use both.
Business email compromise (BEC)
Impersonating an executive or supplier by email to redirect payments. Financially the most damaging category by a large margin, because it needs no malware at all.
Watering hole
Compromising a website the target group is known to visit, rather than attacking the target directly. Indirect by design.
Typosquatting
Registering domains close to a legitimate one — gooogle.com — to catch mistyped addresses.
Brand impersonation
Mimicking a trusted brand's look and language to make a message credible.
Misinformation / disinformation
False information spread to mislead. Disinformation is deliberate; misinformation may be unwitting.
Check yourself
An attacker compromises an industry news site that engineers at a target company read daily, so that visiting it installs malware. What technique is this?
The principles behind social engineering
Worth knowing because scenario questions describe the pressure rather than naming the technique:
- Authority — appearing to be someone who can compel compliance.
- Urgency — removing time to think or verify.
- Scarcity — limited availability driving haste.
- Social proof — everyone else is doing it.
- Intimidation — threats of consequence.
- Familiarity / liking — building rapport first.
- Trust — leveraging an existing relationship.
Attack surface
The sum of all vectors. It shrinks by:
- Closing unused ports and disabling unnecessary services (4.1)
- Removing unsupported software (4.2)
- Reducing who has access (least privilege, 4.6)
- Training people, since the human vector cannot be patched