1-10 Flashcards
What is an amplification attack?
Use of botnets for a DDOS or SPAM attack
What is a reflection attack?
Using the victims IP to spam itself
What is poisoning?
Manipulated a trusted source of data
What is hijacking?
Intercepting communications to eavesdrop, capture, manipulate, and/or reuse packets
What are the common types of phishing?
Spear fishing, Whaling, SMSishing, Vishing, Watering holes
What are local types of social engineering?
Shoulder surfing, Piggybacking/Tailgaiting, Dumpster Diving, USB Baiting.
What is a cross site scripting attack?
Injection of malicious code into a web app or back end that will execute scripts in a user’s browser. Can be persistent or reflective.
Cross Site Request Forgery?
Tricks a web browser into executing malicious actions on a trusted site for which the user is authenticated (usually via manipulated link/URL).
What can significantly reduce the impact of of XSS and SQL injection attacks?
Input and output validation
What is threat modeling?
Structured process by which potential threats, actors, and vectors can be identified, enumerated, and prioritized.
What is OSINT?
Open Source Intelligence
What are some government sources of threat modeling data?
NIST, FBI, US-CERT, NVD, MITRE, and CISA
What are the three threat modeling approaches?
Asset-Centric (what/why), Architecture-Centric (how), and Attacker-Centric (who).
