701 - Section 2 Flashcards
What is the entity responsible for an event that has an impact on the safety of another entity called?
Threat actor or a malicious actor
What are the three attributes of threat actors?
Internal or external, resources or funding, level of sophistication or capability
Why is it important to find the motivation of a threat actor?
Because it identifies the purpose of the attack
Name five or more motivations for attackers?
Data exfiltration, espionage, service disruption, blackmail, financial gain, philosophical or political beliefs, ethical, revenge, disruption or chaos, war
Constant nation state attacks with massive resources are also known as
An advanced persistent threat
What are the location, resources, sophistication attributes of a nation state threat actor?
External, extensive, very high
What are the location, resources, sophistication attributes for an unskilled threat actor?
External, limited, very low
What are the location, resources, sophistication attributes for a Hacktivist threat actor?
External, some funding, can be high
What are the location, resources, sophistication attributes for an insider threat threat actor?
Internal, many resources, medium
What are the location, resources, sophistication attributes for an organized crime thread actor?
External, often extensive, very high
What are the location, resources, sophistication attributes for a shadow IT threat actor?
Internal, many resources, limited
What are the possible motivations for a nation state thread actor?
Data filtration, philosophical, revenge, disruption, war
What are the possible motivations for an unskilled threat actor?
Disruption, data, exfiltration, philosophical beliefs
What are the possible motivation for a Hacktivist thread actor?
Philosophical beliefs, revenge, disruption chaos
What are the possible motivations for an insider threat threat actor?
Revenge and financial gain
What are the possible motivations for an organized crime thread actor?
Financial
What are the possible motivations for shadow IT thread actor?
Philosophical beliefs and revenge
What is the method used by an attacker to gain access or to infect a target?
A threat vector or an attack vector
What are three types of message based attack vectors?
Fishing attacks for example, providing a link in an email or a text, delivering malware to a user for example and attachment within an email, social engineering attacks for example, invoice or cryptocurrency scams
What image format is known as a threat?
The scalable vector graphic format, SVG
What are two attack types of an image based attack?
HTML injection and JavaScript attack
What can defend against an image based attack?
A web browser providing input validation
What are three file based threat vectors?
Adobe PDF, zip or RAR files, Microsoft Office files
What are the four types of voice call attack vectors?
Vishing which is fishing over the phone spam over IP, war dialing, call tampering
What does an attacker use for a removable device attack vector?
A USB drive
Which attack vector can infect an air gapped network?
A removable device attack vector
What are two types of software used for a vulnerable software attack vector?
Client and agentless
What are the differences between a client based vulnerability and an agent less software vector vulnerability?
For a client based, it is an infected executable that requires installation whereas agentless is not an installed executable, and the impact would affect all users using the service
What are two examples of unsupported system vectors?
A system that isn’t regularly patched and an outdated operating system
What is the best way to prevent an unsupported system attack vector?
Making sure every system is patched and has all the latest updates, as a single system could represent an entry point
What is the best way to prevent an open service port attack vector?
Adding firewall rules for every open port as each one represents a potential entry point for an attacker
What is the best way to prevent a default, credential attack vector?
Changing all default username and passwords, as it’s very easy to find the default credentials for every device.
Why is a supply chain attack vector difficult to defend against?
Because they provide many points of entry and some or most are out of an organizations control
What are two methods to defeat a fishing attack vector?
Check the URL of all links by hovering over them and usually there’s something not quite right with the spelling, the fonts or the graphics
What is at the root of a business email compromise attack vector?
Because we trust the email source and the attacker takes advantage of this trust
Why are tricks and misdirection attack vectors difficult to defend against?
Because of how realistic that they are. There may be a slight typo in the URL known as typosquatting or they use a highly believable character in a realistic situation also known as pre-texting
What are two types of fishing that use voice and SMS messages?
Vishing known as voice phishing and Smishing known as SMS phishing
Why are impersonation attacks so successful?
Because they include a realistic pretext or story
What are some of the methods used in an impersonation attack?
They use pieces of information that they know about you, they will act as if they are higher in rank, they will throw many technical details around, they will act as if they are your friend
What is the result of a successful impersonation attack against a person?
They have enough information regarding your identity to commit fraud such as credit card for fraud, bank fraud, loan fraud, government benefits fraud
What are ways you can protect against impersonation?
Never volunteer any personal information or personal details and always verify through third parties
How does a watering hole attack work?
By infecting a website or system, which an organization is known to use.. these infections can impact just those in the organization or they can infect all visitors
How do you defend against a watering hole attack?
Using a lay defense known as defense in depth, firewalls, update to date antivirus and anti-malware software
How does a misinformation or disinformation attack work?
Attackers create fake users and fake content, they post on social media and amplify the message, real users begin to share the message, then the mass media picks up the story
What are the different types of processes that a memory injection attack can infect?
Malware can be hidden in all of these… DLLs, threads, buffers, memory management functions
What are the two types of memory injections?
Memory and DLL
How does a memory injection attack work?
By adding the malicious code into the memory of an existing process, which allows access and system privileges to the data in that process
How does a DLL injection attack work?
An attacker injects a path to the malicious DLL, which then runs as part of the target process
How does a buffer overflow attack work and what does it need to be successful?
By overwriting a buffer of memory which spills into other memory areas. This is not a simple exploit, and the buffer overflow needs to be repeatable.
How do you defend against a buffer overflow attack?
By having the developers perform bounds checking within their code
How does a race condition work?
It is a result of two conditions happening at the same time that can produce a vulnerability
What is another name for a race condition attack?
Time of check to time of use attack TOCTOU
What is the best defense against malicious updates?
Keeping your operating system and applications up-to-date
How do you prevent against a malicious update when downloading an update?
By having a good known backup , By confirming the source visiting the trusted download site directly and not disabling operating system security controls
How do you defend against an operating system vulnerability?
By having a good back up in case of an issue and always keeping the system up-to-date
How does a SQL injection attack work?
The attacker will add their own malicious bits of SQL code into a form field that is submitted to the server and executed within the DB
What is the best defense against a SQL injection attack?
Having the application properly validate and properly escape (using escape keys) all input and output
How does a cross site scripting attack work?
Attacker sends a link containing malicious script to a victim, the victim clicks the link and visits the legitimate site, the legitimate site loads in the victims browser and the malicious script is executed. the malicious script sends the victims information to the attacker. This includes credentials session IDs, and cookies.
What are the two types of cross scripting attacks?
A non-persistent or reflected attack and a persistent or stored attack
How does a non-persistent (aka reflected) cross scripting attack work?
An attacker emails a link that execute the script that sends credentials, session, IDs, cookies to the attacker…this script is embedded within a URL…
What is a common source of a cross site scripting attack? And why?
A website search box…Search boxes accept user input, which can be manipulated by attackers to inject malicious code. If the input is not properly sanitized or validated, it opens up the possibility for attacks like SQL injection or cross-site scripting (XSS).
What is a persistent or stored scripting attack?
When the attacker post a message to a social network that includes the malicious payload. It’s called persistent because everyone who views the page will get this malicious code.
How do you protect against a cross site scripting attack?
By avoiding clicking on untrusted links, disabling JavaScript in your browser, keeping your browser and applications properly updated and validating input fields
Why are hardware vulnerabilities so dangerous?
Because we are surrounded by intelligent hardware devices, many of which do not have an accessible operating system. Each of these pose an entry point for an attack
What are main security risks with hardware vulnerabilities?
The vendors are the only ones who can fix their issues, assuming they know about the problem, or care about fixing it… The end of life or the technological end of service life, which is the time when the product stops being sold and or stops being supported.
