Chapter 2 Flashcards
Threat actor
Any person or group who presents a security risk
nation state actors
Highly skilled, highly funded government-sponsored attackers
hactivist
Attacks for ideological reasons, often highly sophisticated with little resources/funding
unskilled attacker (script kiddie)
attackers with little skill and little funding
Insider threat
many resources, medium sophistication, employee out for revenge or financial gain, takes advantage of organization knowledge, knows exactly where to hit vulnerable systems
Organized crime
highly funded, highly sophisticated, motivated by money
Shadow IT
many resources, low sophistication, group that doesn’t want to deal with IT dept regulations, circumvents existing IT
Threat vector
Method used by an attacker to access a victim’s machine
Agentless
Executable that does not require installation, such as a web-based executable
Client-based
Executable that requires installation, think installed malware
Unsupported systems
Outdated operating systems no longer supported by the manufacturer; no patches exist
WEP, WPA, WPA2, WPA3
Wireless network security protocols used to encrypt wireless traffic. WPA3 is most secure and up to date.
802.1X
A port-based authentication protocol. Prevents access to the network unless someone provides proper credentials. Can be used wireless or wired.
Bluetooth
Attackers can use bluetooth for reconnaissance to determine location
TCP
Transmission Control Protocol. A port. TCP is usually seen as TCP/IP in writing.
UDP
User Datagram Protocol. A port.
Open port vector
an opportunity for an attacker. Could be due to a misconfiguration or a system vulnerability.
Default credentials
if you keep default credentials, very easy for attackers to gain access
MSP
Managed service provider
Supply chain vector
An attacker could gain access to a network using a vendor or a supplier. Think 2013 target CC breach and counterfeit Cisco hardware being delivered
Phishing
Social engineering, usually delivered by email, SMS. Usually grammar, spacing, URL not quite right. Creates a sense of urgency to click a malicious link.
Business Email Compromise (BEC)
Attacker pretends to be a trusted business for financial gain
BEC
Business Email Compromise
Pretexting
Lying to get information, often creating stories.
Typosquatting
An attacker registers a domain name with a common misspelling of an existing URL
Vishing
Voice phishing over the phone
Smishing
SMS phishing
Watering Hole attack
A malicious attack that is directed toward a small group of specific individuals who visit the same 3rd party website, such as a sandwich shop.
DLL
Dynamic Link Library. A Windows library containing data and code.
Malware
Malware runs in memory. Malware can run on its own or inject itself into a legitimate process
Memory Injection
Malware injecting itself into an existing process, getting access to the data with the same rights and permissions, performing a privilege escalation.
DLL injection
Attacker injects a path to a malicious DLL (Dynamic link library) into memory and runs it.
Buffer overflow attack
Attacker overwrites a buffer of memory, spilling over into other memory areas, effectively manipulating data to change the permissions the system gives the attacker
Race condition
A programming flaw that occurs when two sets of code attempt to access the same resource. The first one to access the resource wins, which can result in inconsistent results.
TOCTOU (Time-of-Check to Time-of-Use)
Race condition. You don’t check bank account before going grocery shopping.
TOCTOU
Time-of-Check to Time-of-Use
OS
Operating system
SQL
Structured query language. The most common database management system language
Malicious update
A fake update used to introduce malicious functionality
SQLi
SQL injection
SQL injection
An attacker injects commands into a field to be manipulated by the database. All they have to do is enter ‘OR ‘1 = 1’ and they have access to entire database.
XSS
Cross-site scripting
Cross-site Scripting
Attacker sends malicious link to victim, runs a legitimate website, but attacker runs malicious code behind the scenes to obtain user’s data.
Vulnerable XSS website
Website with search engine that allows javascript code injection for attacker to obtain information
