Unit 5 - Module 4 - Theats Flashcards
What do you call a manipulation technque that exploits human error to gain private information, access , or valuables?
Social Engineering
These are the stages or what?
1) Prepare
2) Establish Trust
3) Use persuasion tactics
4) Disconnect from the target ( Dissapear after wards )
Stages of __________
Social Engineering
What social engineering tactic temps people into compromising their security?
Baiting
What digital communications trick people into revealing sensitive data or deploying malicious software?
Phishing
What is a type of bait used to trick someone into believing that they’ll be rewarded in return for sharing access, information, or money?
Quid pro quo
What social engineering tact is used which unauthorized people follow an authorized person into a restricted area?
Tailgating
What type of attack is when a threat actor compromises a website frequently visited by a specific group of users?
Watering Hole
What do you call the use of digital communications to trick people into revealing sensitive data or deploying malicous software?
Phishing
What do you call the exploitation of electronic voice communication to obtain sensitive information or impersonate a known source?
Vishing
What do you call a subnet of email phising in which specific people are purposefully targeted, such as the accountants of a small business?
Spear Phishing
What do you call the spear phishing attempts that are aimed at high-ranking executives in an organization?
Whaling
What do you call the technique where attackers impersonate customer service reps on social media?
Angler Phishing
What malware is used to gather and sell information without consent?
Spyware
What do you call malicious code written to interfere with computer operations and cause damage to data and software?
Virus
What malware can duplicated and spread itself across systems on its own?
Worm
What malware looks like a legitmate file or program?
Trojan
What type of malicious attack is when the attackers encrypt an organization’s data and demand payment to restore access?
Ransomware
What do you call software designed to harm device or networks?
Malware
What do you call advertising-supported software?
Adware
What do you call malicious adware that falls into a sub-category of malware?
Potentially unwanted application (PUA)
What do you call malware that does not need to be installed by the user becuase it uses legitimate programs that are already installed on the computer?
Fileless Malware
What do you call malware that provides remote, administrative access to a computer?
Rootkit
What do you call a type of malware that comes packed with malicious code which is delivered and installed onto a target system?
Dropper
What do you call the “robot network” which is a collection of infected computers from malware that are under the control of a single threat actor, known as the “bot-herder”?
Botnet
What is the form of malware that installs software to illegally mine cryptocurrencies?
Cryptojacking
What is malicious code or behavior that’s used to take advantage of coding flaws in a web application?
Web-based exploits
What is malicious code inserted into a vulnerable application?
Injection Attack
What do you call an injection attack that inserts code into a vulnerable website or web application?
Cross-site scripting (XSS)
What kind of attack are these?
1) Reflected
2) Stored
3) DOM-based
Cross-site scripting attacks
What do you call an instance when malicious script is sent to a server and activated during the server’s responce?
Reflected XSS attack
What do you call an instance when malicious script is injected directly on the server?
Stored XSS Attack
What is an instance when malicious script exists in the webpage a browser loads?
DOM-based XSS attack
What is a coding techinique that executes SQL statementes before passing them onto the database?
Prepared Statement
What programming removes user input which could interpreted as code?
Input Sanitization
What programming ensures user input meets a system’s expections?
Input Validation
What model is this? ( What guide )
1) Define the scope
2) Identify Threats
3) Characterize the enviroment
4) Analyze threats
Threat Model Steps
What is a popular threat modeling framework that’s used across many industries?
PASTA
Process for Attack Simulation and Threat Analysis
