Network Security Threats and Vulnerabilities
Threat Categories
Organize threats into categories: malware (viruses, worms, trojans, ransomware, rootkits), social engineering (phishing, vishing, pretexting), network attacks (scanning, sniffing, spoofing, MITM, on-path attacks), denial of service (volumetric, protocol, application-layer), and injection/web attacks (SQLi, XSS, CSRF). Know the difference between a worm (self-propagating) and a trojan (disguised payload), and between DoS and DDoS.
Vulnerabilities and Weaknesses
Understand common weakness classes: misconfiguration, unpatched software, weak/default credentials, exposed services, improper input validation, insecure protocols (Telnet, FTP, SNMPv1), and design flaws. Know the role of CVEs, CVSS scoring, and the difference between a vulnerability scan and a penetration test.
Attack Lifecycle
Recognize reconnaissance, initial access, privilege escalation, lateral movement, persistence, and exfiltration. This framing helps answer 'what does this log indicate?' questions.
Worked Example / Rule of Thumb
Given an indicator, identify the phase and the countermeasure. Example: repeated failed logins from many source IPs followed by one success suggest credential stuffing or brute force; the best response combines account lockout/throttling with MFA, not just a longer password. For a self-propagating payload that spreads without user action, the term is worm - a frequent distractor is 'virus.'
Trap: confusing a vulnerability scan (identifies, low risk) with a pen test (exploits, authorized). Also watch for 'spoofing' vs. 'sniffing' - one forges identity, the other observes traffic.