Threats, Vulnerabilities, and Mitigations
Actors, motivations, and vectors
Threat-actor classification (nation-state/APT, organized crime, hacktivist, insider, unskilled attacker, shadow IT) frames both the risk narrative and the correct mitigation. Nation-states favor stealth and long dwell time; organized crime monetizes ransomware; insiders hold legitimate access and bypass perimeter controls entirely.
Vulnerabilities and malware taxonomy
Know the vulnerability families: unpatched software, misconfiguration, weak or default credentials, supply chain compromise, end-of-life systems, cloud and virtualization misconfiguration, mobile sideloading, and zero-days. Malware terms are heavily tested: a virus needs a host and user action, a worm self-propagates across the network, a trojan disguises itself as legitimate, ransomware encrypts and extorts, a rootkit hides at the OS or firmware layer, a logic bomb fires on a condition, spyware and keyloggers collect, and botnets conscript hosts for DDoS or spam. Fileless malware lives in memory and abuses living-off-the-land tools such as PowerShell.
Social engineering and credential attacks
Distinguish phishing (email), vishing (voice), smishing (SMS), pretexting (invented scenario), tailgating, watering hole, typosquatting, impersonation, and business email compromise. Password attacks: brute force, dictionary, hybrid, spraying (one weak password across many accounts, which sidesteps lockout), and rainbow tables (defeated by salting).
Detection and mitigation
Indicators of compromise include anomalous outbound traffic, unexpected privilege escalation, impossible-travel logins, and newly created service accounts. Mitigations map to the vector: patching, hardening, least privilege, MFA, segmentation, EDR, application allowlisting, sandboxing, and awareness training.
Worked example: an alert shows Word spawning PowerShell with no file written to disk. That is fileless malware, so behavioral EDR detection is the answer - signature antivirus has nothing to match.