Cyber Security Threats and Attacks
What this domain tests
Threats and Attacks tests whether you can recognise an attack from its behaviour, name the threat actor, and separate the attack technique from the vulnerability it exploits. Questions often use a short incident description and ask for the best label or the first control.
Core rules and concepts
- Threat actors: script kiddies, hacktivists, cybercriminals, insiders, nation-states and advanced persistent threats (APTs). Motivation and capability change the risk, not just the tool.
- Malware families: viruses need a host file and user action; worms self-propagate across networks; trojans disguise themselves as useful software; ransomware encrypts or steals data and demands payment; spyware collects information covertly.
- Social engineering targets people: phishing, spear phishing, whaling, vishing (voice), smishing (SMS), baiting and tailgating. Phishing is not spam; spam is unsolicited bulk email, while phishing tries to trick you into an action.
- Network and application attacks: denial of service (DoS) exhausts resources; distributed DoS (DDoS) uses many sources; man-in-the-middle (MITM) intercepts traffic; spoofing falsifies identity; SQL injection and cross-site scripting target poor input handling.
- Attack lifecycle: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, actions on objectives. Defence can interrupt any stage.
- Zero-day: a vulnerability with no available patch; exploitation before defenders can react.
Worked example
An accounts clerk receives an email that appears to come from the CEO, marked urgent, asking for a supplier payment to a new bank account. The domain is slightly misspelt, the reply-to address is external, and the message pressures the clerk to bypass the call-back rule. This is spear phishing with business email compromise characteristics, not malware and not a DDoS. The human target is the delivery path; the weakness is the absence of a verified payment-change process. Effective measures are awareness training, a mandatory call-back to a known number, multi-factor authentication and email filtering. The reasoning matters: the attack is classified by its method and objective, not by the technology in the email.
Traps that cost marks
- Calling every email attack 'spam'. Spam is bulk unsolicited mail; phishing is deceptive.
- Confusing a worm with a virus: worms spread without a host file.
- Treating ransomware as only an availability attack. It is also a confidentiality and extortion risk.
- Assuming insiders are always malicious. Negligence and accident are insider threats too.
- Forgetting that DDoS uses many compromised hosts, while DoS can use one.