Capítulo 1 de 524% del examen
Threats, Attacks, and Social Engineering
This chapter surveys the adversaries and techniques that security professionals defend against. You will learn to distinguish threat actors by motivation and capability, recognize the major malware families, and identify social engineering and application attacks. Understanding how attacks work is the foundation for choosing the right defenses.
Threat Actors and Motivations
Threat actors range from unskilled individuals to well-resourced governments, and their goals shape the risk they pose. Classifying an actor by capability, resources, and intent helps defenders anticipate their methods and prioritize controls.
Nation-state actors
Highly funded and skilled, often called advanced persistent threats, pursuing espionage and long-term stealthy access using zero-days.
Organized crime
Financially motivated groups behind ransomware and fraud, operating like businesses with specialized roles.
Hacktivists
Ideologically driven actors who deface sites or leak data to advance a cause rather than for profit.
Script kiddies
Low-skill attackers using prebuilt tools and exploits without deep understanding, still capable of real damage.
Insiders
Employees or contractors who abuse authorized access, whether maliciously or through negligence.
Malware Types
Malware is malicious software designed to damage, steal, or gain control. Recognizing each family's behavior guides both detection and remediation, since a worm, a Trojan, and ransomware each spread and act differently.
Ransomware
Encrypts data and demands payment; modern variants also exfiltrate data for double extortion. Offline backups are the best defense.
Worm
Self-replicates across networks without user action, making outbreaks spread fast. Patching and segmentation slow it.
Trojan
Disguises itself as legitimate software; does not self-replicate and relies on the user to run it.
Rootkit
Hides at a low level such as the kernel to conceal itself and maintain privileged access; secure boot helps counter it.
Keylogger and spyware
Secretly capture keystrokes and activity to steal credentials and data; MFA limits the impact of stolen passwords.
Social Engineering
Social engineering manipulates human psychology rather than technology to gain access or information. Attackers exploit trust, authority, urgency, and curiosity, so awareness training and verification procedures are the primary defenses.
Phishing and variants
Fraudulent messages harvest credentials or deliver malware; spear phishing targets individuals and whaling targets executives.
Vishing and smishing
Voice calls and text messages that manipulate victims into disclosing information or clicking malicious links.
Pretexting
Inventing a believable scenario, such as posing as IT support, to justify a request for access or data.
Baiting and tailgating
Baiting uses tempting items like infected USB drives; tailgating follows an authorized person through a secure door.
Business email compromise
Impersonates an executive or vendor to trick staff into wiring funds or sharing data, exploiting authority and urgency.
Application and Network Attacks
Many attacks target flaws in software or network protocols. Understanding these techniques clarifies why secure coding, input validation, and encryption matter throughout the lifecycle.
Injection attacks
SQL injection and command injection abuse unvalidated input; parameterized queries and validation are the fix.
Cross-site scripting
Injects scripts that run in victims' browsers; output encoding and validation prevent it.
On-path attacks
Intercept or alter traffic between two parties; strong encryption and certificate validation mitigate them.
Denial-of-service
Floods a target to exhaust resources; distributed versions use botnets. Rate limiting and scrubbing help.
Password attacks
Brute force, spraying, and rainbow tables target weak or unsalted passwords; salting, strong policies, and MFA defend against them.
Pon a prueba tus conocimientos
Preguntas de práctica sobre Threats, Attacks, and Social Engineering