Study guide 2: Threat types, attack surfaces and social engineering
Domain 2: Threats, Vulnerabilities & Mitigations · Not started
Main exam topics
Threat actors and motivations; attack surfaces; phishing and social engineering; malware; network and application attacks; software, hardware, cloud and supply-chain vulnerabilities; indicators of attack; patching, isolation, segmentation and access controls.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Lesson plan · 75 minutes
By the end of this lesson you will be able to:
- Define vulnerability, threat and risk
- Compare threat actors by sophistication, resources and motivation
- Identify software, network, lure and message vectors
- Recognize phishing, pretexting, typosquatting and BEC
Topic 2A — Threat actors
A vulnerability is a weakness; a threat is something that could exploit it; risk is likelihood times impact. Actors differ by location (internal/external), capability and funding. Nation-states run long, stealthy APT campaigns for espionage or disruption. Organized crime seeks money through ransomware and fraud. Hacktivists pursue political goals with defacement and leaks. Unskilled attackers reuse public tools. Insiders — malicious or careless — already hold access; shadow IT is an unintentional insider risk.
Topic 2B — Attack surface and vectors
The attack surface is every point an attacker could reach. Software vectors include unpatched or unsupported apps and vulnerable services; agent-based scanning sees more than agentless scanning. Network vectors include open ports, default credentials, wireless and Bluetooth, and remote access. Lure-based vectors use removable media or files that tempt users. Message-based vectors arrive by email, SMS, IM, voice or images. Supply chain risk covers suppliers, vendors and MSPs that could deliver compromised hardware or software.
Topic 2C — Social engineering
Social engineering targets people. Impersonation pretends to be a trusted person; pretexting adds a believable story. Phishing is mass email; spear phishing targets individuals; whaling targets executives; vishing uses voice; smishing uses SMS. Pharming redirects traffic to a fake site through DNS or hosts-file changes. Typosquatting registers look-alike domains. Business email compromise uses a real or spoofed executive mailbox to authorize fraudulent payments. Defense: training, verification through a known channel, and email authentication (SPF, DKIM, DMARC).
Saved