Threat Vectors and Attack Surfaces

Threat Vectors and Attack Surfaces

• Message-based attacks:

  • Emails are a common vector for phishing, malware, and spam.
  • Spear phishing emails mimic trusted sources, often containing malicious attachments or links.
  • Look for poor grammar, misspellings in emails to detect phishing attempts.
  • SMS messages can also lead to phishing sites or malware download.
  • Fake bank messages requesting urgent verification are common examples.
  • Enable two-factor authentication to enhance security.
  • Instant messaging platforms (WhatsApp, Telegram, Signal) can spread misinformation or malicious links.
  • Be cautious of files or links from known contacts; verify the legitimacy outside the platform.

• Image-based attacks:

  • Images can conceal malware or link to malicious sites.
  • Steganography can hide malicious code within images.
  • Ensure security software scans images for hidden payloads.

• File-based attacks:

  • Files (PDFs, Word documents) can contain embedded scripts or macros that execute malicious code upon opening.
  • A seemingly harmless invoice could release ransomware.

• Voice call attacks (Vishing):

  • Scammers posing as tech support or other trusted entities to obtain personal information.

• Removable Device attacks:

  • USB drives, CDs, and other removable devices can carry malware.
  • Malware can auto-execute upon connection.
  • Disable auto-run features and scan removable media before use.

Vulnerable Software

• Client-based vs. Agentless:
  • Client-based software requires installation and is vulnerable if not updated regularly.
  • Agentless software runs in the cloud and can be vulnerable if unpatched.
  • Regularly update software and run vulnerability scans.

Unsupported Systems and Applications

• Risks:

  • Using outdated or unsupported software increases risk of unpatched vulnerabilities being exploited.

• Mitigations:

  • Switch to supported software or isolate unsupported systems from the network.

Unsecure Networks

• Wireless attacks:

  • Open or poorly secured Wi-Fi networks are susceptible to man-in-the-middle attacks.

• Wired attacks:

  • Even wired networks can be compromised via physical access or unsecured ports.

• Bluetooth attacks:

  • Bluetooth can be exploited (bluejacking/bluesnarfing) where unauthorized users send messages or steal information.
  • Encrypt network traffic, disable unused ports, and services.

Open Service Ports

• Risks:

  • Open ports are vulnerable to attackers gaining unauthorized access.

• Mitigations:

  • Close unnecessary ports and implement proper access controls.

Default Credentials

• Risks:

  • Systems with default usernames and passwords are at high risk of unauthorized access.

• Mitigations:

  • Always change default credentials and use strong, unique passwords.
  • Use a password manager to keep track of complex passwords.

Supply Chain Attacks

• Managed Service Providers (MSPs):

  • MSPs manage services but can be compromised, impacting clients.

• Vendors/Suppliers:

  • Third-party software, hardware, and even chip manufacturers can be compromised.

Human Vectors/Social Engineering

• Social engineering targets human behavior to extract information or gain unauthorized access.

Types of attacks

• Phishing: Via email.
• Vishing: Over the phone.
• Smishing: Via SMS.

General Security Best Practices

• Educate your team regularly on security best practices.

This quiz focuses on the various threat vectors and attack surfaces prevalent in cybersecurity. Participants will learn about message-based, image-based, and file-based attacks, offering insights into prevention strategies and detection methods. Test your knowledge on identifying and mitigating these threats for better security practices.