Threat Vectors and Attack Surfaces (PDF)

Threat Vectors and Attack Surfaces - GuidesDigest Training Chapter 2: Threats, Vulnerabilities, and Mitigations Understanding the channels through which attacks can occur is as critical as knowing who is likely to attack. This chapter discusses various threat vectors and attack surfaces that are...

Threat Vectors and Attack Surfaces - GuidesDigest Training Chapter 2: Threats, Vulnerabilities, and Mitigations Understanding the channels through which attacks can occur is as critical as knowing who is likely to attack. This chapter discusses various threat vectors and attack surfaces that are common targets for threat actors. Message-based Email Emails are among the most common vectors for phishing, malware distribution, and spam. Examples include spear-phishing emails that appear to come from a trusted source but contain malicious attachments or links. Note: Always look out for the signs of phishing emails, such as poor grammar or misspelled words, to detect malicious intent. SMS SMS can be used to trick users into clicking on a malicious link, thus leading them to phishing sites or downloading malware. An example would be a fake bank message asking for urgent verification. Note: Enable two-factor authentication wherever possible to add an extra layer of security. Instant Messaging IM platforms like WhatsApp, Telegram, or Signal can also serve as attack vectors, especially for spreading misinformation or forwarding malicious links. Note: Be cautious when receiving files or links, even from known contacts. Confirm the legitimacy of such files or links outside of the platform. Image-based Images can hide malware or link to malicious sites. They can also be manipulated to convey false information. For example, steganography can hide malicious code within an image file. Note: Make sure your security software scans image files for hidden payloads. File-based Files like PDFs or Word documents can contain embedded scripts or macros that execute malicious code when opened. For example, a seemingly harmless invoice could release ransomware into your system. Voice call Voice phishing, or “vishing,” involves scammers calling victims to solicit personal information. An example could be someone posing as tech support asking for your credentials. Removable Device USB drives, CDs, and other removable devices can carry malware and auto-execute upon connection to a system. The infamous Stuxnet worm was initially spread through USB drives. Note: Disable auto-run features for removable media and scan them before use. Vulnerable Software Client-based vs. Agentless Client-based software requires installation on your system and can be vulnerable if not regularly updated. Agentless software runs in the cloud or on a server, but unpatched security holes can make it a target. Note: Regularly update all your software and run periodic vulnerability scans. Unsupported Systems and Applications Risks Using outdated or unsupported software increases the risk of unpatched vulnerabilities being exploited. Mitigations Switch to supported software, or if that’s not possible, isolate the unsupported systems from the network. Unsecure Networks Wireless Open or poorly secured Wi-Fi networks are prone to man-in-the-middle attacks. Wired Even wired networks can be compromised through physical access or through unsecured ports. Bluetooth Bluetooth can be exploited via “bluejacking” or “bluesnarfing,” where unauthorized users send messages or steal information. Note: Always encrypt your network traffic, and disable unused ports and services. Open Service Ports Risks Open ports can be scanned and exploited by attackers to gain unauthorized access. Mitigations Close unnecessary ports and apply proper access controls. Default Credentials Risks Leaving systems with default usernames and passwords poses a high risk of unauthorized access. Mitigations Always change default credentials and use strong, unique passwords. Note: Use a password manager to keep track of complex passwords. Supply Chain Managed Service Providers (MSPs) MSPs manage and provide specialized services but can be compromised to attack their clients. Vendors Third-party software or hardware can introduce vulnerabilities. Suppliers Even the physical supply chain, such as chip manufacturers, can be compromised. Human Vectors/Social Engineering Social engineering targets human behavior to extract information or gain unauthorized access. Types Phishing: Via email. Vishing: Over the phone. Smishing: Through SMS. Note: Human error is often the weakest link. Educate your team regularly on security best practices. Summary Understanding various threat vectors and attack surfaces is critical for comprehensive cybersecurity. Awareness and preparedness are your first lines of defense. Review Questions How can a seemingly harmless image be a security threat? What are the risks of using unsupported systems? What is the difference between client-based and agentless software in terms of vulnerability? Why are default credentials risky? Key Points Multiple channels, both digital and human, can serve as attack vectors. Awareness and updating systems are fundamental steps for mitigation. Practical Exercises Conduct a security audit to identify potential threat vectors in your organization. Develop a social engineering awareness program for your team. Understanding the landscape of threat vectors allows you to better defend your systems and data from potential compromises.