Chapter 2: Threats, Vulnerabilities, and Mitigations

What you will learn

By the end of this chapter, you will be able to:

• Compare threat actor types — nation-state, hacktivist, insider threat, organized crime, and shadow IT — by their resources, funding, sophistication, and intent
• Explain how threat intelligence is gathered and used, including open-source intelligence (OSINT), dark web monitoring, threat feeds, threat intelligence platforms (TIPs), and the MITRE ATT&CK framework
• Identify common attack surfaces and threat vectors, including email, wireless networks, removable media, cloud services, and the supply chain
• Recognize social engineering techniques such as phishing, smishing, vishing, pretexting, influence campaigns, typosquatting, and brand impersonation
• Describe the major categories of malware and how each one spreads, hides, and causes harm
• Explain common application attacks, including injection, privilege escalation, directory traversal, API attacks, replay attacks, pass-the-hash, and credential stuffing
• Describe network attacks such as distributed denial of service (DDoS), DNS poisoning, ARP poisoning, on-path attacks, Bluetooth attacks, and wireless jamming
• Understand cryptographic attacks, including downgrade, collision, and birthday attacks
• Explain the vulnerability management life cycle: scanning, penetration testing, CVE and CVSS scoring, false positives, and responsible disclosure
• Apply mitigation techniques: patching, segmentation, access control, hardening, disabling unused ports and services, and least privilege

Domain 2 makes up about 22% of the Security+ SY0-701 exam — roughly one question in five. It is the "know your enemy" domain: before you can defend systems (Domains 3 and 4) or run a security program (Domain 5), you need to understand who attacks, how they get in, what they deploy, and how defenders find and fix weaknesses first.

Reading

2.1 Threat actors: who is attacking you?

Not all attackers are equal. A threat actor is any person or group that causes, or has the potential to cause, harm to systems, networks, or data. Security+ expects you to classify actors by four attributes:

• Resources and funding — how much money, time, tooling, and personnel the actor can bring to bear
• Level of sophistication — the technical capability of the actor, from running downloaded scripts to developing custom zero-day exploits
• Intent (motivation) — what the actor wants: money, espionage, political change, revenge, or ideology
• Internal vs. external — whether the actor operates from outside the organization or already has some level of legitimate access

Nation-state actors

A nation-state actor works for, or is sponsored by, a government. These are the best-resourced attackers in the world: they have large budgets, full-time professional teams, custom malware development, and the patience to stay hidden inside a network for months or years. Groups operating this way are often called advanced persistent threats (APTs) — "advanced" because of their tooling, "persistent" because they pursue a specific target over a long period rather than grabbing whatever is easy.

Their usual intent is espionage (stealing state secrets, military plans, or intellectual property), strategic positioning inside critical infrastructure (power grids, water systems, telecoms), and occasionally sabotage. A defining trait is selectivity: a nation-state team breaking into a defense contractor is not interested in the company's payroll spreadsheet — it wants weapons designs, and it will quietly ignore everything else.

Hacktivists

A hacktivist is motivated by ideology, politics, or a social cause. Hacktivist groups have attacked government agencies, corporations, and organizations they view as unethical, usually to embarrass the target, leak information, deface websites, or knock services offline with DDoS attacks. Their resources and sophistication vary widely — some members are skilled, but the group rarely has nation-state funding. The key exam attribute is intent: hacktivists want attention for a cause, not profit or espionage.

Insider threats

An insider threat comes from someone with legitimate access: an employee, contractor, or business partner. Insiders are dangerous because they already know where the valuable data lives and which controls exist. Insider incidents split into two broad kinds:

• Malicious insiders act deliberately — a disgruntled employee copying customer data before resigning, or a worker paid by a competitor to plant malware
• Unintentional insiders cause harm by accident — an employee who clicks a phishing link or misconfigures a cloud storage bucket to be public

Intent separates them, but the damage can be identical. Because insiders operate with valid credentials, their activity often blends into normal logs, which is why user behavior analytics and least privilege (covered later in this chapter and in Domain 4) matter so much.

Organized crime

Organized crime groups are in it for the money. They run ransomware operations, business email compromise (BEC) fraud, banking trojans, and large-scale credential theft as businesses — complete with help desks for victims, affiliate programs, and revenue sharing. Their resources are substantial (criminal profits fund serious tooling) and their sophistication is moderate to high, but their defining attribute is financial motivation. Unlike nation-states, they usually choose targets by expected payout rather than strategic value — hospitals, municipalities, and mid-size companies are frequent victims precisely because downtime pressures them to pay.

Shadow IT

Shadow IT is not a person — it is the unauthorized hardware, software, and cloud services that employees use without IT approval. An employee who stores work files in a personal cloud drive "because it's easier," or a team that buys its own project app on a credit card, creates shadow IT. It appears in the threat actor topic because it creates risk the security team cannot see: unpatched, unmonitored, outside access control and backup policies. Shadow IT has no malicious intent, but it expands the attack surface invisibly, which is why discovery tools (cloud access security brokers, network scanning) are used to find it.

2.2 Threat intelligence: knowing before they strike

Defenders do not have to wait for an attack to learn from it. Threat intelligence is evidence-based knowledge about existing or emerging threats that helps organizations make faster, better security decisions. Security+ covers several sources and tools.

Open-source intelligence (OSINT) is intelligence gathered from publicly available sources: public websites, social media, domain registration records, public code repositories, government advisories, and security research blogs. OSINT is legal and free, and both sides use it — attackers use OSINT to research targets (employee names, email formats, technologies in use), while defenders use it to monitor for leaked credentials, lookalike domains, and new vulnerability disclosures.

Dark web monitoring watches marketplaces and forums that are not indexed by normal search engines, where stolen credentials, access to compromised networks, and malware kits are bought and sold. Finding your organization's accounts for sale there is an early-warning sign of a breach.

Threat feeds are ongoing streams of machine-readable threat data: malicious IP addresses, phishing domains, file hashes of known malware, and similar indicators of compromise (IOCs). Feeds arrive in standard formats (such as STIX/TAXII) so firewalls, SIEMs, and endpoint tools can consume them automatically. Proprietary (closed-source) feeds from commercial vendors often add analyst research and context that free feeds lack.

A threat intelligence platform (TIP) collects feeds from many sources, removes duplicates, correlates indicators, and pushes enriched intelligence out to security tools. Instead of each tool managing its own feeds, the TIP becomes the single place where intelligence is stored, scored, and shared.

Intelligence in practice. Raw indicators are only useful when they reach the tools and people who act on them. A mature program works a simple cycle: collect intelligence from feeds, OSINT, and internal incidents; analyze it for relevance (does this indicator touch technologies we actually run?); distribute it to the SIEM, firewalls, and endpoint tools as block rules and detection logic; and feed the results of investigations back into the next collection round. Relevance is the filter that separates intelligence from noise — a feed listing ten thousand malicious IPs is worth little if nine thousand of them target software your organization does not own. This is also why analysts track specific named threat groups over time: knowing that a particular ransomware affiliate favors a specific initial-access technique tells defenders exactly which detection to build first.

The MITRE ATT&CK framework is a knowledge base of real-world adversary behavior organized as tactics (the attacker's goal — for example, initial access, persistence, exfiltration) and techniques (how they achieve it — for example, phishing for initial access). Defenders use ATT&CK to map an incident to known techniques, check whether their tools would detect each technique, and prioritize gaps. At Security+ level you need the concept, not the full matrix: ATT&CK describes how attackers behave, which makes it useful for threat hunting, detection engineering, and comparing threat actors' playbooks.

2.3 Attack surfaces and threat vectors

The attack surface is the total of all points where an attacker can try to enter or extract data. A threat vector (attack vector) is the specific path an attacker uses. Reducing the attack surface — closing what you do not need — is a theme that runs through this whole chapter.

Message-based vectors. Email remains the most common delivery path: phishing messages, malicious attachments, and links to credential-harvesting sites. The same risks exist in SMS (smishing), voice calls (vishing), instant messaging, and social media messages, where users are often less suspicious than they are in email.

Wireless vectors. Rogue access points, evil twins (access points imitating legitimate networks), and weak encryption let attackers position themselves between users and the network. Wireless attacks are covered in section 2.8.

Removable media. USB drives and other removable media bypass network defenses entirely. A classic technique is dropping infected USB drives in a parking lot and waiting for a curious employee to plug one in. Media found this way should never be inserted into a work computer — and organizations defend by disabling USB storage or restricting it to approved devices.

Cloud vectors. Misconfigured cloud storage, overly permissive identity policies, and exposed management interfaces are attack paths that exist entirely in cloud services. Because cloud resources are reachable from the internet by design, a single misconfiguration can expose data worldwide in minutes.

Other surfaces to reduce. Web applications and their APIs are internet-facing attack surface by design, which is why they get their own attack section (2.6) and dedicated defenses such as web application firewalls. Physical access is an attack surface too: an unlocked server room door or an unattended logged-in workstation bypasses every technical control in this book, and tailgating turns a badge system into an honor system. Finally, people themselves are an attack surface — the entire social engineering section (2.4) exists because attackers treat employees as an entry point. A useful exercise for any organization is to inventory its surface honestly: list every internet-facing service, every SaaS application in use, every place company data can leave, and every person who can approve a payment. Whatever appears on that list needs an owner and a control.

Supply chain vectors. Instead of attacking a hardened target directly, attackers compromise something the target trusts: a software vendor's update mechanism, a managed service provider (MSP), a hardware supplier, or an open-source library used in the target's applications. One compromised vendor can become a doorway into thousands of its customers. Defenses include vendor risk assessments, software bills of materials, code signing verification, and monitoring third-party access.

2.4 Social engineering: attacking the human

Social engineering manipulates people into giving up access, information, or money. It works because it exploits trust, urgency, fear, and helpfulness rather than technology. These are among the most tested topics in Domain 2.

Phishing is fraudulent email (or messages) that imitate a trusted sender to trick recipients into clicking a malicious link, opening an infected attachment, or entering credentials on a fake page. Variants you must know:

• Spear phishing — phishing targeted at a specific person or organization, using researched details to look convincing
• Whaling — spear phishing aimed at senior executives, whose accounts and authority are especially valuable
• Business email compromise (BEC) — the attacker impersonates (or compromises) an executive or vendor and instructs staff to wire money or change payment details; BEC causes enormous financial losses without any malware at all
• Smishing — phishing by SMS text message
• Vishing — phishing by voice call, often with a spoofed caller ID

Pretexting is building a fabricated scenario — the "pretext" — to make a lie believable. A caller pretending to be from the IT help desk who "needs your password to fix a problem tonight" is pretexting; combined with a phone call it is also vishing. Pretexting is the story; phishing/smishing/vishing describe the channel.

Brand impersonation creates fake emails, websites, or social accounts that imitate a known brand (a bank, a delivery company, a software vendor). Typosquatting registers domain names that are common misspellings of legitimate ones — an extra letter, a swapped character, or a different top-level domain — so users who mistype a URL land on the attacker's site. A related term, domain hijacking, means taking over a legitimately owned domain itself.

Influence campaigns use social media and coordinated fake accounts to shape public opinion, spread disinformation, or damage reputations. Organizations defend against their effects with monitoring and communications planning rather than with firewalls.

Other techniques the exam may name include watering hole attacks (compromising a website the target group visits frequently), baiting (leaving infected media where it will be found), tailgating/piggybacking (following an authorized person through a secure door), MFA fatigue (bombarding a user with push approvals until they tap "approve"), and consent phishing (tricking users into granting a malicious app permissions to their account).

Defenses against social engineering are layered: user training and phishing simulations, email authentication and filtering, verification procedures for payment changes (call-back on a known number), MFA that resists phishing (hardware keys), and a culture where employees can report suspicious messages without blame.

2.5 Malware: malicious software

Malware is software designed to harm, spy, or gain unauthorized access. Security+ expects you to distinguish the major types by how they spread and what they do.

• Virus — malicious code that attaches to a legitimate file or program and needs a user action (opening the file, running the program) to spread. Like a biological virus, it needs a host.
• Worm — self-propagating malware that spreads across networks without user interaction, exploiting vulnerabilities to copy itself from machine to machine. Worms can saturate networks quickly.
• Trojan — malware disguised as legitimate or desirable software ("a free game," "a needed update"). The user installs the harm willingly. Unlike viruses and worms, trojans do not self-replicate — their trick is deception.
• Remote access trojan (RAT) — a trojan that gives the attacker remote control of the victim machine: files, webcam, keystrokes, and a launchpad for further attacks.
• Ransomware — malware that encrypts the victim's data (or threatens to leak it — "double extortion") and demands payment for the decryption key. Modern ransomware operators also steal data first so that refusing to pay risks public exposure. Crypto-ransomware encrypts files; locker ransomware locks the device or screen.
• Keylogger — software (or hardware) that records keystrokes to steal passwords, messages, and card numbers.
• Spyware — software that secretly monitors activity and reports it: browsing, location, credentials, screenshots.
• Rootkit — malware that hides deep in the operating system (or firmware) and conceals itself and other malware from users and security tools, often by hooking or replacing system functions. Rootkits are notoriously hard to detect from inside the infected OS because the OS itself is lying to you.
• Logic bomb — code that lies dormant until a condition is met — a date, an employee's account being deleted, a specific file being opened — and then triggers a malicious action such as deleting data. A time bomb is a logic bomb triggered by a date or time.
• Backdoor — a method of bypassing normal authentication to regain access later, installed by malware or sometimes left by developers.
• Fileless malware — malware that operates in memory using legitimate system tools (such as PowerShell or WMI on Windows) rather than dropping executable files to disk. Because there is no malicious file for traditional antivirus to scan, fileless attacks are detected through behavior monitoring and script/logging controls. "Living off the land" describes this abuse of built-in tools.

Delivery and detection tie back to earlier sections: most malware arrives through phishing, malicious downloads, or exploited vulnerabilities. Defenses include endpoint protection with behavior analysis, application allowlisting, patching, email filtering, user training, and tested offline backups (the strongest ransomware defense).

How defenders detect malware. Traditional antivirus relies on signatures — known byte patterns or file hashes of previously seen malware. Signatures are fast and accurate for known threats but useless against brand-new or modified malware, which is why attackers constantly repack their code. Modern endpoint tools add heuristic analysis (scoring suspicious characteristics and behavior in code before or as it runs) and behavioral monitoring (watching what a process actually does — encrypting many files quickly, injecting into other processes, persisting through registry run keys). Sandboxes detonate suspicious files in an isolated environment and observe them safely. Fileless malware specifically defeats signature-based tools, because there is no file to hash; that is why behavior monitoring, script-block logging, and restricting macro and scripting functionality are the recommended countermeasures, and why exam questions pair "fileless" with "lives in memory" and "uses PowerShell."

2.6 Application attacks

Application attacks exploit the software people use every day — web applications, APIs, and authentication systems.

Injection attacks insert malicious input into an application so it is executed as code or commands. In SQL injection (SQLi), attacker input placed in a form field or URL is folded into a database query, potentially exposing or modifying the whole database. Cross-site scripting (XSS) injects malicious scripts into web pages viewed by other users, stealing session cookies or redirecting victims. Other flavors include LDAP injection, XML injection, and command injection. The core defense is treating all input as untrusted: parameterized queries (prepared statements), input validation, and output encoding.

Privilege escalation occurs when an attacker gains higher permissions than intended — moving from a normal user account to administrator, or from one user's data to everyone's. It can be vertical (user → admin) or horizontal (user A → user B's account). It is both an attack goal and a step in nearly every serious intrusion.

Directory traversal uses sequences like ../ in a URL or file path to escape the intended directory and read files elsewhere on the server — configuration files, password files, source code.

API attacks target the application programming interfaces that apps and services use to talk to each other. Attackers abuse APIs that lack authentication, rate limiting, or proper authorization checks — for example, changing an account ID in an API request to view another customer's data (broken object-level authorization), or flooding an API to scrape data or exhaust resources.

Replay attacks capture valid data — such as authentication tokens or session cookies — and retransmit it later to impersonate the legitimate user. Defenses include timestamps, nonces (single-use random values), and short token lifetimes.

Pass-the-hash lets an attacker authenticate using a captured password hash instead of the plaintext password. Some authentication protocols accept the hash as proof, so stealing the hash from memory is as good as stealing the password itself.

Credential stuffing takes username/password pairs leaked from one breached site and automatically tries them against other sites, exploiting password reuse. It differs from brute force (trying many passwords for one account) and password spraying (trying a few common passwords across many accounts). MFA and breach-password screening are the primary defenses.

Related application-level attacks include cross-site request forgery (CSRF), which tricks a logged-in user's browser into submitting unwanted requests; server-side request forgery (SSRF), which makes a server fetch attacker-chosen internal URLs; race conditions, which exploit timing between a check and an action; and buffer overflows, which write beyond allocated memory to crash or take over a program.

2.7 Network attacks

Denial of service (DoS) makes a service unavailable to legitimate users by exhausting some resource — bandwidth, connections, CPU, or an application flaw. A distributed denial of service (DDoS) uses many machines at once, usually a botnet of compromised devices, making the attack far larger and harder to block by source. In a DDoS amplification attack, the attacker sends small requests to third-party servers (open DNS or NTP servers) with the victim's IP address spoofed as the source; the servers' much larger responses flood the victim. The ratio between request and response size is the amplification factor.

DNS poisoning corrupts the data in a DNS resolver's cache so that a legitimate domain name resolves to the attacker's IP address. Users asking for their bank are silently sent to a fake site. (The related DNS spoofing is the broader technique; poisoning targets the cache.) Defenses include DNSSEC, which signs DNS records so resolvers can verify them.

ARP poisoning (ARP spoofing) attacks the local network: the attacker sends forged Address Resolution Protocol messages linking the attacker's MAC address to the IP of another host (often the default gateway). Traffic meant for the gateway flows through the attacker, enabling interception. This only works on the local network segment, because ARP does not cross routers.

On-path attacks (formerly "man-in-the-middle") place the attacker between two communicating parties so traffic passes through them — to eavesdrop, steal session cookies, or modify content. ARP poisoning and evil twin access points are common ways to become on-path. Encryption (TLS) with proper certificate validation is the core defense, because even intercepted traffic is unreadable and tampering is detectable.

Bluetooth attacks include bluejacking (sending unsolicited messages to a device) and bluesnarfing (unauthorized theft of data — contacts, messages — over a Bluetooth connection).

Wireless attacks also include jamming (flooding the radio spectrum so legitimate signals cannot get through), evil twins, and disassociation attacks that knock clients off an access point. Radio-frequency attacks cannot be "patched" — they are managed with monitoring, spectrum analysis, and physical security.

Defending against denial of service. DoS attacks come in different shapes, and the defense depends on the shape. Volumetric attacks flood bandwidth — the answer is upstream capacity and scrubbing: traffic is diverted through a provider or cloud service that absorbs and filters the flood before it reaches you. Protocol attacks exhaust connection state on firewalls and load balancers (the classic example is a SYN flood, which a firewall mitigates with SYN cookies and rate limits). Application-layer attacks send small numbers of expensive requests that look legitimate — searching a slow database query a thousand times a minute — and are countered with rate limiting, caching, and web application firewalls. Two practical points the exam rewards: a single organization cannot absorb a large DDoS with on-premises hardware alone (the pipe fills before your firewall ever sees the traffic), and effective defense is arranged before the attack, through a provider, CDN, or always-on mitigation service.

2.8 Cryptographic attacks

Some attacks target the cryptography itself rather than the application:

• Downgrade attack — the attacker forces two parties to abandon a strong protocol or key length for a weaker one that the attacker can break (for example, forcing an old, vulnerable version of TLS), then attacks the weak version. Defended by disabling legacy protocols and enforcing minimum versions.
• Collision attack — an attack on a hash function that finds two different inputs producing the same hash output. Collisions break the trust in digital signatures and certificates that rely on the hash, which is why weak hashes such as MD5 and SHA-1 were abandoned.
• Birthday attack — a method of finding hash collisions faster than brute force, based on the "birthday paradox" from probability: in a group of just 23 people, there is roughly a 50% chance two share a birthday. For hashes, the lesson is that an n-bit hash offers only about n/2 bits of collision resistance — a 128-bit hash can be collided with roughly 2^64 attempts, not 2^128 — which is why modern hashes are 256 bits or longer.

Related concepts include salting (adding random data before hashing passwords so identical passwords produce different hashes and precomputed "rainbow tables" fail) and the danger of reused keys and weak random number generation.

2.9 Vulnerability management

Vulnerability management is the continuous process of finding, prioritizing, and fixing weaknesses before attackers exploit them. Its core loop is: scan → report → prioritize → remediate → rescan.

Vulnerability scanning uses automated tools that probe systems and compare findings against databases of known vulnerabilities. Scans are broad, fast, and safe enough to run regularly. Two important variations:

• Credentialed scans log in to target systems with provided credentials and inspect them from the inside — installed software, patch levels, configuration files. They are more accurate and more complete than non-credentialed scans, which view the system as an attacker would from the network and can miss anything not visible remotely.
• Scans can produce false positives (reporting a vulnerability that is not really there — for example, when a vendor backported a patch without changing the version number) and false negatives (missing a real vulnerability). Analysts validate important findings rather than blindly trusting scanner output.

Penetration testing goes further: a human tester (or team) actively exploits vulnerabilities to prove real-world impact — chaining a minor flaw into domain admin access, for example. Pen tests are deeper but narrower, point-in-time, and governed by rules of engagement. Testing can be performed with different knowledge levels: unknown environment (black box — the tester starts with no information, like an outside attacker), known environment (white box — full documentation and credentials provided), and partially known environment (gray box — some information, often like a low-privilege insider).

CVE and CVSS. A CVE (Common Vulnerabilities and Exposures) entry is a standardized identifier for a publicly known vulnerability — CVE-YEAR-NUMBER — so everyone is talking about the same flaw. The CVSS (Common Vulnerability Scoring System) assigns a severity score from 0.0 to 10.0 based on factors such as attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. Scores group into None (0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), and Critical (9.0–10.0). Organizations combine CVSS with asset criticality and threat intelligence (is this CVE being exploited right now?) to prioritize patching — a critical score on an isolated test box may matter less than a high score on an internet-facing server under active attack.

Threat feeds in vulnerability management connect the two halves of this chapter: feeds of actively exploited vulnerabilities tell you which scanner findings to fix first.

Zero-days and exceptions. A zero-day vulnerability is a flaw with no patch available — the vendor has had "zero days" to fix it since learning of it (or attackers found it first). Zero-days cannot be handled by patching, so they are managed with compensating controls: segmentation, virtual patching at a WAF or IPS, disabling the affected feature, and heightened monitoring. At the other end of the process, some findings cannot be fixed immediately — a legacy application may break under a patch, or a system may be scheduled for retirement. Formal programs handle this with a documented risk acceptance/exception: the finding, the business justification, the compensating controls, an owner, and an expiry date are recorded. An exception without an expiry date is just an ignored vulnerability, and auditors treat it that way.

Responsible disclosure is the ethical process for reporting vulnerabilities: a researcher notifies the vendor privately, gives them reasonable time to produce a fix, and only then (if at all) publishes details. Coordinated disclosure programs and bug bounty programs formalize this, paying researchers for valid reports. The opposite — dropping a zero-day publicly with no warning — endangers users before any patch exists.

2.10 Mitigation techniques

Finding weaknesses is only half the work. These mitigation techniques reduce the attack surface and limit damage throughout this domain:

• Patching — applying vendor fixes for known vulnerabilities, on a prioritized schedule (internet-facing and actively exploited first), with testing so patches do not break production. Patch management is the single highest-value mitigation for known flaws.
• Network segmentation — dividing the network into zones (by function, sensitivity, or trust) with controlled communication between them, using firewalls, VLANs, and access lists. Segmentation contains breaches: an attacker in the guest Wi-Fi zone should have no path to the database zone. Microsegmentation applies the same idea at the workload level.
• Access control — ensuring only authorized identities can reach resources, through authentication, authorization models (such as role-based access control), and network access control (NAC) that checks device health before admission.
• Hardening — configuring systems securely: changing default credentials, applying security baselines and benchmarks, enabling only necessary features, and keeping configurations consistent across fleets.
• Disabling ports and services — every listening service is attack surface. If a server does not need a service, the service should be off; if a port is not required, it should be closed. This is attack-surface reduction in its purest form.
• Least privilege — every user, service, and process gets the minimum permissions needed to do its job, for the minimum time needed. Least privilege limits both insider misuse and the damage when an account is compromised. Related practices include removing standing admin rights and using just-in-time elevation.
• Other common mitigations include endpoint protection (EDR/XDR), application allowlisting, web filtering, encryption in transit and at rest, multi-factor authentication, network and host firewalls/WAFs, regular backups, and user security awareness training — each mapped to the attacks it blunts in the rest of this book.

Key terms

Exercises

Exercise 1: Dissect a phishing email

Goal: Learn to inspect message headers and content the way a SOC analyst does.

You will need: an email client or webmail that can show full message headers ("Show original" in Gmail, "View message source" or Message Properties in Outlook), and a sample suspicious message from your spam folder (do NOT open attachments or click links).

1. Open the suspicious message and display its full headers.
2. Find the Return-Path and the Reply-To fields. Write down their domains. Do they match the domain in the From field? A mismatch is a classic impersonation sign.
3. Locate the Received lines and read them bottom-to-top (each mail server adds one at the top). Identify the first server that handled the message.
4. Find the Authentication-Results line and record whether SPF, DKIM, and DMARC show pass, fail, or none.
5. Hover over (do not click) every link in the body. Write down the real destination domain of each link and compare it with the text displayed to the reader.
6. List three additional red flags in the message body (urgency, threats, generic greeting, unusual request, attachment type).
7. Write a four-sentence verdict: is this message legitimate or phishing, and which single header field gave you the strongest evidence?

Exercise 2: Map an incident to MITRE ATT&CK-style tactics

Goal: Practice describing an attack in the tactic language defenders use.

Scenario: An employee receives an email about a "shared invoice," opens the attachment, and a macro runs PowerShell. Over the next week the attacker uses the employee's credentials to log in to the file server at night, creates a new local admin account, compresses folders of documents, and uploads them to a consumer cloud storage site.

1. Break the scenario into individual steps and list them in order.
2. For each step, assign the most fitting tactic from this list: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Collection, Exfiltration. (One step may fit best under one tactic — choose the strongest match.)
3. For each step, write one detection idea: what log, alert, or tool could have revealed it?
4. For each step, write one mitigation that could have broken the chain (for example, disabling macros from the internet for Initial Access/Execution).
5. Identify the earliest step where a single control could have stopped the entire incident, and justify your choice in two or three sentences.

Exercise 3: Rank vulnerabilities like a vulnerability manager

Goal: Practice prioritizing scanner output with CVSS plus business context.

Setup: Your weekly scan of a small company returns these findings:

• Finding A: CVE with CVSS 9.8 on the public web server's framework — threat feeds report active exploitation in the wild
• Finding B: CVE with CVSS 10.0 on a lab workstation that is powered off and disconnected from the network for a rebuild
• Finding C: CVE with CVSS 7.5 on the VPN gateway; no known exploit yet
• Finding D: CVE with CVSS 5.3 (missing security header) on the public web server
• Finding E: A "critical" finding on the mail server that your admin believes is a false positive because the vendor backported the patch

Steps:

1. Rank the five findings in the order you would remediate them.
2. For each finding, write one sentence justifying its position, explicitly citing the factor that mattered most (exposure, exploitation status, asset state, or confidence).
3. For Finding E, describe the two checks you would perform to confirm or refute the false positive (hint: one uses a credentialed scan, one uses the vendor's own documentation).
4. In two sentences, explain to a manager why Finding B is NOT first despite having the highest CVSS score.

Exercise 4: Harden a workstation (attack-surface reduction)

Goal: Apply this chapter's mitigation techniques to a real or virtual machine you own.

You will need: a computer or VM you are allowed to modify. Do not perform this exercise on a work or school machine without permission.

1. List the programs that start automatically at boot (Task Manager → Startup on Windows, or systemctl list-unit-files --state=enabled on Linux). Disable two that you do not need, and note what they were.
2. List listening network services (netstat -ano / ss -tlnp). Identify every listening port and decide: needed or not needed? Write down any you cannot explain.
3. Check for operating system and application updates. Install pending security updates and record the before/after patch state.
4. Verify that the host firewall is on, that a standard (non-admin) account is used for daily work, and that unused default accounts are disabled.
5. Write a one-page hardening summary: what you found, what you changed, what you deliberately left alone and why, and which chapter concept (patching, segmentation, access control, hardening, disabling services, least privilege) each change illustrates.

PBQ practice

Scenario: The invoice that wasn't

You are the security analyst on duty. A user, Dana in Accounting, reports: "I got an email about an unpaid invoice from our supplier. I clicked the link and signed in like it asked, but it just showed an error. Now I'm worried."

Your SIEM shows the following log excerpts from the last hour for Dana's workstation (WS-ACCT-014):

09:02  OUTLOOK.EXE opened attachment: Invoice_8841.docm
09:02  WINWORD.EXE spawned: powershell.exe -enc SQBFAFgA...
09:03  powershell.exe -> HTTPS connection to 185.220.xx.xx:443
09:04  lsass.exe memory accessed by unsigned process
09:11  NTLM authentication from WS-ACCT-014 to FILESRV-02 using Dana's credentials (from an unusual process)
09:26  Large outbound HTTPS upload (340 MB) from WS-ACCT-014 to storage.share-drive-example.com

The email headers (abbreviated) show:

From: "Supplier Billing" <billing@suppller-payments.com>
Reply-To: billing@supplier-payments-helpdesk.ru
Return-Path: <bounce@mail.suppller-payments.com>
Authentication-Results: spf=fail dkim=none dmarc=fail
Subject: URGENT: Invoice 8841 overdue - payment suspended

Your tasks (print this page and answer in writing, as you would on paper in the exam):

1. Classify the email: legitimate or malicious? List FOUR separate pieces of evidence from the headers and subject line.
2. Name the type of attack used to deliver the payload, and the type of malware behavior shown by WINWORD spawning an encoded PowerShell that runs in memory.
3. Order these events into an attack chain: data exfiltration, credential theft, initial access, lateral movement, execution. Match each phase to the log line(s) that prove it.
4. The 09:11 log line shows authentication using Dana's credentials from an unusual process, right after LSASS memory was accessed. Name this technique.
5. List your FIRST three containment/remediation actions, in priority order.

Model answer

1. Malicious (phishing). Evidence (any four): the From domain suppller-payments.com is a typosquat of the supplier's real domain (note the triple "l"); the Reply-To points to an unrelated domain in a different country; the Return-Path domain differs from the From domain; SPF and DMARC both fail and DKIM is absent, meaning the message is not authorized by the domain it claims to be from; the subject uses urgency and a threat ("payment suspended") to pressure the user.
2. Delivery: a phishing email with a malicious macro-enabled attachment. Behavior: fileless malware — PowerShell launched by Word, running an encoded command and operating in memory rather than as a dropped executable file.
3. Attack chain: Initial access — 09:02, the user opens the attachment from the phishing email. Execution — 09:02–09:03, the macro runs encoded PowerShell, which connects out to the attacker's server. Credential theft (credential access) — 09:04, LSASS memory is accessed to steal credentials. Lateral movement — 09:11, Dana's credentials are used to authenticate to FILESRV-02. Exfiltration — 09:26, 340 MB is uploaded to an external consumer storage site.
4. Pass-the-hash — the attacker extracted credential material (hashes) from LSASS memory and used the hash to authenticate without knowing Dana's plaintext password.
5. First three actions, in order: (1) Isolate WS-ACCT-014 from the network (disable its switch port / NAC quarantine) to stop the ongoing exfiltration while preserving the machine for forensics. (2) Disable Dana's account and force a password reset, and revoke active sessions/tokens — her credentials are compromised and being used for lateral movement; also check FILESRV-02 for further spread. (3) Escalate/declare an incident and preserve evidence (memory and disk images, mail gateway logs, the original email) before wiping or reimaging, and begin threat hunting for the same indicators (the attacker IP, the upload destination) across the environment.

End-of-chapter test

1. A threat actor is discovered inside a defense contractor's network. Investigators determine the group has government-level funding, developed its own custom malware, and has quietly collected weapons research for eight months. Which threat actor type is this?

• A. Hacktivist
• B. Organized crime
• C. Nation-state
• D. Insider threat

2. A finance employee receives a text message claiming to be from the company's bank, asking her to "verify" her login at a linked page because of suspicious activity. Which attack is this?

• A. Vishing
• B. Smishing
• C. Pretexting
• D. Whaling

3. Which of the following BEST describes a worm, compared with a virus?

• A. A worm disguises itself as legitimate software; a virus does not
• B. A worm records keystrokes; a virus encrypts files for ransom
• C. A worm spreads by itself across networks; a virus needs a host file and user action
• D. A worm only runs in memory; a virus only runs from disk

4. An attacker registers the domain "arnazon-support.com" and builds a page imitating a well-known online retailer to harvest customer passwords. Which two techniques are being used?

• A. Typosquatting and brand impersonation
• B. DNS poisoning and ARP poisoning
• C. Credential stuffing and replay
• D. Pretexting and watering hole

5. A web application's login form is tested by entering ' OR '1'='1 into the username field, causing the application to return records for every user. Which attack does this demonstrate?

• A. Cross-site scripting
• B. Directory traversal
• C. Privilege escalation
• D. SQL injection

6. In a DDoS amplification attack, what role does the victim's IP address play?

• A. It is used to encrypt the attack traffic so filters cannot read it
• B. It is spoofed as the source of small requests so that large responses are sent to the victim
• C. It is registered as a lookalike domain to redirect users
• D. It is used to authenticate the attacker to the reflector servers

7. A user reports that when she types her bank's web address, she reaches a convincing fake site, but only when connected to the office network. Other websites resolve normally, and her home connection reaches the real bank. Which attack is MOST likely?

• A. ARP poisoning
• B. DNS poisoning
• C. A downgrade attack
• D. A birthday attack

8. A vulnerability scan reports a medium finding. A penetration test the following month shows that the same weakness lets a tester chain two minor flaws together and obtain domain administrator access. What is the MOST important difference between the two activities?

• A. Scanning requires credentials; penetration testing never does
• B. Scanning is performed by humans; penetration testing is fully automated
• C. Scanning identifies weaknesses; penetration testing exploits them to prove real-world impact
• D. Scanning is only for compliance; penetration testing is only for insurance

9. Two different documents are found that produce the identical MD5 hash value. The documents are being used to defeat a system that verifies file integrity by comparing hashes. Which attack concept does this demonstrate?

• A. A collision
• B. A downgrade
• C. Salting
• D. A replay

10. A server audit finds an old file-and-print service still running on a production database server, even though no application uses it. A known critical vulnerability affects that service. What is the BEST mitigation?

• A. Move the database server to a different VLAN but leave the service running
• B. Disable or remove the unused service on the server
• C. Add the service's port to the firewall's allow list so monitoring tools can reach it
• D. Give the service its own administrator account with a strong password

Answer key

1. C — Nation-state. Government funding, custom malware, and a long, quiet espionage campaign against a specific strategic target are the defining attributes of a nation-state (APT) actor. Organized crime seeks profit, hacktivists seek publicity for a cause, and nothing indicates the actor held legitimate internal access.

2. B — Smishing. Phishing delivered by SMS text message is smishing. Vishing is the voice-call equivalent; pretexting is the fabricated story that may accompany either; whaling targets senior executives.

3. C — A worm spreads by itself across networks; a virus needs a host file and user action. Worms self-propagate by exploiting vulnerabilities with no user interaction, while viruses attach to host files and spread when a user runs them. Disguise as legitimate software defines a trojan, not a worm.

4. A — Typosquatting and brand impersonation. The lookalike domain name is typosquatting, and the imitation retailer page is brand impersonation. No DNS cache or local network traffic is being poisoned, and no captured credentials are being replayed or stuffed.

5. D — SQL injection. The input is folded into a database query, changing its logic so it returns every record. XSS would execute a script in another user's browser, and directory traversal would use path sequences to reach files outside a directory.

6. B — It is spoofed as the source of small requests so that large responses are sent to the victim. Reflector servers (such as open DNS resolvers) reply to the forged source address — the victim — so the victim receives a flood of oversized responses it never requested.

7. B — DNS poisoning. The office resolver's cache has been corrupted so the bank's name resolves to the attacker's address, which explains why only office users are affected. ARP poisoning operates on a local segment to intercept traffic, not to change name resolution results across the network.

8. C — Scanning identifies weaknesses; penetration testing exploits them to prove real-world impact. Scanners enumerate known vulnerabilities without exploiting them; testers safely exploit and chain findings to demonstrate what an attacker could actually achieve, which is why the pen test revealed the domain-admin path.

9. A — A collision. A collision is two different inputs producing the same hash output, which is exactly what breaks hash-based integrity verification. A downgrade forces weaker protocol settings, and a replay retransmits captured data.

10. B — Disable or remove the unused service on the server. Removing an unneeded vulnerable service eliminates that attack surface entirely, which is stronger than isolating or monitoring it. Segmentation (option A) can reduce exposure but leaves an exploitable, unnecessary service running on a critical asset.

End of Chapter 2. In Chapter 3, we build on this threat picture to design security architectures — zero trust, cloud security, and secure protocols — that assume these attacks will come.