CompTIA Security+: Threats, Vulnerabilities, and Mitigations Concepts

Overview

This chapter is about who attacks, how they get in, what weaknesses they use, and how to reduce the risk. Questions often describe an attack in one or two sentences and ask you to name it, so focus on the clue words that separate similar attacks.

Threat actors differ by resources and motive. Organized crime mainly wants money, hacktivists want to promote a cause, and nation-states have large resources and run long, quiet spying campaigns. Shadow IT is technology employees use without approval. Social engineering tricks people: phishing uses email, vishing uses voice calls, smishing uses text messages, whaling targets executives, and tailgating means following someone through a secure door. Typosquatting uses look-alike domain names, and a supply chain attack compromises a vendor to reach its customers.

Malware types are told apart by behavior. Ransomware encrypts files for payment, a worm spreads by itself, a Trojan hides inside software that looks useful, a logic bomb waits for a trigger, and a rootkit hides deep in the system. Application attacks include SQL injection, cross-site scripting, directory traversal, buffer overflows, and race conditions. Network attacks include DDoS floods, on-path interception, evil twin access points, replay of captured data, and downgrade to weaker protocols. Password spraying tries one common password on many accounts.

A zero-day is a flaw with no patch yet. Common mitigations are patching, segmentation, and hardening (removing what is not needed and changing defaults). Indicators of compromise include privilege escalation and impossible travel, where one account logs in from places too far apart for the time between logins.