Chapter 6 - Comparing Threats, Vulnerabilities, and Common Attacks

Request for Comments (RFC)

A document published by the IETF that details information about standardized Internet protocols and those in various development stages.

Spear Phishing

A phishing attack that targets a specific group of users or even a single user

Fileless virus

A virus that operates in main memory instead of from a file on a disk. Often are scripts injected into legitimate processes

Zero-Day exploit

A vulnerability that is exploited before the software creator/vendor is even aware of its existence and therefore no patch is available. Can evade up-to-date antivirus software

Insider Threat

Anyone who has legitimate access to an organization's internal resources. Issues include loss of confidentiality and availability.

Rootkit

Malicious code that is designed to hide the existence of processes or programs from normal detection methods and to gain continuous privileged access to a computer system.

Vishing

Phishing attacks committed using telephone calls or VoIP systems.

Smishing

Phishing attacks committed using text messages (SMS).

Attack vector

The path or means by which an attacker gains access to computers or networks. Examples: Email Social Media

Whaling

a form of spear phishing that attempts to target high-level executives.

Advanced Persistent Threat (APT)

a sophisticated, possibly long-running computer hack that is perpetrated by large, well-funded organizations such as governments

Watering hole attack

an attack which attempts to discover which websites a group of people are likely to visit and then infects those websites with malware that can infect the visitors.

Hacktivist

an attacker who launches attacks as part of an activist movement or to further a cause

Trusted Automated eXchange of Indicator Information (TAXII)

an open standard that defines a set of services and message exchanges used to share information

Structured Threat Information eXpression (STIX)

an open standard that identifies what cyber threat information organizations should share. Provides a common language for addressing a wide range of cyber threat information. Data is shared via TAXII

Shadow IT

any unauthorized systems or applications within an organization installed by users

Typo Squatting

attack where someone buys a domain name that is close to a legitimate domain name and uses it for malicious purposes (malware, ads, profit)

Social Engineering

attack which uses social tactics to trick users into giving up information or providing actions they normally wouldn't take. Can occur in person, over the phone, via the Internet, or email

Script Kiddie

attacker with very little expertise, sophistication, and funding who uses already existing computer scripts or code to launch attacks

Indicators of Compromise (IoC)

evidence that a cyberattack is happening or has happened. Examples: Increased network traffic Strange destinations Alerts Pop-ups

File Integrity Monitoring (FIM)

feature of antivirus software that calculates hashes on system files to create a baseline, then recalculates hashes and compares them with the baseline. If the hashes are different, it indicates system files have been modified and an alert is sent.

Trojan

malicious code that appears to be something useful but includes a malicious component (backdoor, adware, keylogger, etc.). Often delivered via drive-by downloads

Virus

malicious code that attaches itself to an application and runs when the application is started

Worm

malicious code that can self replicate and does not require user interaction to run

Keyloggers

malicious code that captures a user's keystrokes and stores them in a file.

Cryptomalware

malicious code that encrypts the user's data and then demands payment with the promise of decrypting the data

Logic Bomb

malicious code that executes in response to an event, such as when a specific application is executed or a specific time arrives

Spyware

malicious code that monitors the user's computer and activity

Ransomware

malicious code that takes control of a user's system or data and demands a payment before releasing ownership back to the user

Cuckoo Sandbox

open-source automated software analysis system used to analyze suspicious files/malware

potentially unwanted program (PUP)

programs that a user may not want even if they consented to download it. Often bundled into legitimate downloads

Tailgating

social engineering tactic that occurs when one user follows closely behind another user and gains access to a building without providing credentials. Prevented with mantraps.

Backdoor

software code that provides another way to access a system. Attackers use these to access systems from remote locations

Malware

software that is intended to damage or disable computers and computer systems.

Phishing

the practice of sending email to users with the purpose of tricking them into revealing personal information, installing malware, or clicking on a link.

Reconnaissance

the process of gathering as much information as possible on a specific target