Threat vectors and attack surfaces

A threat vector is the path an attacker uses to get in; the attack surface is the sum of all those paths. This objective walks through message-based attacks, files and images, voice, removable media, vulnerable software, unsupported systems, open services, default credentials, the supply chain, and human manipulation.

Message, file, and voice vectors

Email remains the most common vector: phishing links, malicious attachments, and business email compromise. SMS (smishing) and instant messaging carry the same tricks to phones. Malicious files hide code in documents (macros), PDFs, or archives; images can carry exploits for vulnerable parsers or hide data. Voice calls (vishing) impersonate banks or the help desk.

Software, systems, and network vectors

Vulnerable software can be client-based (an agent installed on endpoints) or agentless (accessed through a browser); both need patching. Unsupported systems and applications no longer receive security fixes, so every new flaw stays open forever. Unsecure networks include open wireless, wired ports in public areas, and Bluetooth left discoverable. Open service ports expand the surface, and default credentials on routers, cameras, and IoT devices are among the first things attackers try.

Removable devices such as USB drives can carry malware past network controls, and dropped USB sticks in a parking lot remain an effective test of user awareness.

Supply chain

Attackers increasingly go through a trusted third party. Managed service providers (MSPs) hold privileged access to many customers at once. Vendors and suppliers may ship compromised hardware or software updates. A single compromised update channel can reach thousands of organizations that all trust the same vendor.

Key terms

Phishing

A fraudulent message that tricks recipients into clicking a link, opening a file, or entering credentials.

Spear phishing

A phishing message tailored to a specific person or small group using details about them.

Whaling

A targeted phishing attack aimed at senior executives.

Vishing

Phishing carried out over voice calls, often impersonating a bank or help desk.

Smishing

Phishing delivered by SMS text message.

Business email compromise (BEC)

Using a compromised or spoofed executive or vendor mailbox to trick staff into sending payments or data.

Pretexting

Creating a believable invented scenario to justify a request for information or access.

Watering hole attack

Compromising a website that a target group often visits so their devices get infected.

Typosquatting

Registering a domain that is a common misspelling of a real one to catch users who mistype it.

Removable media vector

Using USB drives or other portable storage to bring malware past network controls.

Default credentials

Factory-set usernames and passwords that attackers try first on devices and software.

Unsupported systems

Hardware or software past end of life that no longer receives security patches.

Managed service provider (MSP) risk

The danger that an attacker compromises a provider with privileged access to many customer networks.

Open service ports

Network ports with listening services that expand the attack surface if unneeded or unprotected.