Threats and attacks

A catalogue of moves, not a list of villains

This part of the field studies how intrusions really unfold so that defenders can spot them early. The subject is broad but patterned. An attacker needs a way in, a way to stay, a way to reach what they want and a way to profit, and most techniques serve one of those needs. Learning the patterns matters more than memorising malware family names, which change constantly while the underlying behaviour barely moves. The NICE Workforce Framework turns this knowledge into jobs: threat analysis and insider threat analysis are named work roles in its Protection and Defense category.

• Getting in. Phishing by email, text or voice, stolen or guessed passwords, default credentials, open service ports, unsupported software and compromised suppliers.
• Persuading people. Social engineering that impersonates a manager, a supplier or IT support, including business email compromise, and leans on urgency to cut thinking short.
• Staying and spreading. Malware that survives a reboot, accounts created quietly, and movement from the first machine towards the servers that hold credentials.
• Taking or holding hostage. Data copied out, and ransomware that encrypts systems and demands payment, sometimes paired with a threat to publish what was taken.
• Attacking the application. Injection, cross-site scripting and similar flaws, covered from the builder's side in application security.

How the exams frame it, and the beginner's trap

CompTIA weights Threats, Vulnerabilities and Mitigations at 22 per cent of the SY0-701 blueprint, second only to Security Operations, so nobody passes Security+ without this material. The domain moves in a sensible order: who attacks and why, the vectors and attack surfaces they use, the classes of weakness, the indicators that give an attack away, and the mitigations that answer it. Those indicators are worth learning early, because they are what defenders actually see: an account locked out without explanation, two sessions from places no traveller could reach in the time, logs that stop without a reason. CySA+ moves the subject into analysis, asking what a piece of threat intelligence means for a particular organisation. The CEH examines the same techniques from the attacker's side, which suits people heading for penetration testing. Threat modelling is the design-time use of all this knowledge: asking which of these moves a new system invites before it is built.

The trap for newcomers is fascination with sophistication. Nation-state tooling fills the headlines, yet the ordinary moves in the list above are the ones a typical team meets week after week, and they are where early recognition pays off. A defender who knows the plain techniques thoroughly, and knows how each one shows up in their own logs, stops more than one who can describe exotic malware in detail. From here, incident response covers what to do once a move is spotted, vulnerability management closes the openings attackers look for, and security awareness speaks to the people those lures are aimed at.