Testout Security Pro Chapter 2 - Threats, Attacks, and Vulnerabilities

A type of threat in which threat actors actively pursue and compromise a target entity's infrastructure while maintaining anonymity

An attack in which the threat actor is almost always trying to make money as fast as possible and with minimal effort

A threat agent who has authorized access to an organization and either intentionally or unintentionally carries out an attack

A threat agent who carries out attacks on behalf of an organization and targets competing companies

Any threat agent who uses technical knowledge to bypass security, exploit a vulnerability, and gain access to protected information

A subcategory of hacker threat agents. They are willing to take more risks and use more extreme tactics for financial gain

A sovereign state threat agent that may wage an all-out war on a target and have significant resources for the attack

A threat from authorized individuals (insiders) who exploit assigned privileges and inside information to carry out an attack

A threat from individuals or groups not associated with the organization, who seek to gain unauthorized access to data

A threat that seeks to gain access to a network and remain there undetected

A threat that focuses on getting into a system and stealing information. It is usually a one-time event, so the attacker is not concerned with detection

Information that is readily available to the public and doesn't require any type of malicious activity to obtain

A skilled hacker who uses skills and knowledge for defensive purposes only. This hacker interacts only with systems for which express access permission is given

A skilled hacker who uses skills and knowledge for illegal or malicious purposes

A skilled hacker who falls in the middle of white hat and black hat hackers. They may cross the line of what is ethical, but usually has good intentions and isn't malicious like a black hat hacker

Software designed to take over or damage a computer without the user's knowledge or approval

A program that attempts to damage a computer system and replicate itself to other computer systems

A self-replicating malware program

A malicious program that is disguised as legitimate or desirable software

A computer that is infected with malware and is controlled by a command and control center called a zombie master

A group of zombie computers that are commanded from a central control infrastructure

A set of programs that allows attackers to maintain hidden, administrator-level access to a computer

Malware designed to execute only under predefined conditions. It is dormant until the predefined condition is met

Software installed without the user's consent or knowledge and is designed to intercept or take partial control of the user's computer

Malware that monitors a user's personal preferences and sends pop-up ads that match those preferences

Malware that denies access to a computer system until the user pays a ransom

A scam to fool a user into thinking there is some form of malware on the system

Malware designed to perpetrate identity theft. It allows a hacker access to online accounts at financial services, such as banks and online retailers

Ransomware that encrypts files until a ransom is paid

Malware that includes a back door to allow a hacker administrative control over the target computer

A person who commits crimes through gaining unauthorized access to computer systems

A person actively engaged in developing and distributing worms, Trojans, and viruses; engaging in probing and reconnaissance activities; creating toolkits so that others can hack known vulnerabilities; and/or cracking protective measures

A less-skilled hacker who often relies on automated tools or scripts written by crackers to scan systems and exploit weaknesses

…is a software inadvertently installed that contains adware, installs toolbars, or has other objectives

…uses legitimate programs to infect a computer

An attack involving human interaction to obtain information or access

Uses social engineering to obtain as much information as possible about an organization

A fictitious scenario to persuade someone to perform an action or give information

A technique to extract information from a target without arousing suspicion

Influencing a target thoughts, opinions, and emotions before something happens

Doing phishing through an SMS message. Tricking a user to download a virus, Trojan horse, or malware onto a cell phone

Pretending to be somebody else and approaching a target to extract information

…is similar to spam, but the malicious link is sent to the target over instant messaging instead of email

A type of malicious email with some type of urgent or alarming message to deceive the target

A hacker with a political motive

…means the target is not educated in social engineering tactics and prevention, so the target doesn't recognize social engineering when it is happening

Looking over someone's shoulder while that person works on a computer or reviews documents

An unauthorized person listening to private conversations between employees or other authorized personnel when sensitive topics are being discussed

A device used to steal data through by capturing what the user types

Make a wrong statement and then admit to not knowing much about the subject in hopes the target will reveal the needed information

Gathers information about the victim, such as the online bank

…is another form of phishing. It targets senior executives and high-profile victims

…is like phishing, but instead of an email, the attacker uses Voice over IP (VoIP) to gain sensitive information. The term is a combination of voice and phishing

Executing malicious programs on the target's computer so that any URL traffic redirects to the attacker's malicious website

Many attackers are turning to applications such as Facebook, Twitter, Instagram, to steal identities and information. Also, many attackers use social media to scam users. These scams are designed to entice the user to click a link that brings up a malicious site the attacker controls. Usually, the site requests personal information and sensitive data, such as an email address or credit card number

…is a software vulnerability that is unknown to the vendor

The loss of files and documents either accidentally or through malicious acts

The exposure of confidential or protected data, either accidentally or through malicious acts

The unauthorized transfer of information or files from a computer

A crime in which an attacker commits fraud by using someone else's name or existing accounts to obtain money or to purchase items

Loss of access to computer resources due to the network being overwhelmed or crashing