Threats to Security

This chapter covers the following topics:

• Threats to security: Describe network threats and attacks and their impact on security.

• Common threat categories: Describe different types of threats that can impact organizations.

• Security best practices and risk management: Understand the identification and prevention of threats and the management of risks.

Understanding the various types of threats to security will aid you in understanding the need for security controls and help you implement more effective protection measures and mitigation techniques as you enter the cybersecurity field and land your first role. In this chapter, we will look at the various types of threats to security and why it’s essential to understand them, common threat types and mitigations, advanced techniques used by threat actors, and ways to discover and mitigate vulnerabilities.

This chapter covers the following Certified in Cybersecurity exam objectives:

• 4.2 Understand network threats and attacks

  • 4.2a Types of threats (e.g., distributed denial-of-service (DDoS), virus, worm, Trojan, on-path attack, side-channel)

  • 4.2b Identification (e.g., intrusion detection system (IDS), host-based intrusion detection system (HIDS), network intrusion detection system (NIDS))

  • 4.2c Prevention (e.g., antivirus, scans, firewalls, intrusion prevention system (IPS))

“Do I Know This Already?” Quiz

The “Do I Know This Already?” quiz allows you to decide whether you need to read this entire chapter or skip to the “Exam Preparation Tasks” section. If you doubt your selection of answers to these questions or your own assessment of your knowledge of these topics, you may want to read the entire chapter. Table 3-1 lists the major headings in this chapter and their corresponding “Do I Know This Already?” Quiz questions. You can find the answers in Appendix A, “Answers to the ‘Do I Know This Already?’ Quizzes and Q&A Sections.” Good luck!

Table 3-1 “Do I Know This Already?” Section-to-Question Mapping

1. What is a threat in cybersecurity?

1. A strategy to prevent data theft

2. An event that leads to data destruction only

3. Any circumstance or event with the potential to impact operations, assets, or individuals through unauthorized access, destruction, disclosure, or modification of information

4. A way to reduce the time that it takes to investigate security issues

2. How can cybersecurity professionals prepare to defend against threats?

1. By ignoring the latest news in the cybersecurity world

2. By sharing information with peer organizations

3. By ensuring all systems and devices have no vulnerabilities

4. By allowing unauthorized access to information and systems

3. What is the purpose of threat intelligence?

1. To encourage data theft and destruction

2. To help cybersecurity professionals and executives make decisions about potential threats

3. To slow down the investigation of security issues

4. To keep emerging technology concerns around IoT, AI, and some aspects of the cloud a secret

4. What is ransomware?

1. Code that runs on computer systems without the user’s knowledge

2. Malicious software designed to disrupt, damage, or gain unauthorized access to a computer system

3. Standalone, self-replicating malware that causes damage to systems

4. Malicious software that encrypts your data to block access in exchange for a ransom payment

5. What is the main difference between viruses and worms?

1. Viruses can self-replicate, while worms need a human to execute them on a system.

2. Viruses spread through the Internet, while worms spread through LANs.

3. Viruses are malware that slows down systems, while worms cause extensive damage to systems.

4. Viruses need human interaction to be successful, while worms can self-replicate and spread without human interaction.

6. What is the main difference between a DDoS attack and a regular DoS attack?

1. A DDoS attack floods a system with traffic to multiple compromised devices, while a regular DoS attack floods one system with traffic to exhaust resources.

2. A DDoS attack targets routers, switches, and servers, while a regular DoS attack targets individual devices.

3. A DDoS attack alters data between communicating parties, while a regular DoS attack intercepts data between communicating parties.

4. A DDoS attack requires physical access to a system, while a DoS attack is executed remotely.

7. Where are man-in-the-middle (MITM) attacks typically executed?

1. Secure and encrypted networks

2. Government organizations and military networks

3. In places with insecure Wi-Fi, such as coffee shops or hotels

4. Internal networks within an organization

8. How do side-channel attacks exploit system vulnerabilities?

1. By intercepting and altering data between communicating parties

2. By flooding a system with traffic through coordinated efforts

3. By analyzing unintended information leaked by a system’s physical implementation

4. By gaining physical access to a system’s hardware components

9. What are the two categories of firewalls?

1. Stateful and stateless

2. Network-based and host-based

3. Proxy and packet filtering

4. Next-generation and web application

10. What is the main difference between packet filtering firewalls and web application firewalls?

1. Packet filtering firewalls inspect data packets based on payload content, while web application firewalls monitor IP information.

2. Packet filtering firewalls authenticate clients and forward requests to servers, while web application firewalls authenticate servers and forward requests to clients.

3. Packet filtering firewalls analyze surface-level data such as IP addresses and ports, while web application firewalls inspect HTTP traffic and protect against web-based attacks.

4. Packet filtering firewalls utilize machine learning and behavior analytics, while web application firewalls conduct deep packet inspection.

11. What is the purpose of vulnerability scanning in cybersecurity?

1. To exploit vulnerabilities found in an organization’s environment

2. To analyze behaviors on specific endpoints and respond to issues

3. To determine what vulnerabilities an organization has, to prioritize remediation efforts, and to track progress

4. To apply patches to software to fix vulnerabilities

12. What is the difference between vulnerability scanning and pentesting?

1. Vulnerability scanning is used to exploit vulnerabilities, while pentesting analyzes behaviors on specific endpoints.

2. Vulnerability scanning doesn’t exploit the vulnerabilities, while pentesting aims to find and exploit vulnerabilities.

3. Vulnerability scanning allows teams to test incident response and detection processes, while pentesting prioritizes remediation efforts.

4. Vulnerability scanning gives a continuous look at what is going on in an organization, while pentesting is conducted with open-source tools.

13. What is the purpose of regularly updating and patching systems in cybersecurity?

1. To analyze behaviors on specific endpoints and respond to issues

2. To detect and protect against threats using predictive analytics

3. To gain unauthorized access to systems and data

4. To apply security fixes for vulnerabilities found in the software