• comp (a)   refers to rival companies who pose a threat because they might benefit from leaked information.

st (a)   actors are government intelligence agencies.

criminal syn (a)   refer to organized groups of people who make money from criminal activity.

ins (a)   threats can be any individual who has or had authorized access to an organization’s resources. This includes employees who accidentally compromise assets or individuals who purposefully put them at risk for their own benefit.

sha (a)   IT refers to individuals who use technologies that lack IT governance. A common example is when an employee uses their personal email to send work-related communications.

Because the formal definition of a hacker is broad, the term can be a bit ambiguous. In security, it applies to three types of individuals based on their intent:

unau___________ hackers

Authorized, or eth___________, hackers

Sem_________-authorized hackers

(a)  

An adv________ pers_________ thre__________ (APT) refers to instances when a threat actor maintains unauthorized access to a system for an extended period of time. The term is mostly associated with nation states and state-sponsored actors. Typically, an APT is concerned with surveilling a target to gather information. They then use the intel to manipulate government, defense, financial, and telecom services.

(a)  

For the most part, threat actors gain access through one of these attack vector categories:

dire_______ access, referring to instances when they have physical access to a system

Remo_______ media, which includes portable hardware, like USB flash drives

Social media pla_______ that are used for communication and content sharing

Em_______, including both personal and business accounts

Wire_______ networks on premises

Clo_______ services usually provided by third-party organizations

Sup_______ chains like third-party vendors that can present a backdoor into systems

(a)  

Attack vec__________ refer to the pathways attackers use to penetrate security defenses. Like the doors and windows of a home, these pathways are the exploitable features of an attack surface. One example of an attack vec__________ would be social media. Another would be removable media, like a USB drive.

(a)  

Remember, an attack ? includes all the potential vulnerabilities that a threat actor could exploit. An attack ? is the pathway that an attacker uses to penetrate security defenses of an attack surface.

(a)  

• Cred___________ stuf___________ is a tactic in which attackers use stolen login credentials from previous data breaches to access user accounts at another organization. A specialized type of credential stuffing is called pass the hash. These attacks reuse stolen, unsalted hashed credentials to trick an authentication system into creating a new authenticated user session on the network.

Instead of dedicating the time to do this, attackers often use sof (a)   to do the guess work for them. These are some common brute forcing tools:

Aircrack-ng

Hashcat

John the Ripper

Ophcrack

THC Hydra

Organizations defend against brute force attacks with a combination of technical and managerial controls. Each make cracking defense systems through brute force less likely:

Has_______ and sal______

Multi-factor authentication (MFA)

CAP_________

Password policies

(a)  

ha_________ converts information into a unique value that can then be used to determine its integrity. sa_________ is an additional safeguard that’s used to strengthen hash functions. It works by adding random characters to data, like passwords. This increases the length and complexity of hash values, making them harder to brute force and less susceptible to dictionary attacks.

(a)