Threats to Security
This chapter is from the book
This chapter is from the book
This chapter is from the book
This chapter covers the following topics:
Threats to security: Describe network threats and attacks and their impact on security.
Common threat categories: Describe different types of threats that can impact organizations.
Security best practices and risk management: Understand the identification and prevention of threats and the management of risks.
Understanding the various types of threats to security will aid you in understanding the need for security controls and help you implement more effective protection measures and mitigation techniques as you enter the cybersecurity field and land your first role. In this chapter, we will look at the various types of threats to security and why it’s essential to understand them, common threat types and mitigations, advanced techniques used by threat actors, and ways to discover and mitigate vulnerabilities.
This chapter covers the following Certified in Cybersecurity exam objectives:
4.2 Understand network threats and attacks
4.2a Types of threats (e.g., distributed denial-of-service (DDoS), virus, worm, Trojan, on-path attack, side-channel)
4.2b Identification (e.g., intrusion detection system (IDS), host-based intrusion detection system (HIDS), network intrusion detection system (NIDS))
4.2c Prevention (e.g., antivirus, scans, firewalls, intrusion prevention system (IPS))
“Do I Know This Already?” Quiz
The “Do I Know This Already?” quiz allows you to decide whether you need to read this entire chapter or skip to the “Exam Preparation Tasks” section. If you doubt your selection of answers to these questions or your own assessment of your knowledge of these topics, you may want to read the entire chapter. Table 3-1 lists the major headings in this chapter and their corresponding “Do I Know This Already?” Quiz questions. You can find the answers in Appendix A, “Answers to the ‘Do I Know This Already?’ Quizzes and Q&A Sections.” Good luck!
Table 3-1 “Do I Know This Already?” Section-to-Question Mapping
Foundation Topics Section |
Questions |
|---|---|
Threats to Security |
1–3 |
Common Threat Categories |
4, 5 |
Network Attacks |
6–8 |
Detection and Mitigation Techniques |
9, 10 |
Scanning and Penetration Testing |
11, 12 |
1. What is a threat in cybersecurity?
A strategy to prevent data theft
An event that leads to data destruction only
Any circumstance or event with the potential to impact operations, assets, or individuals through unauthorized access, destruction, disclosure, or modification of information
A way to reduce the time that it takes to investigate security issues
2. How can cybersecurity professionals prepare to defend against threats?
By ignoring the latest news in the cybersecurity world
By sharing information with peer organizations
By ensuring all systems and devices have no vulnerabilities
By allowing unauthorized access to information and systems
3. What is the purpose of threat intelligence?
To encourage data theft and destruction
To help cybersecurity professionals and executives make decisions about potential threats
To slow down the investigation of security issues
To keep emerging technology concerns around IoT, AI, and some aspects of the cloud a secret
4. What is ransomware?
Code that runs on computer systems without the user’s knowledge
Malicious software designed to disrupt, damage, or gain unauthorized access to a computer system
Standalone, self-replicating malware that causes damage to systems
Malicious software that encrypts your data to block access in exchange for a ransom payment
5. What is the main difference between viruses and worms?
Viruses can self-replicate, while worms need a human to execute them on a system.
Viruses spread through the Internet, while worms spread through LANs.
Viruses are malware that slows down systems, while worms cause extensive damage to systems.
Viruses need human interaction to be successful, while worms can self-replicate and spread without human interaction.
6. What is the main difference between a DDoS attack and a regular DoS attack?
A DDoS attack floods a system with traffic to multiple compromised devices, while a regular DoS attack floods one system with traffic to exhaust resources.
A DDoS attack targets routers, switches, and servers, while a regular DoS attack targets individual devices.
A DDoS attack alters data between communicating parties, while a regular DoS attack intercepts data between communicating parties.
A DDoS attack requires physical access to a system, while a DoS attack is executed remotely.
7. Where are man-in-the-middle (MITM) attacks typically executed?
Secure and encrypted networks
Government organizations and military networks
In places with insecure Wi-Fi, such as coffee shops or hotels
Internal networks within an organization
8. How do side-channel attacks exploit system vulnerabilities?
By intercepting and altering data between communicating parties
By flooding a system with traffic through coordinated efforts
By analyzing unintended information leaked by a system’s physical implementation
By gaining physical access to a system’s hardware components
9. What are the two categories of firewalls?
Stateful and stateless
Network-based and host-based
Proxy and packet filtering
Next-generation and web application
10. What is the main difference between packet filtering firewalls and web application firewalls?
Packet filtering firewalls inspect data packets based on payload content, while web application firewalls monitor IP information.
Packet filtering firewalls authenticate clients and forward requests to servers, while web application firewalls authenticate servers and forward requests to clients.
Packet filtering firewalls analyze surface-level data such as IP addresses and ports, while web application firewalls inspect HTTP traffic and protect against web-based attacks.
Packet filtering firewalls utilize machine learning and behavior analytics, while web application firewalls conduct deep packet inspection.
11. What is the purpose of vulnerability scanning in cybersecurity?
To exploit vulnerabilities found in an organization’s environment
To analyze behaviors on specific endpoints and respond to issues
To determine what vulnerabilities an organization has, to prioritize remediation efforts, and to track progress
To apply patches to software to fix vulnerabilities
12. What is the difference between vulnerability scanning and pentesting?
Vulnerability scanning is used to exploit vulnerabilities, while pentesting analyzes behaviors on specific endpoints.
Vulnerability scanning doesn’t exploit the vulnerabilities, while pentesting aims to find and exploit vulnerabilities.
Vulnerability scanning allows teams to test incident response and detection processes, while pentesting prioritizes remediation efforts.
Vulnerability scanning gives a continuous look at what is going on in an organization, while pentesting is conducted with open-source tools.
13. What is the purpose of regularly updating and patching systems in cybersecurity?
To analyze behaviors on specific endpoints and respond to issues
To detect and protect against threats using predictive analytics
To gain unauthorized access to systems and data
To apply security fixes for vulnerabilities found in the software