Threats & Malware
Know the adversaries and their tools
Threat Landscape
- Actors: nation-state, cybercrime, hacktivists, insiders.
- Campaigns: APT (long-term, stealthy) vs opportunistic (broad, automated).
- TTPs: use MITRE ATT&CK to categorize techniques.
Malware Types
- Virus: attaches to files; Worm: self-propagates; Trojan: disguised as legitimate.
- Ransomware: encrypts data for payment; spyware/adware collect or inject ads.
- Rootkit: hides presence; botnet: remote-controlled compromised hosts.
Infection Vectors
Phishing attachments, drive-by downloads, RDP brute-force, supply chain.
Detection & Defense
- Endpoint: EDR/antivirus, application allow-listing, patching.
- Network: IDS/IPS, DNS filtering, email gateways, sandboxing.
- Backups and immutable storage against ransomware; 3-2-1 rule.
Common Attacks
- Phishing (spear, whaling), MFA fatigue.
- MITM: ARP spoofing, rogue AP; defend with TLS and certificate pinning.
- DoS/DDoS: volumetric, protocol, application; mitigate with WAF/CDN/rate limits.
- Web: SQLi, XSS, CSRF; input validation, parameterized queries, tokens.
Quick Revision
- Ransomware defense = backups+patching+EDR+email filtering.
- Use parameterized queries to stop SQLi.
- Verify unexpected requests via a second channel.
Social Engineering
Psychological manipulation to obtain information or access.