CoreQ Academy2.2 Explain common threat vectors and attack surfaces.
A threat vector is the path an attacker uses to get in. The attack surface is the total of all those paths. Reducing the attack surface (fewer open ports, fewer unsupported systems, better-trained people) is one of the most effective security investments.
Message-based
- The most common vector: phishing links, malicious attachments, business email compromise.
- Short Message Service (SMS)
- Text messages with malicious links or fake alerts (smishing).
- Instant messaging (IM)
- Chat apps (Teams, Slack, WhatsApp) used to send malicious links or impersonate colleagues.
Other vectors
- Image-based
- Malicious code or links hidden in images, or QR codes that lead to phishing sites.
- File-based
- Malicious documents, PDFs, archives or scripts that run code when opened.
- Voice call
- Phone calls used to trick people into revealing information or taking actions (vishing).
- Removable device
- USB drives with malware, or devices that pretend to be keyboards. Some attacks rely on people plugging in found drives.
- Vulnerable software
- Unpatched applications with known flaws.
- Client-based vs. agentless
- Client-based software installs an agent on endpoints (more attack surface on each host); agentless uses existing protocols or a browser (less to patch on endpoints, but relies on network access).
- Unsupported systems and applications
- End-of-life software no longer receives security patches, so new vulnerabilities stay open forever.
- Open service ports
- Every listening service is a potential entry point. Close or firewall what is not needed.
- Default credentials
- Factory usernames and passwords (admin/admin) are published online and are a top cause of compromise for devices.
Unsecure networks
- Wireless
- Open or weakly encrypted Wi-Fi allows eavesdropping, rogue access points and evil twins.
- Wired
- Unprotected network jacks let anyone plug in; use 802.1X and port security.
- Bluetooth
- Attacks such as bluejacking and bluesnarfing against discoverable or unpatched devices.
Supply chain
- Managed service providers (MSPs)
- An MSP with access to many customers is a high-value target; compromising one compromises all.
- Vendors
- Third parties whose software or access can be abused.
- Suppliers
- Providers of hardware or components that could be tampered with before delivery.
Human vectors/social engineering
- Phishing
- Fraudulent messages that trick people into clicking, opening or entering credentials.
- Vishing
- Voice phishing over phone calls.
- Smishing
- Phishing by SMS text message, often a fake delivery or bank alert with a link.
- Misinformation/disinformation
- False information; disinformation is deliberately false and meant to mislead or manipulate.
- Impersonation
- Pretending to be someone trusted, such as IT support or an executive.
- Business email compromise
- Using a compromised or spoofed business mailbox to trick staff into wiring money or changing payment details.
- Pretexting
- Inventing a believable story to obtain information ("I am from the auditor, I need the vendor list").
- Watering hole
- Compromising a website a target group commonly visits, then waiting for victims.
- Brand impersonation
- Copying a well-known brand look in emails or sites to gain trust.
- Typosquatting
- Registering domains with common misspellings (examp1e.com) to catch mistyped visits.
Check your understanding
Knowledge quiz · pass mark 80%
- Which reduces the attack surface most directly?
- A finance clerk receives an email from the "CEO" asking to urgently change a supplier bank account. This is most likely:
- Software that has reached end-of-life still receives security patches.
- Which are supply chain vectors? (choose all)
- An attacker compromises an industry forum that staff at the target firm frequently visit. This is a:
Original CoreQ Academy material, mapped to objective 2.2 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.