Month 2: Who's out there, and how they get in

Insider threat and shadow IT

An insider threat is someone with authorized access (employee, contractor, partner) who misuses it, on purpose (revenge, money) or by carelessness. Insiders already know the systems and are inside the defenses. Shadow IT is staff using hardware, software or cloud services that IT hasn't approved, usually to get work done faster. Not malicious, but unmanaged, unpatched and invisible to security.

Exam tip Shadow IT is listed as a threat actor by CompTIA. A team buying its own cloud file-sharing account is shadow IT, not an insider attack.

Attributes of actors

CompTIA compares actors on three attributes. Internal/external: inside the organization (insider, shadow IT) or outside it. Resources/funding: money, people and time (nation-states and organized crime are rich; unskilled attackers are not). Level of sophistication/capability: from point-and-click tools to custom malware and zero-day exploits.

Actor          In?  Funding    Skill
-------------  ---  ---------  ---------
Nation-state   Ext  Very high  Very high
Org. crime     Ext  High       High
Hacktivist     Ext  Varies     Varies
Unskilled      Ext  Low        Low
Insider        Int  Low-med    Varies
Shadow IT      Int  Low        Low

Exam tip Exam questions often give you two attributes and ask for the actor.

Voice call and removable device

Voice call vectors include vishing calls, caller ID spoofing, voicemail scams and automated robocalls. Removable devices such as USB drives can carry malware, act as a keyboard that types commands, or be left in a parking lot hoping someone plugs one in (baiting). They can also cross an air gap into networks that aren't online, and carry data out.

Exam tip Mitigation clue: disable USB storage with policy, and train staff never to plug in found drives.

Open service ports and default credentials

Every open service port is a listening service an attacker can probe, and each needs to be needed, patched and filtered; close the rest. Default credentials are the factory usernames and passwords (admin/admin) on routers, cameras, printers and IoT gear; attackers keep lists of them and scan for devices that still use them.

Exam tip Default credentials are one of the most common ways IoT devices are taken over in bulk. Change them on day one.

Supply chain

The supply chain vector attacks you through someone you trust. Managed service providers (MSPs) often hold remote admin access to many customers at once, so one breached MSP opens many doors. Vendors sell you software and hardware that may carry flaws or tampering. Suppliers provide components and services that could be counterfeit or compromised before they reach you.

Exam tip Mitigation clue: vendor risk assessments, least-privilege access for MSPs, and verifying hardware sources.

Watering hole, brand impersonation, typosquatting

A watering hole attack compromises a website the targets already visit (like a pet-industry trade forum) and waits for them. Brand impersonation copies a known brand's logos and style in emails or sites to borrow its trust. Typosquatting registers misspelled lookalike domains (kibbelco.example, kibbleco-shop.example) to catch typos or fool readers.

Exam tip Watering hole: the attacker goes to where victims gather instead of contacting them.

Misinformation and disinformation

Misinformation is false information shared without intent to deceive. Disinformation is false information spread on purpose to mislead, often through fake accounts and social media, to sway opinion, damage a brand or support an attack. A fake post claiming "Kibble & Co. food recalled!" spread by a rival is disinformation.

Exam tip Dis = deliberate. Mis = mistaken.