Types of Security Threats and Attack Vectors
Malware comprises distinct categories based on propagation method. A virus attaches to executable files and spreads only when users run those files. A worm replicates independently across networks without user action, making it faster and more dangerous. A trojan disguises itself as legitimate software but performs malicious functions once installed.
Ransomware encrypts files to extort payment. Spyware secretly monitors user activity. Each type requires different detection and prevention methods.
Social Engineering and Advanced Threats
Social engineering attacks manipulate users into compromising security. Phishing uses deceptive emails to steal credentials. Pretexting constructs false scenarios to extract information. Baiting offers something attractive (USB drive, file download) containing malware. Tailgating gains physical access by following authorized personnel.
Advanced Persistent Threats (APTs) are sophisticated, targeted attacks that maintain long-term system access. They often target specific organizations and use custom tools.
Network and Exploitation Attacks
Man-in-the-Middle (MITM) attacks intercept communications between two parties. Denial of Service (DoS) overwhelms a single system with traffic. Distributed Denial of Service (DDoS) uses multiple systems to flood a target.
Zero-day exploits target previously unknown vulnerabilities before patches exist. Password attacks include brute force, dictionary, and rainbow table methods. Privilege escalation gains higher access levels, while lateral movement spreads within a network after initial compromise.
Why Threat Mechanics Matter
Security+ requires you to understand not just threat names but how they work. Know their propagation methods, the damage they cause, and what indicators reveal their presence. This knowledge helps you both identify attacks and choose appropriate defenses.
Vulnerability Classification and Assessment
Vulnerabilities are weaknesses that threats can exploit. The Common Vulnerabilities and Exposures (CVE) system provides standardized identifiers for known security flaws. The Common Vulnerability Scoring System (CVSS) rates severity on a 0 to 10 scale, considering factors like attack method, required privileges, user interaction, and impact on confidentiality, integrity, and availability.
CVSS severity ratings guide remediation priorities. Critical vulnerabilities (9.0-10.0) require immediate patching within days. High severity (7.0-8.9) needs remediation within weeks. Medium (4.0-6.9) fits normal maintenance windows. Low (0.1-3.9) receives routine attention.
Classification Methods
Vulnerabilities fall into three classification types. Design flaws exist in system architecture. Configuration errors result from improper setup. Implementation bugs occur in source code. OWASP Top 10 lists the most critical web application vulnerabilities: injection attacks, broken authentication, sensitive data exposure, and XML external entities (XXE).
The Vulnerability Management Process
Vulnerability assessment systematically identifies, quantifies, and prioritizes security weaknesses using tools like Nessus, OpenVAS, or Qualys. Penetration testing goes further by attempting to exploit vulnerabilities to demonstrate real-world impact. The full vulnerability management lifecycle includes identification through scanning, analysis of risk and business impact, remediation through patching or configuration changes, and verification that fixes work properly.
Threat Modeling and Risk Analysis
Threat modeling structures how you identify potential attacks against a system. The STRIDE methodology categorizes threats into six types: Spoofing identity, Tampering with data, Repudiation of actions, Information disclosure, Denial of Service, and Elevation of privilege.
PASTA (Process for Attack Simulation and Threat Analysis) provides another framework for understanding attack surfaces. These structured approaches map how attackers might compromise systems and what entry points they could use.
Risk Calculation Fundamentals
Risk equals Threat multiplied by Vulnerability multiplied by Asset Value. If any element is zero, risk becomes zero. Qualitative risk analysis uses subjective ratings like High, Medium, or Low. Quantitative analysis assigns numerical values to express risk in financial terms.
Annualized Loss Expectancy (ALE) equals Annual Rate of Occurrence (ARO) multiplied by Single Loss Expectancy (SLE). This metric justifies security investments to business leaders using financial language they understand.
Understanding Threat Actors
Identifying threat actors helps predict attack sophistication and likelihood. Internal threats come from employees or contractors. Script kiddies use existing tools without deep technical knowledge. Hacktivists pursue political or social causes. Organized crime seeks financial gain. Nation-states conduct espionage or cyberwarfare.
The kill chain framework describes attacker progression through seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Understanding this progression helps you identify where defenses can interrupt the attack.
Mitigation Strategies and Security Controls
Security controls fall into three operational categories that work together. Preventive controls stop attacks before they occur: firewalls, access controls, encryption, and awareness training. Detective controls identify attacks in progress: intrusion detection systems, log monitoring, and security information and event management (SIEM). Corrective controls remediate damage after attacks: backup restoration, incident response, and recovery procedures.
Threat-Specific Mitigations
Different threats require different defenses. Against malware, deploy antivirus software, endpoint detection and response (EDR) tools, and behavior-based detection. Defend against social engineering through security awareness training, email filtering, and multi-factor authentication.
Network segmentation limits lateral movement if one network segment becomes compromised. Patching and configuration management address known vulnerabilities. Encryption protects data confidentiality in transit and at rest. Secure coding practices and code review reduce implementation vulnerabilities.
Foundational Security Principles
Principle of least privilege ensures users have only the access necessary for their role. Defense in depth implements multiple security layers so no single failure causes total compromise. Incident response procedures outline how to contain, investigate, and recover from attacks.
Matching Controls to Threats
Security+ scenario questions test whether you can match appropriate controls to specific risks. For example, understanding that network segmentation prevents lateral movement helps you design better network architecture. Knowing that user training reduces social engineering attacks helps you allocate security budgets effectively.
Study Strategies and Flashcard Effectiveness for Threats and Vulnerabilities
The threats and vulnerabilities domain requires mastery of dozens of concepts, threat types, and mitigation strategies. Flashcards work exceptionally well because this domain demands rapid pattern recognition. You must see a scenario and immediately identify the threat or vulnerability type.
Effective flashcards emphasize scenarios over definitions. A front might read: "A user receives an email appearing to be from IT support requesting their password. What type of social engineering attack is this?" The back identifies it as pretexting and explains why this matters for security.
Building Application-Focused Cards
Create cards that test concept application, not just recall. Example: "Given a network vulnerability requiring authentication to exploit, which CVSS metric would be most affected?" This builds the analytical thinking Security+ demands. Practice calculating risk scores and identifying appropriate controls for specific scenarios.
Organize cards by threat type, by mitigation approach, and by real-world scenarios. This develops multiple retrieval pathways in your memory. Include cards covering threat actors and motivations, because understanding who attacks systems and why helps predict future attacks.
Maximizing Retention and Speed
Study with active recall by testing yourself before reviewing answers. This strengthens long-term retention far better than passive reading. Space out your review sessions rather than cramming, allowing your brain to consolidate knowledge and making information more retrievable during the exam.
Combine flashcard study with hands-on practice using actual vulnerability scanning tools. Read real CVE entries to ground abstract concepts in concrete examples. This multi-sensory approach builds deeper understanding than flashcards alone.