Types of attack
The axes along which an attack is classified, the property it targets (confidentiality, integrity, availability) and ten families: eavesdropping, spoofing, man in the middle, denial of service, brute force and dictionary, social engineering, injection, privilege escalation, ransomware and supply chain.
- 33 cards
- 4 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
A few cards from the deck
CIA triad: what is it?
Show the answer
The three properties an attack can target: not being read by just anyone, not being changed without authorisation, staying reachable when needed.
Confidentiality, integrity, availability: every attack hits at least one of the three. Classifying by them tells at once what the victim loses.
In a café, an attacker captures the unencrypted HTTP traffic of customers on the open Wi-Fi. Which family is it and which property is targeted?
- Eavesdropping, confidentiality
- Man in the middle, integrity of the exchanges
- Spoofing, authenticity of the sender
- Denial of service, availability of the network
Show the answer
Eavesdropping, confidentiality
He reads without changing anything: a passive attack on confidentiality. He would become a man in the middle if he altered pages on the way.
A … attack observes without changing anything and is hard to detect; an … attack changes data or disrupts a service.
Show the answer
A passive attack observes without changing anything and is hard to detect; an active attack changes data or disrupts a service.
Eavesdropping is passive, man in the middle and denial of service are active. A passive attack is prevented (encryption), an active one can also be detected.
Network eavesdropping (sniffing): what is it?
Show the answer
A passive attack that captures the packets travelling over a network to read their content.
It leaves no trace on the victim's side. Encryption (HTTPS, WPA3, VPN) does not prevent it, it just makes what is captured unreadable.
An update to a piece of management software, signed by its vendor, installs a backdoor at every one of its customers. Which type of attack is it, and which countermeasure limits the risk?
- A phishing attack; training users to recognise booby-trapped messages
- Signature spoofing; checking the signature before installing
- A supply chain attack; limiting what the software can reach on the network
- A man in the middle; encrypting the update download
Show the answer
A supply chain attack; limiting what the software can reach on the network
The signature is valid: the supplier itself was compromised. This trust cannot be removed, so what it allows is reduced: outbound filtering for the software, minimal privileges, monitoring for abnormal behaviour.