Topic 2.1 Notes – Cyber Foundations
What Risk Is in Cybersecurity
Risk exists when a threat can exploit a vulnerability and harm an asset.
Keep these terms separate because the exam loves mixing them up:
- Asset = something valuable
Examples include data, money, devices, intellectual property, infrastructure, and reputation. - Vulnerability = a weakness
Examples include a weak password, an exposed account, or an unlocked server room. - Threat or adversary = the person or group capable of using the weakness
- Attack = the action they take
- Security control = the safeguard that prevents, detects, or corrects the problem
A quick example helps lock it in. Customer records are the asset. A reused password is the vulnerability. A criminal group is the threat. Logging in with stolen credentials is the attack. MFA would be a control.
Impact is usually described with the CIA triad:
- Confidentiality = unauthorized access or disclosure
- Integrity = unauthorized change, falsification, or destruction
- Availability = loss of access or downtime
The whole topic keeps coming back to this relationship:
asset + vulnerability + relevant threat = risk
Social Engineering and Adversary Types
A lot of attacks begin with people, not code.
Social engineering tactics
Social engineering means manipulating a person into doing what the attacker wants. The channel does not matter. Email, text, phone, fake website, and in-person tricks all count.
This example packs several common pressure tactics into one message.
Social engineering email example
Know these tactics by the clue in the scenario:
- Pretexting = a believable reason for contact, like a fake audit or vendor issue
- Authority = pretending to be a boss, admin, police officer, or someone relaying their orders
- Intimidation = threatening punishment, suspension, legal trouble, or embarrassment
- Consensus = “everyone else already did this”
- Scarcity = limited supply or limited spots
- Familiarity = pretending to be or know someone you trust
- Urgency = a deadline that pressures fast action
One message can use more than one tactic at once. That is a common test move.
Adversary types
You usually identify the attacker by motivation, access, skill, and target.
- Script kiddies use other people’s tools with low skill. They often want attention or easy profit.
- Hacktivists attack for a social or political cause. Website defacement is a classic example.
- Insider adversaries already have legitimate access, which makes them dangerous.
- Cyberterrorists aim for broad disruption of communities or infrastructure like power or water.
- Transnational criminal organizations are organized and profit-driven, often tied to ransomware or IP theft.
The Phases of a Cyberattack
Attacks often unfold in phases, even if not every attack uses all of them. This diagram shows the general flow from early reconnaissance to the attacker’s end goal.
Cyberattack lifecycle
Reconnaissance
The attacker gathers information, often through OSINT, which means public information like company websites, LinkedIn, job posts, or social media.Initial access
The first foothold. This often happens through social engineering or weak/compromised credentials.Persistence
The attacker keeps access over time. Terms to know are RAT, rootkit, and C2. You just need the idea here: tools and communication methods that help maintain control.Lateral movement
The attacker moves to other systems or accounts, often seeking higher privileges.Taking action
This is the goal phase. Stealing, exfiltrating, encrypting, disrupting, or destroying.Evading detection
Attackers also try to hide evidence by deleting logs, removing malware, or cleaning up files.
Classic flow: public employee research → fake login page → install RAT → move to file server → steal/encrypt files → delete logs.
Assessing and Managing Risk
Risk assessment
Risk assessment always looks at likelihood and impact.
Likelihood depends on things like:
- how valuable the target is
- how hard the exploit is
- how motivated and capable the attacker is
Impact can include:
- financial cost
- operational harm
- reputational harm
Results may be:
| Assessment type | What it looks like |
|---|---|
| Qualitative | low, medium, high, severe, or a likelihood-by-impact grid such as unlikely low impact, likely low impact, unlikely high impact, likely high impact |
| Quantitative | a scaled score (say 1 to 10) or a monetary value, such as a $10,000 risk versus a $100,000 risk |
Good documentation names the asset, threat, vulnerability, exploit path, likelihood, impact, and final rating.
Risk management choices
After identifying risk, an organization can:
- Avoid the risk by stopping the activity
- Transfer it through insurance or contracts
- Mitigate it with controls
- Accept the remaining residual risk
A control should be cost effective. If the fix costs more than the likely loss and barely reduces risk, it is a poor choice.
Security Controls and Defense in Depth
Types of controls
- Physical controls protect space and equipment, like locks, guards, cameras, fences, bollards
- Technical controls protect digital systems, like firewalls, anti-malware, encryption
- Managerial controls are policies and procedures, like password rules, access reviews, incident response plans
Functions of controls
- Preventative controls try to stop the attack
- Detective controls identify the attack or leave evidence
- Corrective controls repair damage and restore operations
A camera is a good example of why type and function are separate. It is physical by type and detective by function.
Why defense in depth matters
Defense in depth means layered security. One failed control should not mean total compromise.
The diagram shows this layered idea. Security is built from multiple overlapping areas, from policies and access control to applications and data.
Defense-in-depth security layers
For AP review, focus on the main idea that security uses several layers such as human, physical, network, device, application, data. Different threats need different controls, and overlapping layers reduce damage when one layer fails.
Key Takeaways
Social Engineering
Using psychological tactics to manipulate a target into taking an action desired by an adversary
Pretexting
Creating a believable reason or invented situation for contacting a target and making a request seem legitimate
Authority
Impersonating someone with power over a target or claiming to relay that person's instructions
Intimidation
Stating or implying that a target will suffer negative consequences for refusing to comply
Consensus
Creating social pressure by claiming that other people are already performing or approving an action
Scarcity
Pressuring a target to act by claiming that an opportunity, product, reward, or resource has limited availability
Familiarity
Pretending to be or know someone close to a target in order to establish trust
Urgency
Imposing a deadline that pressures a target to act quickly, often to avoid a negative consequence
Adversary
A person or organization that seeks to compromise devices, networks, applications, data, or supporting systems
Script Kiddie
A low-skilled adversary who uses tools created by others without understanding how they work, often for greed or recognition
Hacktivist
An adversary who illegally compromises systems to promote a social, political, or personal cause
Insider Adversary
A malicious person who uses legitimate organizational credentials or authorized access, often from greed, revenge, or outside recruitment
Cyberterrorist
An ideologically motivated adversary seeking broad fear, harm, or disruption to populations or civil infrastructure
Transnational Criminal Organization
An organized, profit-seeking adversary operating across national boundaries, commonly through ransomware or intellectual-property theft
Phases of a Cyberattack
Reconnaissance, initial access, persistence, lateral movement, taking action, and evading detection; attacks may omit, repeat, or revisit phases
Reconnaissance
The attack phase in which an adversary gathers information about a target and possible routes of attack
Open Source Intelligence (OSINT)
Information gathered from freely available public sources, often during reconnaissance
Initial Access
The attack phase in which an adversary establishes a first foothold on a target system, often through social engineering or weak credentials
Persistence
The attack phase in which an adversary establishes a way to maintain access without repeating the initial compromise
Command and Control (C2)
Communication through which an adversary sends commands to a compromised device and receives output or collected information
Remote Access Trojan (RAT)
Malware that enables unauthorized remote control of a device and can help an adversary maintain access
Rootkit
Malware designed to provide privileged access while helping conceal malicious activity
Lateral Movement
The attack phase in which an adversary accesses additional systems or accounts, often seeking elevated permissions and more valuable resources
Taking Action
The attack phase in which an adversary carries out objectives such as collecting or exfiltrating data, disrupting services, or destroying data
Exfiltration
The unauthorized transfer of data out of a target environment
Evading Detection
The attack phase in which an adversary conceals evidence by editing logs, deleting malware, or removing other planted files
Asset
Anything valuable, including money, intellectual property, data, infrastructure, physical property, or reputation
Vulnerability
A weakness or flaw associated with an asset that could allow compromise
Threat
A potential source capable of exploiting a vulnerability and compromising an asset
Attack
The action taken to exploit a vulnerability and compromise an asset
Risk
The possibility of loss or harm when a threat can exploit a vulnerability to compromise an asset
Risk Assessment
Evaluating a specific risk by considering the likelihood that a vulnerability will be exploited and the severity of the resulting damage
Likelihood
The probability or practical chance that a specific vulnerability will be exploited, based on target value, exploit difficulty, and likely adversaries
Impact (Severity)
The projected damage if an attack succeeds, including financial, operational, reputational, and other consequences
Qualitative Risk Assessment
A risk assessment that assigns descriptive ratings such as low, medium, high, or severe
Quantitative Risk Assessment
A risk assessment that assigns a numerical score or quantifiable impact, such as a monetary estimate
Risk Assessment Documentation
For each risk, record the asset and value, threat, vulnerability and exploit path, likelihood, impact, and final rating
Risk Management
Choosing how to handle an assessed risk through avoidance, transference, mitigation, or acceptance
Risk Avoidance
Stopping the activity that generates a risk
Risk Transference
Placing some burden or consequences of a risk on another entity, such as an insurer or contractor
Risk Mitigation
Implementing security controls to reduce the likelihood or impact of a risk
Residual Risk
The risk remaining after avoidance, transference, and mitigation have been applied where appropriate
Risk Acceptance
Acknowledging and choosing to live with a remaining level of risk because absolute security is unattainable
Cost-Effective Solution
A solution that costs less to install and maintain than the expected loss from the attack it addresses
Security Control
A safeguard intended to prevent, detect, or correct a security problem
CIA Triad
The three core security objectives: confidentiality, integrity, and availability
Confidentiality
Ensuring that only authorized individuals, systems, or processes can access data
Integrity
Ensuring that data are accurate, trustworthy, and protected from unauthorized alteration
Availability
Ensuring that data and services are accessible to authorized users when needed
Physical Control
A control that provides security in physical space, such as a lock, fence, camera, bollard, or guard
Technical Control
A control that provides security in the digital space, such as a firewall, anti-malware software, or encryption
Managerial Control
A rule, guideline, policy, or procedure specifying required security, such as a password policy or incident response plan
Preventative Control
A control intended to address a vulnerability and stop an adversary from successfully attacking
Detective Control
A control intended to identify an attack when it occurs or provide evidence that it occurred
Corrective Control
A control intended to fix a problem and help restore a system to an operational state
Defense in Depth (Layered Defense)
Using overlapping controls across multiple layers so different threats are addressed and one failed control does not cause complete compromise
Notes
Social Engineering
Using psychological tactics to manipulate a target into taking an action desired by an adversary
Pretexting
Creating a believable reason or invented situation for contacting a target and making a request seem legitimate
Authority
Impersonating someone with power over a target or claiming to relay that person's instructions
Intimidation
Stating or implying that a target will suffer negative consequences for refusing to comply
Consensus
Creating social pressure by claiming that other people are already performing or approving an action
Scarcity
Pressuring a target to act by claiming that an opportunity, product, reward, or resource has limited availability
Familiarity
Pretending to be or know someone close to a target in order to establish trust
Urgency
Imposing a deadline that pressures a target to act quickly, often to avoid a negative consequence
Adversary
A person or organization that seeks to compromise devices, networks, applications, data, or supporting systems
Script Kiddie
A low-skilled adversary who uses tools created by others without understanding how they work, often for greed or recognition
Hacktivist
An adversary who illegally compromises systems to promote a social, political, or personal cause
Insider Adversary
A malicious person who uses legitimate organizational credentials or authorized access, often from greed, revenge, or outside recruitment
Cyberterrorist
An ideologically motivated adversary seeking broad fear, harm, or disruption to populations or civil infrastructure
Transnational Criminal Organization
An organized, profit-seeking adversary operating across national boundaries, commonly through ransomware or intellectual-property theft
Phases of a Cyberattack
Reconnaissance, initial access, persistence, lateral movement, taking action, and evading detection; attacks may omit, repeat, or revisit phases
Reconnaissance
The attack phase in which an adversary gathers information about a target and possible routes of attack
Open Source Intelligence (OSINT)
Information gathered from freely available public sources, often during reconnaissance
Initial Access
The attack phase in which an adversary establishes a first foothold on a target system, often through social engineering or weak credentials
Persistence
The attack phase in which an adversary establishes a way to maintain access without repeating the initial compromise
Command and Control (C2)
Communication through which an adversary sends commands to a compromised device and receives output or collected information
Remote Access Trojan (RAT)
Malware that enables unauthorized remote control of a device and can help an adversary maintain access
Rootkit
Malware designed to provide privileged access while helping conceal malicious activity
Lateral Movement
The attack phase in which an adversary accesses additional systems or accounts, often seeking elevated permissions and more valuable resources
Taking Action
The attack phase in which an adversary carries out objectives such as collecting or exfiltrating data, disrupting services, or destroying data
Exfiltration
The unauthorized transfer of data out of a target environment
Evading Detection
The attack phase in which an adversary conceals evidence by editing logs, deleting malware, or removing other planted files
Asset
Anything valuable, including money, intellectual property, data, infrastructure, physical property, or reputation
Vulnerability
A weakness or flaw associated with an asset that could allow compromise
Threat
A potential source capable of exploiting a vulnerability and compromising an asset
Attack
The action taken to exploit a vulnerability and compromise an asset
Risk
The possibility of loss or harm when a threat can exploit a vulnerability to compromise an asset
Risk Assessment
Evaluating a specific risk by considering the likelihood that a vulnerability will be exploited and the severity of the resulting damage
Likelihood
The probability or practical chance that a specific vulnerability will be exploited, based on target value, exploit difficulty, and likely adversaries
Impact (Severity)
The projected damage if an attack succeeds, including financial, operational, reputational, and other consequences
Qualitative Risk Assessment
A risk assessment that assigns descriptive ratings such as low, medium, high, or severe
Quantitative Risk Assessment
A risk assessment that assigns a numerical score or quantifiable impact, such as a monetary estimate
Risk Assessment Documentation
For each risk, record the asset and value, threat, vulnerability and exploit path, likelihood, impact, and final rating
Risk Management
Choosing how to handle an assessed risk through avoidance, transference, mitigation, or acceptance
Risk Avoidance
Stopping the activity that generates a risk
Risk Transference
Placing some burden or consequences of a risk on another entity, such as an insurer or contractor
Risk Mitigation
Implementing security controls to reduce the likelihood or impact of a risk
Residual Risk
The risk remaining after avoidance, transference, and mitigation have been applied where appropriate
Risk Acceptance
Acknowledging and choosing to live with a remaining level of risk because absolute security is unattainable
Cost-Effective Solution
A solution that costs less to install and maintain than the expected loss from the attack it addresses
Security Control
A safeguard intended to prevent, detect, or correct a security problem
CIA Triad
The three core security objectives: confidentiality, integrity, and availability
Confidentiality
Ensuring that only authorized individuals, systems, or processes can access data
Integrity
Ensuring that data are accurate, trustworthy, and protected from unauthorized alteration
Availability
Ensuring that data and services are accessible to authorized users when needed
Physical Control
A control that provides security in physical space, such as a lock, fence, camera, bollard, or guard
Technical Control
A control that provides security in the digital space, such as a firewall, anti-malware software, or encryption
Managerial Control
A rule, guideline, policy, or procedure specifying required security, such as a password policy or incident response plan
Preventative Control
A control intended to address a vulnerability and stop an adversary from successfully attacking
Detective Control
A control intended to identify an attack when it occurs or provide evidence that it occurred
Corrective Control
A control intended to fix a problem and help restore a system to an operational state
Defense in Depth (Layered Defense)
Using overlapping controls across multiple layers so different threats are addressed and one failed control does not cause complete compromise
