2.1 Cyber Foundations

1. Seven social engineering tactics (2.1.A)

Social engineers use psychological tactics to manipulate a target into a desired action 2.1.A.1. Topic 1.1 introduced intimidation and urgency. Here is the full set.

Tactic	The adversary…	Sounds like
Pretexting 2.1.A.2	invents a believable reason to contact you	“I’m from the information technology (IT) team, running the yearly laptop check.”
Authority 2.1.A.3	impersonates someone with power over you, or relays “their” instructions	“The principal needs this list before lunch.”
Intimidation 2.1.A.4	states negative consequences if you refuse	“If this isn’t done, you’ll be written up.”
Consensus 2.1.A.5	makes you believe everyone else is already doing it	“Your whole team has already signed in here.”
Scarcity 2.1.A.6	creates a sense of limited availability	“Only 20 free upgrades left.”
Familiarity 2.1.A.7	pretends to be, or to know, someone close to you	“Your cousin gave me your number.”
Urgency 2.1.A.8	sets a deadline to avoid a bad outcome	“Reply within the hour or lose access.”

One message can use several tactics. Ask three questions and name each tactic by the words that show it.

2. Five types of adversaries (2.1.B)

Adversary	Profile	Usual motive
Script kiddie 2.1.B.1	Low skill; uses tools made by others without understanding how they work	Greed or recognition
Hacktivist 2.1.B.2	Breaks into systems to support a social, political or personal cause, believing the goal justifies illegal methods	The cause
Insider 2.1.B.3	Already has legitimate credentials and access; can be recruited by outsiders	Greed or revenge
Cyberterrorist 2.1.B.4	Aims to disrupt whole communities, regions or nations, for example a power grid or water treatment plant; acts alone or for governments or criminal groups	Politics or beliefs
Transnational criminal organization 2.1.B.5	Deploys ransomware and steals corporate intellectual property (IP) to sell	Money

3. The six phases of a cyberattack (2.1.C)

Cyberattacks aim to disrupt, harm, steal or destroy devices, networks or data. Adversaries work in phases, though not every attack uses all of them 2.1.C.1.

1. Reconnaissance: gather as much information about the target as possible, often from open source intelligence (OSINT), information that is freely available 2.1.C.2.
2. Initial access: gain a foothold on a computer, often through social engineering or compromised or weak credentials 2.1.C.3.
3. Persistence: keep access without needing to break in again, often using a command and control (C2) protocol through malware such as a remote access trojan (RAT) or a rootkit 2.1.C.4.
4. Lateral movement: move to other computers and accounts to escalate privileges and reach more services and data 2.1.C.5.
5. Taking action: collect and exfiltrate target data, disrupt services or destroy data 2.1.C.6.
6. Evading detection: remove or edit log files and erase planted files such as malware 2.1.C.7.

Key terms by phase: a foothold is a first point of access; to escalate privileges is to reach accounts with more permissions; to exfiltrate is to send stolen data out of the organization.

Case file: the Harborview breach

An adversary reads staff profiles on a professional networking site (reconnaissance), emails a convincing “payroll update” link to an accountant (initial access), installs a remote access trojan that checks in every night (persistence), uses it to reach the file server with an administrator’s account (lateral movement), copies the customer database out (taking action), then deletes the server’s login records (evading detection).

4. Assessing risk (2.1.D)

Risk exists when a threat can exploit a vulnerability to compromise an asset 2.1.D.1. An asset is anything valuable: money, intellectual property, data, digital infrastructure, physical property and reputation 2.1.D.2.

A risk assessment weighs two factors 2.1.D.3:

• Likelihood of an attack on that vulnerability. It rises with the value of the target to adversaries, falls with the skill required (well-documented exploits need less skill, so more adversaries can use them), and depends on the motivation and capabilities of likely adversaries 2.1.D.4.
• Severity of the damage, usually measured as financial cost, including reputational and operational impact 2.1.D.5.

Example: a ransomware gang ignores a tiny charity’s website, but a group angry about the charity’s stance might target it for publicity. Value depends on who is looking.

Results can be quantitative (a number, such as a score from 1 to 5 or an expected yearly loss) or qualitative (descriptive levels, such as minor, significant and critical) 2.1.D.6.

Risk assessment documentation should include 2.1.D.7:

• vulnerable assets and their value
• likely threats to those assets
• specific vulnerabilities and how they would be exploited
• the severity of damage (financial, operational, reputational) and the likelihood
• a final quantitative or qualitative rating for each risk

5. Managing risk (2.1.E)

Once a risk is assessed, there are four options 2.1.E.1:

Option	Meaning	Example
Avoid 2.1.E.2	Stop the activity causing the risk. Impossible if the activity is core to the organization’s mission.	A club deletes an old member database it no longer needs.
Transfer 2.1.E.3	Move the burden to someone else, such as an insurance company, a government or consumers.	A company buys cyber insurance.
Mitigate 2.1.E.4	Put security controls in place to reduce the likelihood or impact.	A school installs badge readers and MFA.
Accept 2.1.E.5	Acknowledge the residual risk left after avoiding, transferring and mitigating. Absolute security is unattainable.	Leadership signs off on the risk that is left.

Organizations favor controls that are cost effective and easy to implement and maintain. A cost-effective control costs less to install and maintain than the expected loss from an attack 2.1.E.6. A $500 lock against a $20,000 expected loss is cost-effective; a $50,000 guard for the same loss is not.

6. Security controls (2.1.F)

Every security control supports at least one of three principles 2.1.F.1:

• Confidentiality: only authorized people, systems or processes can access data. Without it: data theft or destruction.
• Integrity: data are accurate and trustworthy. Without it: data manipulation.
• Availability: data and services are accessible to authorized people when needed. Without it: unexpected downtime.

Controls are classified two ways.

By type 2.1.F.2	Examples
Physical	Locks, fences, cameras, bollards, security guards
Technical	Firewalls, anti-malware software, encryption
Managerial	Password policies, regular access reviews, incident response plans (IRPs)

By function 2.1.F.3	Goal	Examples
Preventative	Stop the attack	Locks, encryption
Detective	Identify attacks when they happen	Intrusion detection systems (IDSs), cameras, security incident and event management (SIEM) systems
Corrective	Fix problems and restore operation	Vulnerability patching, repairing a broken card reader, intrusion prevention systems (IPSs)

Put the two together and you get a grid:

Type ↓ / Function →	Preventative	Detective	Corrective
Physical	Locks, fences, bollards	Cameras, security guards	Repairing a broken card reader
Technical	Encryption, firewalls, anti-malware	IDS, SIEM	Vulnerability patching, IPS
Managerial	Password policies	Regular access reviews	Incident response plan

The CED lists examples by type and by function separately; where an example sits in this grid outside those lists is our placement, so learn the lists first. A camera is both a physical control (type) and a detective control (function). Always ask both questions.

7. Defense in depth (2.1.G)

A defense-in-depth strategy, also called layered defense, uses several types of security controls together 2.1.G.1. Why it is necessary:

• Different threats get the control best suited to stop each one 2.1.G.2.
• Resilience: if an adversary bypasses one control, another can still block access or limit the damage 2.1.G.3.

Layers can include human, physical, network, device, application and data 2.1.G.4. Units 2 to 5 of the course follow these layers: spaces, networks, devices, then applications and data.