Unit 2: Securing Spaces

1. Seven social engineering tactics (2.1.A)

Social engineers use psychological tactics to manipulate a target into a desired action 2.1.A.1. Topic 1.1 introduced intimidation and urgency. Here is the full set.

Tactic	The adversary…	Sounds like
Pretexting 2.1.A.2	invents a believable reason to contact you	“I’m from the information technology (IT) team, running the yearly laptop check.”
Authority 2.1.A.3	impersonates someone with power over you, or relays “their” instructions	“The principal needs this list before lunch.”
Intimidation 2.1.A.4	states negative consequences if you refuse	“If this isn’t done, you’ll be written up.”
Consensus 2.1.A.5	makes you believe everyone else is already doing it	“Your whole team has already signed in here.”
Scarcity 2.1.A.6	creates a sense of limited availability	“Only 20 free upgrades left.”
Familiarity 2.1.A.7	pretends to be, or to know, someone close to you	“Your cousin gave me your number.”
Urgency 2.1.A.8	sets a deadline to avoid a bad outcome	“Reply within the hour or lose access.”

One message can use several tactics. Ask three questions and name each tactic by the words that show it:

1. Who do they claim to be? Someone with power over you is authority; someone close to you is familiarity.
2. Why, what reason do they give? A believable cover story is pretexting.
3. What pushes you to act? Limited time is urgency, limited supply is scarcity, “everyone already did it” is consensus, and a threat of consequences is intimidation.

Anatomy of a pressure message: ask three questions

[2.1.A] One message can use several tactics. Name each one by the words that show it.

WHO?Who do they claim to be?

• Authoritysomeone with power over you
• Familiaritysomeone close to you

WHY?What reason do they give?

• Pretextinga believable cover story

PRESSURE?What pushes you to act?

• Urgencylimited time: act fast
• Scarcitylimited supply
• Consensuseveryone else already did it
• Intimidationa threat of consequences

2. Five types of adversaries (2.1.B)

Adversary	Profile	Usual motive
Script kiddie 2.1.B.1	Low skill; uses tools made by others without understanding how they work	Greed or recognition
Hacktivist 2.1.B.2	Breaks into systems to support a social, political or personal cause, believing the goal justifies illegal methods	The cause
Insider 2.1.B.3	Already has legitimate credentials and access; can be recruited by outsiders	Greed or revenge
Cyberterrorist 2.1.B.4	Aims to disrupt whole communities, regions or nations, for example a power grid or water treatment plant; acts alone or for governments or criminal groups	Politics or beliefs
Transnational criminal organization 2.1.B.5	Seeks financial gain primarily by deploying ransomware and stealing corporate intellectual property (IP) to sell in illegal markets. A ransomware attack on a hospital that demands payment fits here; a cyberterrorist wants disruption, not money	Financial gain

3. The six phases of a cyberattack (2.1.C)

Cyberattacks aim to disrupt, harm, steal or destroy devices, networks or data. Adversaries work in phases, though not every attack uses all of them 2.1.C.1.

1. Reconnaissance: gather as much information about the target as possible, often from open source intelligence (OSINT), information that is freely available 2.1.C.2.
2. Initial access: gain a foothold on a computer, often through social engineering or compromised or weak credentials 2.1.C.3.
3. Persistence: keep access without needing to break in again, often using a command and control (C2) protocol through malware such as a remote access trojan (RAT) or a rootkit 2.1.C.4.
4. Lateral movement: move to other computers and accounts to escalate privileges and reach more services and data 2.1.C.5.
5. Taking action: collect and exfiltrate target data, disrupt services or destroy data 2.1.C.6.
6. Evading detection: remove or edit log files and erase planted files such as malware 2.1.C.7.

The six phases of a cyberattack, in order

[2.1.C] Not every attack uses every phase. Ask what the adversary is doing at that moment.

1. 1ReconnaissanceGather information, often with OSINT (freely available information)
2. 2Initial accessGet a foothold, often by social engineering or compromised or weak credentials
3. 3PersistenceKeep access without breaking in again; may use C2, often via a RAT or rootkit
4. 4Lateral movementMove to other computers and accounts to escalate privileges
5. 5Taking actionCollect and exfiltrate data, disrupt services, or destroy data
6. 6Evading detectionRemove or edit log files, erase planted files such as malware

Key terms by phase: a foothold is a first point of access; to escalate privileges is to reach accounts with more permissions; to exfiltrate is to send stolen data out of the organization.

Case file: the Harborview breach

An adversary reads staff profiles on a professional networking site (reconnaissance), emails a convincing “payroll update” link to an accountant (initial access), installs a remote access trojan that checks in every night (persistence), uses it to reach the file server with an administrator’s account (lateral movement), copies the customer database out (taking action), then deletes the server’s login records (evading detection).

4. Assessing risk (2.1.D)

Risk exists when a threat can exploit a vulnerability to compromise an asset 2.1.D.1. An asset is anything valuable: financial resources, intellectual property, data, digital infrastructure, physical property and reputation 2.1.D.2.

Anatomy of risk: a threat exploits a vulnerability to compromise an asset

[2.1.D] All three parts must be present. Remove one, and the risk goes away.

Threatwho or what causes harm: an adversary or a disaster

exploits

Vulnerabilitya weakness or flaw that could let an asset be harmed

to compromise

Assetanything valuable: data, money, intellectual property, reputation

Rating a risk [2.1.D]

Severity high

Unlikely, high impact

Likely, high impact

Severity low

Unlikely, low impact

Likely, low impact

Unlikely

Likely

Likelihood

Likelihood goes up when

• the target is valuable to the adversary
• the exploit is well documented (needs low skill)
• likely adversaries are motivated and capable

Severity is often measured as financial cost, which can include reputational and operational impacts.

A risk assessment weighs two factors 2.1.D.3:

• Likelihood of an attack on that vulnerability. It rises with the value of the target to adversaries, falls with the skill required (well-documented exploits need less skill, so more adversaries can use them), and depends on the motivation and capabilities of likely adversaries 2.1.D.4.
• Severity of the damage, often measured as financial cost, including reputational and operational impact 2.1.D.5.

Example: a ransomware gang ignores a tiny charity’s website, but a group angry about the charity’s stance might target it for publicity. Value depends on who is looking.

Results can be quantitative (a number, such as a score from 1 to 10 or an expected yearly loss) or qualitative (descriptive levels, such as low, medium, high or severe) 2.1.D.6.

Risk assessment documentation should include 2.1.D.7:

• vulnerable assets and their value
• likely threats to those assets
• specific vulnerabilities and how they would be exploited
• the severity of damage (financial, operational, reputational) and the likelihood
• a final quantitative or qualitative rating for each risk

5. Managing risk (2.1.E)

Once a risk is assessed, there are four options 2.1.E.1:

Option	Meaning	Example
Avoid 2.1.E.2	Stop the activity causing the risk. Impossible if the activity is core to the organization’s mission.	A club deletes an old member database it no longer needs.
Transfer 2.1.E.3	Move the burden to someone else, such as an insurance company, a government or consumers.	A company buys cyber insurance.
Mitigate 2.1.E.4	Put security controls in place to reduce the likelihood or impact.	A school installs badge readers and multifactor authentication (MFA).
Accept 2.1.E.5	Acknowledge the residual risk left after avoiding, transferring and mitigating. Absolute security is unattainable.	Leadership signs off on the risk that is left.

Organizations favor controls that are cost effective and easy to implement and maintain. A cost-effective control costs less to install and maintain than the expected loss from an attack 2.1.E.6. A $500 lock against a $20,000 expected loss is cost-effective; a $50,000 guard for the same loss is not.

6. Security controls (2.1.F)

Every security control supports at least one of three principles 2.1.F.1:

• Confidentiality: only authorized people, systems or processes can access data. Without it: data theft or destruction.
• Integrity: data are accurate and trustworthy. Without it: data manipulation.
• Availability: data and services are accessible to authorized people when needed. Without it: unexpected downtime.

Controls are classified two ways.

By type 2.1.F.2	What it does	Examples
Physical	Provides security in the physical space	Locks, fences, cameras, bollards (short sturdy posts that stop vehicles), security guards
Technical	Provides security in the digital space	Firewalls, anti-malware software, encryption
Managerial	Provides rules, guidelines, policies and procedures	Password policies, regular access reviews, incident response plans (IRPs)

Some controls serve more than one function: a guard can prevent entry and also detect it.

By function 2.1.F.3	Goal	Examples
Preventative	Stop the attack	Locks, encryption
Detective	Identify attacks when they happen	Intrusion detection systems (IDSs), cameras, security incident and event management (SIEM) systems
Corrective	Fix problems and restore operation	Vulnerability patching, repairing a broken card reader, intrusion prevention systems (IPSs)

Put the two together and you get a grid:

Type ↓ / Function →	Preventative	Detective	Corrective
Physical	Locks, fences, bollards	Cameras, security guards	Repairing a broken card reader
Technical	Encryption, firewalls, anti-malware	IDS, SIEM	Vulnerability patching, IPS
Managerial	Password policies	Regular access reviews	Incident response plan

The CED lists examples by type and by function separately; where an example sits in this grid outside those lists is our placement, so learn the lists first. A camera is both a physical control (type) and a detective control (function). Always ask both questions.

7. Defense in depth (2.1.G)

A defense-in-depth strategy, also called layered defense, uses several types of security controls together 2.1.G.1. Why it is necessary:

• Different threats get the control best suited to stop each one 2.1.G.2.
• Resilience: if an adversary bypasses one control, another can still block access or limit the damage 2.1.G.3. If a laptop is stolen, the physical layer has failed, but encryption at the data layer still keeps the files unreadable.

Layers can include human, physical, network, device, application and data 2.1.G.4. Units 2 to 5 of the course follow these layers: spaces, networks, devices, then applications and data.

Defense in depth: when one layer is bypassed, the next can still stop the adversary

[2.1.G] Layers from the CED, outside in, with example controls.

Humansecurity awareness training

Physicallocks, fences, cameras

Networkfirewalls · adversary stopped here, after getting past two layers

Deviceanti-malware

Applicationsoftware updates

Dataencryption

Why layers? [2.1.G]

1. Different threats need different controls.
2. When one control is bypassed, another can still block access or limit the damage.
3. Layers can include human, physical, network, device, application and data.

1. Five physical attacks (2.2.A)

Physical attacks often lean on social engineering 2.2.A.1.

Attack	How it works
Piggybacking 2.2.A.2	The adversary manipulates an authorized person into granting access to a restricted area: carrying something bulky so they hold the door, “forgetting” a badge, or posing as a maintenance worker who needs to inspect something.
Tailgating 2.2.A.3	The adversary follows close behind an authorized person, without that person noticing.
Shoulder surfing 2.2.A.4	The adversary watches someone access sensitive information, sometimes recording it with a camera, to use it later.
Dumpster diving 2.2.A.5	The adversary searches the target’s physical trash, including recycling bins, for useful information.
Card cloning 2.2.A.6	The adversary copies an authorized user’s access card and gains everything that user can access. Warning sign: a real staff badge used by someone who is not that person, or in two places at once.

Piggybacking vs tailgating: did the employee know?

Both get an unauthorized person into a restricted area. The difference is the employee's awareness.

Piggybacking [2.2.A]The employee says "I'll get the door" and holds it open.The employee knowingly lets them in. Tricks: carrying boxes, "forgot my badge", a fake repair.

Tailgating [2.2.A]The employee walks through and does not notice.The employee does not know. The adversary follows close behind.

Stops both: an access control vestibule or turnstile [2.3.B]. Detects both: a badge door sensor records how long the door stays open; in the entry logs, a door open longer than normal can show potential piggybacking or tailgating [2.4.C.3].

2. How threats exploit physical vulnerabilities (2.2.B)

Threats include human adversaries and natural disasters, which can damage or destroy computers and data and disrupt digital services 2.2.B.1.

Vulnerabilities are weaknesses or flaws that could let an asset be compromised. Common results are unauthorized access to data or restricted spaces, disruption of services, theft or destruction of resources, and unauthorized modification of data 2.2.B.2.

What physical access gives an adversary:

• Power disruption: damaging fuses or breakers, cutting or unplugging wiring, or damaging substations and transformers takes a device and its services offline 2.2.B.3.
• Information theft: in a room with sensitive information, they can steal or copy it 2.2.B.4.
• Device ports: plugging in a keylogger (often a small plug placed between the keyboard and the computer, easy to miss) or a Universal Serial Bus (USB) drive with malware can capture what a user types or even take control of the device. They can also physically destroy the device, its data and its services 2.2.B.5.

3. Rating physical risk (2.2.C)

Physical access can bypass many technical controls and layers of security 2.2.C.1. Rate a physical risk by asking three questions in order: Is sensitive information or a sensitive system exposed without restricted, controlled access? (high) If not, is a noncritical part left unprotected so it could be a foothold to other resources? (moderate) If not, is the asset low value and the vulnerability unlikely to be exploited? (low)

Rating	When	Example
High 2.2.C.2	Sensitive information or systems sit in physical spaces without enough restricted, controlled access	A tutoring center keeps student files and payment records on a computer in an unlocked back office that visitors walk past.
Moderate 2.2.C.3	A noncritical, nonsensitive area is unprotected and could be a foothold to other resources	A reception computer holds no sensitive files, but it is connected to the staff Wi-Fi network and has open USB ports.
Low 2.2.C.4	The asset has low value and the vulnerability is unlikely to be exploited	A wall display in a staff kitchen shows only the weather and holds no logins.

1. Managerial controls for physical security (2.3.A)

Security awareness training teaches employees how they keep the organization safe 2.3.A.1:

• detecting social engineering attempts such as phishing
• not badging other people into restricted areas
• preventing device theft

A workstation security policy sets out how to protect a physical workplace. It may have tiers depending on the data a workstation handles 2.3.A.2. Policies often require:

• locking devices before leaving them unattended
• clearing sensitive documents away (a clean desk policy)
• a privacy screen filter or other barrier so others cannot read the screen
• plugging devices into surge protectors or an uninterruptible power supply (UPS)

2. Choosing mitigations (2.3.B)

To pick a control, a defender asks how an adversary could use the vulnerability, then how to prevent, detect or correct that attack 2.3.B.1.

Control	What it does	Stops
Fences, gates, bollards 2.3.B.2	Deter adversaries from trying to reach the building	Unauthorized approach
Locks on doors, server cabinets and computers 2.3.B.3	Prevent devices from being accessed or stolen	Theft, tampering
Card readers 2.3.B.4	Record which badge opened which entry and when, and deny unauthorized badges	Unauthorized entry
Access control vestibules and turnstiles 2.3.B.5	Stop an authorized person from admitting an unauthorized one, on purpose or by accident	Piggybacking, tailgating
Disabled USB ports 2.3.B.6	Stop external drives from loading malware	Malware on external drives
UPS and power generators 2.3.B.7	A UPS keeps a device running in a power outage; generators power a building or critical devices	Power disruption

Prioritize by the severity of each risk and the cost of the mitigation 2.3.B.8.

Case file: the library makerspace

The makerspace has 3D printers, a shared laptop with student design files, and a back door to the loading dock that is often propped open. Ranked plan: lock the back door and fit a closer (high risk, low cost), lock the laptop to the bench with a cable and set an auto-lock (moderate, low cost), then consider a card reader on the main door later (moderate, higher cost).

1. What detects physical attacks (2.4.A)

Detector	How it helps
Cameras 2.4.A.1	Capture a visual record of malicious activity. Record and monitor the feed; recordings are especially useful in investigations after an incident.
Security guards 2.4.A.2	Watch an area and respond to suspicious activity.
Motion sensors 2.4.A.3	Alert security to movement in an area.
Employees 2.4.A.4	Often the first to notice someone who does not belong, and can alert security.

2. Placing detection controls (2.4.B)

• Cameras: consider coverage, angle and how easily an adversary could tamper with them, plus what the camera would capture and how that would help. Points of ingress and egress (entries and exits) are common choices 2.4.B.1.
• Motion sensors: place them where traffic is unexpected, such as server rooms or storage for sensitive materials. In busy areas they cause false alarms, and real alerts get ignored 2.4.B.2.
• Locks: on every entry to areas with sensitive information or systems. For the most sensitive areas, an access control vestibule stops piggybacking and tailgating 2.4.B.3.
• Guards 2.4.B.4:

Stationary guards	Patrolling guards
Constant protection of one area, entrance or high-value item	Harder for an adversary to plan around; create time pressure
Best where traffic funnels: entry gates, main lobbies, entrances to secure areas	Best for perimeters and exterior areas

Put detection where adversaries must pass, and sensors where no one should be

[2.4.B] A made-up floor plan. Letters show where each control goes.

1. CCameraentrances, exits, sensitive doors; record and monitor
2. MMotion sensorwhere no traffic is expected (busy areas cause false alarms)
3. GStationary guardwhere traffic funnels: gates, main entrances
4. PPatrolling guardperimeter and exterior; hard to plan around
5. VVestibulemost sensitive entry; stops piggybacking and tailgating
6. LLockevery entry to areas with sensitive information

3. Detection techniques in action (2.4.C)

• Cameras give live and recorded footage. With facial recognition software they can alert when an unauthorized person enters a controlled area, and after a breach, defenders use footage to trace the adversary’s path and actions 2.4.C.1.
• Motion detectors work best with cameras: when a sensor fires, defenders check the camera to confirm a real breach 2.4.C.2.
• Badge logs: when a door is unlocked with an electronic badge, a sensor records how long it stays open. A door open longer than normal can signal piggybacking or tailgating 2.4.C.3.

Try reading a real-style badge log below.