IS6523 Chap.2 Attack Methods and the Threat Landscape
Attack Methods and the Threat Landscape
Four words that carry the whole session
An attack is an act that exploits a vulnerability, meaning an identified weakness, in a controlled system, accomplished by a threat agent that damages or steals an organisation's information. A threat is something else entirely: an object, person or other entity representing a constant danger to an asset. The distinction is that a threat stands whether or not anyone acts.
Most confusion in this area is one of those words used where another belongs, and the later risk identification work walks the chain from asset back to weakness, which only functions if the links are kept apart.
Arrange the catalogue by what each entry exploits
The list of named attacks is long, running through malicious code, hoaxes, defacement, back doors, password cracking, brute force and dictionary guessing, denial of service in single and distributed forms, spoofing, interception in transit, unsolicited mail, sniffers, phishing, pharming, clickjacking, prompt injection, social engineering, structured query injection, ransomware and crime tooling sold as a service.
Memorising names is the least useful thing to do with it, because a question describes a situation instead of naming a technique.
What is worth carrying is what each one exploits, since that determines whether any control has a chance against it, and several of them exploit a person or an interface rather than a machine.
Half the threat list has nobody behind it
The threat categories include compromises to intellectual property, software attacks, deviations in quality of service, espionage or trespass, forces of nature, human error or failure, information extortion, sabotage or vandalism, theft, technical hardware and software failures, and technological obsolescence.
Several of those involve no hostile party at all, and the session states that staff rank among the largest dangers to the data an organisation holds, through acts performed without malicious intent. An answer that equates security with defence against attackers has discarded a large part of the published list.
What this chapter covers
- 01
Threat agent, threat, vulnerability, attack and loss as one chain
- 02
Why a hoax is classified as an attack
- 03
Password cracking, brute force and dictionary guessing as three different costs
- 04
Denial of service and the connection negotiation it abuses
- 05
Attacks that exploit a person or an interface rather than a system
- 06
Prompt injection as an attack surface specific to language models
- 07
Threat categories with no attacker behind them
- 08
Steganography against encryption
Sort four help desk records into their published categories
- 3Place the software and the missing hardware.
- 3Place the mailing, and say why its classification is not obvious.
- 2Place the card readers and name the control class.
Key terms
- Attack
- An act or action exploiting an identified weakness in a controlled system, carried out by a threat agent that damages or steals information.
- Threat Agent
- The actor that carries out an attack. Removing one leaves the threat standing, because another agent inherits it.
- Hoax
- A false warning sent as though it were genuine. The course classes it among attack types and calls it the more devious form when a real payload rides along with it.
- Dictionary Attack
- An attack that targets specific accounts and guides its guesses with commonly used passwords, so its cost is set by human habit rather than by the size of the key space.
- Distributed Denial of Service
- A coordinated stream of requests launched against one target from many locations at once, so that legitimate requests cannot be served.
- Pharming
- The redirection of legitimate traffic, such as a browser request, to an illegitimate site in order to obtain private information.
- Prompt Injection
- An attack surface specific to large language models, in which crafted text manipulates the model's output. The course divides it into direct and indirect forms and treats it as more dangerous where the model can reach external tools.
- Steganography
- The concealment of the existence of a message, typically inside files that appear to hold images or audio. It differs from encryption, which conceals content while advertising that a message exists.
Attack Methods and the Threat Landscape FAQ
What is the practical difference between a threat and a vulnerability?
A threat is an entity that represents a standing danger to an asset and exists independently of anything the organisation does. A vulnerability is an identified weakness inside a system the organisation controls, which is why it is the only one of the two that can be removed. Every control recommendation you write is a claim about a vulnerability, and a proposal to remove a threat is a category error a marker will notice.
Why does the session put the connection handshake next to denial of service?
To show that the attack spends a resource rather than breaking anything. A connection oriented protocol has to negotiate sequence and acknowledgement fields before two devices communicate, and the defender holds state during that negotiation. Flooding the first step and never completing the third consumes that state faster than it can be released, which is why the answers are capacity and filtering rather than repair.
Does the course treat social engineering as a real attack category?
It does, and it gives it unusual emphasis with a practitioner quotation about people being the weakest link and the best technology being bypassed by a telephone call to an unsuspecting employee. The consequence for an answer is that controls addressing a person, training, verification channels and instructions about what a message may ask, belong in the same list as technical devices rather than as an afterthought to it.
Which of the newer attack names does the course single out, and why?
Two. Prompt injection, because language models increasingly carry tools that fetch information, perform calculations or generate content, so a manipulated instruction reaches beyond the conversation. And crime tooling sold as a service, which changes nothing about a mechanism but removes the requirement that an attacker possess any of the skill the attack needs, widening the population capable of using it.
Exam move
Write the five links of the chain on one line, then take any three named attacks and say which link each one occupies. Next, cover the threat category list and reproduce it, then mark every entry that involves no hostile party; if you recover fewer than four of those you have been reading the session as a list of attackers.
Finish by stating in one sentence what a control that detects encrypted traffic would do about a hidden message.
Working through Attack Methods and the Threat Landscape in IS6523? Sia is AskSia’s AI Information Technology tutor — ask any IS6523 Attack Methods and the Threat Landscape question and get a clear, step-by-step explanation grounded in how IS6523 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.
