2.1 - Cyber Foundations
Social Engineering Psychological Tactics
Different psychological principles make social engineering effective by exploiting how people naturally think and react.
Social engineers use these tactics to manipulate a target into taking a desired action, like sharing a password, clicking a link, opening an attachment, sending money, or holding a door open. A single message often stacks two or three tactics at once, so it helps to know the clue for each one.
Pretexting
Pretexting means making up a believable scenario that gives the attacker a reason to contact the target. They build a detailed backstory and play a role that makes their request feel legitimate, convincing enough that the target doesn't think to question it.
Example: an attacker calls an employee claiming to be from the company's IT vendor doing a "scheduled security audit," referencing real systems and recent IT announcements to sound credible. The employee, believing it's legit, hands over system access credentials because the elaborate backstory made the request feel routine.
Authority
Authority plays on people's tendency to comply with anyone who seems to have power or legitimate control, whether the attacker is impersonating that person directly or just claiming to act on their behalf.
Example: an attacker sends an email that looks like it's from "Michael Chen, CEO," asking finance to urgently process a wire transfer for a "confidential acquisition." The actual email address has a subtle typo (a hyphen that shouldn't be there), but the perceived authority of the CEO title makes the recipient focus on complying fast rather than checking who actually sent it.
Intimidation
Intimidation creates fear of consequences, like punishment, legal trouble, or losing a job, to pressure someone into compliance without stopping to verify anything.
Example: an email claiming to be from a "Cybersecurity Compliance Division" says the recipient's computer was involved in "unauthorized data access," and that failing to click a link immediately will result in termination and a criminal investigation within 24 hours. The panic that creates stops the recipient from noticing it's fake.
Consensus (Social Proof)
Consensus plays on people following what others are doing, especially when a situation is ambiguous. If it looks like everyone else is already doing something, it seems safe and normal.
Example: a fake company-wide message says all employees must re-verify their credentials by Friday, and that 85% of staff have already done it. That false statistic pressures people into thinking "well if most people already did this, it must be fine," and they click the malicious link.
Scarcity
Scarcity makes something feel limited or about to disappear, which pushes people to act fast instead of thinking it through, since people react more strongly to potential loss than to an equivalent gain.
Example: a phishing email offers a $500 bonus to the "first 50 employees" who enroll in a new benefits portal, claiming only 7 spots are left. That artificial scarcity creates urgency and competition, and employees rush to click before questioning whether the offer is even real.
Familiarity (Trust)
Familiarity exploits existing relationships and trust. The attacker pretends to know the target personally or claims a shared connection to build rapport and lower the target's guard.
Example: an attacker finds through LinkedIn that a target and someone named Jennifer Rodriguez went to the same college, then calls claiming to be from Jennifer's team, mentioning the shared school to build a sense of connection. That false familiarity makes the target more willing to share information they'd normally protect.
Familiarity also covers pretending to be someone close to the target, not just to know them. For example, a text from an unknown number says "Hey, it's your sister, my phone broke so I'm using a friend's. Can you send me the code that just came to your phone?" The adversary is borrowing the trust the target already has in a family member.
Urgency
Urgency creates artificial time pressure that forces quick decisions and prevents careful evaluation, since people shift into reactive mode instead of analytical mode when a deadline looms.
Example: a text says an account shows unauthorized access from another country and gives the recipient 15 minutes to verify their identity or lose all their data. That tight deadline creates panic, and the person clicks the link without stopping to think about whether a real organization would even communicate that way.
Telling the Tactics Apart
To name the tactic, look for the clue in the message itself:
Tactic | What the adversary does | Clue to look for |
Pretexting | Makes up a believable reason to contact the target | A detailed backstory or role, like "I'm from IT, running the scheduled audit" |
Authority | Pretends to be someone with power over the target, or passes along that person's "instructions" | A boss, CEO, police officer, or admin title |
Intimidation | States negative consequences if demands aren't met | Threats like "you'll be fired" or "we'll report you" |
Consensus | Makes it seem like everyone else is already doing it | "85% of staff have already verified" |
Scarcity | Makes something seem limited | "Only 7 spots left" |
Familiarity | Pretends to be or know someone close to the target | A friend's or relative's name, or a shared school or team |
Urgency | Sets a deadline the target has to beat to avoid something bad | "Within 15 minutes" or "by end of day" |
Three of these get mixed up a lot. Intimidation is the threat itself (you'll lose your job), urgency is the clock (you have one hour to stop it), and scarcity is a limited supply of something you want (only a few spots left). One message can use all three.
Types of Adversaries
Script Kiddies
Low-skilled attackers who use tools built by others without really understanding how they work, relying on pre-built exploit kits, automated tools, and step-by-step tutorials. They typically target known vulnerabilities and can't adapt if their tools get blocked. Their motivation is usually small-scale financial gain or just proving their skills to peers.
Example: a teenager downloads a free ransomware kit from a forum and deploys it against small businesses with outdated systems, following the included instructions. When one target has updated security that blocks the attack, they simply move on since they can't modify the malware themselves.
Hacktivists
Attackers driven by social, political, or personal causes, who believe their goals justify breaking the law. They target organizations that oppose their values and often publicize their attacks to maximize awareness.
Example: an environmental activist group opposed to a company's logging practices breaches its network, leaks internal emails showing regulatory violations, defaces the corporate website, and posts stolen documents publicly. Their goal isn't money, it's exposing what they see as harmful practices.
Insider Adversaries
These are uniquely dangerous because they already have legitimate access and can operate inside the security perimeter that would normally block outside attackers. Motivations range from greed (selling data or IP), to revenge (sabotage after being fired or demoted), to being recruited or bribed by outside actors.
Example: a database administrator with access to customer records takes $50,000 from a competitor to steal the entire customer database. Since their access is legitimate and expected, the export doesn't trigger any alerts, bypassing perimeter security entirely simply because they were already inside.
Cyberterrorists
Motivated by political ideology, aiming to disrupt entire communities or nations by targeting critical infrastructure like power grids, water systems, transportation, or healthcare, seeking maximum disruption and fear.
Example: a politically motivated group attacks a region's power grid during winter, compromising the industrial control systems and causing blackouts that hit hospitals, emergency services, and hundreds of thousands of homes, aiming to create chaos and shake public confidence in the government.
Cyberterrorists can act on their own or on behalf of a government or a criminal organization. What sets them apart is the target and the goal: they go after civil infrastructure like power grids and water treatment plants to disrupt whole communities, regions, or nations for a political cause or belief, not for money.
Transnational Criminal Organizations
Well-funded, organized groups operating across borders, mainly after financial gain through sophisticated operations like ransomware and stealing intellectual property to sell to competitors or on illegal markets.
Example: an organized cybercrime group based in Eastern Europe specializes in ransomware against hospitals, employing developers, social engineers, negotiators, and money launderers like a real business. Over 18 months, they hit 47 hospitals across multiple countries and pull in $23 million in ransom, even offering "customer service" to help victims recover files after paying.
Comparing Adversaries
Adversary | Main motivation | What sets them apart |
Script kiddies | Greed or recognition | Low skill; use tools others built without understanding how they work |
Hacktivists | Social, political, or personal causes | Believe their goals justify illegal methods; often publicize their attacks |
Insider adversaries | Greed or revenge (sometimes recruited by outsiders) | Already have legitimate credentials and access to systems and data |
Cyberterrorists | Politics or beliefs | Disrupt communities, regions, or nations by attacking civil infrastructure |
Transnational criminal organizations | Financial gain | Deploy ransomware and steal intellectual property (IP) to sell in illegal markets |
Phases of a Cyberattack
Attacks tend to move through these general stages, though not every attack hits every phase.
Every cyberattack aims to disrupt, harm, steal, or destroy devices, networks, or data. In order, the six phases are reconnaissance, initial access, persistence, lateral movement, taking action, and evading detection.
Phase 1: Reconnaissance
Gathering information about the target before making any direct contact, mostly through open source intelligence (OSINT), which is publicly available info requiring no hacking at all. This includes social media, company websites, public records, technical data like DNS records, news articles, and old data breach dumps.
Example: attackers targeting a pharmaceutical company spend two weeks finding employees on LinkedIn, learning the IT director's name and email format, discovering the software the company uses from job postings, finding an old breach that might reveal reused passwords, and locating the company's IP ranges to scan for exposed services. All of this happens before any actual attack.
Physical recon works the same way, like noticing an unlocked server room accessed through an unmonitored hallway.
Phase 2: Initial Access
This is when the attacker gets their first actual foothold, through social engineering, using stolen or purchased credentials, exploiting weak passwords or missing MFA, or exploiting vulnerable, unpatched, or misconfigured services.
Example: a spear-phishing email to the finance team includes an attachment that installs malware through a macro when opened, giving the attacker remote access to that employee's computer. That's their first foothold. Physically, this could look like a fake delivery person dropping a malicious USB drive near a reception desk that someone plugs in out of curiosity.
Phase 3: Persistence
Once inside, attackers set up ways to keep their access even through reboots or dropped connections, using things like command and control channels, remote access trojans, rootkits hidden deep in the system, scheduled tasks, hidden admin accounts, or registry changes that auto-run malware at startup.
Example: after compromising a workstation, the attacker installs a RAT that checks in with their server every 30 minutes, disguising its traffic as normal HTTPS. Even if the user restarts their computer, the connection re-establishes automatically, giving the attacker weeks of access without needing to break in again. Physically, this could look like someone stealing an unattended laptop during lunch, planting malware, and returning it before anyone notices.
Three terms come up in this phase. A command and control (C2) protocol is how the adversary talks to a compromised device: it sends commands to the device and receives the output back. A remote access trojan (RAT) is malware hidden inside software that seems harmless, and it gives the adversary remote access to the device. A rootkit is sophisticated malware that gets into the operating system, can control nearly every part of it, and hides itself from detection. Unit 4 covers both kinds of malware in more detail.
Phase 4: Lateral Movement
Expanding access beyond that first compromised system, aiming to escalate privileges, reach valuable servers, map the internal network, and harvest more credentials.
Example: an attacker who compromised a marketing employee's laptop extracts cached credentials from memory, finds they'd recently accessed a shared file server, gets in there, finds a spreadsheet with IT department passwords, and uses those to reach the domain controller, effectively taking over the whole network.
Escalating privileges means moving from an account with limited permissions, like a regular employee's, to computers and accounts with elevated permissions, like an IT administrator's account that can reach services and data a normal user can't. The more privileges the adversary has, the more damage they can do in the next phase.
Phase 5: Taking Action
This is when attackers actually carry out their real objective, whether that's gathering and stealing data, disrupting services, destroying data, or deploying ransomware.
Example: after weeks of recon and lateral movement, attackers reach the engineering department's file servers with proprietary product designs. Over several low-traffic nights, they quietly exfiltrate 450GB of CAD files and technical specs, which get sold to a competitor. The company doesn't even find out until a competitor releases suspiciously similar products six months later.
Exfiltration means copying data out of the target's network to a place the adversary controls, like the 450GB of files in the example. Not every attack is about stealing data, though. Depending on the goal, adversaries may disrupt services (like knocking a website offline) or destroy data instead.
Phase 6: Evading Detection
Many attackers try to cover their tracks afterward to make investigation harder, by deleting or altering logs, changing timestamps, removing their tools, clearing command history, or disabling security tools.
Example: after stealing data, the attacker deletes their custom malware, clears PowerShell history, removes entries from event logs showing when they accessed things, and edits firewall logs to erase evidence of their connection to their command server. By the time the security team finds the breach, incomplete logs make it hard to know the full scope.
Risk Assessment Process
Understanding Risk Components
Risk happens when a threat can exploit a vulnerability to compromise an asset.
Assets are anything valuable, like money, intellectual property, data, digital infrastructure, physical property, or reputation. Vulnerabilities are weaknesses that can be exploited, whether technical, physical, human, or process-related. Threats are potential sources of harm, like attackers, insiders, natural disasters, or system failures.
Risk is basically threat times vulnerability times asset value. If any one of those is zero, there's no real risk. A valuable asset with no vulnerabilities isn't at risk, and a huge vulnerability in a worthless asset doesn't matter much either.
A risk assessment rates each risk using two factors: the likelihood of an attack against a specific vulnerability, and the severity of the damage that attack would cause. The next two sections cover each one.
Assessing Likelihood
A few things drive how likely a vulnerability is to actually get exploited: how valuable the target is (a database of credit cards attracts way more attention than a newsletter list), how easy the exploit is to pull off (a simple script is more likely to get used than something requiring months of custom development), and how motivated and skilled the adversary is (a nation-state going after defense contractors will attempt things a script kiddie never could).
Example: a hacktivist upset about illegal fishing practices targets a food company's website. Even though defacing the site brings no money, it raises awareness for their cause, so the likelihood of attack is high despite the limited financial payoff, because it lines up with what actually motivates them.
Difficulty also depends on how well known the exploit is. When a vulnerability has a well-documented exploit (the method is already published, often with ready-made tools), it takes much less skill, so far more adversaries, including script kiddies, can pull it off. That makes it more likely to be exploited than a vulnerability only a highly skilled adversary could use.
Assessing Severity
Severity is about how much damage a successful attack could cause, usually measured in financial terms covering direct costs, recovery costs, regulatory fines, and lost productivity, plus operational impacts like disruptions and reputational impacts like lost trust and damaged brand.
Example: a breach exposing 500,000 customer records could rack up $2,000,000 in fines, $500,000 in incident response, $1,200,000 in customer notification and credit monitoring, and $3,000,000 in lost revenue from customers leaving, on top of reputational damage that's hard to even put a number on, adding up to roughly $6,700,000 in quantifiable impact alone.
Risk Rating Methods
Quantitative assessment assigns numbers, either on a scale (likelihood times impact, both rated 1 to 10, giving a risk score) or in dollars, like annualized loss expectancy, which is the cost of a single loss multiplied by how often it's expected to happen in a year. If a breach costs $500,000 and happens roughly once every 5 years, that works out to about $100,000 of expected loss per year.
Qualitative assessment uses categories instead of precise numbers, like low, medium, high, and critical, or a simple two-axis scale like "unlikely, low impact" versus "likely, high impact." For example, an unpatched web server open to the internet would land as likely and high impact, making it critical risk, while weak passwords on an internal test system might be unlikely and low impact, making it low risk.
Scales vary between organizations. Another common qualitative scale is low, medium, high, severe. The two-axis version gives four categories:
Low impact | High impact | |
Unlikely | Unlikely low impact (lowest priority) | Unlikely high impact |
Likely | Likely low impact | Likely high impact (highest priority) |
Documenting a Risk Assessment
A thorough assessment documents the asset and its value, a description of the threat, details of the vulnerability, an explanation of potential severity, an assessment of likelihood, and a final risk rating.
Example: a customer database holding 2 million records including payment info faces threats from external attackers after financial gain and insiders looking to sell data. The vulnerability is a SQL injection flaw in the search function. Financial impact could hit $6,700,000 in fines and lost revenue, with real operational and reputational damage on top. Since the exploit is easy to pull off, the target is valuable, and attacker motivation is high, the overall likelihood is high, giving a risk score around 90 out of 100, or roughly $1,340,000 in annual risk, rating this a critical risk needing immediate action.
Risk Management Strategies
Once a risk has been identified and assessed, an organization has four options for managing it: avoid, transfer, mitigate, or accept. These often get combined. A company might mitigate a risk with controls, transfer part of what's left with insurance, and accept the small amount that still remains.
Avoidance means eliminating the risky activity entirely. This works for non-essential activities, like a hospital shutting down a rarely-used patient portal that would cost a fortune to secure properly instead of investing in fixing it. It doesn't work for anything critical to the business, since you can't just shut down your e-commerce site to avoid its security risks.
Transference shifts the burden elsewhere, through cyber insurance, outsourcing, contract terms, or passing costs to customers. For example, a small business pays $25,000 a year for $2,000,000 in cyber insurance coverage, so if an $800,000 breach happens, the insurer covers it. That said, transference only moves the financial hit, not the operational or reputational damage, and the organization is still ultimately responsible for the incident.
The burden can land on an insurance company, a government, or consumers. For example, a business with a data center in a flood zone can buy flood insurance through the National Flood Insurance Program, which the US government runs through FEMA, so the government pays for covered flood damage instead of the business. Passing the risk to consumers usually means building expected losses into prices, the way stores factor theft and fraud into what they charge.
Mitigation means putting controls in place to reduce likelihood or impact, and it's the most common approach. Reducing likelihood might mean patching, firewalls, strong authentication, or training. Reducing impact might mean encryption, network segmentation, backups, or incident response plans. For example, a company with SQL injection vulnerabilities (risk score 90/100) deploys a web application firewall, switches to parameterized queries, tightens database permissions, and improves logging, dropping their risk score down to about 20/100. The risk isn't gone, just much smaller.
Acceptance acknowledges that some risk always remains after avoidance, transference, and mitigation, called residual risk, and consciously decides it's tolerable. This makes sense when the residual risk is low enough, or when further mitigation would cost more than the risk itself. For example, if adding 24/7 armed guards to prevent a $50,000 theoretical annual risk would cost $400,000 a year, the organization just accepts the risk instead, and documents that decision formally so leadership is clearly aware of it rather than ignoring it.
Cost-Effectiveness
A control is worth it if it costs less than the risk it prevents. For example, spending $30,000 a year on security awareness training that cuts $200,000 in average annual phishing losses by 70% (avoiding $140,000) is clearly worth it. On the flip side, spending $75,000 a year on specialized hardware to address a risk only worth $10,000 a year isn't worth it, so the organization would accept that risk or find a cheaper fix instead. It's also worth considering whether a solution is actually practical to maintain, since something that needs three full-time staff to run might not make sense even if it looks good on paper.
Types of Security Controls
CIA Triad
Confidentiality means only authorized people or systems can access data, protected through things like encryption, access controls, authentication, and data classification.
Integrity means data stays accurate and unaltered, protected through hash functions, digital signatures, checksums, version control, and change management.
Availability means data and services stay accessible to the people who need them, protected through redundancy, backups, load balancing, DDoS protection, and disaster recovery.
Example: a hospital's patient database needs all three at once, confidentiality so only authorized staff see records, integrity so those records stay accurate, and availability so doctors can pull up patient info during an emergency.
Every security control addresses at least one of these three principles. It also helps to know what goes wrong when one is missing: systems lacking confidentiality are vulnerable to data theft or destruction, systems lacking integrity are vulnerable to data manipulation (like an adversary changing grades or account balances), and systems lacking availability may experience unexpected downtime.
Controls by Type
Physical controls protect physical spaces: locks, fences, cameras, guards, badge readers, biometric scanners, and mantrap entries.
Technical controls protect digital spaces: firewalls, anti-malware, encryption, intrusion detection systems, MFA, access control lists, VPNs, and security information and event management (SIEM) systems.
Managerial controls are the rules, policies, and procedures: password policies, access reviews, incident response plans, security awareness training, acceptable use policies, change management, and business continuity plans.
Controls by Function
Preventative controls stop attacks before they happen, like locks, encryption, firewalls, authentication, input validation, and security training.
Detective controls identify attacks as they happen, like intrusion detection systems, cameras, SIEM correlation, log monitoring, file integrity monitoring, and security audits.
Corrective controls fix things and restore normal operation after an incident, like patching, intrusion prevention systems, backup restoration, incident response procedures, repairs, and account lockouts.
A useful distinction: an IDS (intrusion detection system) is detective, it monitors and alerts but doesn't block anything on its own. An IPS (intrusion prevention system) is corrective, since it actively blocks threats in addition to detecting them.
Putting Type and Function Together
Every control has both a type (what kind of control it is) and a function (what it does). A lock is a physical preventative control, a camera is a physical detective control, and an IPS is a technical corrective control. Some examples:
Physical | Technical | Managerial | |
Preventative | Locks, fences, bollards | Encryption, firewalls | Password policies, security awareness training |
Detective | Cameras, motion sensors | IDSs, SIEM systems | Regular access reviews |
Corrective | Repairing a broken card reader | Vulnerability patching, IPSs | Incident response plans (IRPs) |
Defense in Depth
Defense in depth means layering multiple types of security controls so that one failure doesn't lead to total compromise.
Why It's Necessary
Relying on a single control creates a single point of failure. For example, a company protecting sensitive data with only a firewall is fully exposed the moment an employee falls for phishing and hands over credentials, since the attacker just walks in through legitimate authentication with nothing else stopping them.
Different threats also need different controls: physical intrusion needs locks and cameras, network attacks need firewalls and IDS, malware needs anti-malware software, social engineering needs training, and insider threats need access controls and audit logging. No single control handles all of that.
How Layers Provide Resilience
Even when one layer fails, others can still catch the problem. In one example, an employee clicks a phishing link despite training (layer 1 fails), the email gateway blocks the attachment but the employee still clicks a link (layer 2 partially fails since the domain is too new to be blocked), the endpoint protection catches and quarantines the malware attempt through behavioral analysis (layer 3 succeeds), and even if it hadn't, network segmentation would have stopped lateral movement to sensitive servers (layer 4), database authentication with MFA would have stopped unauthorized access (layer 5), and encryption at rest would have made stolen data unreadable anyway (layer 6). Despite the very first layer failing, the attack still gets stopped, and even further failures would have been caught downstream. Compare that to relying on employee training alone, where that one failure means total compromise.
The Layers
A full defense in depth strategy covers the human layer (training, phishing simulations, reporting channels), the physical layer (locks, cameras, guards, badge access), the network layer (firewalls, IDS/IPS, segmentation, VPNs), the device layer (endpoint protection, patching, encryption), the application layer (secure coding, input validation, authentication), and the data layer (encryption, classification, access controls, backups).
The AP course framework draws defense in depth as a stack of layers: the physical perimeter at the base, then the network, then the device, then data and applications on top. Policy and governance surrounds the whole stack, since policies apply at every layer. Example controls at each layer:
Layer | Example controls |
Policy and governance | Security policies, like password policies and acceptable use policies |
Physical perimeter | Locks, security guards, gates and fences, cameras |
Network | Authentication mechanisms, encryption, firewalls, network segmentation |
Device | Endpoint detection and response (EDR), authentication, anti-malware software, host-based firewalls |
Data and applications | Encryption, access controls, data loss prevention (DLP) software |
Example: a company protecting payment data might train employees on PCI-DSS requirements, lock down the server room with badges and cameras, segment the payment network away from the general network, harden and patch servers automatically, tokenize credit card numbers instead of storing them directly, and encrypt payment data end to end with keys stored in dedicated hardware. If an attacker gets through one layer, like phishing an employee, they still run into physical controls, network segmentation, hardened systems, application security, and encrypted data.
Benefits
Each layer requires different skills to bypass, which massively increases the effort and time an attack takes. More layers mean more chances to catch the attack before it succeeds. No single point of failure leads to full compromise. Organizations can adjust individual layers as threats evolve without rebuilding everything. And many compliance frameworks like PCI-DSS, HIPAA, and NIST actually require this layered approach. An attacker might get past recon and initial access but get caught during lateral movement, since each layer demands a different way of getting around it, making a fully successful attack exponentially harder than beating just one control.