FR FieldReady Academy
Unit 3ThreatsObjective 2.28 min read

Threat Vectors and Attack Surfaces

Unit 3: Threat Actors and Vectors. Lesson 11 of 54 in SecPlus Academy.

A threat vector is the path an attack takes in. The attack surface is the sum of every path available. Shrink the surface and you close vectors.

Message-based and content-based

  • Email, SMS, and instant messaging carry phishing links, malicious attachments, and fraudulent requests.
  • Image-based: malicious code hidden in image files or images that trigger vulnerable viewers.
  • File-based: documents with macros, executables disguised as documents, archives that hide payloads.
  • Voice call: vishing, where the attacker talks a person into acting.
  • Removable device: a USB drive left in a parking lot, or an infected drive carried between networks.

Software and systems

  • Vulnerable software: unpatched applications. Client-based scanning uses an installed agent; agentless scanning checks from outside. Both find the same gaps in different ways.
  • Unsupported systems: end-of-life operating systems and applications that no longer receive patches. Every new flaw stays open forever.
  • Open service ports: every listening service is a door; unused ones should be closed.
  • Default credentials: admin and password, still set on far too many devices.

Networks

  • Unsecure wireless: open or weakly encrypted Wi-Fi, evil twins.
  • Unsecure wired: live network jacks in public areas, no port security.
  • Bluetooth: pairing attacks and data theft from discoverable devices.

Supply chain

Attackers compromise something you trust and receive from others: a managed service provider with access to many customers, a vendor whose software update is poisoned, a supplier whose hardware arrives with malicious firmware. Defense: vendor assessment, verified updates, and monitoring what trusted parties do.

Shrinking the surface

Close unused ports, remove unneeded software, retire unsupported systems, change every default password, encrypt wireless, secure physical jacks, and treat every vendor connection as a vector to monitor.

Exam tip: "the update from the vendor contained malware" is a supply chain vector. "An old server that cannot be patched" is an unsupported system; isolate it or replace it. "Found a USB drive and plugged it in" is a removable device vector, and the fix is training plus device control.
Remember
Vectors: message, image, file, voice, removable media, vulnerable and unsupported software, open ports, defaults, unsecure networks, supply chain. Close the door you do not need.
Deeper explanation

Threat Vectors and Attack Surfaces, explained slowly

Doors, and the number of doors

A threat vector is a door an attack comes through. The attack surface is the count of every door, window, and vent that exists. Two ideas the exam tests: recognizing the vector from a scenario, and knowing that shrinking the surface is a control in itself.

The vectors, grouped

Messages         email, SMS, instant messaging            links, attachments, fake requests
Content          image-based, file-based                  malicious images, macros, disguised executables
Voice            phone calls (vishing)                    talk a person into acting
Removable media  USB drives                               dropped in the lot, carried between networks
Software         vulnerable, unsupported                  unpatched apps, end-of-life systems
Exposure         open service ports, default credentials  a door with no lock
Networks         unsecure wireless, wired, Bluetooth      open Wi-Fi, live jacks, discoverable devices
Supply chain     MSPs, vendors, suppliers                 trusted parties as the path in

The ones with a twist

  • Client-based versus agentless: this is about how you check for vulnerable software. Client-based means an agent installed on each machine reports what is there. Agentless means a scanner examines machines from the network. Same goal, different method; a question may ask which requires software on the endpoint (client-based).
  • Unsupported systems: an operating system past end-of-life will never get another patch. Every flaw found from now on is permanent. The vector stays open until the system is replaced or isolated.
  • Open service ports: each listening service is reachable code. A port that serves nothing you need is pure risk.
  • Default credentials: the manufacturer's admin password is printed in the manual and indexed on the internet. Devices installed and never changed are the easiest entry there is.
  • Supply chain: you did not open this door; someone you trust did. A managed service provider's stolen credentials reach every customer. A vendor's poisoned update installs itself on every system that trusts the vendor. A supplier's hardware arrives already compromised.

Reading scenarios

  • "Employees received a text with a link to update their payroll details": message-based, SMS (smishing).
  • "A user opened a spreadsheet and enabled macros": file-based.
  • "A visitor plugged a laptop into a conference room jack and reached the server network": unsecure wired network; the fix is port security or 802.1X.
  • "Attackers logged into the camera system with admin/admin": default credentials.
  • "The breach originated from the company that manages our backups": supply chain, managed service provider.

Shrinking the attack surface

Every vector has a matching closing move.

open ports              close what is unused; firewall the rest
default credentials     change on install; enforce with a baseline
unsupported systems     replace, or isolate and monitor
vulnerable software     patch; scan with agents or agentless tools
unsecure wireless       WPA3, enterprise authentication
live wired jacks        port security, 802.1X, disable unused ports
removable media         device control policies, training
supply chain            vendor assessment, signed updates, monitor third-party access

How the exam asks it

  • "Which vector is exploited when a user inserts a found USB drive?" Removable device.
  • "A vendor's software update contained a backdoor." Supply chain.
  • "Which requires installing software on each host?" Client-based vulnerability scanning.
  • "Reduce the attack surface of a new server." Disable unnecessary services and close unused ports.

What to memorize

  • Vectors: message, image, file, voice, removable media, vulnerable and unsupported software, open ports, defaults, unsecure networks, supply chain.
  • Attack surface: count the doors; every unnecessary door is closed.