Skip to content
academia.sh
tr
Log in

Course Intermediate

Attack Techniques and the Threat Landscape

Published Updated

By the end of this course

Start course

01

Threat Models

The attack modeled as a sequence of steps and which link in the chain can be broken: how many steps of the chain a threat actor can get through based on capability and motivation level, the windows of opportunity that duration creates in long-running campaigns together with the item count that dwell time grows, the attack lifecycle built from preconditions and the calculation of the gain from breaking early, the tactic-and-technique matrix surfacing the step with no control at all, how much knowing one corner in the four-corner relationship model narrows the others, and, under a zero-day threat, the separation between the links a signature-based control misses and the links a behavior-based control catches.

  1. 01 Threat Actors Separating the actor by capability and motivation level: of five actor levels, only one clears all eight steps of an eight-step chain, two levels get stuck at the capability threshold on the fifth step, the capability wall sits in the middle of the chain rather than at its ends, one of the two actors that reach their target is the lowest-capability actor, if the chain is never broken the five actors touch 64 items and if it is broken at reconnaissance 0 items, and the cost of breaking a step one step late ranges from 0 to 17 items.
  2. 02 Advanced Persistent Threat Measuring a long-running campaign on the time axis: in a 330-day, eight-step sequence, 261 days (79.1%) are days no control sees; only two of five controls reach their record threshold; the two longest steps carry 65.5% of the duration and two-thirds of the item growth; first detection arrives on day 92 with 7 items; raising a single record threshold from 180 to 300 pushes detection to day 325 and raises dwell time from 47 days to 280 days and the item count from 7 to 45; and a control placed on the recon step saves all 48 items without foothold ever being established.
  3. 03 Attack Lifecycle Building the course's unit of measure: writing the eight steps by their preconditions, removing any one of five environment conditions breaking the chain with certainty, reaching 48 items if the chain runs to the end unbroken while the expected item count is 20.14, the share that reaches the end never broken (0.2384) carrying more than half of the expected total, removing an environment condition yielding a certain gain that ranges from 20.14 to 1.67 items, and placing the same control item on each of the eight steps in turn producing an early-break gain that falls from 7.05 to 0.58 items.
  4. 04 Adversary Behavior Classifications Mapping techniques onto steps and counting the step with no control at all: 8 tactics and 27 technique classes producing 10,800 chains; five control items covering 40.7% of the techniques; three steps remaining steps no control sees at all; 80% of chains breaking within the first two steps while 72 chains (0.67%) cannot be broken at any link; the latest-breaking 1.33% slice carrying 42.6% of the average items; and two interventions that yield the same coverage percentage (51.9%) producing gains that differ threefold, 1.39 versus 0.47 items.
  5. 05 Diamond Model Translating the four-corner relationship model into a link count: the actor, infrastructure, capability, and victim corners fill 77 of 134 possible links across 20 observations; the narrowing ratio of knowing one corner comes out exactly equal to that corner pair's link sparsity; the strongest corner (50%) becomes visible at the chain's eighth step and only after 41 items; the earliest-visible corner narrows only 30.7%; the capability corner gives 43.1% narrowing at a cost of 1 item; and adding a second corner adds only 10 to 13.1 points to the narrowing.
  6. 06 Known and Unknown Threats Measuring zero-day in terms of control coverage: eight controls make 7 links breakable under a known threat but drop to 5 under an unknown threat; three signature-based controls leave two steps completely uncovered; three behavior-based controls keep 70% of their catch; two configuration-based controls are not affected at all; expected items rise from 6.42 to 19.69; and the 77-day pre-patch window leaves 115.49 items exposed while the same window under structural breaking gives 0.00.

02

Social Engineering

Measuring the human layer as one link in the chain: the number of verification items at decision time and the budget that time pressure cuts short, the number of distinguishing indicators across phishing types and the cost of threshold choice, the verifiability gap between text messages and voice calls, physical techniques counted in access items, the edit distance and visual similarity used to detect typosquatted domain candidates, watering hole attacks built on a shared external dependency, and the persistence of awareness programs measured on two metrics.

  1. 01 Fundamentals of Social Engineering Modeling the moment of decision as a time budget: how many of seven verification items can be used under pressure, how many of twelve requests are fake and pass anyway, how many of six chain links carry a control, and the requests a callback procedure stops versus the legitimate work it delays.
  2. 02 Phishing Types Counting ten indicator types in a fictional set of twenty-six messages: the gap in average indicator count across bulk, spear, and whaling messages, the opposite directions of what a threshold scan misses versus what it falsely flags, legitimate messages flagged independent of any threshold, and the early-break gain of a five-step chain.
  3. 03 Other Channels Measuring text-message- and voice-call-based phishing in terms of verifiability: the strength of ten verification items across four channels, the fact that the number of strong items in a voice call is zero, the number of breakable links per channel, and the link a callback verification procedure gains in only one channel versus the cost it pays across four channels.
  4. 04 Physical Techniques Counting tailgating, shoulder surfing, and dumpster diving in terms of access items: the number of paths to the target zone in a fictional building made up of ten doors, five cards, and two visual verifications, how many doors break the chain on each path, the two paths that never break, and the ten access items the escort procedure gains against its daily cost of 6.8 hours.
  5. 05 Domain Spoofing Detecting typosquatting and homograph domain names in a fictional registry list: the number of candidates edit distance and visual normalization catch separately and together, each metric's false positive rate, the one spoof that is missed, and the average 11.3-day window that registry monitoring gains.
  6. 06 Watering Hole Attacks Modeling the watering hole attack as a shared dependency: eight external resources that six internal applications reach, how many users a single resource affects at once, at which link the six-step chain breaks per resource, the three chains that a resource-integrity hash breaks, and the 48-day-a-year delay cost of version pinning.
  7. 07 Awareness Programs Running the awareness program with two metrics: the weekly path of the reporting and click rate after training, which week the gain decays back to its old value, the eighteen-fold difference in the number of people who click before the first report, and the per-hour return of four reinforcement intervals.

03

Technical Attack Classes

Measuring application- and system-layer attack classes as a step-to-control mapping: how common risk lists are read and why the ranking changes by organization, which defense layer breaks which step in the injection, cross-site scripting, request forgery, and path traversal classes, how buffer overflow corrupts the neighboring item in the bounded-array model, the cost difference between brute-force, dictionary, and spraying forms against lockout and rate limiting, the precondition chain of browser-based infection, and the place of reverse engineering in defense.

  1. 01 Web Application Risks Measuring that common risk lists are a way of reading, not a ranking: six of ten fictional items changing places between the overall ranking and the organizational ranking, the largest shift being four places, twenty-two of the thirty-nine steps across nine chains remaining uncontrolled, one chain never being breakable at runtime, and the defense's break order overlapping the organizational ranking in only one of three items.
  2. 02 Injection Attacks Measuring the injection class as a six-step chain: which step each of the six defense layers breaks, the absence of a control in forty-two of the seventy-two step-site combinations across twelve call sites, the three-layer paper design being complete at only one call site, six of the one hundred ninety-two input-site combinations completing all six steps, and those six concentrating at two call sites.
  3. 03 Cross-Site Scripting Measuring the three forms as separate step sequences: reflected five, stored six, DOM-based four steps; the number of steps the three server-side layers break in the DOM-based form being zero, no link breaking in three of the twenty-four combinations across eight pages, the daily cost of one hundred ninety sessions for the seven combinations broken only at the last step, and a single browser-side layer closing off all three forms at once.
  4. 04 Request Forgery Measuring the two directions of request forgery as separate chains: in the browser direction, the five steps' preconditions are split between the victim, the browser, and the server; in the server direction, forty percent of the cost is realized at the third step; two of eleven endpoints cannot be broken at all; removing a single layer produces a forty-five-transaction difference; and the two directions' costs are measured in separate units.
  5. 05 Path Traversal Measuring path traversal as a five-step chain and a count of accessible items: in a thirty-item fictional inventory, the root check brings the item count down to twelve and the sensitivity down to seven; the narrow process identity removes no items within the jail; the identifier mapping breaks the chain at the second step and leaves ten items; and the jail, which breaks no step at all, brings the sensitivity down from forty-one to twenty.
  6. 06 Buffer Overflow Measuring buffer overflow in a bounded-array model: in a thirty-two-byte region, eleven copy lengths corrupt thirty-three neighboring fields in total; the guard value is corrupted in four of eleven cases; the corrupted return label stays valid in neither of the two cases it is corrupted in; the bounds check catches nine of eleven cases; and in one of six components, no link can be broken at all.
  7. 07 Password Attacks Separating three password-attack forms along the cost-and-threshold axis: across four hundred fictional accounts, brute force drops one hundred ninety, dictionary one hundred eighty, and spraying eighteen; account lockout stops two of the three forms and cuts the number of dropped accounts by eighty-seven percent; spraying, at three attempts per account, never triggers the lockout threshold at all; and the total legitimate-work cost of the two thresholds that see all three forms is four.
  8. 08 Drive-By Downloads Counting browser-based infection as a precondition chain: across six hundred fictional endpoints, all six of six conditions hold at once in only twenty-two of them; the item has already been written to disk at seventy-three endpoints that hold through the fourth condition; the single most effective defense on its own brings the remainder down to one; the defense that breaks two conditions at once ends up the weakest because its coverage is narrow; and two defenses reach, with a legitimate-work cost of nine, the same result that seven defenses reach with a cost of fifty-five.
  9. 09 Reverse Engineering Fundamentals Measuring reverse engineering's place in defense: the total defense value of twenty fictional indicators being thirty-eight, twelve items coming out of the raw binary through a string scan, symbol stripping together with string hiding bringing those twelve down to zero, three items being impossible to extract in any deployment and visible only in the victim's own record, and the chain columns of the course's twenty-two lessons being gathered into a single table.

Final exam

Attack Techniques and the Threat Landscape — Final Exam

In preparation

This course's question bank is not complete yet. The exam opens here automatically once enough questions are added.

Start typing to search.

↑↓ ↵ Esc navigate · open · close