SkarpChapter 6 of 25
Threat Vectors, Attack Surface, and Common Attack Patterns
Trace how attackers actually get in by mapping threat vectors to an organization’s attack surface and recognizing the patterns behind common attacks.
Big Picture: How Attackers Actually Get In
From Theory to Entry Points
Earlier you met threat actors and saw how change management and cryptography help secure systems. Now we zoom in on the how: the concrete paths attackers use to get from outside to inside a target.
Three Core Ideas
We focus on three ideas: attack surface (everything an attacker can interact with), threat vectors (routes attackers use), and attack patterns (repeatable ways they combine tools and techniques).
Mental Model
- Assets are what attackers want. 2. Every way those assets connect outward becomes attack surface. 3. Attackers pick the easiest threat vectors. 4. You see recurring patterns: initial access, credential theft, lateral movement, data theft, disruption.
Your Exam Goal
You need to define attack surface, list major vectors (email, web, removable media, remote, cloud, supply chain), map attacks to vectors, and suggest high-level mitigations that reduce risk without killing availability.
Attack Surface: What Can Be Touched or Misused
Definition: Attack Surface
An attack surface is the sum of all the points where an unauthorized user could try to enter data into, extract data from, or otherwise interact with a system or environment.
Building Analogy
Imagine a building: every door, window, vent, and cable is attack surface. Some are obvious (front door = public web app), others subtle (maintenance hatch = forgotten admin console or old API).
Modern Attack Surface
It spans network (IPs, ports, VPNs, Wi‑Fi), applications (web, mobile, APIs), endpoints (laptops, IoT, OT), identities (accounts, keys), data interfaces (file shares, DBs), people, and third parties.
How It Grows
Attack surface grows whenever you add systems, enable new connectivity, or integrate partners. Shadow IT and poor asset inventory silently expand it, making defense much harder.
Threat Vectors: The Routes Attackers Use
Definition: Threat Vector
Threat vectors are the specific paths or methods an attacker uses to get into or move within your environment. Attack surface is the map; vectors are the roads attackers choose.
Core Vector Types
Key vectors: email, web/browser, removable media, remote access, cloud/SaaS, mobile and IoT/OT, and supply chain or third-party relationships.
Vector vs Vulnerability
Vulnerability = weakness (unpatched server). Vector = path (internet-facing port exploited via that weakness). Exam questions often test whether you can distinguish the two.
Chaining Vectors
Attackers chain vectors: phishing email steals VPN credentials, VPN gives access to internal systems, then cloud consoles are abused for data theft or ransomware.
Visualizing Attack Surface on a Simple Diagram
Sample Network Diagram
Picture: Internet → firewall → DMZ with web and mail servers → internal LAN with file, DB, domain controller, workstations; plus VPN appliance, SaaS CRM, and payroll API.
Internet-Facing Surface
Attack surface: public web server, mail gateway, VPN appliance. Each exposes ports, services, admin consoles, and underlying OS that can be probed from the internet.
Internal and Human Surface
Inside: file and DB servers, domain controller, workstations, and users. Endpoints and people are exposed via email, browsers, and internal services like SMB or LDAP.
Cloud and Third Parties
SaaS CRM and payroll API add cloud and vendor attack surface: user accounts, SSO, API keys, and trust relationships that can be abused if misconfigured or compromised.
Common Threat Vectors and Their Attack Patterns
Email-Based Patterns
Email carries phishing, spear phishing, BEC, and malware attachments. The goal is to trick users into clicking, opening, or entering credentials to gain initial access.
Web and Browser Patterns
Web vectors include drive-by downloads, watering-hole attacks, and credential harvesting via fake login pages or malicious JavaScript on compromised sites.
Credential-Based Attacks
Credential stuffing reuses leaked passwords across many sites. Password spraying tries a few common passwords across many accounts. Brute force guesses systematically.
Network Exposure Attacks
Attackers scan for open ports and vulnerable services (RDP, VPN, web servers) and can run MitM on insecure Wi‑Fi or unencrypted protocols to steal data or credentials.
Cloud, Remote Access, and Supply Chain Vectors
Remote Access Vector
Remote access is attacked via exposed RDP/SSH, stolen VPN credentials, and abused remote management tools. These often give direct access deep into internal networks.
Cloud and SaaS Vector
Cloud risks: misconfigured storage, overly permissive IAM, leaked API keys, and OAuth or SSO abuse by malicious apps requesting broad permissions.
Supply Chain Vector
Supply chain attacks poison software updates, dependencies, or vendor remote access. A single compromise can impact many downstream organizations.
Exam Signal
If many organizations are hit via the same vendor or update, identify it as a supply chain attack using a third-party vector, not just generic phishing.
Thought Exercise: Mapping Vectors to Attack Surface
Work through these mini-scenarios. For each, identify:
- Which part of the attack surface is being targeted.
- The primary threat vector.
- The most likely attack pattern.
Write your answers in a notebook or say them out loud before checking the suggested responses.
Scenario A
A finance employee receives an email that appears to be from the CFO, asking them to urgently update vendor banking details via a linked form. The link goes to a realistic-looking login page for the company’s accounting SaaS.
Pause. Answer the three questions.
Suggested answer:
- Attack surface: finance user’s email and SaaS accounting portal.
- Threat vector: email.
- Attack pattern: spear phishing / BEC for credential harvesting and potentially fraudulent payments.
Scenario B
An engineering team exposes a new internal web dashboard to the internet “temporarily” for a contractor. They forget to add authentication. Attackers find it via a search engine index and dump internal performance metrics.
Pause, then answer.
Suggested answer:
- Attack surface: new web dashboard (internet-facing, unauthenticated).
- Threat vector: web / browser via open HTTP endpoint.
- Attack pattern: unauthenticated web app access / data exfiltration.
Scenario C
A managed service provider (MSP) that remotely administers clients’ endpoints is compromised. Attackers push ransomware through the MSP’s management tool to hundreds of customer networks.
Suggested answer:
- Attack surface: MSP remote management agents installed on endpoints.
- Threat vector: supply chain / third-party remote access.
- Attack pattern: mass ransomware deployment via trusted tool.
Reducing Attack Surface and Disrupting Threat Vectors
Inventory and Minimize
Shrink attack surface with good asset inventory, decommissioning unused systems, and removing unnecessary ports or services using the principle of least functionality.
Harden Exposed Services
Patch and securely configure internet-facing systems, protect web apps with WAFs, and require strong authentication (ideally MFA) for VPN, admin, and cloud access.
Identities, Users, and Segmentation
Use least privilege and MFA, train users on phishing and BEC, verify payment changes out-of-band, and segment networks while monitoring logs for unusual behavior.
Third-Party Risk
Limit vendor access, enforce MFA for MSP accounts, and regularly review integrations and API keys to prevent supply chain and third-party vectors from being abused.
Quick Check: Mapping Attacks to Vectors
Test your understanding of threat vectors and patterns.
An attacker uses a list of usernames and passwords from a previous breach and successfully logs into a cloud-based HR portal used by your company. Which combination best describes the primary threat vector and attack pattern?
- Email vector and phishing attack
- Web/cloud vector and credential stuffing attack
- Remote access vector and brute-force attack
- Supply chain vector and drive-by download attack
Show Answer
Answer: B) Web/cloud vector and credential stuffing attack
The attacker is using previously breached credentials against a cloud-based portal. That is a web/cloud login vector combined with a credential stuffing attack. It is not email-based, not generic brute force (they are reusing known credentials), and not a supply chain or drive-by scenario.
Quick Check: Attack Surface Growth
Another short scenario to reinforce attack surface concepts.
A small company adopts a new SaaS project management tool. Employees start logging in with their corporate SSO accounts from personal laptops and mobile phones. Which statement best describes the impact on the company's attack surface?
- The attack surface decreases because the SaaS provider is responsible for security.
- The attack surface stays the same because no on-premises servers were added.
- The attack surface increases due to new cloud, identity, and endpoint exposure.
- The attack surface is unaffected because SSO provides implicit trust.
Show Answer
Answer: C) The attack surface increases due to new cloud, identity, and endpoint exposure.
Adding a SaaS tool expands the attack surface: there is a new cloud application, additional identity exposure via SSO, and access from unmanaged personal devices. Responsibility is shared, not shifted entirely to the provider, and SSO does not make the attack surface disappear.
Key Term Flashcards: Vectors and Surface
Use these flashcards to reinforce core definitions and mappings.
- Attack surface
- The sum of all the points where an unauthorized user could try to enter data into, extract data from, or otherwise interact with a system or environment.
- Threat vector (attack vector)
- A specific path or method an attacker uses to gain access to a target system or move within an environment, such as email, web, remote access, or supply chain.
- Phishing vs spear phishing
- Phishing is broad, generic deceptive messaging; spear phishing is highly targeted at a specific person or small group, often using personal details.
- Drive-by download
- An attack where simply visiting a compromised or malicious website causes malware to be downloaded and potentially executed, often exploiting browser or plugin flaws.
- Credential stuffing
- An attack that uses large lists of previously breached username/password pairs against many websites or services, relying on password reuse.
- Business Email Compromise (BEC)
- A social-engineering attack where an attacker hijacks or convincingly spoofs a trusted business email account (often an executive or vendor) to request payments or sensitive data.
- Supply chain attack
- An attack that targets less-secure elements in the supply chain (vendors, software dependencies, service providers) to compromise many downstream organizations.
- Principle of least functionality
- Configuring systems to provide only the minimum services, features, and ports required for business needs, reducing the attack surface.
Key Terms
- phishing
- A social engineering technique that uses deceptive messages, typically via email, to trick users into revealing information, clicking malicious links, or opening harmful attachments.
- threat vector
- A specific path or method an attacker uses to gain access to a target system or move within an environment, such as email, web, remote access, or supply chain.
- attack surface
- The sum of all the points where an unauthorized user could try to enter data into, extract data from, or otherwise interact with a system or environment.
- spear phishing
- A highly targeted form of phishing aimed at a specific individual or small group, often using personal or organizational details.
- drive-by download
- An attack where visiting a compromised or malicious website causes malware to be downloaded and potentially executed, often exploiting browser or plugin vulnerabilities.
- password spraying
- An attack that tries a small number of common passwords across many different accounts to avoid lockouts.
- brute-force attack
- An attack that systematically guesses passwords or keys until the correct one is found.
- credential stuffing
- An attack that uses large lists of previously breached username/password pairs against many websites or services, relying on password reuse.
- supply chain attack
- An attack that targets suppliers, software dependencies, or service providers to compromise many downstream organizations.
- web application firewall (WAF)
- A security control that monitors and filters HTTP/HTTPS traffic to and from a web application, protecting against common web exploits.
- business email compromise (BEC)
- A social-engineering attack where an attacker hijacks or convincingly spoofs a trusted business email account to request payments or sensitive data.
- principle of least functionality
- Configuring systems to provide only the minimum services, features, and ports required for business needs, reducing the attack surface.
- multi-factor authentication (MFA)
- An authentication method that requires two or more independent factors (something you know, have, or are) to verify identity, making credential-based attacks harder.