Threat Landscape, Adversaries and Attack Modeling

Introduction

Cybersecurity begins with understanding what must be protected, who may attack it, why attacks occur, and how attacks progress through a system. A threat landscape is the changing collection of threats, adversaries, vulnerabilities, technologies, and environmental conditions that influence cyber risk. It is not simply a list of malware families. It is a structured view of interactions among assets, attackers, weaknesses, controls, and consequences.

Modern organizations depend on cloud services, mobile devices, application programming interfaces, software suppliers, operational technology, artificial intelligence, and interconnected identity systems. Consequently, an attacker may compromise an employee rather than directly attacking a server, exploit a supplier rather than the final victim, or steal a valid account instead of deploying obvious malware. Effective security therefore requires both technical knowledge and analytical models.

This chapter classifies major threat categories, examines adversary motives and capabilities, introduces attack surfaces and cyber kill chains, explains MITRE ATT&CK, and presents practical threat-modeling methods.

Learning Objectives

By the end of this chapter, students should be able to:

1. Classify malware, phishing, credential, insider, supply-chain, denial-of-service, and advanced persistent threats.
2. Explain adversary motives, capabilities, resources, and target selection.
3. Identify attack surfaces and distinguish vulnerabilities, threats, and risks.
4. Apply the cyber kill chain and MITRE ATT&CK to analyze an intrusion.
5. Construct a basic threat model using assets, trust boundaries, attack trees, STRIDE, and risk ratings.
6. Recommend proportionate technical, organizational, and governance controls.

1. The Language of Cyber Threats

An asset is something valuable to an organization, such as data, credentials, software, infrastructure, reputation, or a safety-critical process. A threat is a potential cause of harm. A threat actor or adversary is an individual, group, organization, or state capable of carrying out a threat. A vulnerability is a weakness that can be exploited. An exploit is a technique or code that takes advantage of a vulnerability. An event is an observable occurrence; an incident is an event that actually or potentially harms confidentiality, integrity, or availability.

Risk combines the possibility of an adverse event with its consequences. A simple qualitative model is:

Likelihood describes how probable or feasible an event is, while impact describes the severity of its consequences. This expression is a decision-making model, not a universal physical law. It is most useful when the scales are defined consistently—for example, from 1 to 5—and when uncertainty is acknowledged. It should not be interpreted as a precise probability unless likelihood has been estimated statistically.

A more detailed view considers exposure, vulnerability, threat capability, and control effectiveness. However, multiplying arbitrary scores can create false precision. Professional assessments should document assumptions, evidence, confidence, and uncertainty.

Threat, vulnerability, and risk: an example

A public web server with an unpatched vulnerability is an asset with a vulnerability. An internet-based criminal group is a threat actor. Exploitation of the vulnerability is a threat scenario. If exploitation could expose customer data and the server is reachable from the internet, the resulting risk may be high. Patching reduces the vulnerability; a web application firewall may reduce exploitability; backups and response procedures reduce consequences.

2. The Contemporary Threat Landscape

The threat landscape changes because technology, economics, geopolitics, and human behavior change. Important trends include:

• Identity-centered attacks: Attackers increasingly seek passwords, session cookies, tokens, and multifactor authentication approvals.
• Cloud and API exposure: Misconfigured storage, excessive permissions, weak API authentication, and exposed management interfaces expand the attack surface.
• Ransomware and extortion: Criminal groups may encrypt systems, steal data, and threaten public disclosure.
• Software dependency risk: Applications often incorporate open-source packages, libraries, build tools, and cloud services.
• Automation: Attackers use automation to scan, exploit, guess passwords, generate convincing messages, and move laterally.
• Convergence of physical and digital systems: Industrial control systems, medical devices, vehicles, and building systems create safety and availability concerns.
• Artificial intelligence: AI can improve defensive detection and analysis, but it can also support social engineering, malicious code adaptation, and large-scale reconnaissance. AI outputs remain subject to error, bias, and misuse.

Security professionals should avoid treating trends as isolated categories. A ransomware operation may begin with phishing, use stolen credentials, exploit remote-access software, move through a supplier connection, and exfiltrate data before encryption.

3. Major Threat Categories

3.1 Malware

Malware is software designed to perform unauthorized or harmful actions. Important classes include:

The same malicious program can exhibit several behaviors. Classification should therefore consider delivery, execution, persistence, privilege use, objectives, and command-and-control mechanisms. Malware defenses include secure configuration, patching, application control, endpoint detection and response, least privilege, network segmentation, tested backups, and user awareness. No single antivirus product is sufficient because malware may be fileless, signed with stolen certificates, or executed through legitimate administrative tools.

3.2 Phishing and social engineering

Phishing uses deceptive communication to induce a victim to reveal information, open content, transfer funds, or authorize an action. Spear phishing targets a particular person or organization. Whaling targets senior executives. Business email compromise often impersonates a trusted executive or supplier. Smishing uses text messages, while vishing uses voice communication.

Phishing succeeds by exploiting authority, urgency, fear, curiosity, trust, and cognitive overload. Technical indicators include look-alike domains, unexpected authentication requests, shortened links, unusual payment instructions, and mismatched sender identities. Defensive measures include phishing-resistant multifactor authentication, secure email gateways, domain authentication, transaction verification, browser protections, reporting channels, and rehearsed procedures for financial or sensitive requests.

Awareness training should not blame victims. Organizations must design systems that make safe behavior easier and provide rapid support when a mistake occurs.

3.3 Credential attacks

Credential attacks target the mechanisms used to prove identity. Examples include password spraying, credential stuffing, brute-force guessing, phishing for passwords, theft of password databases, token theft, and abuse of OAuth or session cookies.

Password spraying tries a small number of common passwords against many accounts, reducing lockout risk. Credential stuffing reuses username-password pairs obtained from another breach. Strong password managers, unique passwords, multifactor authentication, rate limiting, breached-password screening, secure password hashing, conditional access, and session monitoring reduce exposure.

Multifactor authentication improves security, but approval fatigue and real-time phishing can defeat weak implementations. Hardware-backed, phishing-resistant methods—such as passkeys based on public-key cryptography—provide stronger protection because the authenticator verifies the legitimate site origin.

3.4 Insider threats

An insider is a person with authorized access who misuses it, intentionally or accidentally. Malicious insiders may steal data, sabotage systems, or support an external actor. Negligent insiders may mishandle data, install unauthorized software, or disclose credentials. Compromised insiders are legitimate users whose accounts or devices are controlled by an attacker.

Controls should combine least privilege, separation of duties, access reviews, data loss prevention, logging, behavioral monitoring, secure offboarding, and a just organizational culture. Monitoring must be proportionate, transparent, and consistent with employment and privacy law. Insider-risk programs should focus on behaviors and risk indicators rather than unsupported assumptions about individuals.

3.5 Supply-chain attacks

A supply-chain attack compromises a vendor, dependency, update mechanism, managed service, or development pipeline to reach downstream victims. Examples include malicious or compromised software updates, vulnerable open-source dependencies, stolen developer credentials, and attacks through a managed service provider.

Supply-chain security requires inventory and provenance: organizations should know which components they use, who supplies them, how they are built, and how updates are verified. Useful practices include software bills of materials, signed artifacts, reproducible or controlled builds, dependency scanning, vendor assessment, secure software development, segmentation of supplier access, contractual notification duties, and rapid revocation of compromised trust.

A software bill of materials improves visibility but does not by itself prove that components are safe. A listed component may be vulnerable, misconfigured, malicious, or exploited through an interaction with another component.

3.6 Denial-of-service attacks

A denial-of-service attack seeks to reduce or eliminate availability. A distributed denial-of-service attack uses many systems or services to generate traffic or requests. Attacks may consume bandwidth, connection state, CPU, memory, application threads, or database capacity. Application-layer attacks can be effective even with moderate traffic because they invoke expensive operations.

Defenses include capacity planning, rate limiting, caching, resilient architecture, traffic filtering, upstream scrubbing services, anycast distribution, autoscaling with safeguards, and tested continuity plans. Availability protection must consider legitimate traffic: an overly aggressive filter can deny service to real users.

3.7 Advanced persistent threats

An advanced persistent threat (APT) is a sustained campaign in which an adversary with significant capability seeks continued access to a target. “Advanced” does not mean every technique is novel; it often refers to resources, patience, operational discipline, and adaptability. State-linked groups, intelligence services, and highly organized criminal groups may conduct APT-like operations.

APT defense emphasizes threat-informed detection, identity protection, segmentation, endpoint telemetry, anomaly analysis, hunting, incident response, and resilience. Attribution is difficult and should be treated as a confidence-based analytical judgment rather than an immediate certainty.

4. Adversaries: Motives, Capabilities, and Constraints

Adversaries differ in objectives and resources. Common categories include:

Capability includes technical skill, funding, infrastructure, access, intelligence, and ability to conceal operations. Opportunity also matters: a low-capability actor may cause serious harm when a system is exposed and poorly protected. Target selection reflects value, accessibility, vulnerability, expected return, and strategic importance.

Defenders should avoid assuming that an attacker must be highly sophisticated. Basic controls prevent many high-impact incidents, while advanced controls are necessary for determined adversaries.

5. Attack Surfaces and Attack Paths

An attack surface is the collection of reachable points through which an attacker may interact with an organization or system. It includes:

• Internet-facing servers, domains, APIs, and cloud resources.
• Endpoints, mobile devices, removable media, and remote-access tools.
• User identities, privileged accounts, service accounts, and tokens.
• Third-party suppliers, dependencies, integrations, and support channels.
• Physical facilities, network ports, wireless systems, and operational technology.
• Human processes such as payment approval, help-desk identity verification, and onboarding.

An attack path is a sequence of actions connecting an initial foothold to an objective. Attack-surface management should identify assets, owners, exposure, software versions, identity relationships, and business criticality. Asset inventories must be continuously maintained because temporary cloud resources, forgotten domains, and shadow applications frequently become entry points.

6. Cyber Kill Chain

The Lockheed Martin Cyber Kill Chain describes an intrusion as seven stages:

1. Reconnaissance: Collect information about targets, people, technology, and relationships.
2. Weaponization: Prepare a malicious payload or delivery mechanism.
3. Delivery: Transmit the payload through email, web content, removable media, a supplier, or another channel.
4. Exploitation: Trigger a vulnerability or manipulate a user.
5. Installation: Establish malware or another persistent mechanism.
6. Command and control: Communicate with attacker-controlled infrastructure.
7. Actions on objectives: Steal data, disrupt operations, commit fraud, or conduct espionage.

The model is useful because it encourages layered disruption. A defender can block malicious delivery, detect exploitation, prevent persistence, restrict command-and-control traffic, or limit the final objective through segmentation and access controls. Its limitations are equally important: attacks are not always linear, stages may overlap or repeat, and cloud or identity attacks may not involve traditional malware installation.

7. MITRE ATT&CK

MITRE ATT&CK is a knowledge base describing adversary tactics, techniques, and procedures. Tactics represent goals, such as Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. Techniques describe how goals may be achieved; procedures provide examples of observed implementation.

ATT&CK supports several activities:

• Mapping observed alerts to adversary behavior.
• Identifying detection and control gaps.
• Designing threat-informed security tests.
• Organizing threat-intelligence reports.
• Comparing defensive coverage across platforms.

ATT&CK is not a complete incident-response procedure and does not assign certainty automatically. A technique mapping is a hypothesis supported by evidence. Analysts should record the source, confidence, affected asset, timestamp, and alternative explanations. Organizations should also avoid claiming that a technique is “covered” merely because a product advertises a related feature; coverage requires a tested analytic, telemetry, response capability, and appropriate tuning.

Kill chain and ATT&CK compared

The kill chain emphasizes a campaign’s progression and opportunities to break it. ATT&CK provides greater behavioral detail and supports many non-linear paths. They are complementary: the kill chain provides a high-level narrative, while ATT&CK provides a vocabulary for specific behaviors.

8. Threat-Modeling Methods

Threat modeling is a structured process for anticipating abuse and selecting controls before or during system development. A practical process is:

1. Define scope, assumptions, and security objectives.
2. Identify assets, actors, entry points, and trust boundaries.
3. Model normal data and control flows.
4. Enumerate threats and plausible attack paths.
5. Evaluate likelihood, impact, and uncertainty.
6. Select mitigations and assign owners.
7. Validate through testing and update the model as the system changes.

Data-flow diagrams

A data-flow diagram represents processes, data stores, external entities, and flows. Trust boundaries identify points where privilege, ownership, or security assumptions change—for example, the boundary between a public client and an internal API. DFDs are especially useful for applications, cloud services, and privacy analysis.

STRIDE

STRIDE organizes common threat types:

• Spoofing: pretending to be another identity.
• Tampering: unauthorized modification.
• Repudiation: inability to prove an action occurred.
• Information disclosure: unauthorized exposure.
• Denial of service: loss of availability.
• Elevation of privilege: obtaining unauthorized authority.

STRIDE is a classification aid, not a guarantee of completeness. It should be applied to components and flows, then connected to actual controls and abuse cases.

Attack trees

An attack tree starts with an attacker’s goal and decomposes it into subgoals. “Obtain unauthorized payment” might be achieved through account takeover, fraudulent supplier change, or insider manipulation. Nodes can be combined using logical AND and OR relationships. Attack trees encourage analysts to consider alternative paths and dependencies.

Abuse cases and misuse cases

An abuse case describes how a feature could be misused. For example, a password-reset function may be abused through account enumeration, weak identity verification, or token reuse. Abuse cases are accessible to developers and product owners and connect security requirements to user stories.

9. A Worked Threat-Modeling Example

Consider a university learning portal containing student records. Students and staff authenticate through a web interface. The portal connects to a database and a payment service. A cloud provider hosts the application, and an external identity provider supplies single sign-on.

Assets include grades, personal data, payment references, administrator accounts, availability, and audit logs. Actors include ordinary attackers, dishonest users, compromised accounts, malicious insiders, and a compromised supplier. Trust boundaries exist between the public internet and web tier, web tier and database, portal and identity provider, and portal and payment service.

Plausible threats include phishing of staff, credential stuffing, insecure direct object references, excessive administrator privileges, database injection, exposed cloud storage, denial of service, and a compromised software dependency.

A qualitative assessment might rate a staff-account takeover as high likelihood and high impact because staff accounts can alter records. Controls should include phishing-resistant multifactor authentication, role-based access control, step-up authentication for grade changes, authorization tests for every object, audit logging, alerting on unusual changes, dependency management, backups, and incident playbooks.

The model should be tested. A security team might conduct an authorized review of access-control logic, simulate phishing using approved procedures, inspect cloud permissions, and verify that an alert is generated when a privileged account changes many records rapidly. Findings should be assigned to owners with deadlines and retested after remediation.

10. Applied Case: The Compromised Supplier Update

The following is an illustrative case, not a report of a specific real organization.

Background

A medium-sized manufacturer uses a supplier’s remote-management software to maintain production workstations. The supplier distributes a signed update through its normal channel.

Problem

An attacker compromises the supplier’s build environment and inserts a backdoor into an update. The manufacturer installs it because the update is correctly signed. The attacker obtains a foothold, discovers administrator credentials stored on an engineering workstation, and attempts to move toward production systems.

Analysis

The incident combines supply-chain compromise, credential access, persistence, discovery, lateral movement, and potential impact. The signature proves that the update came from the expected supplier; it does not prove that the supplier’s build process was uncompromised. Excessive network trust and shared administrative credentials increase blast radius.

Using the kill chain, the malicious update represents delivery and exploitation through a trusted channel. Using ATT&CK, defenders would map behaviors such as valid-account use, credential access, discovery, and lateral movement based on evidence. Threat modeling would identify the supplier connection and update process as critical trust boundaries.

Approach and outcome

The manufacturer isolates affected hosts, blocks unnecessary supplier connectivity, rotates credentials, preserves forensic evidence, validates production-system integrity, and coordinates with the supplier. Long-term improvements include software provenance requirements, staged updates, independent validation, privileged-access management, segmentation between office and production networks, application allowlisting, and an emergency update-revocation process. Production continues through a tested continuity procedure.

Learning points

Trust is transitive and therefore dangerous: trusting a supplier can extend the supplier’s compromise into the customer’s environment. Digital signatures are valuable but insufficient without secure build systems, monitoring, least privilege, and constrained deployment. Incident response must protect evidence while restoring safe operations.

11. Controls, Governance, and Ethics

Threat analysis should result in layered controls. Preventive controls reduce the chance of compromise; detective controls identify suspicious activity; corrective controls restore systems and remove causes; compensating controls reduce risk when ideal controls are unavailable.

Governance requires clear ownership, risk acceptance criteria, supplier obligations, incident reporting procedures, retention rules, and periodic review. Relevant legal and regulatory duties vary by jurisdiction and sector. Organizations should consult applicable privacy, breach-notification, critical-infrastructure, financial, and data-protection requirements rather than relying on generic advice.

Ethical security work requires authorization, proportionality, privacy protection, responsible disclosure, secure handling of evidence, and avoidance of unnecessary harm. Threat intelligence may contain personal data or politically sensitive claims. Analysts should distinguish facts from inferences, protect sources, and avoid discriminatory profiling.

12. Limitations and Contemporary Practice

No model captures reality perfectly. Kill chains can imply linearity; STRIDE can encourage checklist thinking; risk scores can conceal uncertainty; ATT&CK mappings can become superficial; and inventories become outdated. Models must therefore be validated against architecture, incidents, threat intelligence, testing, and business priorities.

Effective contemporary practice combines secure-by-design engineering, identity protection, continuous asset discovery, cloud security, software supply-chain governance, resilience, and human-centered processes. AI-assisted detection can prioritize events and summarize evidence, but human analysts must verify conclusions, protect sensitive data, monitor false positives, and control automated actions. Security is not achieved by predicting every attack; it is achieved by reducing exposure, detecting meaningful behavior, limiting blast radius, recovering reliably, and learning continuously.

Chapter Summary

The threat landscape consists of changing adversaries, technologies, vulnerabilities, attack surfaces, and consequences. Malware, phishing, credential attacks, insider misuse, supply-chain compromise, denial of service, and APT campaigns differ in mechanisms but often combine within one intrusion. Adversaries should be analyzed by motive, capability, resources, access, and constraints.

Attack surfaces include technical systems, identities, suppliers, physical facilities, and human procedures. The cyber kill chain explains broad stages of intrusion, while MITRE ATT&CK provides a detailed behavioral vocabulary for tactics and techniques. Threat modeling uses assets, actors, trust boundaries, data flows, STRIDE, attack trees, and abuse cases to identify and prioritize threats. Sound security decisions combine prevention, detection, response, recovery, governance, ethical practice, and continuous validation.

Key Terms

Threat landscape: The changing environment of threats, actors, vulnerabilities, technologies, and consequences.

Asset: Anything valuable that requires protection.

Threat actor: An entity capable of causing cyber harm.

Vulnerability: A weakness that may be exploited.

Risk: The possibility and consequence of adverse harm.

Malware: Software designed to perform unauthorized or harmful actions.

Phishing: Deceptive communication intended to manipulate a recipient.

Credential stuffing: Reuse of stolen credentials against other services.

Insider threat: Harm caused by misuse of authorized access.

Supply-chain attack: Compromise through a supplier, dependency, update, or service.

Denial of service: An attack that reduces system or service availability.

Advanced persistent threat: A sustained campaign by a capable and determined adversary.

Attack surface: Reachable points through which systems may be attacked.

Cyber kill chain: A staged model of intrusion activity.

MITRE ATT&CK: A knowledge base of adversary tactics, techniques, and procedures.

Trust boundary: A point where security assumptions, privilege, or ownership changes.

STRIDE: A threat-classification model covering spoofing, tampering, repudiation, disclosure, denial of service, and elevation of privilege.

Attack tree: A hierarchical representation of ways to achieve an attacker goal.

Threat model: A structured analysis of assets, threats, attack paths, and mitigations.

Review Questions

5 Short Answer Questions

1. Distinguish a threat, vulnerability, exploit, and risk.
2. What is the difference between phishing and credential stuffing?
3. Name the seven stages of the cyber kill chain.
4. Why is a software bill of materials useful, and why is it insufficient by itself?
5. What is the purpose of a trust boundary in threat modeling?

5 Long Answer Questions

1. Compare malware, insider, supply-chain, and APT threats in terms of access, objectives, and suitable controls.
2. Explain how attacker motives and capabilities influence target selection.
3. Compare the cyber kill chain with MITRE ATT&CK and discuss how they can be used together.
4. Explain STRIDE and illustrate each category using a learning-management system.
5. Discuss the ethical, privacy, and governance issues involved in insider-risk monitoring.

3 Analytical / Application Questions

1. Develop a threat model for a university mobile application that uses cloud storage and single sign-on. Identify assets, trust boundaries, five threats, and prioritized controls.
2. A supplier update is digitally signed but later found to contain malicious code. Analyze the incident using the kill chain and ATT&CK, and recommend improvements to the update process.
3. A company experiences repeated login failures followed by successful access from an unfamiliar location. Determine plausible attack types, evidence to collect, immediate response actions, and long-term preventive controls.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a vulnerability from a threat?

A. A vulnerability is a weakness; a threat is a potential cause of harm.

B. A vulnerability is an attacker; a threat is a security control.

C. A vulnerability is an incident; a threat is a patch.

D. A vulnerability is an asset; a threat is a backup.

Correct Answer: A. A vulnerability is a weakness; a threat is a potential cause of harm.

Question 2

Which malware class is primarily designed to deny access to data or systems and demand payment?

A. Spyware

B. Ransomware

C. Rootkit

D. Keylogger

Correct Answer: B. Ransomware

Question 3

What is credential stuffing?

A. Trying one common password against many accounts

B. Reusing stolen username-password pairs against other services

C. Encrypting credentials in a password manager

D. Creating a hardware-backed authentication key

Correct Answer: B. Reusing stolen username-password pairs against other services

Question 4

Which control most directly reduces the effectiveness of real-time password phishing?

A. Longer email signatures

B. Phishing-resistant multifactor authentication

C. More shared administrator accounts

D. Disabling audit logs

Correct Answer: B. Phishing-resistant multifactor authentication

Question 5

Which activity belongs to the reconnaissance stage of the cyber kill chain?

A. Collecting information about a target’s systems and personnel

B. Encrypting files for extortion

C. Installing a persistence mechanism

D. Rotating compromised credentials

Correct Answer: A. Collecting information about a target’s systems and personnel

Question 6

In MITRE ATT&CK, tactics primarily describe:

A. The cost of a security product

B. An adversary’s broad goals

C. The legal status of an incident

D. The number of users in a network

Correct Answer: B. An adversary’s broad goals

Question 7

Which STRIDE category concerns unauthorized modification of data?

A. Spoofing

B. Repudiation

C. Tampering

D. Elevation of privilege

Correct Answer: C. Tampering

Question 8

Why can a valid digital signature fail to guarantee that a software update is safe?

A. Signatures cannot identify the publisher

B. The signed build process or publisher environment may be compromised

C. Signed files cannot be transmitted over networks

D. Digital signatures automatically remove logging

Correct Answer: B. The signed build process or publisher environment may be compromised

Question 9

Which is an example of an attack-surface element?

A. An unreachable offline calculation

B. An exposed API with weak authentication

C. A successfully tested backup stored offline

D. A documented security policy with no technical interface

Correct Answer: B. An exposed API with weak authentication

Question 10

What is the main purpose of an attack tree?

A. To display organizational reporting lines

B. To represent alternative ways of achieving an attacker’s goal

C. To calculate internet bandwidth exactly

D. To replace all incident-response procedures

Correct Answer: B. To represent alternative ways of achieving an attacker’s goal