Threats, Adversaries and Attack Models

Introduction

Network and information security begins with a realistic understanding of what can go wrong, who may cause harm, how attacks progress, and why particular systems are attractive targets. A security control is meaningful only when it is related to a threat, an adversary capability, an asset, and a plausible attack path. This chapter develops a structured vocabulary and analytical approach for examining malware, phishing, credential attacks, spoofing, denial-of-service, man-in-the-middle, insider, and supply-chain threats.

The chapter also introduces three complementary ways of interpreting attacks. The Cyber Kill Chain describes a broad sequence of attack activities. MITRE ATT&CK provides a detailed knowledge base of adversary tactics and techniques. Threat modelling examines possible attacks during system design and risk assessment. These approaches are related but not interchangeable: one emphasizes sequence, another adversary behaviour, and the third system weaknesses and security requirements.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Distinguish assets, vulnerabilities, threats, threat actors, events, and risks.
2. Classify major network and information-security threats.
3. Explain common adversary motivations, capabilities, and operating methods.
4. Interpret attack activity using the Cyber Kill Chain and MITRE ATT&CK.
5. Apply a structured threat-modelling method to a networked system.
6. Recommend preventive, detective, and responsive controls.
7. Evaluate ethical, legal, governance, and supply-chain implications of threat analysis.

1. The Language of Threat Analysis

A precise vocabulary prevents confusion between a harmful event and the conditions that make it possible.

Risk is commonly discussed qualitatively as a combination of likelihood and impact. A simple risk-ranking expression is:

Here, likelihood is an estimate of how probable or plausible an adverse event is, while impact represents the magnitude of loss or harm. The expression is a decision-support model, not a universal physical law. It should not be interpreted as a precise probability unless likelihood and impact have been defined on compatible, documented scales. In practice, organizations often use low, medium, and high ratings or a more detailed risk matrix.

Threat analysis should consider five security properties:

• Confidentiality: preventing unauthorized disclosure.
• Integrity: preventing unauthorized alteration or destruction.
• Availability: ensuring timely and reliable access.
• Authenticity: establishing that an identity, message, or system is genuine.
• Accountability: linking actions to responsible identities through trustworthy records.

Safety, privacy, resilience, and non-repudiation may also be critical, particularly in healthcare, industrial control, finance, and public services.

2. Adversaries and Their Motives

Threat actors differ in resources, expertise, access, patience, and legal status. Classification is useful for planning but should not become an assumption that every member of a category behaves identically.

Motivation does not determine capability. A financially motivated group may be technically sophisticated, while a highly capable state-sponsored group may conduct quiet espionage rather than destructive attacks. Analysts should therefore assess capability, opportunity, intent, and access separately.

Threat intelligence is most useful when it answers an operational question: which adversaries are relevant to this organization, which techniques are plausible against its environment, and which observable behaviours would indicate preparation or execution?

3. Malware and Malicious Code

Malware is software or code designed to perform unauthorized, harmful, deceptive, or intrusive actions. Categories overlap because modern malware often combines several functions.

3.1 Major malware classes

• Virus: Code that attaches to a host file or program and replicates when the host executes. The defining feature is dependence on a host for propagation.
• Worm: Malware that self-propagates across systems or networks, often by exploiting vulnerabilities or weak credentials.
• Trojan: Malicious software presented as legitimate or useful software. It generally relies on deception rather than self-replication.
• Ransomware: Malware that blocks access to systems or data, commonly through encryption, and demands payment. Modern operations may also steal data and threaten disclosure.
• Spyware: Software that covertly monitors activity or collects information.
• Keylogger: Software or hardware that records keystrokes, often to obtain credentials or sensitive messages.
• Rootkit: Tools or components intended to conceal malicious activity and maintain privileged access.
• Bot or botnet malware: Code that places a device under remote control; a collection of controlled devices forms a botnet.
• Wiper: Malware designed primarily to destroy or render data and systems unusable.
• Fileless or memory-resident malware: Malicious activity that minimizes traditional files and abuses legitimate tools, scripts, or memory.

A single campaign may use a phishing attachment to deliver a loader, which installs a remote-access trojan, steals credentials, moves laterally, and deploys ransomware. Classification should therefore record both the malware family and its functions.

3.2 Malware analysis and controls

Defenders use static analysis to inspect code without executing it, dynamic analysis to observe behaviour in a controlled environment, and behavioural analysis to identify suspicious actions such as credential dumping, persistence, or unusual encryption. Sandboxing, application allow-listing, endpoint detection and response, patch management, least privilege, network segmentation, tested backups, and email filtering reduce malware risk.

Backups must be isolated from ordinary administrative credentials and tested through restoration exercises. A backup that cannot be restored, or that is reachable by ransomware, is not a dependable recovery control.

4. Phishing and Social Engineering

Phishing is deceptive communication intended to make a person reveal information, execute code, transfer funds, or perform another action. It exploits human decision-making and organizational processes rather than only technical vulnerabilities.

Common forms include:

• Bulk phishing: Large-scale messages using generic lures.
• Spear phishing: Targeted messages based on information about a particular person or organization.
• Whaling: Spear phishing directed at senior executives or high-value individuals.
• Business email compromise: Impersonation or compromise of accounts to redirect payments or authorize fraudulent actions.
• Smishing: Phishing through SMS or messaging applications.
• Vishing: Phishing through voice calls.
• Clone phishing: Reuse of a legitimate message or document with altered links or attachments.
• Consent phishing: Persuading a user to grant a malicious application access through an authorization workflow.

Phishing succeeds when technical indicators, organizational procedures, and human judgement fail together. Effective defence combines email authentication, attachment and URL analysis, multi-factor authentication, payment verification, staff training, reporting channels, browser protections, and processes that permit employees to pause suspicious requests without penalty.

Training should not be treated as a substitute for secure design. A robust organization assumes that some users will click a convincing message and limits the resulting privilege, access, and financial consequences.

5. Credential Attacks

Credentials include passwords, passphrases, cryptographic keys, tokens, certificates, and biometric factors. Credential attacks aim to obtain, guess, replay, or abuse these authentication materials.

Important forms include:

• Brute force: Systematically trying possible passwords or keys.
• Password spraying: Trying a small number of common passwords across many accounts to avoid account lockout.
• Credential stuffing: Reusing username-password pairs stolen from another service.
• Dictionary attack: Trying words and common transformations from a prepared list.
• Pass-the-hash or token replay: Using a captured authentication value without knowing the original secret.
• Credential harvesting: Obtaining credentials through fake login pages, malware, or social engineering.
• Session hijacking: Taking over an authenticated session through stolen cookies or tokens.

Defensive design includes phishing-resistant multi-factor authentication, password managers, unique passwords, breached-password screening, rate limiting, adaptive authentication, secure password hashing, short-lived tokens, device and location signals, and careful session invalidation. Password databases should store salted, slow, purpose-designed password hashes rather than plaintext or reversible encryption.

Multi-factor authentication improves security because compromise of one factor does not automatically compromise the others. It is not absolute protection: adversaries may target recovery procedures, steal session tokens, socially engineer help desks, or use adversary-in-the-middle techniques. Recovery channels therefore require controls equivalent to the primary authentication process.

6. Spoofing and Impersonation

Spoofing occurs when an adversary falsifies identity, origin, address, or content so that a communication or system appears trustworthy. Examples include:

• IP address spoofing;
• DNS or domain spoofing;
• email sender spoofing;
• caller-ID spoofing;
• ARP spoofing on local networks;
• website or login-page impersonation;
• GPS or positioning spoofing; and
• biometric or identity-document impersonation.

Spoofing may support phishing, malware delivery, denial-of-service, or interception. Authentication and integrity controls are therefore central. Examples include DNS security mechanisms, email authentication policies, digital signatures, certificate validation, mutual TLS, secure routing practices, switch protections, network segmentation, and out-of-band verification of sensitive requests.

A displayed sender name is not proof of identity. Trust should be based on verifiable cryptographic or procedural evidence, not visual similarity or familiarity.

7. Denial-of-Service Attacks

A denial-of-service attack seeks to reduce or eliminate access to a service. A distributed denial-of-service attack uses many sources, often compromised devices, to increase volume and complicate blocking.

Attacks may target:

1. Volumetric capacity: Internet links or network infrastructure.
2. Protocol state: Firewalls, load balancers, or connection tables.
3. Application resources: Expensive queries, authentication services, or transaction processing.
4. Dependencies: DNS, identity providers, cloud services, or upstream suppliers.

The security objective is availability, but effects may include financial loss, safety consequences, reputational damage, and diversion of defenders while another intrusion occurs. Defences include capacity planning, rate limiting, caching, resilient architecture, content delivery networks, upstream filtering, autoscaling with cost controls, service degradation modes, and tested continuity plans. No single control stops every denial-of-service attack; response depends on attack type, provider capability, and business priorities.

Availability analysis should identify recovery time objectives, recovery point objectives, maximum tolerable downtime, critical dependencies, and communication responsibilities. These are governance decisions as well as technical decisions.

8. Man-in-the-Middle and Adversary-in-the-Middle Attacks

A man-in-the-middle attack occurs when an adversary positions between communicating parties and intercepts, alters, delays, or selectively forwards traffic. The more current term adversary-in-the-middle emphasizes that the attacker may not literally occupy a physical midpoint.

Examples include rogue wireless access points, DNS manipulation, compromised routers, fraudulent certificates, proxy-based phishing, and session interception. A successful attack often requires two conditions: the ability to influence traffic and the ability to defeat or bypass endpoint authentication.

Transport encryption reduces exposure, but encryption alone is insufficient if users accept invalid certificates, endpoints are compromised, or authentication is directed to an attacker-controlled service. Mutual authentication, certificate validation, secure name resolution, network access control, VPNs used appropriately, secure wireless configuration, hardware-backed keys, and phishing-resistant authentication help reduce risk.

9. Insider Threats

An insider is a person with authorized access, such as an employee, contractor, administrator, partner, or service provider. Insider risk includes malicious action, negligence, accidental disclosure, coercion, and compromised insiders whose accounts are controlled by outsiders.

Controls must balance security with privacy, fairness, and operational practicality. Useful measures include least privilege, segregation of duties, privileged-access management, joiner-mover-leaver processes, data-loss prevention, logging, independent approvals, anomaly detection, secure offboarding, and a non-punitive reporting culture for mistakes.

Monitoring should have a legitimate purpose, defined access, retention limits, and appropriate oversight. Behavioural indicators are not proof of malicious intent. Investigations should preserve evidence, respect employment and privacy law, and avoid discriminatory profiling.

10. Supply-Chain Threats

A supply-chain attack compromises a supplier, software component, build process, update mechanism, managed service, or physical device in order to reach downstream victims. Modern organizations depend on complex software and service ecosystems, making direct perimeter defence insufficient.

Examples include malicious code inserted into a software dependency, compromise of a vendor’s update server, counterfeit hardware, stolen signing keys, and abuse of a managed-service provider’s privileged access. Open-source components create substantial value but may have uncertain maintenance, provenance, and vulnerability-disclosure practices.

Risk reduction includes supplier due diligence, contractual security requirements, software bills of materials, signed and reproducible builds where feasible, dependency pinning and scanning, isolated build environments, key protection, staged updates, least-privileged vendor access, continuous monitoring, and tested supplier exit plans. A software bill of materials improves visibility but does not itself prove that a component is safe.

11. Interpreting Attack Lifecycles

11.1 The Cyber Kill Chain

The Lockheed Martin Cyber Kill Chain presents seven broad stages:

1. Reconnaissance: Collecting information about people, technology, domains, and processes.
2. Weaponization: Preparing a malicious payload or exploit, generally outside the victim environment.
3. Delivery: Transmitting the payload through email, web traffic, removable media, supply-chain mechanisms, or another route.
4. Exploitation: Triggering a vulnerability or human action.
5. Installation: Establishing malware, persistence, or unauthorized access.
6. Command and control: Creating communication between the compromised environment and the adversary.
7. Actions on objectives: Theft, disruption, espionage, fraud, encryption, or destruction.

Figure: The Cyber Kill Chain presents attack activity as stages at which defenders may prevent, detect, contain, or recover.

The model is valuable for communicating an intrusion and identifying intervention points. Its limitations are equally important: attacks do not always follow a linear order; adversaries may repeat stages, skip stages, or operate several stages simultaneously. Weaponization may be invisible to the victim, and legitimate administration can resemble malicious activity.

11.2 MITRE ATT&CK

MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on observed behaviour. Tactics describe objectives, such as Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. Techniques describe how those objectives may be pursued.

ATT&CK is useful for:

• mapping observed events to known behaviours;
• identifying detection gaps;
• organizing threat intelligence;
• designing purple-team exercises;
• comparing security-tool coverage; and
• communicating adversary behaviour among technical teams.

ATT&CK should not be treated as a prediction engine or a checklist proving that an organization is secure. A technique may be possible but not relevant, and the absence of a recorded technique does not prove that it cannot occur. Analysts should record evidence, confidence, affected assets, data sources, and defensive assumptions.

11.3 Comparing the models

The models work well together. Threat modelling identifies plausible attack paths before deployment. ATT&CK helps describe adversary behaviour and detection requirements. The Kill Chain provides a concise narrative for incident coordination.

12. Threat Modelling for Networked Systems

Threat modelling is a systematic process for identifying assets, trust boundaries, attack paths, security requirements, and mitigations. It should begin during design and continue when systems, suppliers, or business processes change.

A practical method is:

1. Define scope and objectives. Identify the system, users, data, dependencies, and unacceptable outcomes.
2. Create an architecture view. Show components, data flows, trust boundaries, administrative paths, and external services.
3. Identify assets and security properties. Determine what must remain confidential, accurate, available, authentic, safe, and accountable.
4. Enumerate threats. Use structured prompts such as STRIDE: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.
5. Construct attack paths. Consider prerequisites, weaknesses, controls, and likely detection points.
6. Assess and prioritize. Estimate likelihood, impact, affected stakeholders, and treatment options.
7. Select controls. Prefer layered prevention, detection, response, and recovery.
8. Validate and maintain. Review assumptions through testing, exercises, monitoring, and change management.

Attack trees are another useful representation. The root is an undesired outcome, such as unauthorized payment. Branches represent alternative routes, while sub-branches represent prerequisites. The analysis reveals whether a route depends on phishing, credential compromise, privileged access, or supplier failure.

Threat modelling is not a one-time compliance document. It becomes obsolete when an application moves to the cloud, an identity provider changes, a new API is exposed, or a supplier receives privileged access.

13. Applied Case: Illustrative Hospital Ransomware Scenario

Background

A regional hospital operates electronic health-record systems, diagnostic devices, email, remote access, and several managed services. A supplier provides software updates for laboratory equipment. Staff use cloud email and multi-factor authentication, but some older clinical devices cannot support modern endpoint agents.

Problem

An accounts employee receives a convincing invoice message. The link opens a counterfeit cloud-login page. The employee enters credentials and approves an unexpected authentication request. The attacker accesses email, discovers an administrator’s contact details, and later uses a vulnerable remote-access appliance to enter the hospital network. After reconnaissance, the attacker deploys ransomware and threatens to publish copied patient information.

Analysis

The scenario contains several linked threats: spear phishing, credential harvesting, adversary-in-the-middle authentication, exploitation of an exposed appliance, privilege escalation, lateral movement, data exfiltration, and ransomware impact. Using the Kill Chain, reconnaissance and delivery preceded exploitation, installation, command and control, and actions on objectives. Using ATT&CK terminology, analysts would examine Initial Access, Credential Access, Valid Accounts, Discovery, Lateral Movement, Exfiltration, and Impact behaviours.

Threat modelling would identify the cloud identity service, remote-access appliance, clinical network, patient data, and supplier update channel as high-value assets or trust boundaries. It would ask whether an ordinary accounts employee should be able to reach clinical systems, whether administrative accounts are separated, and whether backups are isolated.

Approach and solution

Immediate response would include isolating affected systems, preserving evidence, disabling compromised sessions and credentials, contacting the incident-response team and relevant authorities, and maintaining safe clinical operations. Recovery would use clean, tested backups and staged restoration rather than reconnecting every system simultaneously.

Longer-term improvements would include phishing-resistant authentication for privileged and high-risk users, conditional access, network segmentation between business and clinical systems, rapid patching or compensating controls for the remote appliance, privileged-access management, immutable or offline backups, supplier access restrictions, centralized logging, and exercises involving clinical continuity.

Outcome

The hospital reduces the probability that a single phished account can reach critical systems and improves its ability to detect unusual authentication, lateral movement, and bulk encryption. It also establishes an alternative clinical workflow for periods of system unavailability.

Learning points

1. Multi-factor authentication is strongest when it resists phishing and is supported by secure recovery.
2. Segmentation limits impact but must be tested; a diagram alone does not prove isolation.
3. Patient safety and service continuity must guide incident response.
4. Supplier and remote-access pathways are part of the hospital’s attack surface.
5. Recovery capability is a security control, not merely an IT operations concern.

14. Professional, Ethical, and Governance Considerations

Threat analysis can involve sensitive personal data, employee monitoring, customer information, and evidence of criminal activity. Analysts should collect only information necessary for a legitimate purpose, protect it from unauthorized access, document decisions, and follow applicable privacy, employment, breach-notification, and cybercrime laws.

Security testing requires explicit authorization, defined scope, safety controls, and rules for handling discovered data. Scanning an external system without permission may be unlawful even when the intention is defensive. Responsible vulnerability disclosure should provide affected parties an opportunity to remediate while avoiding unnecessary public harm.

Organizations should align threat management with governance frameworks and risk appetite. Boards and senior managers need understandable information about business impact, dependencies, residual risk, and investment choices rather than lists of technical alerts. Metrics should measure meaningful outcomes, such as time to detect, time to contain, restoration success, privileged-account coverage, and remediation of exploitable weaknesses. Metrics can mislead when teams optimize the number of closed tickets instead of reducing exposure.

Artificial intelligence can assist with alert triage, malware classification, phishing detection, summarization, and attack-path analysis. It can also generate convincing phishing messages, automate reconnaissance, mutate malicious code, and create false or biased conclusions. AI outputs require human validation, protected data handling, model-risk assessment, and clear accountability. An automated classification is an investigative lead, not proof of attribution or malicious intent.

15. Contemporary Developments and Best Practices

Several developments are changing threat analysis:

• Identity has become a primary security boundary in cloud and hybrid environments.
• Ransomware operations increasingly combine encryption, data theft, and public pressure.
• Software ecosystems are assessed through provenance, build integrity, dependency visibility, and signing-key protection.
• Cloud APIs, containers, infrastructure-as-code, and machine identities expand the attack surface.
• Zero-trust architectures emphasize continuous verification, least privilege, device and workload identity, and explicit policy enforcement.
• Defensive deception, threat hunting, and behavioural detection complement signature-based controls.
• Adversaries increasingly exploit legitimate tools, making context and telemetry essential.

A mature security program should:

1. maintain an accurate asset and dependency inventory;
2. prioritize identity protection and least privilege;
3. patch internet-facing and exploited vulnerabilities quickly;
4. use layered preventive, detective, and recovery controls;
5. centralize and protect relevant logs;
6. test backups, segmentation, incident response, and supplier failure;
7. map realistic threats to ATT&CK techniques and detection sources;
8. conduct threat modelling whenever architecture or trust relationships change; and
9. review legal, privacy, safety, and ethical consequences alongside technical risk.

Challenges and Limitations

Threat classification is imperfect because attacks combine techniques and change over time. Attribution is difficult: infrastructure may be rented, compromised, or deliberately misleading. Threat intelligence can be incomplete, biased toward well-observed organizations, or too general to support a local decision. Risk estimates contain uncertainty, while controls may introduce usability, cost, and availability trade-offs.

The Kill Chain can encourage linear thinking; ATT&CK can encourage checklist compliance; and threat models can become stale documents. Effective practice therefore combines models with evidence, testing, engineering judgement, business context, and continuous review.

Chapter Summary

Threat analysis distinguishes assets, threats, vulnerabilities, adversaries, attacks, incidents, and controls. Major threat classes include malware, phishing, credential attacks, spoofing, denial-of-service, adversary-in-the-middle activity, insider threats, and supply-chain compromise. Each class has distinctive mechanisms but commonly overlaps with others in a campaign.

The Cyber Kill Chain offers a broad sequence from reconnaissance to actions on objectives. MITRE ATT&CK organizes observed adversary tactics and techniques, supporting detection engineering and threat-informed defence. Threat modelling examines assets, trust boundaries, attack paths, impacts, and controls before and during system operation. These methods are complementary rather than competing.

Effective defence is layered: secure identity, least privilege, patching, segmentation, supplier assurance, logging, detection, incident response, tested recovery, and sound governance. Professional analysis must also address authorization, privacy, legal duties, human safety, uncertainty, and the responsible use of artificial intelligence.

Key Terms

Asset: A valuable resource requiring protection.

Threat: A potential cause of harm.

Threat actor: An individual or group capable of conducting harmful activity.

Vulnerability: A weakness that may be exploited or abused.

Exploit: A method or action that takes advantage of a vulnerability.

Malware: Malicious or unauthorized software or code.

Phishing: Deceptive communication intended to induce an unsafe action.

Credential stuffing: Reuse of stolen credentials against other services.

Spoofing: Falsifying identity, origin, or content.

Denial-of-service: An attempt to reduce or prevent service availability.

Adversary-in-the-middle: Interception or manipulation of communication between parties.

Insider threat: Risk arising from a person with authorized access.

Supply-chain attack: Compromise of a supplier, component, or delivery process.

Persistence: Maintaining access after an initial compromise.

Lateral movement: Moving from one system or account to another.

Command and control: Communication used to manage compromised systems.

Cyber Kill Chain: A staged model of common intrusion activity.

MITRE ATT&CK: A knowledge base of adversary tactics and techniques.

Threat modelling: Structured analysis of threats, attack paths, and mitigations.

Zero trust: A security approach based on explicit, continuous verification rather than implicit trust.

Review Questions

Short Answer Questions

1. Distinguish a vulnerability from an exploit.
2. What is the difference between phishing and credential stuffing?
3. Name the seven stages of the Cyber Kill Chain.
4. Why is network segmentation useful against ransomware?
5. What is the purpose of a software bill of materials?

Long Answer Questions

1. Explain how a single phishing message can develop into a multi-stage ransomware incident.
2. Compare the Cyber Kill Chain and MITRE ATT&CK, including the strengths and limitations of each.
3. Discuss technical and organizational controls for reducing insider threat.
4. Explain why multi-factor authentication is valuable but not a complete defence against credential attacks.
5. Describe a threat-modelling process for a cloud-based student information system.

Analytical / Application Questions

1. A company observes repeated login failures across many accounts, followed by successful logins from unfamiliar locations. Classify the likely attack, identify relevant ATT&CK behaviours, and recommend immediate controls.
2. A critical supplier requests permanent administrative access to a production network. Analyse the supply-chain risks and propose a safer access and monitoring model.
3. A public website remains available during a large volumetric attack, but its login service becomes unusable because of expensive requests. Explain why this is an application-layer availability problem and design a layered response.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a worm from a Trojan?

A. A worm self-propagates, whereas a Trojan is presented as legitimate software.

B. A worm always encrypts files, whereas a Trojan only steals passwords.

C. A worm requires a human host, whereas a Trojan spreads automatically.

D. A worm is hardware, whereas a Trojan is a network protocol.

Correct Answer: A. A worm self-propagates, whereas a Trojan is presented as legitimate software.

Question 2

Which attack reuses username-password pairs stolen from another service?

A. Password spraying

B. Credential stuffing

C. DNS spoofing

D. Session timeout

Correct Answer: B. Credential stuffing

Question 3

In the Cyber Kill Chain, transmitting a malicious attachment to a victim is primarily which stage?

A. Reconnaissance

B. Weaponization

C. Delivery

D. Actions on objectives

Correct Answer: C. Delivery

Question 4

What is the primary purpose of MITRE ATT&CK?

A. To provide a detailed knowledge base of adversary tactics and techniques

B. To replace all network firewalls with encryption

C. To calculate an organization’s exact annual cyber loss

D. To certify that a system is completely secure

Correct Answer: A. To provide a detailed knowledge base of adversary tactics and techniques

Question 5

Which control most directly reduces the impact of ransomware on recovery?

A. Using identical administrator passwords everywhere

B. Maintaining isolated, tested backups

C. Disabling all system logging

D. Allowing unrestricted supplier access

Correct Answer: B. Maintaining isolated, tested backups

Question 6

An attacker falsifies the apparent source of an email. This is an example of:

A. Spoofing

B. Hashing

C. Segmentation

D. Availability engineering

Correct Answer: A. Spoofing

Question 7

Which threat involves compromising a software update mechanism to reach customers?

A. Supply-chain attack

B. Password spraying

C. Local data classification

D. Physical tailgating only

Correct Answer: A. Supply-chain attack

Question 8

Which STRIDE category concerns unauthorized alteration of data?

A. Spoofing

B. Tampering

C. Repudiation

D. Information disclosure

Correct Answer: B. Tampering

Question 9

Why should a threat model be reviewed after a new cloud identity provider is introduced?

A. Trust boundaries, dependencies, and attack paths may have changed.

B. Threat models are required only for physical buildings.

C. Cloud services eliminate all vulnerabilities.

D. The change affects only user interface colours.

Correct Answer: A. Trust boundaries, dependencies, and attack paths may have changed.

Question 10

Which statement about multi-factor authentication is most accurate?

A. It prevents every form of phishing.

B. It improves security, but recovery processes and session theft can still be attacked.

C. It makes password hygiene unnecessary in all situations.

D. It protects only against denial-of-service attacks.

Correct Answer: B. It improves security, but recovery processes and session theft can still be attacked.