PowerPoint on advanced network threats

1. Advanced Network Security:
Threats, Assessment, and
Prioritization
A Comprehensive Guide to Fortifying Your Digital Defenses
Engr. Angielo B. Becenia, MIT
Source: Vector cyber security concept. Network data security. Technology ...

2. The Evolving Threat Landscape
From simple digital nuisances to coordinated global campaigns, the nature of cyber threats has transformed,
demanding a more sophisticated and adaptive approach to security.
Why Traditional Defenses Are
Insufficient
Characteristics of Modern Adversaries
Highly Organized & Resourced: Often nation-states or
sophisticated criminal enterprises with significant funding.
Signature Bypass: Ineffective against polymorphic and fileless
malware that constantly changes its form. Stealthy & Persistent: Employ Advanced Persistent Threat (APT)
tactics for long-term, undetected access.
Perimeter Focus Fallacy: Fails to address insider threats and
lateral movement once a breach occurs. Adaptive & Automated: Continuously evolve methods, leveraging
AI and automation to scale attacks.
Reactive Nature: Lacks the proactive threat intelligence needed to
anticipate and counter emerging TTPs.
Historical Evolution of Cyber Attacks
2000s 2020s+
Mass Exploitation & Botnets Geopolitical & AI-Driven
1980s-1990s 2010s Threats
Focus: Financial Gain & DDoS
Ex: Code Red, Slammer
Early Viruses & Worms Targeted Attacks & APTs Focus: Supply Chain, Misinformation
Ex: SolarWinds, AI Malware
Focus: Disruption & Nuisance
Ex: Morris Worm, Melissa
Focus: Espionage & Sabotage
Ex: Stuxnet, Ransomware 2.0

3. Advanced Persistent Threats (APTs)
The APT Kill Chain: A Prolonged Attack Lifecycle
Unlike conventional cyber attacks, APT
s are characterized by a methodical, multi-stage kill chain designed for stealthy, long-
term compromise and persistence. Each phase represents a critical step an adversary undertakes to achieve their objectives
without immediate detection.
7. Actions
1. 2. 4. 5. on
3. Delivery 6. C & C
Reconnaissance Weaponization Exploitation Installation Objectives
Exfiltrate Sabotage
Defining APTs: Stealth & Persistence Motivation & Prime Targets
Advanced Persistent Threats (APTs) are a class of sophisticated,
targeted cyber attacks designed to maintain long-term, clandestine
access to a compromised network.
APT
s are fundamentally driven by strategic objectives that
distinguish them from opportunistic cybercrime.
Primary Motivations:
Stealth: APT groups employ sophisticated evasion techniques to
bypass conventional security measures, rendering them highly
difficult to detect for extended durations.
Espionage: Theft of IP and state secrets.
Sabotage: Disruption of critical infrastructure.
Financial Gain: Funding operations or destabilization.
Persistence: Adversaries meticulously establish multiple

4. Zero-Day Exploits: The Unknown Danger
Zero-Day
Vulnerabilities
Lifecycle of a Zero-Day Attack
Understanding
A zero-day vulnerability is a software flaw or hardware weakness
unknown to those responsible for patching it (i.e., the vendor). The
term "zero-day" refers to the fact that developers have had zero
days to create a fix. 1. Undiscovered Vulnerability
An unknown flaw exists in the software.
An attacker who discovers such a flaw can develop a zero-day
exploit—the malicious code or technique used to take advantage of
the vulnerability—allowing them to compromise systems before a
defense is even possible.
This creates a critical window of opportunity for adversaries, as
traditional signature-based defenses are ineffective against these
novel attacks.
2. Exploit Developed
Impact on Organizations A threat actor creates a tool to leverage the flaw.
Widespread Data Breaches
Attackers can exfiltrate sensitive data, intellectual property, and
customer information undetected.
Complete System Compromise

5. Supply Chain Attacks: Targeting Trust
The Rise of Supply Chain Attacks: Targeting Trusted Relationships
The Exploited Link Notable Incidents Lessons & Mitigation
Attackers bypass direct defenses by
compromising less-secure third-party
vendors, injecting malicious code into
trusted software, hardware, or services.
Software Update Compromise Proactive Vulnerability
Assessment
Impact: Widespread infiltration of government
and enterprise networks through a trojanized
software update.
Continuously assess third-party
components. Don't assume trust.
MSP/Tooling Breach
Risk-Based Prioritization
Impact: Massive ransomware deployment
affecting thousands of downstream customers
via a managed service provider's tools.
Focus remediation on vulnerabilities that
pose the greatest risk to critical assets.
Common Attack Vectors:
Compromised Software Updates
Infected Hardware Components
Breached Service Providers
Open-Source Library Flaw
Strengthen Vendor Security
Impact: Countless applications exposed to
remote code execution due to a flaw in a
ubiquitous logging library.
Mandate Software Bill of Materials (SBOM)
and conduct regular vendor security audits.
Source: balbix.com, wiz.io, pentera.io (Vulnerability/Risk Prioritization Concepts)

6. Polymorphic and Fileless Malware
Traditional vs. Polymorphic: What is Fileless Malware?
Evading Signatures Operating in Memory
Traditional malware has a fixed, static signature (like a
fingerprint). Antivirus software easily detects it by matching this
signature against a database of known threats.
This advanced threat avoids detection by never writing malicious
files to disk. It operates entirely in volatile memory (RAM), hijacking
legitimate system tools like PowerShell or WMI to execute
commands. This "living-off-the-land" approach makes it nearly
invisible to file-based scanners.
Polymorphic malware, in contrast, is designed to constantly alter
its code. Each new infection has a unique signature, rendering
traditional databases ineffective. Persistence & Detection Challenges
Core Evasion Techniques T
o survive reboots, it creates subtle disk-based
PERSISTENCE
CHALLENGES
triggers (e.g., registry keys, scheduled tasks) that
relaunch the in-memory payload.
A mutation engine rewrites the malware's code—
MUTATION
reordering instructions or adding junk data—without
changing its core malicious functionality. No Signatures: Blinds traditional antivirus.
Legitimate Tools: Blends with normal system
activity.
The malware encrypts its own payload, using a
different key for each infection. Only a small, ever-
changing decryptor stub is exposed.
ENCRYPTION
Ephemeral: Evidence vanishes on reboot.
The Evasion Gap: Traditional vs. Evolving Threats

7. Sophisticated Social Engineering Tactics
Beyond Basic Phishing: The Art of Manipulation
Email Attacks Voice & Phone Attacks Physical & In-Person
Targeted Digital Lures Verbal Deception Exploiting Physical Access
Spear Phishing: Highly personalized
emails targeting specific individuals using
gathered intelligence (e.g., job title,
interests) to appear legitimate.
Vishing (Voice Phishing): Using phone
calls to create a sense of urgency or
authority, often impersonating tech
support, banks, or government agencies to
solicit sensitive information.
Baiting: Leaving a malware-infected
device (like a USB drive) in a location
where it is likely to be found. Curiosity
leads an employee to plug it into a work
computer.
Whaling: A form of spear phishing aimed
at senior executives (C-suite) to trick them
into authorizing large wire transfers or
divulging strategic data.
Pretexting: The core of vishing, where the
attacker creates a believable fabricated
scenario (a pretext) to engage the target in
a way that encourages them to volunteer
information.
Tailgating: Following an authorized
individual into a secure area. This
technique relies on social courtesy to
bypass physical security controls like
keycard access.
Common Lures: Common Lures: Common Lures:
Fake Invoices, Urgent Security Alerts, Password
Resets, HR Policy Updates.
Tech Support Scams, Fraud Alerts, Threats of Legal
Action, Impersonating Authority.
"Lost" USB Drives, Impersonating Staff/Vendors,
Appealing to Helpfulness.
Leveraging Human Psychology in Cyber Attacks

8. Insider Threats: The Human Element
Understanding the risks that originate from within the organization.
Categorizing Insider Threats: Intent, Motivation, and Impact
Detection Challenges & Red Flags Prevention & Mitigation Strategies
Challenge: Distinguishing malicious behavior from legitimate daily
activities.
Implement strict access controls (RBAC) and
conduct regular reviews.
Least Privilege
Challenge: Trust in employees often leads to delayed suspicion and
Run continuous training programs to educate
Security Awareness
detection.

9. Advanced DDoS and Botnet Attacks
Evolution of DDoS Attacks
DDoS attacks have evolved from simple network floods to
complex, multi-vector assaults. Early attacks aimed to
saturate bandwidth, while modern threats leverage
massive botnets to launch sophisticated attacks targeting
the application layer, aiming for maximum disruption and
evasion of traditional defenses.
Modern DDoS Architecture via IoT Botnet
Layer 7 vs. Volumetric Attacks
Volumetric (Layers 3/4): Aims to overwhelm network
bandwidth with sheer traffic volume (e.g., DNS
amplification). Measured in Gbps/Tbps.
2. Compromised IoT
Botnet (e.g., Mirai) Attack
Traffic
C&C
Application (Layer 7): Aims to exhaust server
resources with legitimate-looking requests (e.g., HTTP
floods). Harder to detect, measured in Requests per
Second (RPS).
IP Cameras
Smart TVs
Routers
1. Threat
Actor
3. Target
Server
Other
Devices
Initiates
Attack
Service
Disruption
Impact & Remediation Strategies
Impact on Business: Causes severe service disruption,
direct financial loss, reputational damage, and can serve
as a smokescreen for other attacks like data theft.
Remediation Strategies: Employ cloud-based DDoS

10. Ransomware 2.0 and Data Extortion
Double Extortion Attack Flow The Extortion Evolution
Attackers steal sensitive data *before* encrypting it,
Double Extortion:
1. Initial Breach
2. Recon & Lateral Movement
3. Data Exfiltration
threatening public release to pressure victims.
Adds DDoS attacks or direct contact with the victim's customers
Triple Extortion:
to amplify pressure.
RaaS Ecosystem
Ransomware-as-a-Service lowers the barrier to entry, allowing
Business Model:
less skilled criminals (affiliates) to launch attacks using tools from developers.
Negotiation & Payment Challenges
4. Data Encryption
Paying ransoms funds criminal enterprises and offers no guarantee of data
recovery or deletion.
Legal risks, like violating OFAC sanctions, add another layer of complexity for
victims.
5. Ransom Demand
Proactive Defense Strategies
6. Threat of Data Publication
Regularly tested, offline backups are critical for recovery.
Employ network segmentation and the principle of least privilege to
contain breaches.
Immutable Backups:
If Victim Refuses
If Victim Pays Zero Trust:
Data Leak / Public Use EDR, robust patch management, and continuous employee
Vigilance:
Double Extortion Payment

11. Cloud and IoT Specific Threats
Cloud Security: Misconfigurations & IoT Security: Pervasive
Insecure APIs Vulnerabilities
The dynamic and complex nature of cloud environments makes
them susceptible to critical vulnerabilities, often stemming from
human error during configuration.
The proliferation of IoT devices has introduced a vast and often
unmanaged attack surface into corporate and home networks.
Lack of Patching
Common Misconfigurations Many IoT devices are sold with a "fire-and-forget" model,
rarely receiving security patches, leaving them permanently
vulnerable to known exploits.
Publicly accessible storage buckets (e.g., S3), overly
permissive IAM policies, and exposed network ports create
massive, unintentional attack surfaces.
Default Credentials
Insecure APIs & Interfaces The use of hardcoded or easily guessable default passwords
(e.g., admin/admin) allows attackers to easily compromise
devices and enlist them in botnets like Mirai.
APIs lacking robust authentication, rate limiting, or proper
input validation can be exploited for data breaches or denial-
of-service attacks.
Visualizing the IoT Attack Surface

12. Key Takeaways: Understanding Threats
Dynamic & Sophisticated
Landscape
Multi-Layered, Adaptive
Defenses
Evolving Threats are not static; they evolve Defense-in-Depth A multi-layered security
rapidly in complexity and methodology. posture is critical to protect all attack surfaces.
Resourced Attackers are often well-funded, Adaptability Static defenses are insufficient;
organized, and use advanced TTPs. security infrastructure must constantly adapt.
New vulnerabilities emerge Prioritize the ability to rapidly respond
Expanding Resilience
continuously in cloud, IoT, and supply chains. and recover from incidents.
Continuous Learning &
Staying Ahead
Proactive Threat
Intelligence
Security is a race against Transition from reactive incident
Ongoing Race Proactive Shift
adversaries; continuous learning is essential. response to proactive threat hunting.
Human Element Invest in security awareness to CTI Boost Use Cyber Threat Intelligence to
empower your first line of defense. enhance vulnerability prioritization.
Skill Up Commit to upskilling security teams to Anticipate Leverage CTI to anticipate adversary
counter modern attack methods. moves and allocate resources effectively.
Source: online_files (T
ech Shield), Balbix, Bitsight, Pentera, Wiz (Vulnerability/Risk Prioritization Concepts).

13. Introduction to Vulnerability Assessment
What is Vulnerability The Vulnerability
Assessment? Management
Lifecycle: A
Continuous Process
A systematic, proactive process of identifying, quantifying,
and ranking security weaknesses within an organization's IT
systems, applications, and networks. It provides a snapshot
of the current security posture.
Identification: Discovering known weaknesses in software Discover
and configurations.
Analysis: Understanding the nature and potential impact of
each vulnerability.
Reporting: Documenting findings to provide actionable
remediation guidance. Remediate Assess
Objectives and Benefits
Core Objectives: Key Benefits:
Proactive Security Posture
Risk Understanding & Context
Reduced Attack Surface
Optimized Resource Allocation Verify

14. Web Application Vulnerability Scanning
Common OWASP Top 10 Dedicated Scanning Tools
Vulnerabilities: Context
Burp Suite
Web applications are prime targets due to internet exposure. The
OWASP T
op 10 lists critical risks, and scanners simulate attacks to
find these weaknesses.
Strengths: Industry-standard for manual pen-testing with a
powerful proxy, repeater, and intruder.
Acunetix
Injection (e.g., SQL, Command)
Strengths: High-accuracy DAST with extensive coverage, SDLC
integration, and proof-of-exploit features.
Attackers insert malicious code into inputs to execute
unintended commands. Scanners detect this by injecting
payloads (e.g., `' OR '1'='1`) and analyzing application
responses like errors or time delays. OWASP ZAP
Strengths: Free, open-source, and highly extensible, perfect for
developers and integrated CI/CD pipelines.
Cross-Site Scripting (XSS)
Malicious scripts injected into web pages can hijack user
sessions. Scanners inject payloads (e.g., `<script>alert(1)
</script>`) and check if the script executes or is reflected
unsafely. Testing Techniques
Manual techniques are vital to uncover complex flaws in
authentication and session management.
Broken Authentication
Flaws in login or session handling allow impersonation.
Scanners test for weak passwords, insecure session tokens,
and improper logout handling.
Credential Brute-Forcing: Guessing credentials with
automated tools.
Bypassing Authentication Logic: T
esting for direct access to

15. Web Application Vulnerability Scanning
OWASP Top 10 Context
SQL Injection: Malicious SQL code injected into
inputs.
Cross-Site Scripting (XSS): Malicious scripts
injected into web pages.
Broken Authentication: Weak session or credential
management.
How Scanners Identify Vulnerabilities
Insecure Design: Lack of secure design principles.
SQL Injection
Automated
Probing
Dedicated Scanning Tools Malicious
Input Vulnerability
Scanner
Burp Suite: Comprehensive platform for web app
testing.
Web
Application
Threat Actor Fuzzing
Signatures
Behavior Analysis
Acunetix: Automated web vulnerability scanner.
Report Findings
XSS
OWASP ZAP: Open-source scanner for pen-testing.
Auth & Session Testing
Automated session token analysis.
Credential brute-forcing.
T
esting for insecure direct object references.

16. Database and Configuration Assessments
Tools for Database
Importance of Database Security Assessment
Scanning &
Protects an enterprise's most critical assets: intellectual property,
customer PII, and financial records. Specialized tools are essential for proactively identifying
vulnerabilities within database systems.
A breach can lead to catastrophic financial loss, severe reputational
damage, and regulatory fines (e.g., GDPR, CCPA). SQLmap Open-source tool to automate detection and exploitation
of SQL injection flaws.
Ensures data confidentiality, integrity, and availability, which
are foundational to business operations. Nessus/Qualys plugins find misconfigurations, missing
Scanners
patches, and weak auth.
Dedicated Tools Imperva/Guardium for comprehensive auditing and
Common
Database
&
Vulnerabilities real-time monitoring.
Exploits
SQL Injection (SQLi): Injecting malicious SQL to manipulate
database queries. Configuration Compliance Audits
Weak or Default Credentials: Easily guessable passwords providing
direct access. Systematically checking configurations against secure standards to
prevent misconfigurations.
Missing Patches: Unpatched systems with known, exploitable
vulnerabilities. Secure Baselines: Auditing against established security
benchmarks like CIS to validate controls.
Misconfigurations: Excessive privileges, insecure network listeners,
unencrypted data. Least Privilege: Verifying user roles and permissions to ensure no
excessive access rights exist.
Continuous Monitoring: Automating compliance checks to detect
and alert on unauthorized changes.

17. Penetration Testing Methodologies
Red Team vs. Blue Team: Simulated Adversaries vs. Defenders
Red Team: Simulating Adversaries Blue Team: Fortifying Defenses
The Red T
eam acts as a simulated, sophisticated adversary,
employing the tactics, techniques, and procedures (TTPs) of real-
world attackers to test defenses.
The Blue T
eam comprises the internal security personnel
responsible for establishing controls, continuous monitoring, and
responding to threats.
Purple Team
Collaborative effort to
maximize the effectiveness
of red and blue team
exercises.
Objective: Bypass security controls, exploit vulnerabilities, and
achieve specific goals to demonstrate real-world risk and defensive
gaps.
Objective: Establish robust security controls, detect threats,
respond to incidents, and implement recovery efforts to protect
assets.
Penetration Testing Approaches: A Knowledge-Based Spectrum
Attribute Black Box Grey Box White Box
Knowledge Level Zero prior knowledge of the target
system.
Limited knowledge (e.g., user
credentials, network diagrams).
Full knowledge (source code,
architecture, admin access).
Attacker Simulation
Pros
External attacker with no internal access. Insider threat or an attacker who has
gained a foothold.
Malicious insider, developer, or privileged
attacker.
Realistic external attack simulation;
unbiased.
More efficient than black box; balanced
perspective.
Most thorough and comprehensive;
identifies deep flaws.
Phases of a Penetration Test
1. Reconnaissance 2. Scanning 3. Gaining Access 4. Maintaining Access 5. Reporting

18. Static Application Security Testing
(SAST)
What is White-Box of Source
SAST? Testing Code
Integration with CI/CD Pipelines
Automating SAST scans within CI/CD pipelines ensures
continuous security feedback, preventing insecure code
from progressing.
Static Application Security T
esting (SAST) is a "white-box"
testing methodology that analyzes an application's source
code, bytecode, or binary code without execution. It
systematically reviews code for patterns indicating security
vulnerabilities, providing 100% codebase coverage.
When to Use
SAST:
in the
SDLC
Early 1. Planning
2. Design
As a cornerstone of the "Shift Left" approach, SAST is used
as early as possible. Integrating into IDEs and CI/CD
pipelines allows developers to find and fix vulnerabilities at
the coding stage, where remediation is cheapest and
fastest.
3. Coding
Integrated SAST Scans

19. Dynamic Application Security Testing (DAST)
What is DAST?Black-Box Testing DAST in Action: Attacker's Perspective
DAST is a "black-box" security testing method that examines a running
application from the outside, simulating how an attacker would. It
sends various inputs and malicious payloads to identify vulnerabilities
like injection flaws, XSS, and broken authentication without needing
source code access.
Sends
Payloads
(e.g., SQLi, XSS)
Analyzes
Output
(Errors, Data)
Running App
(Web Server/DB)
DAST Scanner
Advantages & Limitations
When to Use DAST:Runtime Analysis
Advantages Limitations
Slow scan times
DAST is most effective in later SDLC stages when an application is
fully compiled and running. It is typically used during: Low false positives
Language agnostic
Finds runtime issues
No code-level detail
QA/Staging: T
o find runtime issues before release.
Production: For continuous monitoring of live applications.
Limited code coverage
Key Differences with SAST
While DAST is black-box, SAST (Static... T
esting) is white-box,
analyzing source code. DAST finds runtime errors; SAST finds coding
flaws. They are highly complementary and should be used together
for comprehensive security coverage.

20. Interactive Application Security Testing
(IAST) and RASP
Navigating Cloud
Security:
CSPM:
The
for Cloud
Security
Challenges Foundation
What is CSPM?
Dynamic & Ephemeral Environments: Cloud resources constantly
change. Traditional tools struggle to maintain real-time visibility into
these fluid infrastructures, leading to blind spots.
T
ools providing continuous visibility, threat detection, and automated
remediation for cloud risks, acting as a central control plane for IaaS,
PaaS, and SaaS.
Shared Responsibility Model: Misunderstandings of provider vs.
customer responsibilities often result in critical misconfigurations and
vulnerabilities.
Automated Misconfiguration Detection
CSPM scans for issues like public buckets, permissive IAM roles, and
unencrypted data, flagging deviations from security best practices
(e.g., CIS Benchmarks).
Decentralized Deployments: Easy provisioning by different teams
can lead to fragmented security postures, inconsistent configurations,
and unmanaged shadow IT. Continuous Policy Violation Checks
Continuously assesses resources against regulatory standards (HIPAA,
GDPR) and custom policies, providing actionable insights for
remediation.
Multi-Cloud Complexity: Operating across AWS, Azure, and GCP
makes consistent policy enforcement and unified compliance reporting
a significant challenge.
Integration with Cloud Native Tools
Integrates with provider APIs and services (e.g., AWS Security Hub,
Azure Security Center) for comprehensive data ingestion and a unified
security view.

21. Cloud Security Posture Management
(CSPM)
Navigating Cloud
Security:
CSPM:
The
for Cloud
Security
Challenges Foundation
What is CSPM?
Dynamic & Ephemeral Environments: Cloud resources constantly
change. Traditional tools struggle to maintain real-time visibility into
these fluid infrastructures, leading to blind spots.
T
ools providing continuous visibility, threat detection, and automated
remediation for cloud risks, acting as a central control plane for IaaS,
PaaS, and SaaS.
Shared Responsibility Model: Misunderstandings of provider vs.
customer responsibilities often result in critical misconfigurations and
vulnerabilities.
Automated Misconfiguration Detection
CSPM scans for issues like public buckets, permissive IAM roles, and
unencrypted data, flagging deviations from security best practices
(e.g., CIS Benchmarks).
Decentralized Deployments: Easy provisioning by different teams
can lead to fragmented security postures, inconsistent configurations,
and unmanaged shadow IT. Continuous Policy Violation Checks
Continuously assesses resources against regulatory standards (HIPAA,
GDPR) and custom policies, providing actionable insights for
remediation.
Multi-Cloud Complexity: Operating across AWS, Azure, and GCP
makes consistent policy enforcement and unified compliance reporting
a significant challenge.
Integration with Cloud Native Tools
Integrates with provider APIs and services (e.g., AWS Security Hub,
Azure Security Center) for comprehensive data ingestion and a unified
security view.

22. Key Takeaways: Vulnerability Assessment
No Single Tool Provides
Complete Coverage
Combine Automated & Manual
Techniques
Relying on one tool creates blind spots. A diverse toolkit
is needed to cover the entire attack surface, from
network infrastructure to custom web applications and
cloud configurations.
Automated scanners provide speed and scale for known
issues, while manual penetration testing is crucial for
uncovering complex logic flaws and business-critical
vulnerabilities.
Integrate Security Testing Early
(Shift Left)
Regular & Consistent
Assessments
Continuous
Embedding security into the entire development
lifecycle—from design to deployment—is far more cost-
effective and less disruptive than fixing vulnerabilities
in production systems.
The threat landscape and your IT environment are
dynamic. Continuous, scheduled assessments are
paramount to proactively identify and remediate new
weaknesses before they are exploited.
Vulnerability
Management
Source: Balbix, Pentera.io, Wiz.io, Purplesec.us (Vulnerability Prioritization Concepts)

23. Introduction to Risk Management
Defining Cybersecurity Risk: The Intersectionof Threats & Vulnerabilities
Threat Vulnerability Asset
A potential cause of an unwanted incident
(e.g., hacker, malware).
A weakness in an asset that can be exploited
(e.g., unpatched software).
Anything of value to an organization (e.g.,
data, systems, reputation).
Risk = Threat x Vulnerability x Impact
The Risk Management Framework (RMF): A Structured Approach
1. Prepare 2. Categorize 3. Select 7. Monitor 6. Authorize 5. Assess 4. Implement
Importance of Risk Assessment in StrategicSecurity Planning
Informed Decision-Making on security investments. Prioritization of efforts on the most significant risks.

24. Threat Identification and Likelihood
Sources of Threats:
Understanding the
Common Threat
Vectors &
Attack
Methods
Origin
Effective cybersecurity begins with identifying where threats
originate. These sources can be broadly categorized, each requiring
different detection and mitigation strategies.
Threat vectors are the paths attackers use to gain unauthorized
access. Attack methods are the techniques used to exploit
vulnerabilities.
Malware & Exploits: Viruses, ransomware, and zero-days
1. Adversaries
delivered via email or websites.
Intent: Malicious, deliberate harm, data theft, sabotage.
Examples: Cybercriminals, Nation-States, Malicious Insiders.
Social Engineering: Phishing and pretexting that exploit human
psychology.
2. Environmental
Vulnerable Systems: Unpatched software, misconfigurations,
and weak access controls.
Intent: Unintentional, natural or systemic forces impacting
systems.
Examples: Natural disasters, Power outages, Hardware
Network Attacks: DDoS, Man-in-the-Middle (MITM) to disrupt or
failures.
intercept data.
Supply Chain Compromise: Injecting malicious code into third-
party software updates.
3. Accidental
Intent: Unintentional, human error or negligence.
Examples: Misconfigurations, Accidental data deletion,
Phishing clicks.
Insider Actions: Data exfiltration or sabotage by trusted
individuals, whether malicious or accidental.

25. Threat Identification and Likelihood
Sources of Threats:
Understanding the
Common Threat
Vectors &
Attack
Methods
Origin
Effective cybersecurity begins with identifying where threats
originate. These sources can be broadly categorized, each requiring
different detection and mitigation strategies.
Threat vectors are the paths attackers use to gain unauthorized
access. Attack methods are the techniques used to exploit
vulnerabilities.
Malware & Exploits: Viruses, ransomware, and zero-days
1. Adversaries
delivered via email or websites.
Intent: Malicious, deliberate harm, data theft, sabotage.
Examples: Cybercriminals, Nation-States, Malicious Insiders.
Social Engineering: Phishing and pretexting that exploit human
psychology.
2. Environmental
Vulnerable Systems: Unpatched software, misconfigurations,
and weak access controls.
Intent: Unintentional, natural or systemic forces impacting
systems.
Examples: Natural disasters, Power outages, Hardware
Network Attacks: DDoS, Man-in-the-Middle (MITM) to disrupt or
failures.
intercept data.
Supply Chain Compromise: Injecting malicious code into third-
party software updates.
3. Accidental
Intent: Unintentional, human error or negligence.
Examples: Misconfigurations, Accidental data deletion,
Phishing clicks.
Insider Actions: Data exfiltration or sabotage by trusted
individuals, whether malicious or accidental.

26. Vulnerability Identification and Impact
Leveraging Assessment Results Assessing Potential Business Impact
The first step is to consolidate outputs from all assessment tools
(network scanners, SAST/DAST, etc.) into a unified inventory. This
creates a comprehensive list of all identified security weaknesses
across the entire digital estate.
Data Loss: Evaluates the risk of unauthorized access or exfiltration
of sensitive information, leading to regulatory fines and competitive
disadvantage.
Each finding is then enriched with context like CVE IDs and CVSS
scores, transforming raw data into actionable intelligence.
Downtime: Assesses the potential for operational disruption and
service unavailability, resulting in revenue loss and productivity
decline.
Reputational Damage: Measures the potential erosion of customer
trust and brand value following a public security incident.
Mapping Vulnerabilities to Assets and Impact
Vulnerability ID /
Desc
Affected Asset(s) Asset Criticality Data Loss Downtime Reputation Overall Risk
Customer DB
Server
CVE-2023-SQLi High High Medium High Critical
Weak Admin Cloud Mgmt.

27. Calculating and Visualizing Risk
The
Risk
& Qualitative
Assessment
Risk Analysis & Cost-
Benefit
Formula Quantitative
The Foundational Risk Formula: Risk is the intersection Quantitative Risk Analysis: This method assigns
of threat likelihood and potential impact, expressed as: monetary values to risk components for precise calculation.
Single Loss Expectancy (SLE): Monetary loss from a single
Risk = Likelihood x Impact event.
Annualized Rate of Occurrence (ARO): Estimated frequency
per year.
Likelihood: The probability of a threat exploiting a vulnerability.
Impact: The magnitude of harm (financial, operational,
reputational).
Annualized Loss Expectancy (ALE): T
otal expected loss per
year (ALE = SLE x ARO).
Using Risk Matrices: Qualitative assessment uses
descriptive scales (e.g., Low, Medium, High) for broad
categorization. A risk matrix maps these onto a grid,
providing a quick visual of relative risk levels to "quickly
assess and compare different risks based on their impact
and [likelihood]." (swimlane.com)
Cost-Benefit Analysis: This helps determine if a security
control is a worthwhile investment. The goal is to ensure
the cost of a control is justified by the reduction in ALE it
provides. This supports data-driven decisions, ensuring that
security investments are strategically allocated to provide
maximum return.
Risk Heatmap Visualizations for Executive Overview

28. Vulnerability Prioritization Frameworks
CVSS: AssessingSeverity Combining CVSS, EPSS, and Business Context
The Common Vulnerability Scoring System (CVSS)
provides a technical score of a vulnerability's severity. It
is context-free and focuses on the inherent
characteristics of the flaw itself.
Exploitability Metrics:
Attack Vector (AV)
Impact Metrics:
Confidentiality (C)
Integrity (I)
Attack Complexity (AC)
Privileges Required (PR)
User Interaction (UI)
Availability (A)
EPSS: PredictingLikelihood
Building an EffectiveStrategy
The Exploit Prediction Scoring System (EPSS) forecasts
the probability (0-100%) that a vulnerability will be
exploited in the wild, adding a crucial layer of threat
intelligence.
1. Identify Asset Criticality: Understand which systems are vital for business
operations.
2. Combine Data: Integrate CVSS (severity), EPSS (likelihood), and asset value
Key Inputs: (impact).
Observed real-world exploitation
Availability of public exploit code
Security researcher activity and discussion
3. Automate Risk Scoring: Use risk-based formulas to create a prioritized
vulnerability list.
4. Set Remediation SLAs: Define clear timelines for patching based on the final
risk level.

29. Risk Treatment and Mitigation Strategies
The Four Pillars of Risk Treatment: Deciding on a Strategic Response
Accept Avoid Transfer Mitigate
Acknowledging a risk without taking
action, typically when the cost of
mitigation outweighs the potential
impact.
Eliminating the cause of the risk by
discontinuing the activity or asset
that creates it.
Shifting the financial burden of a risk
to a third party, such as through
cyber insurance.
Implementing controls to reduce the
likelihood or impact of the risk event
occurring.
Organizational Administrative
Implementing Technical Controls
& Controls
Patch Management
Security Policies
Regularly applying updates to fix known vulnerabilities and reduce the
attack surface. Establishing a formal framework for consistent security behavior and
compliance.
Firewalls
Security Training
Filtering network traffic to prevent unauthorized access and segment
networks. Empowering employees as the first line of defense by reducing human
error.
IDS/IPS

30. Continuous Risk Monitoring and Review
Why Risk Management is an Dynamic
Ongoing & Process
Regular Reviews
and
Proactive
Monitoring
Risk management is not a one-time audit but a perpetual cycle,
critical in today's rapidly changing threat landscape.
The risk register is the central repository for identified risks. Its
accuracy depends on regular, systematic review and proactive
monitoring.
Evolving Threats: Cyber adversaries constantly innovate,
introducing new attack vectors, malware variants, and sophisticated
tactics that bypass static defenses.
Risk Register Updates: Conduct periodic formal reviews (e.g.,
quarterly) and event-driven updates to re-evaluate existing risks and
identify emerging ones.
Dynamic Business Environment: Organizational changes such as
new technologies, cloud adoption, market shifts, and regulatory
updates introduce new risks and alter existing ones.
Key Risk Indicators (KRIs): Implement and track KRIs (e.g.,
number of critical vulnerabilities, mean time to patch) to provide
early warnings of increasing risk exposure.
Adapting to Change: The security posture must continuously adapt
to maintain alignment with the actual threat environment and
business objectives.
Stakeholder Input: Gather input from all relevant stakeholders (IT,
business, legal) to ensure a holistic view of organizational risks.
The Continuous Risk Management Lifecycle:
Proactive,
, and Data-
Driven
Adaptive

31. Reporting and Communicating Risk
Tailoring Risk Reports Different for Risk
Ownership
EstablishingAccountability
for Audiences
Effective risk communication requires customizing content and
presentation for the specific audience.
Clear accountability is fundamental. Risks are best managed when
ownership is defined at the appropriate level.
1. Technical Audience (Analysts, IT Teams)
Focus: Granular detail, CVSS scores, CWE IDs, exploitability, and specific
remediation steps.
1. Defining Risk Ownership
Business & Data Owners: Own risks associated with their operations and
data.
Metrics: Vulnerability counts, patch compliance rates, incident response
times.
Goal: Enable efficient prioritization and mitigation. "Helps cybersecurity
teams focus on the most critical."
System Owners: Accountable for security of specific IT systems.
CIO/CISO: Provide strategic oversight and enforce enterprise-level risk
frameworks.
2. Implementing Risk Governance
Risk Register: A central repository for all identified risks, owners, and
statuses.
Regular Reviews: Scheduled meetings to review risks and track mitigation
progress.
Performance Metrics: Integrate risk KPIs into relevant roles to foster a
culture of continuous management. "Ensure that high-risk vulnerabilities are
addressed first."
2. Executive Audience (Board, C-Suite)
Focus: High-level strategic overview, business impact (financial,
reputational), and ROI on security.
Metrics: T
op risks, aggregate risk scores, compliance status, risk trends over
time.
Goal: Facilitate informed strategic decision-making and investment.
Key Metrics & Dashboards: Visualizing RiskAcross Layers
Tactical Reporting

32. Key Takeaways: Risk Management
Risk is Inherent Prioritization is Crucial
Must be Managed, Not Eliminated. For Efficient Resource Allocation.
Risk Management
A Continuous Process
Integrate Security & Risk Cultivate a Risk-Aware Culture
Into All Business Operations. Throughout the Organization.
Source: Synthesized from concepts by Balbix, Purplesec.us, and Vikingcloud.com

33. Conclusion and Future Outlook
Recap of Key Concepts Emerging Trends in Security
Network security fundamentally hinges on the relationship: Risk =
Threat x Vulnerability. Our journey has covered comprehensive
threat analysis, robust vulnerability assessment techniques, and
the critical importance of a risk-based prioritization strategy to
align security controls with actual business risk.
The future is about adaptive security, leveraging AI-driven threat
intelligence and automation. Technologies like XDR and Zero Trust
architectures will become standard, shifting focus from perimeter
defense to protecting identities and data everywhere, informed by
risk-based automation tools.
A Proactive & Adaptive Posture Call to Action for Resilience
Security is not a static state but a continuous process. A proactive
posture means anticipating and mitigating risks before exploitation.
An adaptive posture ensures the organization can respond
effectively to new and evolving threats, demonstrating true cyber
resilience.
Embed continuous vulnerability assessment and risk management
into your operational DNA. The ultimate goal is to build digital
resilience through ongoing vigilance, employee education, strategic
investment in modern security measures, and a commitment to
continuous improvement.
Source: online_files (Abstract world Cyber Security Concept)

34. References
Academic Papers & Security Industry Standards &
Journals Frameworks
In-depth research, novel attack methodologies, and validated
defense strategies crucial for staying at the forefront of
cybersecurity knowledge.
Essential for establishing robust, repeatable, and compliant
cybersecurity programs by providing best practices and
assessment criteria.
IEEE Security & Privacy NIST: Cybersecurity Framework (CSF), SP 800-53
ISO/IEC 27001: Information Security Management
OWASP: T
o p 10 Web Application Security Risks
MITRE ATT&CK: Adversary Tactics & T
echniques
ACM Transactions on Privacy and Security
Black Hat & DEF CON Proceedings
Recommended Books &
Cybersecurity News & Blogs
Resources
For real-time threat intelligence, emerging vulnerability
disclosures, breach analysis, and expert commentary on the
evolving landscape.
Provides foundational knowledge, deep understanding of specific
domains, and practical guides for cybersecurity professionals.
KrebsOnSecurity
Dark Reading
"The Art of Invisibility" by Kevin Mitnick
"Hacking: The Art of Exploitation" by Jon Erickson
SANS Institute Reading Room
BleepingComputer

35. Questions & Contact
Thank Yo u for Your
Attention!
Open for Questions and Discussion
Connect with us:
x@y.com
Source: online_files (HUD and Shield Icon of Cyber Security)