166 terms ·
75/46/45
123 rezultata za „risk" ·
20 direktnih ·
103 povezanih
Pretnje
10 direktnih pogodaka-
№ 063
Contractor Abuse The risk is not only deliberate theft. A private laptop with no protection is enough, or keeping data for the next project, or sharing an account inside the sup …pretnja · trust
-
№ 035
Deepfake Attack The greatest risk is not that everyone will believe every recording, but that organizations will carry on using voice and video as proof of identity. In a world …pretnja · social eng.
-
№ 012
Infostealer … lopment teams can put an entire infrastructure at risk.pretnja · malware
-
№ 004
Keylogger … sword managers with autofill can reduce keylogger risk.pretnja · malware
-
№ 023
Pass-the-Hash … hash on one computer, every other one is at high risk of compromise.pretnja · identity
-
№ 034
QR phishing - Quishing … and modern way in, so it is less often taken as a risk.pretnja · social eng.
-
№ 019
Session Hijacking … tifier immediately after login remove most of the risk.pretnja · identity
-
№ 064
Shadow IT … l on its own and puts client data into it with no risk assessment.pretnja · trust
-
№ 059
Third-Party Compromise This risk is hard because it does not end at the company's own infrastructure. An organization can have solid internal controls and still depend on somebody els …pretnja · trust
-
№ 033
Whaling A senior position does not reduce the risk; it raises the value of the target.pretnja · social eng.
Tehnike
1 direktan pogodakOdbrane
9 direktnih pogodaka-
№ 041
Risk Assessment … of identifying, analyzing, and prioritizing cyber risks.odbrana · governance
-
№ 033
CSPM … et a list of concrete misconfigurations ranked by risk — 'this bucket is public', 'this role can be assumed by anyone', 'these databases aren't encrypted' — oft …odbrana · resilience
-
№ 013
Certificate Management PKI infrastructure control reduces the risk of MitM attacks.odbrana · identity / access
-
№ 029
DNS Security DNS security encompasses technologies that protect DNS infrastructure and use DNS traffic as a control point for blocking access to malicious domains and detecting suspicious communications.odbrana · resilience
-
№ 009
Identity & Access Management … n loses track of who has access to what, creating risks of unauthorized access, privilege accumulation, and accounts remaining active after they are no longer n …odbrana · identity / access
-
№ 008
Multi-Factor Authentication MFA drastically reduces the risk of unauthorized access even when a password is compromised, because the attacker must also possess the second factor. It is one …odbrana · identity / access
-
№ 012
Password Manager Reduces phishing risk because autofill only works on legitimate domains.odbrana · identity / access
-
№ 023
Patch Management … ess encompasses tracking vendor-released patches, risk and priority assessment, testing in a controlled environment, and planned deployment to production system …odbrana · resilience
-
№ 011
Zero Trust … ous verification of identity, device context, and risk level for every access request.odbrana · identity / access
↳ Povezano
103 stavke koje koriste „risk"-
№ 042
API Abuse API abuse arises when an attacker uses a programming interface in a way the application did not anticipate or did not restrict enough. An API is not merely a technical add-on to the application. It is often the main entrance to the data, the users, the orders, the payments and the administration.pretnja · applications
-
№ 020
Access Token Manipulation Token abuse involves stealing or manipulating authentication tokens, session cookies, or access keys to assume the identity of a legitimate user or service. The attacker can use a token without knowing the password.tehnika · privileges
-
№ 065
Accidental Data Leak An accidental data leak is not an attack in the classic sense, but the consequences can look the same. Data becomes available to the wrong people through human error, bad configuration, wrong sharing, a public repository, open cloud storage, or mail sent to the wrong address.pretnja · trust
-
№ 021
Account Takeover Account takeover is the moment the attacker gains full control of an account — not only access, but the ability to change the password, the recovery mail address, the phone number and the second factor, while the real owner is shut out with no technical way back in on their own. Takeover is rarely the first stage of an attack. It is usually the destination of what came before: phishing, credential stuffing, token theft.pretnja · identity
-
№ 009
AiTM AiTM sits between the user and the real service. Classic phishing steals a password; AiTM steals the live session. The victim gets a link, lands on a proxy that looks exactly like the real login (because it forwards everything to the real site), enters credentials and even the MFA code — the proxy passes them through, the real service issues a session token, and the attacker captures that token.tehnika · initial access
-
№ 043
Authentication Bypass An authentication bypass means the attacker reaches a protected part of the system without logging in the ordinary way. They need not know a password. Sometimes a flaw in the logic is enough, or an unprotected endpoint, a predictable token, a misconfigured proxy, or a gap between two steps of the login.pretnja · applications
-
№ 006
Backdoor A backdoor is a hidden way in. Once placed or opened, it lets the attacker return to the machine — with no password, no authorization and no entry in the ordinary records. A backdoor can be opened by malware while it runs, but it can equally be a user account nobody watches, or web shell access left on a server.pretnja · malware
-
№ 053
Botnet Attacks A botnet is a set of compromised devices the attacker controls remotely. That network can hold computers, servers, routers, cameras, NAS devices, phones and IoT equipment. The owner of the device often does not know that it is carrying out somebody else's requests.pretnja · availability
-
№ 004
Brute Force Brute force as a technique involves the systematic testing of a large number of credential combinations to gain unauthorized access. It includes classic exhaustive testing, dictionary attacks with common passwords, and password spraying.tehnika · initial access
-
№ 015
Brute-force attack A brute-force attack breaks into an account by trying to log in over and over: automated tools work through password after password until one takes. It succeeds against short, weak and common passwords, and against systems that put no limit on failed attempts. It is not clever — it is only fast, and it can run for days.pretnja · identity
-
№ 028
Business Email Compromise Business email compromise is not an ordinary fake email. The attacker breaks into business correspondence, or imitates it well enough that somebody in the company believes the request comes from the director, from finance, from a supplier, a lawyer or a partner. The aim is usually money, but it can also be a confidential document, a change of payment details, or an opening for the next phase of the attack.pretnja · social eng.
-
№ 075
Cloud IAM misconfiguration Cloud IAM misconfiguration means a user, a service account, an application or a role holds more rights than it needs. In the cloud an identity is not merely a login. An identity is permission to read data, spin up resources, change networks, assume roles and delete backups.pretnja · cloud
-
№ 024
Cloud lateral movement In the cloud, identities can assume roles — temporarily take on another identity's rights. It's built for legitimate delegation, but it becomes lateral movement when an attacker who got one identity chains the steps: identity A can become B, B can become C with more rights, C reaches another account. No new password at each step — just inherited delegation.tehnika · privileges
-
№ 074
Cloud storage exposure Cloud storage exposure arises when data that ought to be private becomes publicly reachable through a bad configuration of a cloud service. That can be S3 buckets, blob storage, backups, logs, documents, images, database exports or configuration files.pretnja · cloud
-
№ 039
Command & Control Command and control communication involves establishing a persistent channel between the attacker and the compromised system for sending commands and receiving results. The attacker uses this channel to manage malware, launch new attack phases, and retrieve data.tehnika · C2
-
№ 023
Container Escape Containers are meant to isolate an application from the host and from other containers. Container escape is when an attacker controlling a process inside a container breaks that isolation and reaches the host (or other containers). From an application-level foothold they get host-level reach.tehnika · privileges
-
№ 003
Credential Abuse Credential abuse involves using stolen, leaked, or otherwise obtained login data to gain unauthorized access to systems and services. The attacker impersonates a legitimate user.tehnika · initial access
-
№ 017
Credential stuffing Credential stuffing does not go after unknown passwords; it tries known ones. With username and password pairs from databases leaked across the internet, the attacker tries the most-used services such as Facebook and Instagram, counting on people reusing the same credentials on several services — which in most cases holds.pretnja · identity
-
№ 013
Cryptominer A cryptominer steals what we rarely think of as a target: our computing power and our electricity. In the background it uses our processors and graphics cards to mine cryptocurrency for the attacker while we pay the bill. It has no interest in our data, only in our resources and how much of them there is.pretnja · malware
-
№ 034
DLP DLP watches where sensitive data goes and stops it where it shouldn't: an employee attaching a client list to a private email, copying a file with personal data to a USB, or pasting a database into a chat. It works by recognizing patterns (national IDs, card numbers, marked documents) and applying rules per channel — mail, web, endpoint, cloud.odbrana · resilience
-
№ 051
DNS Amplification DNS amplification is a reflected DDoS attack in which the attacker uses open DNS resolvers to multiply the traffic aimed at a victim. The attacker sends relatively small DNS queries but forges the victim's address as the source.pretnja · availability
-
№ 057
DNS Poisoning DNS poisoning is an attack in which a user or a resolver is given a false answer for a domain. The result is that the user types a familiar address into the browser and DNS takes them to the wrong web server. On paper the name is the same. In reality the road leads somewhere else.pretnja · availability
-
№ 036
DNS Tunneling Technique of exfiltrating data or C2 communication through DNS queries.tehnika · exfiltration / impact
-
№ 030
Data Encryption Protecting data by encrypting it at rest and in transit.odbrana · resilience
-
№ 031
Data Exfiltration Data exfiltration involves transferring stolen information from the compromised environment to an attacker-controlled location. Data can be sent through encrypted channels, legitimate cloud services, email, or even physical media.tehnika · exfiltration / impact
-
№ 050
Denial of Service / DoS DoS is a denial-of-service attack that tries to bring a service down or slow it so far that legitimate users can no longer use it. Unlike DDoS it need not come from a large network of compromised devices. Sometimes one source and a well-chosen vulnerability are enough.pretnja · availability
-
№ 040
DevSecOps Integrating security into all phases of the software development lifecycle.odbrana · people
-
№ 029
Domain Account Discovery Mapping users, groups, permissions, and Active Directory structure.tehnika · discovery
-
№ 040
Domain Fronting Technique of hiding C2 traffic behind legitimate CDN domains.tehnika · C2
-
№ 037
Double Extortion Technique where data is first exfiltrated, then encrypted for ransom.tehnika · exfiltration / impact
-
№ 007
Drive-by Download Drive-by download is automatic malware download when visiting a compromised site.tehnika · initial access
-
№ 003
EDR EDR (Endpoint Detection and Response) is a technology that continuously monitors endpoint activity, records events, and enables detection, investigation, and response to threats that bypassed preventive controls.odbrana · endpoints
-
№ 002
Email Security Email security encompasses technologies that filter inbound and outbound messages to prevent phishing, malware delivery, and business email compromise. It operates at the server or cloud level before the message reaches the user.odbrana · endpoints
-
№ 042
Encrypted C2 Channels Using HTTPS, DNS-over-HTTPS, or other encrypted protocols for C2.tehnika · C2
-
№ 001
Endpoint Protection Endpoint protection encompasses software solutions that protect computers, servers, and mobile devices from malicious software and unauthorized activities. It combines classic signature-based malware detection with heuristic analysis and behavior-based detection.odbrana · endpoints
-
№ 068
Evil Twin A fake Wi-Fi network, known as an evil twin, imitates a legitimate wireless network so that users connect to an access point the attacker controls. The network name looks familiar, the signal can be stronger, and the device often suggests or restores the connection by itself.pretnja · physical / IoT
-
№ 010
Exploitation Exploitation involves leveraging a flaw in software, hardware, or configuration to execute unauthorized code or bypass security controls. Vulnerabilities can exist in operating systems, applications, network services, or firmware.tehnika · execution
-
№ 041
Fast-Flux DNS Rapid rotation of IP addresses associated with a C2 domain.tehnika · C2
-
№ 022
Forge Kerberos Tickets A set of techniques exploiting the Kerberos protocol in Active Directory.tehnika · privileges
-
№ 012
Impair Defenses Defense evasion encompasses techniques by which an attacker conceals their activity from security tools, analysts, and automated detection systems. The goal is to remain undetected for as long as possible in the compromised environment.tehnika · execution
-
№ 046
Insecure Deserialization Deserialization is the return of a packed object into a form the application can use. The problem arises when an application accepts an object from an untrusted source and handles it as though it were safe. At that point the attacker is not sending mere data but a specially prepared structure that can change the flow of execution.pretnja · applications
-
№ 058
Insider Threat An insider threat comes from a person who has, or once had, legitimate access to an organization's systems, data or premises. That can be an employee, a former employee, an administrator, an associate, a supplier or a partner. The trouble is that the access was not necessarily unauthorized to begin with.pretnja · trust
-
№ 067
IoT Device Compromise IoT device compromise hits cameras, routers, sensors, smart televisions, locks, controllers and all the equipment connected to a network that does not behave like a classic computer. The problem is that these devices are often forgotten the moment they are switched on.pretnja · physical / IoT
-
№ 022
Kerberoasting Kerberoasting is an attack specific to Windows domain networks and Active Directory (AD). User logins are handled by the Kerberos protocol, which issues tickets as proof of identity. In a domain environment there are non-user accounts — service accounts — under which most background tasks and services run, such as databases and business applications. Service accounts are set up so that any user can request a ticket for access to a given service. The catch is that the ticket is encrypted with the service account's password.pretnja · identity
-
№ 019
Lateral Movement Lateral movement involves an attacker moving from one compromised system to another within the same network. The goal is to expand access to systems containing more valuable data or enabling further escalation.tehnika · privileges
-
№ 016
Logging & Monitoring Logging and monitoring involves the systematic recording of activities and events on systems, networks, and applications, along with regular analysis of those records to detect anomalies and security incidents.odbrana · monitoring / response
-
№ 024
MFA Fatigue MFA fatigue is social-engineering pressure applied to two-factor authentication. The attacker has the password, leaked or phished, but is stopped at the second factor — a confirmation the user has to approve on their phone. So the attacker starts the login over and over, burying the phone in approval requests. The arithmetic is simple: out of irritation, confusion, or the thought that it must be some glitch, the user approves one at some point — and the attacker is through the whole authentication.pretnja · identity
-
№ 032
Malvertising Malvertising uses ad networks as a delivery channel for attacks. The user does not have to be on a dubious site; a malicious advert can appear on a legitimate portal too, because ad space often arrives through several intermediaries.pretnja · social eng.
-
№ 038
Malware Delivery Malware delivery encompasses the methods by which malicious software is transferred to a target system. This includes infected attachments, compromised websites, malicious ads, removable media, and compromised software updates.tehnika · C2
-
№ 032
Microsegmentation Finer network division at workload or application level, not just VLANs.odbrana · resilience
-
№ 005
Mobile Device Security Managing and protecting mobile devices through MDM and MAM solutions.odbrana · endpoints
-
№ 073
Model theft / extraction Model theft and extraction means an attacker obtains a model an organization trained, bought or adapted to its own needs. That can be direct theft of the files, the weights and the configuration, but also controlled extraction through an API, where the model is queried enough times to build an approximate copy.pretnja · AI / ML
-
№ 025
Network Segmentation Network segmentation is the practice of dividing network infrastructure into smaller, isolated segments with controlled communication between them. The goal is to limit an attacker's ability to move through the network after compromising a single system.odbrana · resilience
-
№ 028
Network Sniffing Passively intercepting network traffic to collect sensitive data.tehnika · discovery
-
№ 030
OSINT Gathering information about targets from publicly available sources before an attack.tehnika · discovery
-
№ 021
Pass-the-Hash Using NTLM hashes instead of plaintext passwords for authentication.tehnika · privileges
-
№ 016
Password spraying Password spraying is brute force turned around. Instead of trying many passwords on one account, the attacker tries common passwords across many accounts. That avoids lockout, because each individual account sees only an attempt or two.pretnja · identity
-
№ 011
Persistence Persistence encompasses techniques by which an attacker ensures their access or malicious code survives system reboots, password changes, or other interruptions. The goal is to maintain a foothold in the environment over an extended period.tehnika · execution
-
№ 026
Phishing Phishing is the most widespread form of social-engineering attack and, in a great many cases, the first link in any serious break-in. The attacker sends a message that appears to come from a known organization — a bank, a courier, a government service, a colleague — and leads the victim into doing one of three things: clicking a link, opening an attachment, or entering their credentials somewhere.pretnja · social eng.
-
№ 001
Phishing Phishing as a technique involves sending fraudulent emails, SMS messages, or chat messages to trick the victim into clicking a malicious link, opening an infected attachment, or entering credentials on a fake page.tehnika · initial access
-
№ 038
Phishing Simulations Regular testing of employees with simulated phishing messages.odbrana · people
-
№ 008
Physical Access Using physical access to a device or space as an attack vector.tehnika · initial access
-
№ 031
Pretexting Pretexting is social engineering with a prepared story. The attacker does not simply send a link and wait for a click; they build a scenario in which what they are doing looks normal. They present themselves as a colleague, technical support, an auditor, a bank, a supplier, a courier or an official.pretnja · social eng.
-
№ 020
Privilege Escalation Privilege escalation is the attempt by an attacker who already holds some level of access to widen their rights in order to move through the network. Escalation is rarely the first stage — it comes after entry through, say, an ordinary user account or a compromised service. It takes the attacker from the crack they slipped through to control of the whole system. There are two directions: vertical escalation, from an ordinary user to domain administrator, and horizontal, moving from one account to another user's resources at the same level of rights.pretnja · identity
-
№ 018
Privilege Escalation Privilege escalation is a technique by which an attacker with limited access gains a higher level of authorization. Vertical escalation means reaching administrator or root level, while horizontal escalation means accessing another user's resources at the same privilege level.tehnika · privileges
-
№ 061
Privilege Misuse Privilege misuse arises when somebody uses rights they genuinely hold for actions they have no business reason to take. Unlike privilege escalation, the attacker or insider here does not have to acquire new authority. The trouble is that the existing authority is enough to do damage.pretnja · trust
-
№ 010
Privileged Access Management Privileged access management controls, monitors, and records the use of accounts with elevated permissions such as administrator accounts, service accounts, and root access. These accounts are the most valuable targets for attackers as they provide broad access to critical systems.odbrana · identity / access
-
№ 072
Prompt injection Prompt injection exploits the weakness of language models in telling an instruction apart from the content they are processing. When a model reads an email, a document, a page, a ticket or a message, the attacker can put text into that content which reads like an instruction.pretnja · AI / ML
-
№ 001
Ransomware Ransomware locks a company's data and demands payment to release it. The ransom is asked in cryptocurrency because it makes the money harder to follow — which is exactly why attackers use it.pretnja · malware
-
№ 025
Reconnaissance Reconnaissance involves the systematic gathering of information about the target environment, both externally before the attack and internally after compromise. The goal is to understand the topology, identify targets, and plan the next stages.tehnika · discovery
-
№ 043
Regulatory Compliance Meeting requirements of regulatory frameworks and standards for cybersecurity.odbrana · governance
-
№ 038
Remote Code Execution Remote code execution is one of the most dangerous classes of vulnerability, because it lets an attacker run their own code on a vulnerable system from somewhere else entirely. If the application runs on a server, the attacker is no longer merely a user on the outside; they gain a way to influence what the server executes.pretnja · applications
-
№ 032
Resource Exhaustion Resource exhaustion as a technique involves deliberately overloading target systems to make them unavailable to legitimate users. The attacker targets CPU, memory, network bandwidth, disk, or connection limits.tehnika · exfiltration / impact
-
№ 070
SCADA/OT Attack An attack on SCADA and OT systems targets industrial processes, not only data. These are the systems that run manufacturing, energy, water, transport, buildings, sensors, PLC controllers and HMI stations. When such a system stops or starts working wrongly, the consequences can be fatal.pretnja · physical / IoT
-
№ 015
SIEM SIEM (Security Information and Event Management) is a system that collects logs and events from diverse sources across the entire infrastructure, centralizes them, and applies correlation rules to detect suspicious patterns and security incidents.odbrana · monitoring / response
-
№ 025
SIM Swapping SIM swapping does not attack the phone but the phone number. The attacker persuades, or bribes, a mobile operator to move the number to a new SIM card, citing a lost phone or a damaged card. They usually come armed with personal details from leaked databases and phishing. The moment the number moves to their card, the real phone loses signal and every call and message goes to the attacker.pretnja · identity
-
№ 030
SMS phishing - Smishing Smishing is phishing over SMS or messaging apps. The attacker sends a short message with a link, a request to confirm something, or an instruction for an urgent action, counting on messages being read quickly on a phone and without much checking.pretnja · social eng.
-
№ 007
SPF/DKIM/DMARC By default, anyone can put your domain in the sender field — that's how spoofed mail 'from the director' works. SPF, DKIM, and DMARC are three records you publish for your domain that let a recipient check whether mail claiming to be from you actually came from your systems. SPF says which servers may send for you, DKIM signs the message, and DMARC tells the recipient what to do with mail that fails the check and sends you reports.odbrana · endpoints
-
№ 039
SQL Injection SQL injection usually arises when a web application passes user input blindly to the database on the web server. Instead of ordinary text, the attacker can put part of an SQL command into a login, search or filter field. If the application does not stop it, the database can execute something the designer never had in mind, and certainly never intended.pretnja · applications
-
№ 014
Secrets Management Applications, scripts, and services need secrets to do their work — passwords, API keys, certificates, database connection strings. The wrong place for them is code, a config file, a repository, or a chat message. Secrets management means a central, protected store (a vault) from which an application fetches a secret exactly when it needs it, instead of carrying it around in plaintext.odbrana · identity / access
-
№ 026
Secure Configuration Secure configuration involves applying established security baselines to all systems, services, and applications in an organization. The goal is to reduce the attack surface by eliminating unnecessary functions, default passwords, and insecure settings.odbrana · resilience
-
№ 037
Security Awareness Employee education programs about cyber threats and safe behavior.odbrana · people
-
№ 039
Security Champions An ambassador program for security within development and business teams.odbrana · people
-
№ 042
Security Policies Formal documents defining an organization's cybersecurity rules and standards.odbrana · governance
-
№ 054
Service Abuse Service abuse uses legitimate functions of a system in an unforeseen way. The attacker does not have to find a classic vulnerability. It is enough to work out how a normal function can be automated, overloaded, or turned against the service and its users.pretnja · availability
-
№ 033
Service Abuse Service abuse as a technique involves using legitimate system functionalities in unintended ways to cause damage, gain unauthorized access, or achieve financial gain.tehnika · exfiltration / impact
-
№ 062
Shared Account Abuse Shared account abuse begins wherever several people use the same username and password. The system then no longer knows who actually did something. It knows only that a particular account was used, which for accountability is the same as knowing nothing.pretnja · trust
-
№ 002
Social Engineering Social engineering as a technique involves manipulating human behavior to obtain information, access, or the execution of actions that benefit the attacker. It relies on trust, authority, urgency, or fear.tehnika · initial access
-
№ 027
Spear Phishing Spear phishing is phishing cut to fit one person or a small group of users. Instead of sending the same message to thousands of addresses, the attacker first gathers information about the victim — where they work, who they work with, what they are working on right now, how the company addresses its clients — and then writes a message that reads as if it came from that world.pretnja · social eng.
-
№ 003
Spyware Spyware watches the user and what they do. Hidden, it can spend months collecting what you type, what is on your screen, where you are, who calls you, and what you say through the microphone and camera. The point is not damage to the device but a record of the person, which can later be turned to any number of uses.pretnja · malware
-
№ 060
Supply Chain Attack A supply chain attack does not always aim at the final victim directly. The attacker compromises software, hardware, a supplier, a build process or an update mechanism before the product or service reaches the user. The victim then carries the problem into their own environment, because it comes from a source they trust.pretnja · trust
-
№ 006
Supply Chain Compromise Technique of injecting malicious code into the software supply chain.tehnika · initial access
-
№ 018
Token Theft A token is proof that you have already logged in. When you sign in and confirm your identity with a second factor, the service issues a token, stored in the browser, which vouches that you have already been checked the next time round. The token is sent automatically with every further request, so you do not have to type the password again. Token theft is the taking of that proof. With it in hand, the attacker presents themselves as you — without your password and without the second factor, because both have already been approved.pretnja · identity
-
№ 002
Trojan A Trojan does not break in; the victim opens the door. It usually presents itself as something useful — a program or a document, a fake installer, a cracked application, or a harmless-looking tool for speeding up the computer. The user runs what they meant to run, and the attacker gets what they were after.pretnja · malware
-
№ 066
Typosquatting Typosquatting exploits small mistakes in typing, reading or recognizing a name. The attacker registers a domain, an account or a software package that resembles a legitimate name, counting on a user, a developer or a system to miss one letter, swap a character or overlook the difference.pretnja · trust
-
№ 044
Vulnerability Management Continuous process of discovering, classifying, prioritizing, and remediating vulnerabilities.odbrana · governance
-
№ 005
Watering Hole Technique of compromising websites that the target group regularly visits.tehnika · initial access
-
№ 036
Watering Hole Attack A watering hole attack does not chase the victim directly. The attacker first finds a site the target group visits regularly, then compromises that site or the content loaded through it. The victim then comes to the place of the attack on their own, doing what they normally do.pretnja · social eng.
-
№ 035
Website Defacement Unauthorized modification of website content to send a message.tehnika · exfiltration / impact
-
№ 008
Worm A worm spreads on its own. Unlike a virus it needs no host file and no click from the user — once it is on one machine it immediately looks for the next, and the next, and thousands of devices can be infected within minutes. Replication is its purpose, speed is its weapon, and whatever it carries is the real threat.pretnja · malware
-
№ 004
XDR XDR (Extended Detection and Response) unifies data from endpoints, network, email, and cloud.odbrana · endpoints
-
№ 044
Zero-Day Exploitation Zero-day exploitation uses a vulnerability for which the vendor has no patch yet, or does not know exists. The name says how much time the defense had to prepare: zero days. In practice a victim can be doing everything right, keeping systems and applications up to date, and still be exposed.pretnja · applications
-
№ 029
voice phishing - Vishing Vishing is phishing over the telephone. Instead of an email and a link, the attacker uses a voice, a phone number and the pressure of the moment. They present themselves as a bank, technical support, a courier, the police, the tax office, or somebody from the company, while trying to extract details or lead the victim into doing something they otherwise would not.pretnja · social eng.