166 terms ·
75/46/45
73 rezultata za „segmentation" ·
11 direktnih ·
62 povezanih
Pretnje
6 direktnih pogodaka-
№ 067
IoT Device Compromise An IoT device without updates and without segmentation should be treated as a device that will be compromised sooner or later.pretnja · physical / IoT
-
№ 023
Pass-the-Hash … ory the hash lives in (Credential Guard); network segmentation; a move from NTLM to Kerberos. The main recommendation is that privileged accounts are not used a …pretnja · identity
-
№ 070
SCADA/OT Attack … is not always possible straight away. That is why segmentation, monitoring and control of remote access carry far more weight.pretnja · physical / IoT
-
№ 059
Third-Party Compromise … se's laptop, somebody else's EDR, somebody else's segmentation and somebody else's understanding of an incident.pretnja · trust
-
№ 008
Worm … talled. With a worm, regular patching and network segmentation are the difference between one infected machine and a thousand.pretnja · malware
-
№ 044
Zero-Day Exploitation … ist. What matters is reducing the attack surface, segmentation, behavioral detection, limited rights and a response plan. When you do not know the exact flaw, y …pretnja · applications
Tehnike
1 direktan pogodakOdbrane
4 direktna pogotka-
№ 032
Microsegmentation Finer network division at workload or application level, not just VLANs.odbrana · resilience
-
№ 025
Network Segmentation Network segmentation is the practice of dividing network infrastructure into smaller, isolated segments with controlled communication between them. The goal is …odbrana · resilience
-
№ 040
DevSecOps Integrating security into all phases of the software development lifecycle.odbrana · people
-
№ 011
Zero Trust … ion of multiple technologies including MFA, micro-segmentation, user and device behavior monitoring, and context-based access policies. Zero Trust is not a prod …odbrana · identity / access
↳ Povezano
62 stavke koje koriste „segmentation"-
№ 009
AiTM AiTM sits between the user and the real service. Classic phishing steals a password; AiTM steals the live session. The victim gets a link, lands on a proxy that looks exactly like the real login (because it forwards everything to the real site), enters credentials and even the MFA code — the proxy passes them through, the real service issues a session token, and the attacker captures that token.tehnika · initial access
-
№ 043
Authentication Bypass An authentication bypass means the attacker reaches a protected part of the system without logging in the ordinary way. They need not know a password. Sometimes a flaw in the logic is enough, or an unprotected endpoint, a predictable token, a misconfigured proxy, or a gap between two steps of the login.pretnja · applications
-
№ 056
BGP Hijacking BGP hijacking is an attack, or a serious mistake, in which internet traffic is diverted by wrong routing. BGP is the protocol by which autonomous systems on the internet tell each other which path leads to particular IP ranges. If somebody announces another party's range as their own, part of the internet can believe them.pretnja · availability
-
№ 053
Botnet Attacks A botnet is a set of compromised devices the attacker controls remotely. That network can hold computers, servers, routers, cameras, NAS devices, phones and IoT equipment. The owner of the device often does not know that it is carrying out somebody else's requests.pretnja · availability
-
№ 006
Browser Isolation Executing web content in an isolated environment separate from the local system.odbrana · endpoints
-
№ 024
Cloud lateral movement In the cloud, identities can assume roles — temporarily take on another identity's rights. It's built for legitimate delegation, but it becomes lateral movement when an attacker who got one identity chains the steps: identity A can become B, B can become C with more rights, C reaches another account. No new password at each step — just inherited delegation.tehnika · privileges
-
№ 039
Command & Control Command and control communication involves establishing a persistent channel between the attacker and the compromised system for sending commands and receiving results. The attacker uses this channel to manage malware, launch new attack phases, and retrieve data.tehnika · C2
-
№ 026
Configuration Abuse Configuration abuse involves exploiting misconfigured systems, services, or security controls. Attackers look for default passwords, overly broad permissions, open ports, and services without authentication.tehnika · discovery
-
№ 023
Container Escape Containers are meant to isolate an application from the host and from other containers. Container escape is when an attacker controlling a process inside a container breaks that isolation and reaches the host (or other containers). From an application-level foothold they get host-level reach.tehnika · privileges
-
№ 063
Contractor Abuse Contractor access abuse arises when a consultant, a contractor, an external firm or a temporarily engaged person uses access more widely or for longer than the work requires. The access is often granted legitimately, but afterwards it is not monitored, not narrowed and not withdrawn in time.pretnja · trust
-
№ 003
Credential Abuse Credential abuse involves using stolen, leaked, or otherwise obtained login data to gain unauthorized access to systems and services. The attacker impersonates a legitimate user.tehnika · initial access
-
№ 036
DNS Tunneling Technique of exfiltrating data or C2 communication through DNS queries.tehnika · exfiltration / impact
-
№ 034
Data Destruction Technique of permanently deleting or corrupting data on a compromised system.tehnika · exfiltration / impact
-
№ 031
Data Exfiltration Data exfiltration involves transferring stolen information from the compromised environment to an attacker-controlled location. Data can be sent through encrypted channels, legitimate cloud services, email, or even physical media.tehnika · exfiltration / impact
-
№ 031
Deception Technology Deploying decoy resources (honeypots, honeytokens) to detect attackers.odbrana · resilience
-
№ 048
Dependency Confusion Dependency confusion is an attack on the process by which software build platforms find and deliver software dependencies. An attacker can publish a package on a public registry with the same name as an organization's internal package, or with the name of another public and valid package, counting on the fetching tool choosing their version over the real one.pretnja · applications
-
№ 049
Distributed Denial of Service / DDoS DDoS is a distributed denial-of-service attack. Instead of attacking from one place, the attacker uses a large number of compromised devices, rented infrastructure and reflected traffic to bury the target in web requests until the server is blocked. The aim is not data theft but choking the service into unavailability.pretnja · availability
-
№ 037
Double Extortion Technique where data is first exfiltrated, then encrypted for ransom.tehnika · exfiltration / impact
-
№ 007
Drive-by Download Drive-by download is automatic malware download when visiting a compromised site.tehnika · initial access
-
№ 003
EDR EDR (Endpoint Detection and Response) is a technology that continuously monitors endpoint activity, records events, and enables detection, investigation, and response to threats that bypassed preventive controls.odbrana · endpoints
-
№ 042
Encrypted C2 Channels Using HTTPS, DNS-over-HTTPS, or other encrypted protocols for C2.tehnika · C2
-
№ 001
Endpoint Protection Endpoint protection encompasses software solutions that protect computers, servers, and mobile devices from malicious software and unauthorized activities. It combines classic signature-based malware detection with heuristic analysis and behavior-based detection.odbrana · endpoints
-
№ 010
Exploitation Exploitation involves leveraging a flaw in software, hardware, or configuration to execute unauthorized code or bypass security controls. Vulnerabilities can exist in operating systems, applications, network services, or firmware.tehnika · execution
-
№ 041
Fast-Flux DNS Rapid rotation of IP addresses associated with a C2 domain.tehnika · C2
-
№ 035
Firewall A firewall is a control placed at the boundary between networks that permits or blocks traffic according to predefined rules — deciding who may talk to whom, on which ports and protocols.odbrana · resilience
-
№ 022
IDS/IPS IDS/IPS are systems that monitor network traffic (or host activity) for patterns indicating an attack. An IDS (Intrusion Detection System) only reports suspicious activity; an IPS (Intrusion Prevention System) sits inline and can block it immediately.odbrana · monitoring / response
-
№ 009
Identity & Access Management Identity and access management encompasses the policies, processes, and technologies for creating, managing, and revoking digital identities and their access rights. The goal is to ensure the right users have the right access to the right resources at the right time.odbrana · identity / access
-
№ 020
Incident Response A planned process of identifying, containing, eradicating, and recovering from cyber incidents.odbrana · monitoring / response
-
№ 058
Insider Threat An insider threat comes from a person who has, or once had, legitimate access to an organization's systems, data or premises. That can be an employee, a former employee, an administrator, an associate, a supplier or a partner. The trouble is that the access was not necessarily unauthorized to begin with.pretnja · trust
-
№ 016
Logging & Monitoring Logging and monitoring involves the systematic recording of activities and events on systems, networks, and applications, along with regular analysis of those records to detect anomalies and security incidents.odbrana · monitoring / response
-
№ 017
MDR MDR (Managed Detection and Response) is a service where an external security team provides continuous monitoring, threat detection, and incident response on behalf of an organization. It combines technology with human expertise.odbrana · monitoring / response
-
№ 038
Malware Delivery Malware delivery encompasses the methods by which malicious software is transferred to a target system. This includes infected attachments, compromised websites, malicious ads, removable media, and compromised software updates.tehnika · C2
-
№ 008
Multi-Factor Authentication Multi-factor authentication requires two or more independent proofs of identity at login. It typically combines something the user knows (password), something they possess (phone, hardware key), and something they are (biometrics).odbrana · identity / access
-
№ 028
Network Sniffing Passively intercepting network traffic to collect sensitive data.tehnika · discovery
-
№ 021
Pass-the-Hash Using NTLM hashes instead of plaintext passwords for authentication.tehnika · privileges
-
№ 023
Patch Management Patch management is the process of identifying, testing, and applying software updates that fix known vulnerabilities. The goal is to reduce the time window in which an attacker can exploit a known weakness.odbrana · resilience
-
№ 045
Penetration Testing Simulation of real attacks to identify vulnerabilities that automated tools miss.odbrana · governance
-
№ 008
Physical Access Using physical access to a device or space as an attack vector.tehnika · initial access
-
№ 018
Privilege Escalation Privilege escalation is a technique by which an attacker with limited access gains a higher level of authorization. Vertical escalation means reaching administrator or root level, while horizontal escalation means accessing another user's resources at the same privilege level.tehnika · privileges
-
№ 010
Privileged Access Management Privileged access management controls, monitors, and records the use of accounts with elevated permissions such as administrator accounts, service accounts, and root access. These accounts are the most valuable targets for attackers as they provide broad access to critical systems.odbrana · identity / access
-
№ 072
Prompt injection Prompt injection exploits the weakness of language models in telling an instruction apart from the content they are processing. When a model reads an email, a document, a page, a ticket or a message, the attacker can put text into that content which reads like an instruction.pretnja · AI / ML
-
№ 055
Ransom DDoS Ransom DDoS joins an attack on availability to extortion. The attackers threaten to bring the service down, or first run a short demonstration attack, and then ask for money for the attack to stop or for a larger one not to happen.pretnja · availability
-
№ 001
Ransomware Ransomware locks a company's data and demands payment to release it. The ransom is asked in cryptocurrency because it makes the money harder to follow — which is exactly why attackers use it.pretnja · malware
-
№ 025
Reconnaissance Reconnaissance involves the systematic gathering of information about the target environment, both externally before the attack and internally after compromise. The goal is to understand the topology, identify targets, and plan the next stages.tehnika · discovery
-
№ 038
Remote Code Execution Remote code execution is one of the most dangerous classes of vulnerability, because it lets an attacker run their own code on a vulnerable system from somewhere else entirely. If the application runs on a server, the attacker is no longer merely a user on the outside; they gain a way to influence what the server executes.pretnja · applications
-
№ 014
Remote access trojan - RAT A RAT gives the attacker remote control of your machine. Once inside they can browse files, switch on the camera and microphone, record what you type and run commands — all of it live, as if sitting in front of your screen. It resembles remote support tools, only on the wrong side of the law.pretnja · malware
-
№ 032
Resource Exhaustion Resource exhaustion as a technique involves deliberately overloading target systems to make them unavailable to legitimate users. The attacker targets CPU, memory, network bandwidth, disk, or connection limits.tehnika · exfiltration / impact
-
№ 041
Risk Assessment Systematic process of identifying, analyzing, and prioritizing cyber risks.odbrana · governance
-
№ 015
SIEM SIEM (Security Information and Event Management) is a system that collects logs and events from diverse sources across the entire infrastructure, centralizes them, and applies correlation rules to detect suspicious patterns and security incidents.odbrana · monitoring / response
-
№ 018
SOAR Security Orchestration, Automation and Response — automating security operations.odbrana · monitoring / response
-
№ 045
SSRF SSRF is a vulnerability in which the attacker gets a web server to send a request to an address of the attacker's choosing. The distinction matters: the request is not sent by the user's browser but by the server. That opens the door to internal services which from the outside ought to remain invisible.pretnja · applications
-
№ 026
Secure Configuration Secure configuration involves applying established security baselines to all systems, services, and applications in an organization. The goal is to reduce the attack surface by eliminating unnecessary functions, default passwords, and insecure settings.odbrana · resilience
-
№ 060
Supply Chain Attack A supply chain attack does not always aim at the final victim directly. The attacker compromises software, hardware, a supplier, a build process or an update mechanism before the product or service reaches the user. The victim then carries the problem into their own environment, because it comes from a source they trust.pretnja · trust
-
№ 006
Supply Chain Compromise Technique of injecting malicious code into the software supply chain.tehnika · initial access
-
№ 019
Threat Intelligence Collecting, analyzing, and applying data about current cyber threats.odbrana · monitoring / response
-
№ 036
Virtual Private Network A VPN (virtual private network) creates an encrypted tunnel between a device and the network it connects to. For an organization this primarily means controlled remote access to internal resources — from home, on the road, in the field. Traffic inside the tunnel cannot be read in transit, even on hotel Wi-Fi.odbrana · resilience
-
№ 044
Vulnerability Management Continuous process of discovering, classifying, prioritizing, and remediating vulnerabilities.odbrana · governance
-
№ 027
WAF WAF (Web Application Firewall) is a firewall that filters, monitors, and blocks HTTP/HTTPS traffic to web applications. It sits between users and the web server, analyzing each request against defined rules.odbrana · resilience
-
№ 005
Watering Hole Technique of compromising websites that the target group regularly visits.tehnika · initial access
-
№ 036
Watering Hole Attack A watering hole attack does not chase the victim directly. The attacker first finds a site the target group visits regularly, then compromises that site or the content loaded through it. The victim then comes to the place of the attack on their own, doing what they normally do.pretnja · social eng.
-
№ 007
Wiper A wiper does not exist to steal or to extort — a wiper destroys data. It erases and overwrites, breaks file systems, and combined with worms and zero-day vulnerabilities it can bring down hundreds or thousands of networks within hours. Unlike ransomware it offers no ransom; recovery was never part of the plan, because the aim is damage, not money.pretnja · malware
-
№ 004
XDR XDR (Extended Detection and Response) unifies data from endpoints, network, email, and cloud.odbrana · endpoints