5.6 Threat Agents, Attack Techniques & the Stages of a Cyber-Attack
Key Takeaways
- Threat agents are classified along independent axes - internal versus external, nation-state versus non-nation-state - and the risk each poses is the intersection of capability, intent and opportunity, of which controls can remove only opportunity.
- The ISC blueprint separates attack types (physical, distributed denial of service, malware, social engineering, web application attacks, mobile device attacks) from attack techniques, and tests both lists.
- A buffer overflow injects new attacker-supplied code into memory, while a return-oriented programming attack chains together short sequences of code already present in legitimate loaded modules specifically to defeat non-executable memory defenses.
- A race condition exploits the gap between the time a condition is checked and the time it is used, while a covert channel moves information through a path never intended for communication, such as encoding exfiltrated data inside DNS queries.
- Because the final stage of an attack is covering tracks, security logs must be forwarded in near real time to a central system the compromised host cannot reach or alter; a gap in an otherwise continuous log is itself an indicator of compromise.
Threat Agents, Attack Techniques & the Stages of a Cyber-Attack
Quick Answer: Four Area II representative tasks sit here, and three of them are enumerated lists the blueprint spells out. Classify threat agents. Identify types of attacks — physical, distributed denial of service, malware, social engineering, web application attacks, mobile device attacks. Identify techniques used in a cyber-attack — buffer overflow, mobile code, cross-site scripting, SQL injection, race conditions, covert channel, replay, return-oriented attack. And explain the stages in a cyber-attack. The technique list in particular is pure recall: know what each one is and what stops it.
1. Classifying Threat Agents
The blueprint asks candidates to "classify the different types of threat agents (e.g., internal or external, nation or non-nation state-sponsored, adversary, threat actors, attacker or hacker)." Classification runs along several independent axes, and a real adversary sits at a point on each.
Axis 1 — Internal vs. External
- Internal. Employees, contractors, temporary staff, and anyone else holding legitimate credentials. Internal agents skip the perimeter entirely, know where the valuable data sits, and know which controls are weak. Split further into malicious (deliberate theft, sabotage, fraud) and negligent (misconfiguration, clicking a phish, emailing a spreadsheet home).
- External. No authorized access; must obtain it. Includes the entire criminal and state-sponsored spectrum, plus opportunistic scanners.
- The hybrid that causes the most damage: an external adversary who compromises internal credentials. They are external in origin and internal in behavior, which is why controls that assume "inside equals trusted" fail.
Axis 2 — Nation-State vs. Non-Nation-State
- Nation-state sponsored. Funded and directed by a government; objectives are espionage, intellectual property acquisition, pre-positioning in critical infrastructure, and disruption. Effectively unlimited budget, long time horizons, willing to spend undisclosed vulnerabilities. Detection is hard because the objective is persistence, not noise.
- Non-nation-state. Organized criminal enterprises (profit), hacktivists (ideology), terrorists (disruption and fear), competitors (commercial advantage), and individual actors ranging from skilled researchers to unskilled operators running purchased tooling.
Axis 3 — Capability, Intent and Opportunity
Risk from a threat agent is the intersection of three things. A hostile actor with no capability is noise. A capable actor with no intent toward you is irrelevant. An actor with both but no opportunity — no exposed surface, no valid credential — cannot act. Controls work by removing opportunity, because capability and intent belong to the adversary.
Section 5.2 profiles each agent category — nation-state advanced persistent threats, organized cybercrime, malicious and negligent insiders, hacktivists and unskilled opportunistic actors — with its motivation and sophistication. What the blueprint's classification task adds is the discipline of placing a given adversary on each axis at once: a contractor's compromised credential used by a criminal syndicate is external in origin, internal in behavior, non-nation-state in sponsorship, and high in capability. Name the axes, then locate the actor on each.
2. Types of Attacks
The blueprint lists six attack types. Do not confuse a type (the category of assault) with a technique (the specific mechanism used within it). Section 5.2 works the mechanics and controls for the highest-frequency vectors — phishing and business email compromise, ransomware economics, injection and cross-site scripting, and supply chain compromise. This section covers the blueprint's six categories as a complete set, including the two that study plans routinely skip: physical attacks and mobile device attacks.
- Physical attacks. Theft of devices or media, tailgating into a facility, shoulder surfing, dumpster diving, planting a rogue device on a network port, or damaging equipment. Countered by facility access control, device encryption, clean-desk policy, port security and secure disposal. Physical attacks are frequently underweighted in study plans and appear on the exam precisely because of that.
- Distributed denial of service (DDoS). Many compromised hosts flood a target with traffic or requests until legitimate users cannot be served. Volumetric attacks saturate bandwidth; protocol attacks exhaust connection state such as a SYN flood; application-layer attacks issue expensive requests at low volume. The target is availability, not confidentiality. Countered by upstream scrubbing services, rate limiting, anycast distribution and content delivery networks.
- Malware. Viruses (attach to a host file), worms (self-propagate across a network without a host), trojans (disguised as legitimate software), ransomware, spyware and keyloggers, rootkits (hide at or below the operating system), logic bombs (trigger on a condition), and botnet agents. Countered by endpoint detection and response, application allowlisting, patching and least privilege.
- Social engineering. Manipulating a person rather than a machine: phishing, spear phishing, whaling, vishing (voice), smishing (SMS), pretexting, baiting, quid pro quo, tailgating, and business email compromise. Countered by awareness training, verification procedures that are out-of-band and mandatory, and phishing-resistant authentication.
- Web application attacks. Injection, broken access control, cross-site scripting, cross-site request forgery, insecure deserialization, and server-side request forgery, as catalogued by the OWASP Top 10. Countered by secure coding, parameterized queries, output encoding, and a web application firewall as a secondary layer.
- Mobile device attacks. Malicious applications from unofficial stores, jailbreaking or rooting that defeats the platform sandbox, SIM swapping that defeats SMS-based authentication, exploitation of unmanaged personal devices holding corporate data, rogue Wi-Fi access points, and Bluetooth attacks. Countered by mobile device management, containerization that separates corporate and personal data, application vetting and remote wipe.
3. Techniques Used in a Cyber-Attack
This is the blueprint's most specific enumeration in Area II. Each item is a recall item.
| Technique | Mechanism | Primary Defense |
|---|---|---|
| Buffer overflow | Writes more data into a memory buffer than it was allocated, overwriting adjacent memory — including the return address — so the processor jumps to attacker-supplied code | Bounds checking in code, memory-safe languages, non-executable stack (DEP/NX), address space layout randomization, stack canaries |
| Mobile code | Code transferred across a network and executed on the receiving host — Java applets, ActiveX controls, JavaScript, macros in documents. The risk is that code arrives from an untrusted source and runs with the user's privileges | Sandboxing, code signing with verified publishers, disabling macros from the internet, browser isolation |
| Cross-site scripting (XSS) | Injects script into a web page that then executes in another user's browser inside that site's trust context, stealing session cookies or performing actions as the victim | Context-aware output encoding, Content Security Policy, HttpOnly cookie flag, input validation |
| SQL injection | Supplies input that the application concatenates into a database query, changing the query's logic to read, modify or destroy data | Parameterized queries / prepared statements, least-privilege database accounts, stored procedures with bound parameters |
| Race condition (TOCTOU) | Exploits the gap between the time of check and the time of use. A file's permission is verified, and between the check and the open the attacker swaps the file for a link to a protected one | Atomic operations, proper locking, using file handles rather than re-resolving names, avoiding predictable temporary file names |
| Covert channel | Moves information through a path never intended for communication, evading monitoring. A storage channel writes to an unmonitored shared object; a timing channel modulates the timing of legitimate operations to encode bits. Data exfiltration hidden inside DNS queries is the archetype | Egress filtering, DNS monitoring and inspection, data loss prevention, anomaly detection on volume and timing |
| Replay attack | Captures a valid transmission — an authentication token, a signed payment instruction — and re-sends it later to be accepted a second time | Nonces, sequence numbers, timestamps with a narrow validity window, session tokens bound to the session, mutual TLS |
| Return-oriented programming (ROP) | Defeats non-executable memory defenses by chaining together short instruction sequences ("gadgets") that already exist in legitimate loaded code, so no new code is ever injected | Address space layout randomization, control-flow integrity, stack canaries, hardware shadow stacks |
Exam framing: The clean discriminators are (a) buffer overflow versus ROP — the first injects new code, the second reuses existing code to bypass the defenses that stopped the first; (b) XSS versus SQL injection — the first targets the browser of another user, the second targets the database server; (c) replay versus covert channel — the first re-sends legitimate traffic, the second hides new traffic in a legitimate carrier; and (d) race condition — always look for a gap between validating something and acting on it.
4. The Stages of a Cyber-Attack
The blueprint lists six stages: reconnaissance, gaining access, escalation of privileges, maintaining access, network exploitation, and covering tracks. The value of the model for a CPA is that every stage leaves different evidence and yields to a different control.
| Stage | What the Adversary Does | Evidence the Auditor Looks For | Control That Interrupts It |
|---|---|---|---|
| 1. Reconnaissance | Gathers information: public filings, staff on social media, DNS records, exposed services, port and vulnerability scans | Scanning patterns in perimeter logs; enumeration attempts; unusual directory queries | Attack surface reduction, minimizing published technical detail, perimeter monitoring |
| 2. Gaining access | Exploits a vulnerability, phishes a credential, or walks in physically | Anomalous first-time logins, exploit signatures, new processes on an internet-facing host | Patching, phishing-resistant multi-factor authentication, input validation, physical access control |
| 3. Escalation of privileges | Moves from a standard account to administrative rights, often via a local vulnerability, a misconfigured service account, or credentials cached in memory | Privilege group additions, new administrative accounts, credential-dumping tool signatures | Least privilege, privileged access management, just-in-time elevation, credential-guard protections |
| 4. Maintaining access | Installs persistence so a reboot or password reset does not evict them: backdoors, scheduled tasks, registry run keys, new service accounts, rogue SSH keys | New scheduled tasks and services, unexpected autoruns, accounts created outside the HR feed | File integrity monitoring, configuration baselines, reconciliation of accounts to the HR system |
| 5. Network exploitation | Moves laterally, locates the valuable data, and acts on the objective: exfiltration, encryption, fraudulent transactions | East-west traffic to systems a host never talks to; large or unusual outbound transfers; bulk record reads | Network segmentation and microsegmentation, data loss prevention, egress filtering, database activity monitoring |
| 6. Covering tracks | Deletes or edits logs, clears command history, alters timestamps, disables alerting | Gaps in otherwise continuous logs; logging services stopped; timestamps out of sequence | Centralized, write-once log forwarding to a SIEM the compromised host cannot reach or alter |
The single most important control implication: stage 6 is why logs must be shipped off the host in near real time to a system the adversary does not control. Local logs on a compromised server are evidence the adversary can edit. The absence of a log is itself an indicator of compromise — a continuous audit trail with a two-hour hole is a finding, not a housekeeping issue.
An attacker discovers that a server enforces non-executable memory protections, preventing injected shellcode from running. The attacker instead constructs an exploit that chains together short instruction sequences already present in the server's legitimately loaded libraries, ending each sequence with a return instruction. Which technique is being used?
During an incident investigation, a forensic analyst notes that the security event log on a compromised application server is continuous except for a 90-minute gap on the night of the intrusion, after which logging resumes normally. What does this most likely indicate, and what control would have prevented it?
A file-processing utility verifies that a temporary file is owned by the invoking user before opening it for writing. An attacker repeatedly replaces the temporary file with a symbolic link to a protected system configuration file in the interval between the ownership check and the file open. Which attack technique does this describe?