2.1 Key Terminology & the Attack Chain

Theory: Key Terminology & the Attack Chain

Week 1 asked what we protect (confidentiality, integrity, availability). Week 2 asks what puts these three properties at risk, and how? To answer precisely, security professionals use a small, exact vocabulary: target, vulnerability, threat, threat actor, attack vector, exploit, attack. The exam tests these definitions directly and, more often, asks you to label each part of a short scenario.

By the end of this week you should be able to:

distinguish key terms such as threat, vulnerability, risk and attack;
identify organizational assets and prioritize what matters most (see 2.2);
match assets to relevant threats and threat actors, and explain actor motivations (see 2.3);
connect threats and vulnerabilities back to the CIA Triad.

The Core Vocabulary

Target: the specific system, server, application or data aimed at by an attacker, usually a valuable asset.

Vulnerability: a weakness or flaw in software, hardware or processes that can be exploited.

Threat: any potential danger, actor or event that has the capability to cause harm to a system.

Threat actor: the concrete person, group or entity behind a threat, with a motive.

Hacker: an individual with advanced technical skills who may attack (black hat) or defend (white hat) systems.

Exploit: a specific piece of code, script or technique designed to take advantage of a vulnerability; exploitation is the moment the weakness is actually used.

Attack vector: the pathway or method used to deliver an exploit to the target (e.g., phishing email, malware).

Attack (sequence): the structured, step-by-step sequence of events from initial breach to final impact.

The defender’s side has its own terms:

Security analyst: a defender who monitors, analyzes, detects and responds to cyber threats.
Penetration test: an authorized, simulated cyberattack used to evaluate system security and discover weaknesses before real attackers do.

The Five Characters of the Story

The lecture tells the vocabulary as a story with five characters:

Character	Role in the story
Target	What the hacker is after: an organization’s valuable assets
Vulnerability	A weakness that leaves the door open
Threat	Someone or something that could exploit that weakness
Hacker	The person or group who takes deliberate action
Exploit	The moment the weakness is actually used against you

Threat vs. Vulnerability vs. Risk

These three are the most frequently confused terms.

Term	Question it answers	Hospital example
Vulnerability	Where are we weak? (internal)	The EHR server runs unpatched software
Threat	Who or what could cause harm? (external or internal danger)	Cybercriminals who sell medical records
Risk	How likely is harm, and how bad would it be?	High: a known flaw, a motivated attacker, very sensitive data

A risk exists only where a threat can meet a vulnerability in something of value. An unpatched server that holds nothing valuable and cannot be reached has little risk; a motivated attacker with no weakness to use also creates little risk. Measuring and prioritizing risk is Week 3’s topic.

Common mistake: calling the unpatched software “the threat.” Software flaws are vulnerabilities: weaknesses you own. The threat is the danger (actor or event) that could use them. A quick test: you can usually fix a vulnerability yourself; you usually cannot “fix” a threat, only defend against it.

Attack Vector vs. Exploit

Both describe “how,” but at different points:

The attack vector is the path to reach the vulnerability (how the attacker gets in or delivers the payload): a phishing email, a stolen password used on the VPN, an infected USB stick.
The exploit is the act/tool that takes advantage of the vulnerability once there: the exploit code run against the database flaw.

Think of a burglar: the attack vector is the route (through the garden, over the fence), the vulnerability is the unlocked back window, and the exploit is the act of sliding the window open and climbing in.

The Attack Chain

The terms link into one chain, from what is valuable to the damage done:

Diagram loads as you scroll.

Read it as: a threat actor targets a valuable asset, finds a vulnerability, reaches it through an attack vector, uses an exploit, and causes an impact on confidentiality, integrity or availability. The whole end-to-end event is the attack.

Sample Case: Max7 Shop

An online retailer, Max7 shop, stores customers’ credit card data in a database. The database server runs outdated software with a known, unpatched flaw. IT staff at another retail company, 11-shop, scan the internet for servers running this outdated software and find Max7. They send a phishing email to a Max7 employee to steal their VPN password, use the stolen password to log into Max7’s internal network, and then run exploit code against the known database flaw to extract the credit card data.

Term	What it is in this case	Why
Target	The customer credit card data stored in Max7’s database	The valuable asset the attackers are after
Vulnerability	The unpatched, outdated database software	The specific weakness that makes the target exploitable
Threat	People who want this data (in general, as a source of danger)	Anything capable of exploiting the vulnerability
Threat actor	The IT staff of 11-shop carrying out this attack	The concrete entity behind the threat, with a motive (financial gain)
Attack vector	Phishing email → stolen VPN password → network login	The path/method used to reach the vulnerability
Exploit	The moment they run exploit code against the database flaw	The actual act of taking advantage of the vulnerability
Attack	The entire chain of events, end to end	The threat actor using the attack vector to exploit the vulnerability and reach the target

The impact is a confidentiality breach of credit card data, with heavy business consequences (card fraud, regulatory penalties, loss of customer trust).

In scenario questions, underline the noun that is valuable (target), the weakness (vulnerability), the who (threat actor), the route in (attack vector), and the action against the weakness (exploit). Then name the CIA leg affected.

Worked Examples

Exercise 1

Bridge from Week 1: The Misdelivered Spreadsheet. An HR coordinator at a mid-size logistics company accidentally attaches the full company payroll spreadsheet (including salaries and bank details) to a routine email meant for a job applicant. The email is sent to over 200 external recipients before anyone notices.

Which CIA element(s) were violated?
What management decision could have prevented or reduced this incident?

Show solution ↓

Solution

1. CIA analysis.

Salaries and bank details were disclosed to 200+ people who are not authorized to see them → Confidentiality.
Nothing was altered → Integrity intact. The data is still accessible to HR → Availability intact.

So only Confidentiality was violated. Note there was no attacker: an accidental, insider mistake can breach confidentiality just as effectively.

2. Management decisions. Two groups of decisions apply.

Prevention, through a Data Loss Prevention (DLP) policy:

Data classification: payroll, salary and bank data classified as Confidential/Restricted.
External email restriction: restricted files must not be sent externally through normal email.
Automatic content scanning: the email system detects salary, payroll, bank account or other sensitive personal data.
Block or require approval: messages containing restricted data are blocked or need manager/security approval.
Secure sharing: sensitive files are shared only through approved encrypted file-sharing systems, not attachments.
Access control: only authorized HR/payroll staff can access payroll files.
Logging and monitoring: all attempted transfers of restricted data are logged and reviewed.
Training: HR staff receive regular training on handling confidential employee data.

Reduction, through an incident response process:

Contain: recall the email if possible and ask recipients to delete it immediately.
Assess: identify exactly what data was exposed and how many people are affected.
Notify internal teams: HR, IT/Security, management and the DPO or legal team.
Notify affected employees if the exposure creates significant risk to them (e.g., fraud using bank details).
Evaluate legal obligations, including whether the breach must be reported to the authority.
Document the incident, actions, timeline and evidence.
Investigate the root cause and implement corrective controls (DLP, classification, access control, training).

Answer: Confidentiality only. The key preventive decision is a DLP policy (classify payroll data as restricted and block/require approval for sending it externally), backed by a defined incident response process.

Exercise 2

Bridge from Week 1: The Altered Invoice. An attacker gains access to a supplier’s email account and quietly edits the bank account number on an outstanding invoice before it is sent to a client. The client pays the invoice as normal, and the funds are never recovered. The change is only discovered a month later during a routine audit.

Which CIA element(s) were violated?
What management decision could have prevented or reduced this incident?

Show solution ↓

Solution

1. CIA analysis.

The invoice’s bank account number was changed without authorization, and nobody could tell → Integrity (the primary violation, and the one that caused the financial loss).
The attacker accessed the supplier’s email account and could read its contents → Confidentiality was also violated.
Email and invoicing kept working → Availability not affected.

2. Management decisions.

Out-of-band verification of payment details: any new or changed bank account must be confirmed by phoning a known contact number (not one from the email) before paying. This single process control would have stopped the loss.
Strong authentication on email: require multi-factor authentication so a stolen password alone cannot take over the account.
Approval / separation of duties for payments: a second person approves payments to changed bank details.
Timely reconciliation and monitoring: reconcile payments weekly rather than discovering problems a month later; alert on suspicious mailbox rules or logins.
Awareness training on invoice/payment fraud for finance staff at both companies.

Answer: Integrity (primarily) and Confidentiality; the key management decision is a mandatory out-of-band verification procedure for any change to payment details, supported by MFA on email.

Exercise 3

A hospital’s patient-portal web server has a SQL injection flaw. A criminal group finds it with an automated scanner, sends crafted input through the public login form, and downloads 20,000 patient records to sell. Identify the target, vulnerability, threat actor, attack vector, exploit and the CIA leg affected.

Show solution ↓

Solution

Walk through the chain in order.

Target: what is valuable and being sought → the 20,000 patient records behind the portal.
Vulnerability: the weakness → the SQL injection flaw in the web application.
Threat actor: who, with what motive → the criminal group (cybercriminals; motive: financial gain from selling records).
Attack vector: the path to the vulnerability → the public-facing login form on the internet (an exposed web application).
Exploit: taking advantage of the weakness → submitting the crafted SQL injection input that makes the database return records.
Impact: records disclosed to unauthorized parties → Confidentiality.

Target: patient records; Vulnerability: SQL injection flaw; Threat actor: criminal group; Attack vector: public login form; Exploit: crafted SQL injection input; CIA: Confidentiality.

Exercise 4

Classify each item as a threat, vulnerability, exploit or attack vector:

(a) Staff who have never received phishing training. (b) A ransomware gang. (c) A malicious USB stick left in a hospital car park. (d) A script that triggers a buffer overflow in an old VPN appliance. (e) Default administrator passwords on network printers.

Show solution ↓

Solution

Use the definitions: weakness → vulnerability; source of danger → threat; path → attack vector; code/technique against the weakness → exploit.

(a) A weakness in people/process → vulnerability (human/process).
(b) A source of danger with a motive → threat (threat actor: cybercriminals).
(c) The path used to deliver malware into the network → attack vector (physical media).
(d) Code designed to take advantage of a specific flaw → exploit.
(e) An insecure default configuration → vulnerability (technical).

(a) vulnerability, (b) threat, (c) attack vector, (d) exploit, (e) vulnerability.

Exercise 5

A company hires an external firm to try to break into its network, with written permission from management, and to report every weakness found. A month later, an unknown person tries the same techniques without permission. Name each activity and explain the key difference.

Show solution ↓

Solution

The first activity is a penetration test: an authorized, simulated attack whose purpose is to find weaknesses before real attackers do, and to feed the results back to the system owner. The testers act as white-hat hackers.
The second is a real attack by a black-hat hacker (a threat actor).
The techniques can be identical. The difference is authorization and intent: the penetration test is permitted, scoped and aimed at fixing weaknesses; the attack is unauthorized and aimed at causing harm or gaining advantage.

Penetration test (authorized, defensive) vs. attack (unauthorized, harmful); the difference is permission and purpose, not technique.