Security Concepts · Topic 1 of 7
Attack Threats Across On-Premises, Hybrid and Cloud
Learn the attack threats against on-premises, hybrid and cloud systems: malware types, DoS and DDoS, phishing, man-in-the-middle, credentials and APIs.
- 5 min
- A virus needs a host file and user action. A worm spreads on its own.
- A trojan disguises harmful code as something useful.
- A rootkit hides itself and is hard to detect with ordinary tools.
What it is
An attack threat is any way an adversary can harm the confidentiality, integrity or availability of your systems.
The same threats appear in a server room, in a hybrid design and in a public cloud. What changes is where the defender has control. In the cloud, the provider secures the platform and you secure your configuration, identities and data.
Learn each threat by what it does, and by which part of the confidentiality, integrity and availability triad it damages.
How it works
Each threat has a typical method and a typical defence.
Malware families
Malware is software built to do harm. The names describe how it spreads or hides.
| Type | Key behaviour |
|---|---|
| Virus | Attaches to a legitimate file and spreads when a user runs that file |
| Worm | Spreads by itself across the network, without a host file or user action |
| Trojan | Looks useful, but carries a hidden harmful function |
| Ransomware | Encrypts data and demands payment for the key |
| Rootkit | Hides its own presence, often deep in the operating system or boot process |
| Spyware | Quietly gathers information about the user |
A rootkit is hard to detect because it can hide from the very tools you would use to look for it. Defenders use endpoint detection, integrity checks and trusted boot to find it.
Denial of service
A DoS attack tries to make a service unavailable. DDoS means many sources attack at once, usually a botnet of infected hosts.
Common forms flood bandwidth, exhaust connection tables (a SYN flood is the classic case), or abuse an application with expensive requests. Reflection and amplification use a third party to send large replies to the victim. Defences include rate limiting, upstream scrubbing services and spreading load across many locations.
Phishing and social engineering
Phishing tricks a person into revealing a secret or running something harmful. It usually arrives by email, and the variants are named by target or channel.
- Spear phishing: aimed at one person or a small group.
- Whaling: aimed at senior executives.
- Smishing and vishing: sent by text message or voice call.
Man-in-the-middle
In a man-in-the-middle attack, the attacker sits between two parties and reads or changes their traffic. ARP spoofing, rogue access points and forged certificates are common ways to get in the path. Encryption with certificate validation is the main defence.
Data breaches and credentials
A data breach is unauthorised access to protected data. Compromised credentials are a leading cause, through phishing, reuse of leaked passwords or password guessing.
Multifactor authentication reduces the damage, because a stolen password alone is no longer enough. In cloud environments, a leaked access key can be as dangerous as a stolen admin password.
Insecure APIs
Cloud services are managed through APIs, so a weak API is a weak point. Typical problems are missing authentication, excessive permissions, no rate limiting and verbose error messages. Treat APIs as part of the attack surface and inventory them.
Post-quantum cryptography and AI
A large quantum computer could break widely used public key algorithms. Attackers may capture encrypted traffic today and decrypt it later, which is called "harvest now, decrypt later". Post-quantum cryptography (PQC) means algorithms designed to resist that threat, and it is covered on the cryptography page.
AI also changes the threat picture. Attackers use it to write convincing phishing, clone voices and automate reconnaissance. The AI systems themselves can also be attacked, which is covered on a later page.
Where the threats land
| Environment | Typical focus |
|---|---|
| On-premises | Malware on endpoints, lateral movement, perimeter attacks |
| Hybrid | The links between sites and cloud, and inconsistent policy |
| Cloud | Misconfiguration, exposed storage, stolen keys, insecure APIs |
What to remember for the exam
Seven facts cover most questions on this topic.
- A virus needs a host file and user action. A worm spreads on its own.
- A trojan disguises harmful code as something useful.
- A rootkit hides itself and is hard to detect with ordinary tools.
- DDoS uses many sources, and a SYN flood exhausts connection resources.
- Spear phishing targets individuals. Whaling targets executives.
- Compromised credentials and insecure APIs are major cloud attack routes.
- Post-quantum cryptography addresses the future threat to public key algorithms.
When a question describes the behaviour, match the name by how the malware spreads or hides, not by how much damage it causes.
Common mistakes
These four mistakes appear often.
Confusing a virus with a worm. A worm spreads without user action and a virus does not.
Treating DoS and DDoS as the same. DDoS is distributed, so blocking one source address does not stop it.
Assuming the cloud provider secures everything. The customer remains responsible for identities, data and configuration.
Ignoring non-technical attacks. Social engineering works around technical controls, so people need training as well.
A strong perimeter does not help against a valid stolen credential, because the attacker then looks like a normal user.
Check yourself
Work through these three questions.
What separates a worm from a virus?
A worm spreads by itself across the network, while a virus attaches to a file and needs a user to run it.
Why does a DDoS attack resist simple source blocking?
It comes from many distributed sources, such as a botnet, so no single address can be blocked to stop it.
Why is a compromised credential so dangerous in the cloud?
The attacker looks like a legitimate user and can use management APIs, so multifactor authentication matters.
Topic 1 of 7 in Security Concepts
Test yourself on Security Concepts
The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.