Threats, Vulnerabilities, and Mitigations · Topic 2 of 9
Threat Vectors and Attack Surfaces
Learn the Security+ threat vectors, from email and removable media to unsupported software and suppliers, and how to reduce the attack surface.
- 4 min
- A vector is the path in, and the attack surface is everything that is exposed.
- Message vectors include email, SMS and instant messaging. Other vectors include voice calls, files, images and removable devices.
- Unsupported software is a vector because it no longer gets security fixes.
What it is
A threat vector (also called an attack vector) is the path an attacker uses to reach a target. The attack surface is the sum of all the places where an attacker could try to get in or take data out.
Reducing the attack surface means closing paths that are not needed. The fewer entry points exist, the fewer vectors the attacker can use.
How it works
Message based vectors
Messages are the most common way to reach a user.
| Vector | Description |
|---|---|
| Phishing links, malicious attachments, fake invoices | |
| Short Message Service (SMS) | Text messages with links or urgent requests |
| Instant messaging | Chat apps used to send links or files |
Other user focused vectors
| Vector | Description |
|---|---|
| Image based | Malicious code or links hidden in an image file |
| File based | Documents, archives or executables carrying malware |
| Voice call | A caller who tricks a person into giving access or data |
| Removable device | A universal serial bus (USB) drive left in a car park or handed out at an event |
Removable media is dangerous because a person may plug it in out of curiosity. Controls such as disabling autorun and blocking unapproved devices reduce this risk.
Software and system vectors
| Vector | Description |
|---|---|
| Vulnerable software | A flaw in the code of a program. It may be client based, where an agent is installed on the device, or agentless |
| Unsupported systems and applications | Products that no longer receive patches |
| Default credentials | Factory username and password left unchanged |
| Open service ports | Network services that are exposed and not needed |
Unsupported and end of life software is a standing risk because new flaws will never be fixed. If it cannot be replaced, it should be isolated and monitored closely.
Network vectors
| Vector | Description |
|---|---|
| Wireless | Weak encryption, rogue access points, open guest networks |
| Wired | An unused network port in a public area |
| Bluetooth | Nearby attacks on a device with an exposed Bluetooth service |
An unsecured network allows eavesdropping or unauthorized connection. Strong authentication and encryption close these paths.
Supply chain vectors
The supply chain includes managed service providers (MSPs), vendors and suppliers. An attacker who compromises a trusted supplier can reach many customers at once. Software updates, hardware delivered with tampered components, and a service provider's remote access are all examples.
Human vectors
Human vectors rely on deception, not technical flaws. These are covered on the social engineering page, and include phishing, pretexting and impersonation.
Reducing the attack surface
| Action | Effect |
|---|---|
| Close unused ports and disable unneeded services | Fewer network entry points |
| Remove unneeded software and accounts | Fewer flaws and fewer credentials to steal |
| Patch and replace unsupported systems | Known flaws are removed |
| Restrict removable media | Closes the USB path |
| Segment networks | Limits what an attacker can reach after getting in |
What to remember for the exam
- A vector is the path in, and the attack surface is everything that is exposed.
- Message vectors include email, SMS and instant messaging. Other vectors include voice calls, files, images and removable devices.
- Unsupported software is a vector because it no longer gets security fixes.
- Default credentials and open ports are simple, common vectors.
- Wireless, wired and Bluetooth connections each have their own risks.
- Supply chain vectors include MSPs, vendors and suppliers.
- Human vectors use deception instead of technical flaws.
- Reduce the attack surface by removing what is not needed.
If a question describes a flaw that cannot be patched because the vendor stopped support, think unsupported system, then isolation and compensating controls.
Common mistakes
Confusing vector with vulnerability. The vector is how the attacker arrives. The vulnerability is the weakness that makes the attack work.
Focusing only on the network. Voice calls, USB drives and messages reach people directly and bypass many network controls.
Ignoring suppliers. A secure organization can still be exposed through a vendor with weaker security.
Leaving default settings. Default credentials and sample accounts are well known to attackers.
Assuming agentless means unprotected. Agentless approaches can still monitor and scan a system, but they work through the network instead of installed software.
An attack surface includes things people forget, such as test servers, old accounts and unused ports. If nobody owns it, nobody patches it.
Check yourself
What is the difference between a threat vector and an attack surface?
A vector is the specific path an attacker uses. The attack surface is the full set of exposed points where an attack could happen.
Why is an end of life operating system a risk?
It no longer receives security patches, so newly found flaws remain open.
Name one supply chain vector.
A compromised software update from a vendor, or access through a managed service provider.
Topic 2 of 9 in Threats, Vulnerabilities, and Mitigations
Test yourself on Threats, Vulnerabilities, and Mitigations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.