What is an attack vector?

How do malicious actors enter a computer system or network?

The short answer – they use an attack vector. This term refers to a pathway, method, or tool that is used to gain unauthorized or illegal access. An attack vector is also known as a root point of compromise, meaning it is the initial entry point chosen by a threat actor. Unfortunately for enterprises, many attack vectors exist due to increasing system complexity and new technology advancements.

Besides becoming familiar with existing attack vectors, cybercriminals continually scan for new weaknesses that can be exploited to create pathways into an IT system or network. They also take advantage of emerging vectors that result from newly obsolete defenses or unpatched vulnerabilities. That’s why closing off attack vectors is a constant challenge for security teams.

One factor that can help security teams is the preference of certain malicious actors or groups for specific attack vectors. Repeated use can turn an attack vector into a “signature” for the cybercriminals, allowing analysts or threat hunters to recognize who is behind a particular incident. In addition to identifying who is behind a particular incident, familiarity with attack vectors can enable you to focus resources on the most prevalent and impactful ones, and harden protections to make them harder to exploit.

Passive and active vectors

Within the universe of attack vectors, there are two broad categories – active and passive. A threat actor using an active attack vector attempts to change, damage, or disrupt a system, for example, by deploying malware or launching a denial-of-service (DoS) attack.

In contrast, a passive attack vector does not interfere with an IT system, making it harder to detect threat activity. Instead, cybercriminals monitor for opportunities, such as a misconfiguration or open port, which can be exploited to obtain data or credentials. This activity threatens or compromises data confidentiality, rather than causing damage to IT systems. Phishing, social engineering, port scanning, and eavesdropping are considered passive vectors.

Active attack vectors, which involve system or network disruption or damage, include:

• Malware. By introducing malicious software into an enterprise IT system, such as through a phishing campaign, cybercriminals create a pathway to carry out harmful activities. Malware comes in many different “flavors” including spyware, adware, ransomware, Trojan Horses, viruses, and worms.
• DoS/DDoS. This type of attack vector is created when a cybercriminal sends a huge volume of requests to a website to crash it or temporarily disable it. Botnets are often used as the vector in these attacks.
• Brute force. This type of vector relies on trial and error. Threat actors simply attempt different methods, one after the other, until they succeed.
• SQL injection. For this vector, a threat actor injects malicious Structured Query Language code into a server query. The goal is accessing sensitive data residing in SQL databases.
• Session hijacking. Cybercriminals create a vector by stealing or intercepting a user’s unique session identifier (like a cookie or token). This allows them to impersonate the user and access sensitive information or perform actions within that session.
• Cross-site scripting (XSS). By manipulating a vulnerable website (the vector), threat actors enable the site to send malicious code (typically JavaScript) back to the user’s browser for execution.
• Man-in-the-Middle. Here, the vector is public Wi-Fi networks with lax security. The attacker intercepts traffic on a public network with the goal of stealing sensitive information.
• Malicious insiders. Employees or contractors use their credentials to hack into networks and systems where they steal sensitive information, such as customer lists and trade secrets.

Passive attack vectors, which do not interfere with the IT system or network, typically take advantage of existing weaknesses.

• Open ports. Attackers look for vulnerable ports exposed to the Internet to create a vector for malicious activity, such as sending data to a specific service running on that port. While organizations must keep certain ports open to conduct business, unused ports should be closed.
• Unpatched vulnerabilities. A known but unpatched security vulnerability in software or hardware can serve as the entry point for unauthorized access. Organizations should apply patches and perform upgrades promptly.
• Misconfigured devices. Vendors supply devices with pre-set security protections, which tend to be weak. Companies may fail to reconfigure these settings or misconfigure them before deploying devices on the network. In either case, threat actors can take advantage to gain entry.
• Weak passwords. Many people select weak passwords with predictable elements, or reuse the same one across accounts, making it easier for cybercriminals to guess or deduce the credential to access user accounts. To help figure out the password, attackers may use password spraying or brute force methods.
• Poor or missing encryption: When data at rest or in transit is not properly encrypted, a hacker may be able to gain unauthorized access to it. For instance, attackers can eavesdrop on traffic to steal sensitive user data such as usernames and passwords.
• Social engineering. Threat actors use this vector to obtain personal information, such as passwords or credit card numbers, from users who respond to emails or phone calls that are supposedly from a trusted individual. This information can empower the cybercriminal to gain unauthorized access to a company’s network or IT system.
• Trusted third parties. Cloud services providers, vendors, business partners, and consultants may be given access to a company’s security systems. An exploit targeting one of these third parties can give cybercriminals information that provides a vector into the company’s IT environment.

As we mentioned, an attack vector is merely a route to a cybercriminal’s end goal, whether it’s stealing sensitive data, claiming a ransom, harming an organization’s reputation, or disrupting systems and services. Attackers must exploit each vector, either by identifying and leveraging existing weaknesses or by taking action to create those weaknesses.

To drill down, attackers use different approaches to exploit passive and active vectors. They may continuously monitor target organizations with tools like session capture or eavesdropping to find new or unpatched vulnerabilities in software and hardware. Or they may build a file on phishing or spear phishing targets in order to design personalized, persuasive emails and phone calls.

That said, there are some commonalities in the attack vector exploitation process.

• The attacker identifies a potential target.
• The attacker gathers information and intelligence about the target to uncover and evaluate potential attack vectors.
• Depending on the type of vector, the attacker creates tools or tactics, or uses existing ones, to exploit each pathway into the network or system.
• Upon gaining access, the attacker pursues the end objective, such as data theft.

Attackers can use a variety of tactics and technologies to achieve their goals. For instance, after social engineering reveals a user’s credentials, the cyber actors could access the person’s corporate account, use technology to penetrate deeper into the network, and then install malware or ransomware.

We’ve already defined an attack vector in cybersecurity as a pathway or method to achieve unauthorized access to a target organization’s IT environment. While some cybercriminals choose the easiest attack vector to exploit, highly sophisticated attacks often involve multiple vectors.

Organizations should be familiar with all their attack vectors so they can take steps to address them. For instance, if delays in software patching are creating vulnerabilities, the organization could accelerate the patch/update process.

There are other cybersecurity terms similar to “attack vector.” To clear up any confusion, here are definitions.

Attack surface. This term refers to the sum total of attack vectors (i.e., all possible entry points) in an organization at a given time. However, the attack surface is not static. Additions and changes to software, hardware, and even staffing can affect it. For instance, the broad adoption of public cloud services significantly expands the attack surface for any organization that previously operated its IT system solely on premises.

Threat vector. This term is often used as a synonym for attack vector, but its definition is slightly broader. Besides the pathway or method an attacker uses to gain unauthorized access, a threat vector includes context, attacker motivations, and potential risks.

Threat actor. Also called a malicious actor, hacker, or cybercriminal, a threat actor is an individual or group attempting to breach or disrupt an organization’s IT systems and security. These people or groups can be nation-states, hacktivists with a political agenda, cyberterrorists, disgruntled employees, criminals looking to monetize their exploits – even rival corporations seeking to steal trade secrets.